diff options
author | Dan Carpenter <error27@gmail.com> | 2010-06-12 14:51:40 -0400 |
---|---|---|
committer | James Morris <jmorris@namei.org> | 2010-08-02 01:35:01 -0400 |
commit | 5241c1074f6e2f2276d45d857eb5d19fbdc2e4b2 (patch) | |
tree | cf41e959668f5a9ec7a5d75059df864133569c91 /security/selinux/ss/conditional.c | |
parent | 9e0bd4cba4460bff64fb07cfb07849cdfd4d325a (diff) |
selinux: propagate error codes in cond_read_list()
These are passed back when the security module gets loaded.
The original code always returned -1 (-EPERM) on error but after this
patch it can return -EINVAL, or -ENOMEM or propagate the error code from
cond_read_node(). cond_read_node() still returns -1 all the time, but I
fix that in a later patch.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/ss/conditional.c')
-rw-r--r-- | security/selinux/ss/conditional.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 4a4e35cac22b..775418aa0a8e 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c | |||
@@ -445,8 +445,8 @@ int cond_read_list(struct policydb *p, void *fp) | |||
445 | int rc; | 445 | int rc; |
446 | 446 | ||
447 | rc = next_entry(buf, fp, sizeof buf); | 447 | rc = next_entry(buf, fp, sizeof buf); |
448 | if (rc < 0) | 448 | if (rc) |
449 | return -1; | 449 | return rc; |
450 | 450 | ||
451 | len = le32_to_cpu(buf[0]); | 451 | len = le32_to_cpu(buf[0]); |
452 | 452 | ||
@@ -455,11 +455,13 @@ int cond_read_list(struct policydb *p, void *fp) | |||
455 | goto err; | 455 | goto err; |
456 | 456 | ||
457 | for (i = 0; i < len; i++) { | 457 | for (i = 0; i < len; i++) { |
458 | rc = -ENOMEM; | ||
458 | node = kzalloc(sizeof(struct cond_node), GFP_KERNEL); | 459 | node = kzalloc(sizeof(struct cond_node), GFP_KERNEL); |
459 | if (!node) | 460 | if (!node) |
460 | goto err; | 461 | goto err; |
461 | 462 | ||
462 | if (cond_read_node(p, node, fp) != 0) | 463 | rc = cond_read_node(p, node, fp); |
464 | if (rc) | ||
463 | goto err; | 465 | goto err; |
464 | 466 | ||
465 | if (i == 0) | 467 | if (i == 0) |
@@ -472,7 +474,7 @@ int cond_read_list(struct policydb *p, void *fp) | |||
472 | err: | 474 | err: |
473 | cond_list_destroy(p->cond_list); | 475 | cond_list_destroy(p->cond_list); |
474 | p->cond_list = NULL; | 476 | p->cond_list = NULL; |
475 | return -1; | 477 | return rc; |
476 | } | 478 | } |
477 | 479 | ||
478 | /* Determine whether additional permissions are granted by the conditional | 480 | /* Determine whether additional permissions are granted by the conditional |