aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux/ss/services.c
diff options
context:
space:
mode:
authorStephen Smalley <sds@epoch.ncsc.mil>2005-05-17 00:53:52 -0400
committerLinus Torvalds <torvalds@ppc970.osdl.org>2005-05-17 10:59:20 -0400
commit4c443d1b558b21520bd8fd6140b85cee0756becd (patch)
treee6d4fea8329bb709efd825ec14c9598a0c08e562 /security/selinux/ss/services.c
parentb81074800b98ac50b64d4c8d34e8abf0fda5e3d1 (diff)
[PATCH] selinux: fix avc_alloc_node() oom with no policy loaded
This patch should fix the avc_alloc_node() oom condition that Andrew reported when no policy is loaded in SELinux. Prior to this patch, when no policy was loaded, the SELinux "security server" (policy engine) was only returning allowed decisions for the requested permissions for each access check. This caused the cache to thrash when trying to use SELinux for real work with no policy loaded (typically, the no policy loaded state is only for bootstrapping to the point where we can load an initial policy). This patch changes the SELinux security server to return the complete allowed access vector at once, and then to reset the cache after the initial policy load to flush the initial cache state created during bootstrapping. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@redhat.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'security/selinux/ss/services.c')
-rw-r--r--security/selinux/ss/services.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 5a820cf88c9c..8449d667b062 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -476,8 +476,8 @@ int security_compute_av(u32 ssid,
476 int rc = 0; 476 int rc = 0;
477 477
478 if (!ss_initialized) { 478 if (!ss_initialized) {
479 avd->allowed = requested; 479 avd->allowed = 0xffffffff;
480 avd->decided = requested; 480 avd->decided = 0xffffffff;
481 avd->auditallow = 0; 481 avd->auditallow = 0;
482 avd->auditdeny = 0xffffffff; 482 avd->auditdeny = 0xffffffff;
483 avd->seqno = latest_granting; 483 avd->seqno = latest_granting;
@@ -1196,9 +1196,11 @@ int security_load_policy(void *data, size_t len)
1196 } 1196 }
1197 policydb_loaded_version = policydb.policyvers; 1197 policydb_loaded_version = policydb.policyvers;
1198 ss_initialized = 1; 1198 ss_initialized = 1;
1199 1199 seqno = ++latest_granting;
1200 LOAD_UNLOCK; 1200 LOAD_UNLOCK;
1201 selinux_complete_init(); 1201 selinux_complete_init();
1202 avc_ss_reset(seqno);
1203 selnl_notify_policyload(seqno);
1202 return 0; 1204 return 0;
1203 } 1205 }
1204 1206