diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-06-12 22:51:40 +0400 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2010-08-02 09:35:01 +0400 |
| commit | 5241c1074f6e2f2276d45d857eb5d19fbdc2e4b2 (patch) | |
| tree | cf41e959668f5a9ec7a5d75059df864133569c91 /security | |
| parent | 9e0bd4cba4460bff64fb07cfb07849cdfd4d325a (diff) | |
| download | linux-5241c1074f6e2f2276d45d857eb5d19fbdc2e4b2.tar.xz | |
selinux: propagate error codes in cond_read_list()
These are passed back when the security module gets loaded.
The original code always returned -1 (-EPERM) on error but after this
patch it can return -EINVAL, or -ENOMEM or propagate the error code from
cond_read_node(). cond_read_node() still returns -1 all the time, but I
fix that in a later patch.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/ss/conditional.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c index 4a4e35cac22b..775418aa0a8e 100644 --- a/security/selinux/ss/conditional.c +++ b/security/selinux/ss/conditional.c @@ -445,8 +445,8 @@ int cond_read_list(struct policydb *p, void *fp) int rc; rc = next_entry(buf, fp, sizeof buf); - if (rc < 0) - return -1; + if (rc) + return rc; len = le32_to_cpu(buf[0]); @@ -455,11 +455,13 @@ int cond_read_list(struct policydb *p, void *fp) goto err; for (i = 0; i < len; i++) { + rc = -ENOMEM; node = kzalloc(sizeof(struct cond_node), GFP_KERNEL); if (!node) goto err; - if (cond_read_node(p, node, fp) != 0) + rc = cond_read_node(p, node, fp); + if (rc) goto err; if (i == 0) @@ -472,7 +474,7 @@ int cond_read_list(struct policydb *p, void *fp) err: cond_list_destroy(p->cond_list); p->cond_list = NULL; - return -1; + return rc; } /* Determine whether additional permissions are granted by the conditional |