Commit 6f7dac11 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'selinux-pr-20180814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull SELinux updates from Paul Moore:
 "There are 16 patches in here but really only one that is of any
  significance. That one patch is by nixiaoming and fixes a few places
  where we were not properly cleaning up dentry and inode objects in the
  selinuxfs error handling code. The rest are either printk->pr_*
  conversions, constification tweaks, and a minor tweak to MAINTAINERS.

  Everything passes the selinux-testsuite and looks to merge cleanly
  against your master branch"

* tag 'selinux-pr-20180814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: cleanup dentry and inodes on error in selinuxfs
  selinux: constify write_op[]
  selinux: Cleanup printk logging in netnode
  selinux: Cleanup printk logging in avc
  selinux: Cleanup printk logging in netif
  selinux: Cleanup printk logging in netport
  selinux: Cleanup printk logging in sidtab
  selinux: Cleanup printk logging in netlink
  selinux: Cleanup printk logging in selinuxfs
  selinux: Cleanup printk logging in services
  selinux: Cleanup printk logging in avtab
  selinux: Cleanup printk logging in hooks
  selinux: Cleanup printk logging in policydb
  selinux: Cleanup printk logging in ebitmap
  selinux: Cleanup printk logging in conditional
  MAINTAINERS: update the LSM and SELinux subsystems
parents 92d4a036 7e4237fa
...@@ -12799,6 +12799,7 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git ...@@ -12799,6 +12799,7 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git
W: http://kernsec.org/ W: http://kernsec.org/
S: Supported S: Supported
F: security/ F: security/
X: security/selinux/
SELINUX SECURITY MODULE SELINUX SECURITY MODULE
M: Paul Moore <paul@paul-moore.com> M: Paul Moore <paul@paul-moore.com>
......
...@@ -650,7 +650,7 @@ static int avc_latest_notif_update(struct selinux_avc *avc, ...@@ -650,7 +650,7 @@ static int avc_latest_notif_update(struct selinux_avc *avc,
spin_lock_irqsave(&notif_lock, flag); spin_lock_irqsave(&notif_lock, flag);
if (is_insert) { if (is_insert) {
if (seqno < avc->avc_cache.latest_notif) { if (seqno < avc->avc_cache.latest_notif) {
printk(KERN_WARNING "SELinux: avc: seqno %d < latest_notif %d\n", pr_warn("SELinux: avc: seqno %d < latest_notif %d\n",
seqno, avc->avc_cache.latest_notif); seqno, avc->avc_cache.latest_notif);
ret = -EAGAIN; ret = -EAGAIN;
} }
......
...@@ -530,7 +530,7 @@ static int sb_finish_set_opts(struct super_block *sb) ...@@ -530,7 +530,7 @@ static int sb_finish_set_opts(struct super_block *sb)
the first boot of the SELinux kernel before we have the first boot of the SELinux kernel before we have
assigned xattr values to the filesystem. */ assigned xattr values to the filesystem. */
if (!(root_inode->i_opflags & IOP_XATTR)) { if (!(root_inode->i_opflags & IOP_XATTR)) {
printk(KERN_WARNING "SELinux: (dev %s, type %s) has no " pr_warn("SELinux: (dev %s, type %s) has no "
"xattr support\n", sb->s_id, sb->s_type->name); "xattr support\n", sb->s_id, sb->s_type->name);
rc = -EOPNOTSUPP; rc = -EOPNOTSUPP;
goto out; goto out;
...@@ -539,11 +539,11 @@ static int sb_finish_set_opts(struct super_block *sb) ...@@ -539,11 +539,11 @@ static int sb_finish_set_opts(struct super_block *sb)
rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0); rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
if (rc < 0 && rc != -ENODATA) { if (rc < 0 && rc != -ENODATA) {
if (rc == -EOPNOTSUPP) if (rc == -EOPNOTSUPP)
printk(KERN_WARNING "SELinux: (dev %s, type " pr_warn("SELinux: (dev %s, type "
"%s) has no security xattr handler\n", "%s) has no security xattr handler\n",
sb->s_id, sb->s_type->name); sb->s_id, sb->s_type->name);
else else
printk(KERN_WARNING "SELinux: (dev %s, type " pr_warn("SELinux: (dev %s, type "
"%s) getxattr errno %d\n", sb->s_id, "%s) getxattr errno %d\n", sb->s_id,
sb->s_type->name, -rc); sb->s_type->name, -rc);
goto out; goto out;
...@@ -742,7 +742,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -742,7 +742,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
goto out; goto out;
} }
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING "SELinux: Unable to set superblock options " pr_warn("SELinux: Unable to set superblock options "
"before the security server is initialized\n"); "before the security server is initialized\n");
goto out; goto out;
} }
...@@ -784,7 +784,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -784,7 +784,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
mount_options[i], &sid, mount_options[i], &sid,
GFP_KERNEL); GFP_KERNEL);
if (rc) { if (rc) {
printk(KERN_WARNING "SELinux: security_context_str_to_sid" pr_warn("SELinux: security_context_str_to_sid"
"(%s) failed for (dev %s, type %s) errno=%d\n", "(%s) failed for (dev %s, type %s) errno=%d\n",
mount_options[i], sb->s_id, name, rc); mount_options[i], sb->s_id, name, rc);
goto out; goto out;
...@@ -860,8 +860,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -860,8 +860,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
*/ */
rc = security_fs_use(&selinux_state, sb); rc = security_fs_use(&selinux_state, sb);
if (rc) { if (rc) {
printk(KERN_WARNING pr_warn("%s: security_fs_use(%s) returned %d\n",
"%s: security_fs_use(%s) returned %d\n",
__func__, sb->s_type->name, rc); __func__, sb->s_type->name, rc);
goto out; goto out;
} }
...@@ -947,7 +946,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -947,7 +946,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
if (sbsec->behavior != SECURITY_FS_USE_XATTR && if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
sbsec->behavior != SECURITY_FS_USE_NATIVE) { sbsec->behavior != SECURITY_FS_USE_NATIVE) {
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING "SELinux: defcontext option is " pr_warn("SELinux: defcontext option is "
"invalid for this filesystem type\n"); "invalid for this filesystem type\n");
goto out; goto out;
} }
...@@ -969,7 +968,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, ...@@ -969,7 +968,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
return rc; return rc;
out_double_mount: out_double_mount:
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different " pr_warn("SELinux: mount invalid. Same superblock, different "
"security settings for (dev %s, type %s)\n", sb->s_id, name); "security settings for (dev %s, type %s)\n", sb->s_id, name);
goto out; goto out;
} }
...@@ -998,7 +997,7 @@ static int selinux_cmp_sb_context(const struct super_block *oldsb, ...@@ -998,7 +997,7 @@ static int selinux_cmp_sb_context(const struct super_block *oldsb,
} }
return 0; return 0;
mismatch: mismatch:
printk(KERN_WARNING "SELinux: mount invalid. Same superblock, " pr_warn("SELinux: mount invalid. Same superblock, "
"different security settings for (dev %s, " "different security settings for (dev %s, "
"type %s)\n", newsb->s_id, newsb->s_type->name); "type %s)\n", newsb->s_id, newsb->s_type->name);
return -EBUSY; return -EBUSY;
...@@ -1106,7 +1105,7 @@ static int selinux_parse_opts_str(char *options, ...@@ -1106,7 +1105,7 @@ static int selinux_parse_opts_str(char *options,
case Opt_context: case Opt_context:
if (context || defcontext) { if (context || defcontext) {
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); pr_warn(SEL_MOUNT_FAIL_MSG);
goto out_err; goto out_err;
} }
context = match_strdup(&args[0]); context = match_strdup(&args[0]);
...@@ -1119,7 +1118,7 @@ static int selinux_parse_opts_str(char *options, ...@@ -1119,7 +1118,7 @@ static int selinux_parse_opts_str(char *options,
case Opt_fscontext: case Opt_fscontext:
if (fscontext) { if (fscontext) {
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); pr_warn(SEL_MOUNT_FAIL_MSG);
goto out_err; goto out_err;
} }
fscontext = match_strdup(&args[0]); fscontext = match_strdup(&args[0]);
...@@ -1132,7 +1131,7 @@ static int selinux_parse_opts_str(char *options, ...@@ -1132,7 +1131,7 @@ static int selinux_parse_opts_str(char *options,
case Opt_rootcontext: case Opt_rootcontext:
if (rootcontext) { if (rootcontext) {
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); pr_warn(SEL_MOUNT_FAIL_MSG);
goto out_err; goto out_err;
} }
rootcontext = match_strdup(&args[0]); rootcontext = match_strdup(&args[0]);
...@@ -1145,7 +1144,7 @@ static int selinux_parse_opts_str(char *options, ...@@ -1145,7 +1144,7 @@ static int selinux_parse_opts_str(char *options,
case Opt_defcontext: case Opt_defcontext:
if (context || defcontext) { if (context || defcontext) {
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING SEL_MOUNT_FAIL_MSG); pr_warn(SEL_MOUNT_FAIL_MSG);
goto out_err; goto out_err;
} }
defcontext = match_strdup(&args[0]); defcontext = match_strdup(&args[0]);
...@@ -1158,7 +1157,7 @@ static int selinux_parse_opts_str(char *options, ...@@ -1158,7 +1157,7 @@ static int selinux_parse_opts_str(char *options,
break; break;
default: default:
rc = -EINVAL; rc = -EINVAL;
printk(KERN_WARNING "SELinux: unknown mount option\n"); pr_warn("SELinux: unknown mount option\n");
goto out_err; goto out_err;
} }
...@@ -1623,7 +1622,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent ...@@ -1623,7 +1622,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
dput(dentry); dput(dentry);
if (rc < 0) { if (rc < 0) {
if (rc != -ENODATA) { if (rc != -ENODATA) {
printk(KERN_WARNING "SELinux: %s: getxattr returned " pr_warn("SELinux: %s: getxattr returned "
"%d for dev=%s ino=%ld\n", __func__, "%d for dev=%s ino=%ld\n", __func__,
-rc, inode->i_sb->s_id, inode->i_ino); -rc, inode->i_sb->s_id, inode->i_ino);
kfree(context); kfree(context);
...@@ -1643,11 +1642,11 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent ...@@ -1643,11 +1642,11 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
if (rc == -EINVAL) { if (rc == -EINVAL) {
if (printk_ratelimit()) if (printk_ratelimit())
printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid " pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
"context=%s. This indicates you may need to relabel the inode or the " "context=%s. This indicates you may need to relabel the inode or the "
"filesystem in question.\n", ino, dev, context); "filesystem in question.\n", ino, dev, context);
} else { } else {
printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) " pr_warn("SELinux: %s: context_to_sid(%s) "
"returned %d for dev=%s ino=%ld\n", "returned %d for dev=%s ino=%ld\n",
__func__, context, -rc, dev, ino); __func__, context, -rc, dev, ino);
} }
...@@ -1785,8 +1784,7 @@ static int cred_has_capability(const struct cred *cred, ...@@ -1785,8 +1784,7 @@ static int cred_has_capability(const struct cred *cred,
sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS; sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
break; break;
default: default:
printk(KERN_ERR pr_err("SELinux: out of range capability %d\n", cap);
"SELinux: out of range capability %d\n", cap);
BUG(); BUG();
return -EINVAL; return -EINVAL;
} }
...@@ -2029,7 +2027,7 @@ static int may_link(struct inode *dir, ...@@ -2029,7 +2027,7 @@ static int may_link(struct inode *dir,
av = DIR__RMDIR; av = DIR__RMDIR;
break; break;
default: default:
printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n", pr_warn("SELinux: %s: unrecognized kind %d\n",
__func__, kind); __func__, kind);
return 0; return 0;
} }
...@@ -2875,7 +2873,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data) ...@@ -2875,7 +2873,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
mount_options[i], &sid, mount_options[i], &sid,
GFP_KERNEL); GFP_KERNEL);
if (rc) { if (rc) {
printk(KERN_WARNING "SELinux: security_context_str_to_sid" pr_warn("SELinux: security_context_str_to_sid"
"(%s) failed for (dev %s, type %s) errno=%d\n", "(%s) failed for (dev %s, type %s) errno=%d\n",
mount_options[i], sb->s_id, sb->s_type->name, rc); mount_options[i], sb->s_id, sb->s_type->name, rc);
goto out_free_opts; goto out_free_opts;
...@@ -2914,7 +2912,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data) ...@@ -2914,7 +2912,7 @@ static int selinux_sb_remount(struct super_block *sb, void *data)
free_secdata(secdata); free_secdata(secdata);
return rc; return rc;
out_bad_option: out_bad_option:
printk(KERN_WARNING "SELinux: unable to change security options " pr_warn("SELinux: unable to change security options "
"during remount (dev %s, type=%s)\n", sb->s_id, "during remount (dev %s, type=%s)\n", sb->s_id,
sb->s_type->name); sb->s_type->name);
goto out_free_opts; goto out_free_opts;
...@@ -3357,7 +3355,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, ...@@ -3357,7 +3355,7 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
rc = security_context_to_sid_force(&selinux_state, value, size, rc = security_context_to_sid_force(&selinux_state, value, size,
&newsid); &newsid);
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: unable to map context to SID" pr_err("SELinux: unable to map context to SID"
"for (%s, %lu), rc=%d\n", "for (%s, %lu), rc=%d\n",
inode->i_sb->s_id, inode->i_ino, -rc); inode->i_sb->s_id, inode->i_ino, -rc);
return; return;
...@@ -4434,7 +4432,7 @@ static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad, ...@@ -4434,7 +4432,7 @@ static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
} }
parse_error: parse_error:
printk(KERN_WARNING pr_warn(
"SELinux: failure in selinux_parse_skb()," "SELinux: failure in selinux_parse_skb(),"
" unable to parse packet\n"); " unable to parse packet\n");
return ret; return ret;
...@@ -4477,7 +4475,7 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) ...@@ -4477,7 +4475,7 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
err = security_net_peersid_resolve(&selinux_state, nlbl_sid, err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
nlbl_type, xfrm_sid, sid); nlbl_type, xfrm_sid, sid);
if (unlikely(err)) { if (unlikely(err)) {
printk(KERN_WARNING pr_warn(
"SELinux: failure in selinux_skb_peerlbl_sid()," "SELinux: failure in selinux_skb_peerlbl_sid(),"
" unable to determine packet's peer label\n"); " unable to determine packet's peer label\n");
return -EACCES; return -EACCES;
...@@ -7141,11 +7139,11 @@ static __init int selinux_init(void) ...@@ -7141,11 +7139,11 @@ static __init int selinux_init(void)
} }
if (!selinux_enabled) { if (!selinux_enabled) {
printk(KERN_INFO "SELinux: Disabled at boot.\n"); pr_info("SELinux: Disabled at boot.\n");
return 0; return 0;
} }
printk(KERN_INFO "SELinux: Initializing.\n"); pr_info("SELinux: Initializing.\n");
memset(&selinux_state, 0, sizeof(selinux_state)); memset(&selinux_state, 0, sizeof(selinux_state));
enforcing_set(&selinux_state, selinux_enforcing_boot); enforcing_set(&selinux_state, selinux_enforcing_boot);
...@@ -7181,9 +7179,9 @@ static __init int selinux_init(void) ...@@ -7181,9 +7179,9 @@ static __init int selinux_init(void)
panic("SELinux: Unable to register AVC LSM notifier callback\n"); panic("SELinux: Unable to register AVC LSM notifier callback\n");
if (selinux_enforcing_boot) if (selinux_enforcing_boot)
printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n"); pr_debug("SELinux: Starting in enforcing mode\n");
else else
printk(KERN_DEBUG "SELinux: Starting in permissive mode\n"); pr_debug("SELinux: Starting in permissive mode\n");
return 0; return 0;
} }
...@@ -7195,10 +7193,10 @@ static void delayed_superblock_init(struct super_block *sb, void *unused) ...@@ -7195,10 +7193,10 @@ static void delayed_superblock_init(struct super_block *sb, void *unused)
void selinux_complete_init(void) void selinux_complete_init(void)
{ {
printk(KERN_DEBUG "SELinux: Completing initialization.\n"); pr_debug("SELinux: Completing initialization.\n");
/* Set up any superblocks initialized prior to the policy load. */ /* Set up any superblocks initialized prior to the policy load. */
printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n"); pr_debug("SELinux: Setting up existing superblocks.\n");
iterate_supers(delayed_superblock_init, NULL); iterate_supers(delayed_superblock_init, NULL);
} }
...@@ -7273,7 +7271,7 @@ static int __init selinux_nf_ip_init(void) ...@@ -7273,7 +7271,7 @@ static int __init selinux_nf_ip_init(void)
if (!selinux_enabled) if (!selinux_enabled)
return 0; return 0;
printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); pr_debug("SELinux: Registering netfilter hooks\n");
err = register_pernet_subsys(&selinux_net_ops); err = register_pernet_subsys(&selinux_net_ops);
if (err) if (err)
...@@ -7286,7 +7284,7 @@ __initcall(selinux_nf_ip_init); ...@@ -7286,7 +7284,7 @@ __initcall(selinux_nf_ip_init);
#ifdef CONFIG_SECURITY_SELINUX_DISABLE #ifdef CONFIG_SECURITY_SELINUX_DISABLE
static void selinux_nf_ip_exit(void) static void selinux_nf_ip_exit(void)
{ {
printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); pr_debug("SELinux: Unregistering netfilter hooks\n");
unregister_pernet_subsys(&selinux_net_ops); unregister_pernet_subsys(&selinux_net_ops);
} }
...@@ -7315,7 +7313,7 @@ int selinux_disable(struct selinux_state *state) ...@@ -7315,7 +7313,7 @@ int selinux_disable(struct selinux_state *state)
state->disabled = 1; state->disabled = 1;
printk(KERN_INFO "SELinux: Disabled at runtime.\n"); pr_info("SELinux: Disabled at runtime.\n");
selinux_enabled = 0; selinux_enabled = 0;
......
...@@ -145,9 +145,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) ...@@ -145,9 +145,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
dev = dev_get_by_index(ns, ifindex); dev = dev_get_by_index(ns, ifindex);
if (unlikely(dev == NULL)) { if (unlikely(dev == NULL)) {
printk(KERN_WARNING pr_warn("SELinux: failure in %s(), invalid network interface (%d)\n",
"SELinux: failure in sel_netif_sid_slow()," __func__, ifindex);
" invalid network interface (%d)\n", ifindex);
return -ENOENT; return -ENOENT;
} }
...@@ -177,10 +176,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) ...@@ -177,10 +176,8 @@ static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
spin_unlock_bh(&sel_netif_lock); spin_unlock_bh(&sel_netif_lock);
dev_put(dev); dev_put(dev);
if (unlikely(ret)) { if (unlikely(ret)) {
printk(KERN_WARNING pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
"SELinux: failure in sel_netif_sid_slow()," __func__, ifindex);
" unable to determine network interface label (%d)\n",
ifindex);
kfree(new); kfree(new);
} }
return ret; return ret;
......
...@@ -94,7 +94,7 @@ static void selnl_notify(int msgtype, void *data) ...@@ -94,7 +94,7 @@ static void selnl_notify(int msgtype, void *data)
out_kfree_skb: out_kfree_skb:
kfree_skb(skb); kfree_skb(skb);
oom: oom:
printk(KERN_ERR "SELinux: OOM in %s\n", __func__); pr_err("SELinux: OOM in %s\n", __func__);
goto out; goto out;
} }
......
...@@ -238,9 +238,8 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid) ...@@ -238,9 +238,8 @@ static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
out: out:
spin_unlock_bh(&sel_netnode_lock); spin_unlock_bh(&sel_netnode_lock);
if (unlikely(ret)) { if (unlikely(ret)) {
printk(KERN_WARNING pr_warn("SELinux: failure in %s(), unable to determine network node label\n",
"SELinux: failure in sel_netnode_sid_slow()," __func__);
" unable to determine network node label\n");
kfree(new); kfree(new);
} }
return ret; return ret;
......
...@@ -173,9 +173,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid) ...@@ -173,9 +173,8 @@ static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
out: out:
spin_unlock_bh(&sel_netport_lock); spin_unlock_bh(&sel_netport_lock);
if (unlikely(ret)) { if (unlikely(ret)) {
printk(KERN_WARNING pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
"SELinux: failure in sel_netport_sid_slow()," __func__);
" unable to determine network port label\n");
kfree(new); kfree(new);
} }
return ret; return ret;
......
...@@ -614,7 +614,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size) ...@@ -614,7 +614,7 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
length = -ERANGE; length = -ERANGE;
if (len > SIMPLE_TRANSACTION_LIMIT) { if (len > SIMPLE_TRANSACTION_LIMIT) {
printk(KERN_ERR "SELinux: %s: context size (%u) exceeds " pr_err("SELinux: %s: context size (%u) exceeds "
"payload max\n", __func__, len); "payload max\n", __func__, len);
goto out; goto out;
} }
...@@ -767,7 +767,7 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size); ...@@ -767,7 +767,7 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size);
static ssize_t sel_write_user(struct file *file, char *buf, size_t size); static ssize_t sel_write_user(struct file *file, char *buf, size_t size);
static ssize_t sel_write_member(struct file *file, char *buf, size_t size); static ssize_t sel_write_member(struct file *file, char *buf, size_t size);
static ssize_t (*write_op[])(struct file *, char *, size_t) = { static ssize_t (*const write_op[])(struct file *, char *, size_t) = {
[SEL_ACCESS] = sel_write_access, [SEL_ACCESS] = sel_write_access,
[SEL_CREATE] = sel_write_create, [SEL_CREATE] = sel_write_create,
[SEL_RELABEL] = sel_write_relabel, [SEL_RELABEL] = sel_write_relabel,
...@@ -950,7 +950,7 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size) ...@@ -950,7 +950,7 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
length = -ERANGE; length = -ERANGE;
if (len > SIMPLE_TRANSACTION_LIMIT) { if (len > SIMPLE_TRANSACTION_LIMIT) {
printk(KERN_ERR "SELinux: %s: context size (%u) exceeds " pr_err("SELinux: %s: context size (%u) exceeds "
"payload max\n", __func__, len); "payload max\n", __func__, len);
goto out; goto out;
} }
...@@ -1141,7 +1141,7 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size) ...@@ -1141,7 +1141,7 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
length = -ERANGE; length = -ERANGE;
if (len > SIMPLE_TRANSACTION_LIMIT) { if (len > SIMPLE_TRANSACTION_LIMIT) {
printk(KERN_ERR "SELinux: %s: context size (%u) exceeds " pr_err("SELinux: %s: context size (%u) exceeds "
"payload max\n", __func__, len); "payload max\n", __func__, len);
goto out; goto out;
} }
...@@ -1365,13 +1365,18 @@ static int sel_make_bools(struct selinux_fs_info *fsi) ...@@ -1365,13 +1365,18 @@ static int sel_make_bools(struct selinux_fs_info *fsi)
ret = -ENOMEM; ret = -ENOMEM;
inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR); inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
if (!inode) if (!inode) {
dput(dentry);
goto out; goto out;
}
ret = -ENAMETOOLONG; ret = -ENAMETOOLONG;
len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]); len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
if (len >= PAGE_SIZE) if (len >= PAGE_SIZE) {
dput(dentry);
iput(inode);
goto out; goto out;
}
isec = (struct inode_security_struct *)inode->i_security; isec = (struct inode_security_struct *)inode->i_security;
ret = security_genfs_sid(fsi->state, "selinuxfs", page, ret = security_genfs_sid(fsi->state, "selinuxfs", page,
...@@ -1586,8 +1591,10 @@ static int sel_make_avc_files(struct dentry *dir) ...@@ -1586,8 +1591,10 @@ static int sel_make_avc_files(struct dentry *dir)
return -ENOMEM; return -ENOMEM;
inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode); inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
if (!inode) if (!inode) {
dput(dentry);
return -ENOMEM; return -ENOMEM;
}
inode->i_fop = files[i].ops; inode->i_fop = files[i].ops;
inode->i_ino = ++fsi->last_ino; inode->i_ino = ++fsi->last_ino;
...@@ -1632,8 +1639,10 @@ static int sel_make_initcon_files(struct dentry *dir) ...@@ -1632,8 +1639,10 @@ static int sel_make_initcon_files(struct dentry *dir)
return -ENOMEM; return -ENOMEM;
inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
if (!inode) if (!inode) {
dput(dentry);
return -ENOMEM; return -ENOMEM;
}
inode->i_fop = &sel_initcon_ops; inode->i_fop = &sel_initcon_ops;
inode->i_ino = i|SEL_INITCON_INO_OFFSET; inode->i_ino = i|SEL_INITCON_INO_OFFSET;
...@@ -1733,8 +1742,10 @@ static int sel_make_perm_files(char *objclass, int classvalue, ...@@ -1733,8 +1742,10 @@ static int sel_make_perm_files(char *objclass, int classvalue,
rc = -ENOMEM; rc = -ENOMEM;
inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
if (!inode) if (!inode) {
dput(dentry);
goto out; goto out;
}
inode->i_fop = &sel_perm_ops; inode->i_fop = &sel_perm_ops;
/* i+1 since perm values are 1-indexed */ /* i+1 since perm values are 1-indexed */
...@@ -1763,8 +1774,10 @@ static int sel_make_class_dir_entries(char *classname, int index, ...@@ -1763,8 +1774,10 @@ static int sel_make_class_dir_entries(char *classname, int index,
return -ENOMEM; return -ENOMEM;
inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
if (!inode) if (!inode) {
dput(dentry);
return -ENOMEM; return -ENOMEM;
}
inode->i_fop = &sel_class_ops; inode->i_fop = &sel_class_ops;
inode->i_ino = sel_class_to_ino(index); inode->i_ino = sel_class_to_ino(index);
...@@ -1838,8 +1851,10 @@ static int sel_make_policycap(struct selinux_fs_info *fsi) ...@@ -1838,8 +1851,10 @@ static int sel_make_policycap(struct selinux_fs_info *fsi)
return -ENOMEM; return -ENOMEM;
inode = sel_make_inode(fsi->sb, S_IFREG | 0444); inode = sel_make_inode(fsi->sb, S_IFREG | 0444);
if (inode == NULL) if (inode == NULL) {
dput(dentry);
return -ENOMEM; return -ENOMEM;
}
inode->i_fop = &sel_policycap_ops; inode->i_fop = &sel_policycap_ops;
inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET; inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET;
...@@ -1932,8 +1947,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) ...@@ -1932,8 +1947,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
ret = -ENOMEM; ret = -ENOMEM;
inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO); inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
if (!inode) if (!inode) {
dput(dentry);
goto err; goto err;
}
inode->i_ino = ++fsi->last_ino; inode->i_ino = ++fsi->last_ino;
isec = (struct inode_security_struct *)inode->i_security; isec = (struct inode_security_struct *)inode->i_security;
...@@ -1984,7 +2001,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) ...@@ -1984,7 +2001,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
goto err; goto err;
return 0; return 0;
err: err:
printk(KERN_ERR "SELinux: %s: failed while creating inodes\n", pr_err("SELinux: %s: failed while creating inodes\n",
__func__); __func__);
selinux_fs_info_free(sb); selinux_fs_info_free(sb);
...@@ -2034,7 +2051,7 @@ static int __init init_sel_fs(void) ...@@ -2034,7 +2051,7 @@ static int __init init_sel_fs(void)
selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type); selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type);
if (IS_ERR(selinuxfs_mount)) { if (IS_ERR(selinuxfs_mount)) {
printk(KERN_ERR "selinuxfs: could not mount!\n"); pr_err("selinuxfs: could not mount!\n");
err = PTR_ERR(selinuxfs_mount); err = PTR_ERR(selinuxfs_mount);
selinuxfs_mount = NULL; selinuxfs_mount = NULL;
} }
......
...@@ -338,7 +338,7 @@ int avtab_alloc(struct avtab *h, u32 nrules) ...@@ -338,7 +338,7 @@ int avtab_alloc(struct avtab *h, u32 nrules)
h->nel = 0; h->nel = 0;
h->nslot = nslot; h->nslot = nslot;
h->mask = mask; h->mask = mask;
printk(KERN_DEBUG "SELinux: %d avtab hash slots, %d rules.\n", pr_debug("SELinux: %d avtab hash slots, %d rules.\n",
h->nslot, nrules); h->nslot, nrules);
return 0; return 0;
} }
...@@ -368,7 +368,7 @@ void avtab_hash_eval(struct avtab *h, char *tag) ...@@ -368,7 +368,7 @@ void avtab_hash_eval(struct avtab *h, char *tag)
} }
} }
printk(KERN_DEBUG "SELinux: %s: %d entries and %d/%d buckets used, " pr_debug("SELinux: %s: %d entries and %d/%d buckets used, "
"longest chain length %d sum of chain length^2 %llu\n", "longest chain length %d sum of chain length^2 %llu\n",
tag, h->nel, slots_used, h->nslot, max_chain_len, tag, h->nel, slots_used, h->nslot, max_chain_len,
chain2_len_sum); chain2_len_sum);
...@@ -407,18 +407,18 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -407,18 +407,18 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
if (vers < POLICYDB_VERSION_AVTAB) { if (vers < POLICYDB_VERSION_AVTAB) {
rc = next_entry(buf32, fp, sizeof(u32)); rc = next_entry(buf32, fp, sizeof(u32));
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
items2 = le32_to_cpu(buf32[0]); items2 = le32_to_cpu(buf32[0]);
if (items2 > ARRAY_SIZE(buf32)) { if (items2 > ARRAY_SIZE(buf32)) {
printk(KERN_ERR "SELinux: avtab: entry overflow\n"); pr_err("SELinux: avtab: entry overflow\n");
return -EINVAL; return -EINVAL;
} }
rc = next_entry(buf32, fp, sizeof(u32)*items2); rc = next_entry(buf32, fp, sizeof(u32)*items2);
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
items = 0; items = 0;
...@@ -426,19 +426,19 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -426,19 +426,19 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
val = le32_to_cpu(buf32[items++]); val = le32_to_cpu(buf32[items++]);
key.source_type = (u16)val; key.source_type = (u16)val;
if (key.source_type != val) { if (key.source_type != val) {
printk(KERN_ERR "SELinux: avtab: truncated source type\n"); pr_err("SELinux: avtab: truncated source type\n");
return -EINVAL; return -EINVAL;
} }
val = le32_to_cpu(buf32[items++]); val = le32_to_cpu(buf32[items++]);
key.target_type = (u16)val; key.target_type = (u16)val;
if (key.target_type != val) { if (key.target_type != val) {
printk(KERN_ERR "SELinux: avtab: truncated target type\n"); pr_err("SELinux: avtab: truncated target type\n");
return -EINVAL; return -EINVAL;
} }
val = le32_to_cpu(buf32[items++]); val = le32_to_cpu(buf32[items++]);
key.target_class = (u16)val; key.target_class = (u16)val;
if (key.target_class != val) { if (key.target_class != val) {
printk(KERN_ERR "SELinux: avtab: truncated target class\n"); pr_err("SELinux: avtab: truncated target class\n");
return -EINVAL; return -EINVAL;
} }
...@@ -446,16 +446,16 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -446,16 +446,16 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
enabled = (val & AVTAB_ENABLED_OLD) ? AVTAB_ENABLED : 0; enabled = (val & AVTAB_ENABLED_OLD) ? AVTAB_ENABLED : 0;
if (!(val & (AVTAB_AV | AVTAB_TYPE))) { if (!(val & (AVTAB_AV | AVTAB_TYPE))) {
printk(KERN_ERR "SELinux: avtab: null entry\n"); pr_err("SELinux: avtab: null entry\n");
return -EINVAL; return -EINVAL;
} }
if ((val & AVTAB_AV) && if ((val & AVTAB_AV) &&
(val & AVTAB_TYPE)) { (val & AVTAB_TYPE)) {
printk(KERN_ERR "SELinux: avtab: entry has both access vectors and types\n"); pr_err("SELinux: avtab: entry has both access vectors and types\n");
return -EINVAL; return -EINVAL;
} }
if (val & AVTAB_XPERMS) { if (val & AVTAB_XPERMS) {
printk(KERN_ERR "SELinux: avtab: entry has extended permissions\n"); pr_err("SELinux: avtab: entry has extended permissions\n");
return -EINVAL; return -EINVAL;
} }
...@@ -470,7 +470,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -470,7 +470,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
} }
if (items != items2) { if (items != items2) {
printk(KERN_ERR "SELinux: avtab: entry only had %d items, expected %d\n", items2, items); pr_err("SELinux: avtab: entry only had %d items, expected %d\n",
items2, items);
return -EINVAL; return -EINVAL;
} }
return 0; return 0;
...@@ -478,7 +479,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -478,7 +479,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
rc = next_entry(buf16, fp, sizeof(u16)*4); rc = next_entry(buf16, fp, sizeof(u16)*4);
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
...@@ -491,7 +492,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -491,7 +492,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
if (!policydb_type_isvalid(pol, key.source_type) || if (!policydb_type_isvalid(pol, key.source_type) ||
!policydb_type_isvalid(pol, key.target_type) || !policydb_type_isvalid(pol, key.target_type) ||
!policydb_class_isvalid(pol, key.target_class)) { !policydb_class_isvalid(pol, key.target_class)) {
printk(KERN_ERR "SELinux: avtab: invalid type or class\n"); pr_err("SELinux: avtab: invalid type or class\n");
return -EINVAL; return -EINVAL;
} }
...@@ -501,13 +502,13 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -501,13 +502,13 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
set++; set++;
} }
if (!set || set > 1) { if (!set || set > 1) {
printk(KERN_ERR "SELinux: avtab: more than one specifier\n"); pr_err("SELinux: avtab: more than one specifier\n");
return -EINVAL; return -EINVAL;
} }
if ((vers < POLICYDB_VERSION_XPERMS_IOCTL) && if ((vers < POLICYDB_VERSION_XPERMS_IOCTL) &&
(key.specified & AVTAB_XPERMS)) { (key.specified & AVTAB_XPERMS)) {
printk(KERN_ERR "SELinux: avtab: policy version %u does not " pr_err("SELinux: avtab: policy version %u does not "
"support extended permissions rules and one " "support extended permissions rules and one "
"was specified\n", vers); "was specified\n", vers);
return -EINVAL; return -EINVAL;
...@@ -515,17 +516,17 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -515,17 +516,17 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
memset(&xperms, 0, sizeof(struct avtab_extended_perms)); memset(&xperms, 0, sizeof(struct avtab_extended_perms));
rc = next_entry(&xperms.specified, fp, sizeof(u8)); rc = next_entry(&xperms.specified, fp, sizeof(u8));
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
rc = next_entry(&xperms.driver, fp, sizeof(u8)); rc = next_entry(&xperms.driver, fp, sizeof(u8));
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
rc = next_entry(buf32, fp, sizeof(u32)*ARRAY_SIZE(xperms.perms.p)); rc = next_entry(buf32, fp, sizeof(u32)*ARRAY_SIZE(xperms.perms.p));
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
for (i = 0; i < ARRAY_SIZE(xperms.perms.p); i++) for (i = 0; i < ARRAY_SIZE(xperms.perms.p); i++)
...@@ -534,14 +535,14 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol, ...@@ -534,14 +535,14 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
} else { } else {
rc = next_entry(buf32, fp, sizeof(u32)); rc = next_entry(buf32, fp, sizeof(u32));
if (rc) { if (rc) {
printk(KERN_ERR "SELinux: avtab: truncated entry\n"); pr_err("SELinux: avtab: truncated entry\n");
return rc; return rc;
} }
datum.u.data = le32_to_cpu(*buf32); datum.u.data = le32_to_cpu(*buf32);
} }
if ((key.specified & AVTAB_TYPE) && if ((key.specified & AVTAB_TYPE) &&
!policydb_type_isvalid(pol, datum.u.data)) { !policydb_type_isvalid(pol, datum.u.data)) {
printk(KERN_ERR "SELinux: avtab: invalid type\n"); pr_err("SELinux: avtab: invalid type\n");
return -EINVAL; return -EINVAL;
} }
return insertf(a, &key, &datum, p); return insertf(a, &key, &datum, p);
...@@ -562,12 +563,12 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol) ...@@ -562,12 +563,12 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol)
rc = next_entry(buf, fp, sizeof(u32)); rc = next_entry(buf, fp, sizeof(u32));
if (rc < 0) { if (rc < 0) {
printk(KERN_ERR "SELinux: avtab: truncated table\n"); pr_err("SELinux: avtab: truncated table\n");
goto bad; goto bad;
} }
nel = le32_to_cpu(buf[0]); nel = le32_to_cpu(buf[0]);
if (!nel) { if (!nel) {
printk(KERN_ERR "SELinux: avtab: table is empty\n"); pr_err("SELinux: avtab: table is empty\n");
rc = -EINVAL; rc = -EINVAL;
goto bad; goto bad;
} }
...@@ -580,9 +581,9 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol) ...@@ -580,9 +581,9 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol)
rc = avtab_read_item(a, fp, pol, avtab_insertf, NULL); rc = avtab_read_item(a, fp, pol, avtab_insertf, NULL);
if (rc) { if (rc) {
if (rc == -ENOMEM) if (rc == -ENOMEM)
printk(KERN_ERR "SELinux: avtab: out of memory\n"); pr_err("SELinux: avtab: out of memory\n");
else if (rc == -EEXIST) else if (rc == -EEXIST)
printk(KERN_ERR "SELinux: avtab: duplicate entry\n"); pr_err("SELinux: avtab: duplicate entry\n");
goto bad; goto bad;
} }
......
...@@ -96,7 +96,7 @@ int evaluate_cond_node(struct policydb *p, struct cond_node *node) ...@@ -96,7 +96,7 @@ int evaluate_cond_node(struct policydb *p, struct cond_node *node)
if (new_state != node->cur_state) { if (new_state != node->cur_state) {
node->cur_state = new_state; node->cur_state = new_state;
if (new_state == -1) if (new_state == -1)
printk(KERN_ERR "SELinux: expression result was undefined - disabling all rules.\n"); pr_err("SELinux: expression result was undefined - disabling all rules.\n");
/* turn the rules on or off */ /* turn the rules on or off */
for (cur = node->true_list; cur; cur = cur->next) { for (cur = node->true_list; cur; cur = cur->next) {
if (new_state <= 0) if (new_state <= 0)
...@@ -287,7 +287,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum ...@@ -287,7 +287,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
*/ */
if (k->specified & AVTAB_TYPE) { if (k->specified & AVTAB_TYPE) {
if (avtab_search(&p->te_avtab, k)) { if (avtab_search(&p->te_avtab, k)) {
printk(KERN_ERR "SELinux: type rule already exists outside of a conditional.\n"); pr_err("SELinux: type rule already exists outside of a conditional.\n");
goto err; goto err;
} }
/* /*
...@@ -302,7 +302,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum ...@@ -302,7 +302,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
node_ptr = avtab_search_node(&p->te_cond_avtab, k); node_ptr = avtab_search_node(&p->te_cond_avtab, k);
if (node_ptr) { if (node_ptr) {
if (avtab_search_node_next(node_ptr, k->specified)) { if (avtab_search_node_next(node_ptr, k->specified)) {
printk(KERN_ERR "SELinux: too many conflicting type rules.\n"); pr_err("SELinux: too many conflicting type rules.\n");
goto err; goto err;
} }
found = 0; found = 0;
...@@ -313,13 +313,13 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum ...@@ -313,13 +313,13 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
} }
} }
if (!found) { if (!found) {
printk(KERN_ERR "SELinux: conflicting type rules.\n"); pr_err("SELinux: conflicting type rules.\n");
goto err; goto err;
} }
} }
} else { } else {
if (avtab_search(&p->te_cond_avtab, k)) { if (avtab_search(&p->te_cond_avtab, k)) {
printk(KERN_ERR "SELinux: conflicting type rules when adding type rule for true.\n"); pr_err("SELinux: conflicting type rules when adding type rule for true.\n");
goto err; goto err;
} }
} }
...@@ -327,7 +327,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum ...@@ -327,7 +327,7 @@ static int cond_insertf(struct avtab *a, struct avtab_key *k, struct avtab_datum
node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d); node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
if (!node_ptr) { if (!node_ptr) {
printk(KERN_ERR "SELinux: could not insert rule.\n"); pr_err("SELinux: could not insert rule.\n");
rc = -ENOMEM; rc = -ENOMEM;
goto err; goto err;
} }
...@@ -387,12 +387,12 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list * ...@@ -387,12 +387,12 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list *
static int expr_isvalid(struct policydb *p, struct cond_expr *expr) static int expr_isvalid(struct policydb *p, struct cond_expr *expr)
{ {
if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) { if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) {
printk(KERN_ERR "SELinux: conditional expressions uses unknown operator.\n"); pr_err("SELinux: conditional expressions uses unknown operator.\n");
return 0; return 0;
} }
if (expr->bool > p->p_bools.nprim) { if (expr->bool > p->p_bools.nprim) {
printk(KERN_ERR "SELinux: conditional expressions uses unknown bool.\n"); pr_err("SELinux: conditional expressions uses unknown bool.\n");
return 0; return 0;
} }
return 1; return 1;
......
...@@ -362,7 +362,7 @@ int ebitmap_read(struct ebitmap *e, void *fp) ...@@ -362,7 +362,7 @@ int ebitmap_read(struct ebitmap *e, void *fp)
count = le32_to_cpu(buf[2]); count = le32_to_cpu(buf[2]);
if (mapunit != BITS_PER_U64) { if (mapunit != BITS_PER_U64) {
printk(KERN_ERR "SELinux: ebitmap: map size %u does not " pr_err("SELinux: ebitmap: map size %u does not "
"match my size %zd (high bit was %d)\n", "match my size %zd (high bit was %d)\n",
mapunit, BITS_PER_U64, e->highbit); mapunit, BITS_PER_U64, e->highbit);
goto bad; goto bad;
...@@ -383,19 +383,19 @@ int ebitmap_read(struct ebitmap *e, void *fp) ...@@ -383,19 +383,19 @@ int ebitmap_read(struct ebitmap *e, void *fp)
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
rc = next_entry(&startbit, fp, sizeof(u32)); rc = next_entry(&startbit, fp, sizeof(u32));
if (rc < 0) { if (rc < 0) {
printk(KERN_ERR "SELinux: ebitmap: truncated map\n"); pr_err("SELinux: ebitmap: truncated map\n");
goto bad; goto bad;
} }
startbit = le32_to_cpu(startbit); startbit = le32_to_cpu(startbit);
if (startbit & (mapunit - 1)) { if (startbit & (mapunit - 1)) {
printk(KERN_ERR "SELinux: ebitmap start bit (%d) is " pr_err("SELinux: ebitmap start bit (%d) is "
"not a multiple of the map unit size (%u)\n", "not a multiple of the map unit size (%u)\n",
startbit, mapunit); startbit, mapunit);
goto bad; goto bad;
} }
if (startbit > e->highbit - mapunit) { if (startbit > e->highbit - mapunit) {
printk(KERN_ERR "SELinux: ebitmap start bit (%d) is " pr_err("SELinux: ebitmap start bit (%d) is "
"beyond the end of the bitmap (%u)\n", "beyond the end of the bitmap (%u)\n",
startbit, (e->highbit - mapunit)); startbit, (e->highbit - mapunit));
goto bad; goto bad;
...@@ -405,8 +405,7 @@ int ebitmap_read(struct ebitmap *e, void *fp) ...@@ -405,8 +405,7 @@ int ebitmap_read(struct ebitmap *e, void *fp)
struct ebitmap_node *tmp; struct ebitmap_node *tmp;
tmp = kmem_cache_zalloc(ebitmap_node_cachep, GFP_KERNEL); tmp = kmem_cache_zalloc(ebitmap_node_cachep, GFP_KERNEL);
if (!tmp) { if (!tmp) {
printk(KERN_ERR pr_err("SELinux: ebitmap: out of memory\n");
"SELinux: ebitmap: out of memory\n");
rc = -ENOMEM; rc = -ENOMEM;
goto bad; goto bad;
} }
...@@ -418,7 +417,7 @@ int ebitmap_read(struct ebitmap *e, void *fp) ...@@ -418,7 +417,7 @@ int ebitmap_read(struct ebitmap *e, void *fp)
e->node = tmp; e->node = tmp;
n = tmp; n = tmp;
} else if (startbit <= n->startbit) { } else if (startbit <= n->startbit) {
printk(KERN_ERR "SELinux: ebitmap: start bit %d" pr_err("SELinux: ebitmap: start bit %d"
" comes after start bit %d\n", " comes after start bit %d\n",
startbit, n->startbit); startbit, n->startbit);
goto bad; goto bad;
...@@ -426,7 +425,7 @@ int ebitmap_read(struct ebitmap *e, void *fp) ...@@ -426,7 +425,7 @@ int ebitmap_read(struct ebitmap *e, void *fp)
rc = next_entry(&map, fp, sizeof(u64)); rc = next_entry(&map, fp, sizeof(u64));
if (rc < 0) { if (rc < 0) {
printk(KERN_ERR "SELinux: ebitmap: truncated map\n"); pr_err("SELinux: ebitmap: truncated map\n");
goto bad; goto bad;
} }
map = le64_to_cpu(map); map = le64_to_cpu(map);
......
This diff is collapsed.
This diff is collapsed.
...@@ -214,8 +214,7 @@ int sidtab_context_to_sid(struct sidtab *s, ...@@ -214,8 +214,7 @@ int sidtab_context_to_sid(struct sidtab *s,
} }
sid = s->next_sid++; sid = s->next_sid++;
if (context->len) if (context->len)
printk(KERN_INFO pr_info("SELinux: Context %s is not valid (left unmapped).\n",
"SELinux: Context %s is not valid (left unmapped).\n",
context->str); context->str);
ret = sidtab_insert(s, sid, context); ret = sidtab_insert(s, sid, context);
if (ret) if (ret)
...@@ -253,7 +252,7 @@ void sidtab_hash_eval(struct sidtab *h, char *tag) ...@@ -253,7 +252,7 @@ void sidtab_hash_eval(struct sidtab *h, char *tag)
} }
} }
printk(KERN_DEBUG "%s: %d entries and %d/%d buckets used, longest " pr_debug("%s: %d entries and %d/%d buckets used, longest "
"chain length %d\n", tag, h->nel, slots_used, SIDTAB_SIZE, "chain length %d\n", tag, h->nel, slots_used, SIDTAB_SIZE,
max_chain_len); max_chain_len);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment