[Devel] [PATCH linux-cr] always restore msg_msg label

[Serge E. Hallyn]

Hi Oren,

In comparing your ckpt-v19-dev-serge branch to my local one I
noticed this patch was missing, then realized I hadn't sent it
separately, but only inline with a response to Nathan.

Please do apply.

Without this patch, selinux labels will not be restored on msg_msg's in
message queues (because we didn't send the restored msg_msg through
msgsnd), and the restored task won't have the permission to receive the
messages.

As I mentioned in that thread, simply re-routing the restored
msg_msg through msgsnd doesn't really suffice because the msg_msg
label is calculated as a product of the msgq and sending task
labels, and the latter may have already changed.

thanks,
-serge

Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>
---
 security/security.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/security/security.c b/security/security.c
index 28db976..2b147cf 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1524,7 +1524,9 @@ int security_restore_obj(struct ckpt_ctx *ctx, void *v, int sectype,
 
 	/* return if caller didn't want to restore checkpointed labels */
 	if (!(ctx->uflags & RESTART_KEEP_LSM))
-		return 0;
+		/* though msg_msg label must always be restored */
+		if (sectype != CKPT_SECURITY_MSG_MSG)
+			return 0;
 
 	l = ckpt_obj_fetch(ctx, secref, CKPT_OBJ_SECURITY);
 	if (IS_ERR(l))
-- 
1.6.0.6

_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers