selinux: cleanup return codes in avtab_read_item()
The avtab_read_item() function tends to return -1 as a default error code which is wrong (-1 means -EPERM). I modified it to return appropriate error codes which is -EINVAL or the error code from next_entry() or insertf(). next_entry() returns -EINVAL. insertf() is a function pointer to either avtab_insert() or cond_insertf(). avtab_insert() returns -EINVAL, -ENOMEM, and -EEXIST. cond_insertf() currently returns -1, but I will fix it in a later patch. There is code in avtab_read() which translates the -1 returns from avtab_read_item() to -EINVAL. The translation is no longer needed, so I removed it. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
parent
dce3a3d2ee
commit
9e0bd4cba4
|
@ -342,20 +342,20 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
|
||||||
|
|
||||||
if (vers < POLICYDB_VERSION_AVTAB) {
|
if (vers < POLICYDB_VERSION_AVTAB) {
|
||||||
rc = next_entry(buf32, fp, sizeof(u32));
|
rc = next_entry(buf32, fp, sizeof(u32));
|
||||||
if (rc < 0) {
|
if (rc) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
||||||
return -1;
|
return rc;
|
||||||
}
|
}
|
||||||
items2 = le32_to_cpu(buf32[0]);
|
items2 = le32_to_cpu(buf32[0]);
|
||||||
if (items2 > ARRAY_SIZE(buf32)) {
|
if (items2 > ARRAY_SIZE(buf32)) {
|
||||||
printk(KERN_ERR "SELinux: avtab: entry overflow\n");
|
printk(KERN_ERR "SELinux: avtab: entry overflow\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
|
|
||||||
}
|
}
|
||||||
rc = next_entry(buf32, fp, sizeof(u32)*items2);
|
rc = next_entry(buf32, fp, sizeof(u32)*items2);
|
||||||
if (rc < 0) {
|
if (rc) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
||||||
return -1;
|
return rc;
|
||||||
}
|
}
|
||||||
items = 0;
|
items = 0;
|
||||||
|
|
||||||
|
@ -363,19 +363,19 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
|
||||||
key.source_type = (u16)val;
|
key.source_type = (u16)val;
|
||||||
if (key.source_type != val) {
|
if (key.source_type != val) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated source type\n");
|
printk(KERN_ERR "SELinux: avtab: truncated source type\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
val = le32_to_cpu(buf32[items++]);
|
val = le32_to_cpu(buf32[items++]);
|
||||||
key.target_type = (u16)val;
|
key.target_type = (u16)val;
|
||||||
if (key.target_type != val) {
|
if (key.target_type != val) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated target type\n");
|
printk(KERN_ERR "SELinux: avtab: truncated target type\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
val = le32_to_cpu(buf32[items++]);
|
val = le32_to_cpu(buf32[items++]);
|
||||||
key.target_class = (u16)val;
|
key.target_class = (u16)val;
|
||||||
if (key.target_class != val) {
|
if (key.target_class != val) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated target class\n");
|
printk(KERN_ERR "SELinux: avtab: truncated target class\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
val = le32_to_cpu(buf32[items++]);
|
val = le32_to_cpu(buf32[items++]);
|
||||||
|
@ -383,12 +383,12 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
|
||||||
|
|
||||||
if (!(val & (AVTAB_AV | AVTAB_TYPE))) {
|
if (!(val & (AVTAB_AV | AVTAB_TYPE))) {
|
||||||
printk(KERN_ERR "SELinux: avtab: null entry\n");
|
printk(KERN_ERR "SELinux: avtab: null entry\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
if ((val & AVTAB_AV) &&
|
if ((val & AVTAB_AV) &&
|
||||||
(val & AVTAB_TYPE)) {
|
(val & AVTAB_TYPE)) {
|
||||||
printk(KERN_ERR "SELinux: avtab: entry has both access vectors and types\n");
|
printk(KERN_ERR "SELinux: avtab: entry has both access vectors and types\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
for (i = 0; i < ARRAY_SIZE(spec_order); i++) {
|
for (i = 0; i < ARRAY_SIZE(spec_order); i++) {
|
||||||
|
@ -403,15 +403,15 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
|
||||||
|
|
||||||
if (items != items2) {
|
if (items != items2) {
|
||||||
printk(KERN_ERR "SELinux: avtab: entry only had %d items, expected %d\n", items2, items);
|
printk(KERN_ERR "SELinux: avtab: entry only had %d items, expected %d\n", items2, items);
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
rc = next_entry(buf16, fp, sizeof(u16)*4);
|
rc = next_entry(buf16, fp, sizeof(u16)*4);
|
||||||
if (rc < 0) {
|
if (rc) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
||||||
return -1;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
items = 0;
|
items = 0;
|
||||||
|
@ -424,7 +424,7 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
|
||||||
!policydb_type_isvalid(pol, key.target_type) ||
|
!policydb_type_isvalid(pol, key.target_type) ||
|
||||||
!policydb_class_isvalid(pol, key.target_class)) {
|
!policydb_class_isvalid(pol, key.target_class)) {
|
||||||
printk(KERN_ERR "SELinux: avtab: invalid type or class\n");
|
printk(KERN_ERR "SELinux: avtab: invalid type or class\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
set = 0;
|
set = 0;
|
||||||
|
@ -434,19 +434,19 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
|
||||||
}
|
}
|
||||||
if (!set || set > 1) {
|
if (!set || set > 1) {
|
||||||
printk(KERN_ERR "SELinux: avtab: more than one specifier\n");
|
printk(KERN_ERR "SELinux: avtab: more than one specifier\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
rc = next_entry(buf32, fp, sizeof(u32));
|
rc = next_entry(buf32, fp, sizeof(u32));
|
||||||
if (rc < 0) {
|
if (rc) {
|
||||||
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
printk(KERN_ERR "SELinux: avtab: truncated entry\n");
|
||||||
return -1;
|
return rc;
|
||||||
}
|
}
|
||||||
datum.data = le32_to_cpu(*buf32);
|
datum.data = le32_to_cpu(*buf32);
|
||||||
if ((key.specified & AVTAB_TYPE) &&
|
if ((key.specified & AVTAB_TYPE) &&
|
||||||
!policydb_type_isvalid(pol, datum.data)) {
|
!policydb_type_isvalid(pol, datum.data)) {
|
||||||
printk(KERN_ERR "SELinux: avtab: invalid type\n");
|
printk(KERN_ERR "SELinux: avtab: invalid type\n");
|
||||||
return -1;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
return insertf(a, &key, &datum, p);
|
return insertf(a, &key, &datum, p);
|
||||||
}
|
}
|
||||||
|
@ -487,8 +487,7 @@ int avtab_read(struct avtab *a, void *fp, struct policydb *pol)
|
||||||
printk(KERN_ERR "SELinux: avtab: out of memory\n");
|
printk(KERN_ERR "SELinux: avtab: out of memory\n");
|
||||||
else if (rc == -EEXIST)
|
else if (rc == -EEXIST)
|
||||||
printk(KERN_ERR "SELinux: avtab: duplicate entry\n");
|
printk(KERN_ERR "SELinux: avtab: duplicate entry\n");
|
||||||
else
|
|
||||||
rc = -EINVAL;
|
|
||||||
goto bad;
|
goto bad;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue