This patchset revamps the SID table implementation to fix ENOMEM errors returned from sidtab_context_to_sid() during policy reload.
The first patch prepares the way for the second one by moving the handling of initial SIDs to a separate table. This is needed since the second patch will do the sidtab conversion in-place and handling the initial SIDs would complicate things too much. The second patch changes the way that sidtab is transitioned to the new policy so that it does not need to be frozen for modifications during the conversion of entries to the new policy. See individual patches for more details. Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/38 Testing: - passed selinux-testsuite - verified using the reproducer from GH issue - tested with the following stress test on SMP (with lock debugging enabled): function rand_cat() { echo $(( $RANDOM % 1024 )) } function do_work() { while runcon -l s0:c$(rand_cat),c$(rand_cat) echo -n x; do :; done } do_work >/dev/null & do_work >/dev/null & do_work >/dev/null & while load_policy; do echo -n .; sleep 0.1; done kill %1 kill %2 kill %3 -- Ondrej Mosnacek (2): selinux: use separate table for initial SID lookup selinux: fix ENOMEM errors during policy reload security/selinux/include/security.h | 3 + security/selinux/ss/mls.c | 22 +- security/selinux/ss/mls.h | 5 +- security/selinux/ss/policydb.c | 24 ++- security/selinux/ss/policydb.h | 26 ++- security/selinux/ss/services.c | 314 +++++++++++++--------------- security/selinux/ss/services.h | 1 + security/selinux/ss/sidtab.c | 141 +++++++------ security/selinux/ss/sidtab.h | 26 +-- 9 files changed, 296 insertions(+), 266 deletions(-) -- 2.17.2 _______________________________________________ Selinux mailing list [email protected] To unsubscribe, send email to [email protected]. To get help, send an email containing "help" to [email protected].
