Merge tag 'trace-v5.15-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt...

[linux-2.6-microblaze.git] / security / selinux / selinuxfs.c

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 01a7d50..e4cd7cb 100644 (file)
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -41,6 +41,7 @@
 #include "security.h"
 #include "objsec.h"
 #include "conditional.h"
+#include "ima.h"
 
 enum sel_inos {
        SEL_ROOT_INO = 2,
@@ -182,6 +183,8 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
                selinux_status_update_setenforce(state, new_value);
                if (!new_value)
                        call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
+
+               selinux_ima_measure_state(state);
        }
        length = count;
 out:
@@ -563,17 +566,13 @@ static int sel_make_policy_nodes(struct selinux_fs_info *fsi,
 
        ret = sel_make_bools(newpolicy, tmp_bool_dir, &tmp_bool_num,
                             &tmp_bool_names, &tmp_bool_values);
-       if (ret) {
-               pr_err("SELinux: failed to load policy booleans\n");
+       if (ret)
                goto out;
-       }
 
        ret = sel_make_classes(newpolicy, tmp_class_dir,
                               &fsi->last_class_ino);
-       if (ret) {
-               pr_err("SELinux: failed to load policy classes\n");
+       if (ret)
                goto out;
-       }
 
        /* booleans */
        old_dentry = fsi->bool_dir;
@@ -616,7 +615,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
 
 {
        struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
-       struct selinux_policy *newpolicy;
+       struct selinux_load_state load_state;
        ssize_t length;
        void *data = NULL;
 
@@ -642,23 +641,23 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
        if (copy_from_user(data, buf, count) != 0)
                goto out;
 
-       length = security_load_policy(fsi->state, data, count, &newpolicy);
+       length = security_load_policy(fsi->state, data, count, &load_state);
        if (length) {
                pr_warn_ratelimited("SELinux: failed to load policy\n");
                goto out;
        }
 
-       length = sel_make_policy_nodes(fsi, newpolicy);
+       length = sel_make_policy_nodes(fsi, load_state.policy);
        if (length) {
-               selinux_policy_cancel(fsi->state, newpolicy);
-               goto out1;
+               pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n");
+               selinux_policy_cancel(fsi->state, &load_state);
+               goto out;
        }
 
-       selinux_policy_commit(fsi->state, newpolicy);
+       selinux_policy_commit(fsi->state, &load_state);
 
        length = count;
 
-out1:
        audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
                "auid=%u ses=%u lsm=selinux res=1",
                from_kuid(&init_user_ns, audit_get_loginuid(current)),
@@ -762,6 +761,9 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
 
        checkreqprot_set(fsi->state, (new_value ? 1 : 0));
        length = count;
+
+       selinux_ima_measure_state(fsi->state);
+
 out:
        kfree(page);
        return length;