[lkml]   [2004]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: RCU issue with SELinux (Re: SELINUX performance issues)
On Wed, 2004-08-25 at 11:50, Stephen Smalley wrote:
> I haven't tracked down the cause yet, but a kernel built with all three
> patches (list_replace_rcu, atomic_inc_return, and selinux.rcu take3) on
> x86 doesn't allow an enforcing boot; it begins auditing denials _before_
> the initial policy load (which should never happen, as
> security_compute_av allows everything until the policy is loaded), and
> prevents /sbin/init from loading the policy.

-int avc_lookup(u32 ssid, u32 tsid, u16 tclass,
- u32 requested, struct avc_entry_ref *aeref)
+struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass, u32 requested)
struct avc_node *node;
- int probes, rc = 0;
+ int probes;

node = avc_search_node(ssid, tsid, tclass,&probes);

if (node && ((node->ae.avd.decided & requested) == requested)) {
- aeref->ae = &node->ae;
goto out;

- rc = -ENOENT;
- return rc;
+ return node;

Ah, I think the bug is here. avc_search_node() can return a node that
matches the (ssid,tsid,tclass) triple but doesn't include all of the
necessary decisions (the decided vector), but your avc_lookup() code
falls through nonetheless and returns it. This happens normally during
initialization prior to policy load, where security_compute_av is only
adding decisions as they are requested. Notice that the original code
set rc to ENOENT on that path; in your case, you need to reset node to

Stephen Smalley <>
National Security Agency

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:05    [W:0.064 / U:1.204 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site