[GIT PULL] SELinux fixes for 4.5 (#2)

[GIT PULL] SELinux fixes for 4.5 (#2)

[Paul Moore]

Hi James,

One more straightforward patch to fix a problem with the inode invalidation 
changes.  The fix passes the selinux-testsuite and applies cleanly on top of 
your current linux-security#next branch; please apply.

-Paul

---
The following changes since commit b197367ed1ba81b0d26f7e7f76f61731ac6e5842:

  selinux: Inode label revalidation performance fix
           (2016-01-08 16:24:27 -0500)

are available in the git repository at:

  git://git.infradead.org/users/pcmoore/selinux stable-4.5

for you to fetch changes up to e817c2f33efb4aa7f02c98dfab9a5f8ff383ea7e:

  selinux: Don't sleep inside inode_getsecid hook (2016-02-19 16:29:19 -0500)

----------------------------------------------------------------
Andreas Gruenbacher (1):
      selinux: Don't sleep inside inode_getsecid hook

 security/selinux/hooks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
paul moore
security @ redhat

Re: [GIT PULL] SELinux fixes for 4.5 (#2)

[James Morris]

On Mon, 22 Feb 2016, Paul Moore wrote:

> Hi James,
> 
> One more straightforward patch to fix a problem with the inode invalidation 
> changes.  The fix passes the selinux-testsuite and applies cleanly on top of 
> your current linux-security#next branch; please apply.

Where is patch '#1' ?


-- 
James Morris
<jmorris@namei.org>

Re: [GIT PULL] SELinux fixes for 4.5 (#2)

[Paul Moore]

On Tuesday, February 23, 2016 10:39:26 PM James Morris wrote:
> On Mon, 22 Feb 2016, Paul Moore wrote:
> > Hi James,
> > 
> > One more straightforward patch to fix a problem with the inode
> > invalidation changes.  The fix passes the selinux-testsuite and applies
> > cleanly on top of your current linux-security#next branch; please apply.
> 
> Where is patch '#1' ?

Where is said it was in the pull request ... ?  It is in the usual SELinux 
kernel repo, in the stable-4.5 branch.  It looks okay on my end, are you 
having problems fetching the branch/commit?

git://git.infradead.org/users/pcmoore/selinux stable-4.5
http://git.infradead.org/users/pcmoore/selinux/shortlog/refs/heads/stable-4.5

  commit e817c2f33efb4aa7f02c98dfab9a5f8ff383ea7e
  Author: Andreas Gruenbacher <agruenba@redhat.com>
  Date:   Thu Feb 18 12:04:08 2016 +0100

    selinux: Don't sleep inside inode_getsecid hook
    
    The inode_getsecid hook is called from contexts in which sleeping is not
    allowed, so we cannot revalidate inode security labels from there. Use
    the non-validating version of inode_security() instead.
    
    Reported-by: Benjamin Coddington <bcodding@redhat.com>
    Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
    Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

-- 
paul moore
security @ redhat