* avc_open() and netlink_loop()
@ 2010-02-03 6:19 KaiGai Kohei
2010-02-26 19:14 ` Eamon Walsh
0 siblings, 1 reply; 8+ messages in thread
From: KaiGai Kohei @ 2010-02-03 6:19 UTC (permalink / raw)
To: Eamon Walsh; +Cc: selinux
When we initialize userspace avc using avc_open(3), it internally calls
avc_init(3) without any callback functions. The avc_init() is introduced
as a deprecated interface from application code, so it is recommended to
use avc_open() instead for new applications.
The avc_init() internally calls avc_netlink_open(). If no thread callback
is not given, the 'blocking' argument shall be 0, then avc_netlink_open()
set O_NONBLOCK flag on the socket file descriptor.
Next, application will create a thread to receive messages via netlink
socket to invalidate userspace avc, using avc_netlink_loop().
However, if userspace avc of libselinux is already initialized,
the avc_netlink_loop() immediately returns with EWOULDBLOCK, because the
netlink socket is not blocked and avc_netlink_receive() does not expect
recvfrom() returns error.
It seems to me O_NONBLOCK is a wrong strategy in this case, and select(2)
should be checked in avc_netlink_check_nb() instead.
Eamon, what is your opinion?
--
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: avc_open() and netlink_loop()
2010-02-03 6:19 avc_open() and netlink_loop() KaiGai Kohei
@ 2010-02-26 19:14 ` Eamon Walsh
2010-02-26 20:49 ` Eamon Walsh
0 siblings, 1 reply; 8+ messages in thread
From: Eamon Walsh @ 2010-02-26 19:14 UTC (permalink / raw)
To: KaiGai Kohei; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 1409 bytes --]
On 02/03/2010 01:19 AM, KaiGai Kohei wrote:
> When we initialize userspace avc using avc_open(3), it internally calls
> avc_init(3) without any callback functions. The avc_init() is introduced
> as a deprecated interface from application code, so it is recommended to
> use avc_open() instead for new applications.
>
> The avc_init() internally calls avc_netlink_open(). If no thread callback
> is not given, the 'blocking' argument shall be 0, then avc_netlink_open()
> set O_NONBLOCK flag on the socket file descriptor.
>
> Next, application will create a thread to receive messages via netlink
> socket to invalidate userspace avc, using avc_netlink_loop().
> However, if userspace avc of libselinux is already initialized,
> the avc_netlink_loop() immediately returns with EWOULDBLOCK, because the
> netlink socket is not blocked and avc_netlink_receive() does not expect
> recvfrom() returns error.
>
> It seems to me O_NONBLOCK is a wrong strategy in this case, and select(2)
> should be checked in avc_netlink_check_nb() instead.
>
> Eamon, what is your opinion?
>
Hi, my apologies for the delayed response. Yes it appears as though this
is a bug. I think the solution is to configure the file descriptor in
blocking mode at the start of avc_netlink_loop(). When
avc_netlink_loop() is called, we always want blocking behavior. See the
attached patch.
--
Eamon Walsh
National Security Agency
[-- Attachment #2: avc_blocking_bug.patch --]
[-- Type: text/x-patch, Size: 802 bytes --]
diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
index 881b915..5c8def0 100644
--- a/libselinux/src/avc.c
+++ b/libselinux/src/avc.c
@@ -222,7 +222,7 @@ int avc_init(const char *prefix,
avc_enforcing = rc;
}
- rc = avc_netlink_open(avc_using_threads);
+ rc = avc_netlink_open(0);
if (rc < 0) {
avc_log(SELINUX_ERROR,
"%s: can't open netlink socket: %d (%s)\n",
diff --git a/libselinux/src/avc_internal.c b/libselinux/src/avc_internal.c
index 8372f52..90dfa51 100644
--- a/libselinux/src/avc_internal.c
+++ b/libselinux/src/avc_internal.c
@@ -233,6 +233,8 @@ void avc_netlink_loop(void)
int rc;
char buf[1024] __attribute__ ((aligned));
+ fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK)
+
while (1) {
errno = 0;
rc = avc_netlink_receive(buf, sizeof(buf));
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: avc_open() and netlink_loop()
2010-02-26 19:14 ` Eamon Walsh
@ 2010-02-26 20:49 ` Eamon Walsh
2010-02-26 20:56 ` [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode Eamon Walsh
0 siblings, 1 reply; 8+ messages in thread
From: Eamon Walsh @ 2010-02-26 20:49 UTC (permalink / raw)
To: KaiGai Kohei; +Cc: selinux
On 02/26/2010 02:14 PM, Eamon Walsh wrote:
> On 02/03/2010 01:19 AM, KaiGai Kohei wrote:
>> When we initialize userspace avc using avc_open(3), it internally calls
>> avc_init(3) without any callback functions. The avc_init() is introduced
>> as a deprecated interface from application code, so it is recommended to
>> use avc_open() instead for new applications.
>>
>> The avc_init() internally calls avc_netlink_open(). If no thread callback
>> is not given, the 'blocking' argument shall be 0, then avc_netlink_open()
>> set O_NONBLOCK flag on the socket file descriptor.
>>
>> Next, application will create a thread to receive messages via netlink
>> socket to invalidate userspace avc, using avc_netlink_loop().
>> However, if userspace avc of libselinux is already initialized,
>> the avc_netlink_loop() immediately returns with EWOULDBLOCK, because the
>> netlink socket is not blocked and avc_netlink_receive() does not expect
>> recvfrom() returns error.
>>
>> It seems to me O_NONBLOCK is a wrong strategy in this case, and select(2)
>> should be checked in avc_netlink_check_nb() instead.
>>
>> Eamon, what is your opinion?
>>
>
>
> Hi, my apologies for the delayed response. Yes it appears as though this
> is a bug. I think the solution is to configure the file descriptor in
> blocking mode at the start of avc_netlink_loop(). When
> avc_netlink_loop() is called, we always want blocking behavior. See the
> attached patch.
>
>
Also, before you launch a thread to run avc_netlink_loop(), you need to call avc_netlink_acquire_fd(). Otherwise, the avc will internally make calls to avc_netlink_check_nb() which will not work properly.
--
Eamon Walsh
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
2010-02-26 20:49 ` Eamon Walsh
@ 2010-02-26 20:56 ` Eamon Walsh
2010-03-02 2:48 ` KaiGai Kohei
0 siblings, 1 reply; 8+ messages in thread
From: Eamon Walsh @ 2010-02-26 20:56 UTC (permalink / raw)
To: KaiGai Kohei; +Cc: selinux, Joshua Brindle
avc_open() creates the netlink socket in nonblocking mode. If the
application later takes control of the netlink socket with
avc_netlink_acquire_fd() and then calls avc_netlink_loop(), it
will fail with EWOULDBLOCK.
To remedy this, remove the O_NONBLOCK flag from the netlink socket
at the start of avc_netlink_loop(). Also, with this fix, there is
no need for avc_open() to ever create a blocking socket, so change
that and update the man page.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
---
man/man3/avc_netlink_loop.3 | 5 +----
src/avc.c | 2 +-
src/avc_internal.c | 2 ++
3 files changed, 4 insertions(+), 5 deletions(-)
diff --git a/libselinux/man/man3/avc_netlink_loop.3 b/libselinux/man/man3/avc_netlink_loop.3
index 67df6e4..7d8c9a4 100644
--- a/libselinux/man/man3/avc_netlink_loop.3
+++ b/libselinux/man/man3/avc_netlink_loop.3
@@ -43,10 +43,7 @@ to take ownership of it in application code. The
.I blocking
argument specifies whether read operations on the socket will block.
.BR avc_open (3)
-calls this function internally, specifying non-blocking behavior (unless
-threading callbacks were explicitly set using the deprecated
-.BR avc_init (3)
-interface, in which case blocking behavior is set).
+calls this function internally, specifying non-blocking behavior.
.B avc_netlink_close
closes the netlink socket. This function is called automatically by
diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
index 881b915..5c8def0 100644
--- a/libselinux/src/avc.c
+++ b/libselinux/src/avc.c
@@ -222,7 +222,7 @@ int avc_init(const char *prefix,
avc_enforcing = rc;
}
- rc = avc_netlink_open(avc_using_threads);
+ rc = avc_netlink_open(0);
if (rc < 0) {
avc_log(SELINUX_ERROR,
"%s: can't open netlink socket: %d (%s)\n",
diff --git a/libselinux/src/avc_internal.c b/libselinux/src/avc_internal.c
index 8372f52..90dfa51 100644
--- a/libselinux/src/avc_internal.c
+++ b/libselinux/src/avc_internal.c
@@ -233,6 +233,8 @@ void avc_netlink_loop(void)
int rc;
char buf[1024] __attribute__ ((aligned));
+ fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+
while (1) {
errno = 0;
rc = avc_netlink_receive(buf, sizeof(buf));
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
2010-02-26 20:56 ` [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode Eamon Walsh
@ 2010-03-02 2:48 ` KaiGai Kohei
2010-03-02 17:29 ` Eamon Walsh
0 siblings, 1 reply; 8+ messages in thread
From: KaiGai Kohei @ 2010-03-02 2:48 UTC (permalink / raw)
To: Eamon Walsh; +Cc: selinux, Joshua Brindle
(2010/02/27 5:56), Eamon Walsh wrote:
> avc_open() creates the netlink socket in nonblocking mode. If the
> application later takes control of the netlink socket with
> avc_netlink_acquire_fd() and then calls avc_netlink_loop(), it
> will fail with EWOULDBLOCK.
>
> To remedy this, remove the O_NONBLOCK flag from the netlink socket
> at the start of avc_netlink_loop(). Also, with this fix, there is
> no need for avc_open() to ever create a blocking socket, so change
> that and update the man page.
Apart from this design is sane, the libselinux allows applications to
call avc_netlink_check_nb() directly.
If we call the function although its worker thread calls avc_netlink_loop(),
the invocation of avc_netlink_check_nb() can be blocked, because it
assumes the internal netlink socket is non-blocking mode.
(Of course, we will not see the matter in most of sane applications.)
I think a better approach is to put select(2) with zero or infinite
timeout just before avc_netlink_receive() calls to check whether the
unread message is in the netlink socket, or not.
And the 'blocking' argument of avc_netlink_open() shall be obsoleted,
because this design makes nonsense whether the socket has O_NONBLOCK
flag, or not.
The point is we should not assume the netlink socket has a certain
state when we call avc_netlink_loop() and avc_netlink_check_nb().
What is your opinion?
> Signed-off-by: Eamon Walsh<ewalsh@tycho.nsa.gov>
> ---
>
> man/man3/avc_netlink_loop.3 | 5 +----
> src/avc.c | 2 +-
> src/avc_internal.c | 2 ++
> 3 files changed, 4 insertions(+), 5 deletions(-)
>
>
> diff --git a/libselinux/man/man3/avc_netlink_loop.3 b/libselinux/man/man3/avc_netlink_loop.3
> index 67df6e4..7d8c9a4 100644
> --- a/libselinux/man/man3/avc_netlink_loop.3
> +++ b/libselinux/man/man3/avc_netlink_loop.3
> @@ -43,10 +43,7 @@ to take ownership of it in application code. The
> .I blocking
> argument specifies whether read operations on the socket will block.
> .BR avc_open (3)
> -calls this function internally, specifying non-blocking behavior (unless
> -threading callbacks were explicitly set using the deprecated
> -.BR avc_init (3)
> -interface, in which case blocking behavior is set).
> +calls this function internally, specifying non-blocking behavior.
>
> .B avc_netlink_close
> closes the netlink socket. This function is called automatically by
> diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
> index 881b915..5c8def0 100644
> --- a/libselinux/src/avc.c
> +++ b/libselinux/src/avc.c
> @@ -222,7 +222,7 @@ int avc_init(const char *prefix,
> avc_enforcing = rc;
> }
>
> - rc = avc_netlink_open(avc_using_threads);
> + rc = avc_netlink_open(0);
> if (rc< 0) {
> avc_log(SELINUX_ERROR,
> "%s: can't open netlink socket: %d (%s)\n",
> diff --git a/libselinux/src/avc_internal.c b/libselinux/src/avc_internal.c
> index 8372f52..90dfa51 100644
> --- a/libselinux/src/avc_internal.c
> +++ b/libselinux/src/avc_internal.c
> @@ -233,6 +233,8 @@ void avc_netlink_loop(void)
> int rc;
> char buf[1024] __attribute__ ((aligned));
>
> + fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0)& ~O_NONBLOCK);
> +
> while (1) {
> errno = 0;
> rc = avc_netlink_receive(buf, sizeof(buf));
>
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>
--
KaiGai Kohei <kaigai@ak.jp.nec.com>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
2010-03-02 2:48 ` KaiGai Kohei
@ 2010-03-02 17:29 ` Eamon Walsh
2010-03-03 0:30 ` KaiGai Kohei
0 siblings, 1 reply; 8+ messages in thread
From: Eamon Walsh @ 2010-03-02 17:29 UTC (permalink / raw)
To: KaiGai Kohei; +Cc: selinux, Joshua Brindle
On 03/01/2010 09:48 PM, KaiGai Kohei wrote:
> (2010/02/27 5:56), Eamon Walsh wrote:
>
>> avc_open() creates the netlink socket in nonblocking mode. If the
>> application later takes control of the netlink socket with
>> avc_netlink_acquire_fd() and then calls avc_netlink_loop(), it
>> will fail with EWOULDBLOCK.
>>
>> To remedy this, remove the O_NONBLOCK flag from the netlink socket
>> at the start of avc_netlink_loop(). Also, with this fix, there is
>> no need for avc_open() to ever create a blocking socket, so change
>> that and update the man page.
>>
> Apart from this design is sane, the libselinux allows applications to
> call avc_netlink_check_nb() directly.
> If we call the function although its worker thread calls avc_netlink_loop(),
> the invocation of avc_netlink_check_nb() can be blocked, because it
> assumes the internal netlink socket is non-blocking mode.
> (Of course, we will not see the matter in most of sane applications.)
>
> I think a better approach is to put select(2) with zero or infinite
> timeout just before avc_netlink_receive() calls to check whether the
> unread message is in the netlink socket, or not.
> And the 'blocking' argument of avc_netlink_open() shall be obsoleted,
> because this design makes nonsense whether the socket has O_NONBLOCK
> flag, or not.
>
OK I see your point. How about the following:
libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
avc_open() creates the netlink socket in nonblocking mode. If the
application later takes control of the netlink socket with
avc_netlink_acquire_fd() and then calls avc_netlink_loop(), it
will fail with EWOULDBLOCK.
To remedy this, remove the O_NONBLOCK flag from the netlink socket
at the start of avc_netlink_loop(). Also, with this fix, there is
no need for avc_open() to ever create a blocking socket, so change
that and update the man page.
-v2: use poll() in avc_netlink_check_nb(). This makes both
avc_netlink_loop() and avc_netlink_check_nb() independent of the
O_NONBLOCK flag.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
--
man/man3/avc_netlink_loop.3 | 11 +++--------
src/avc.c | 2 +-
src/avc_internal.c | 13 +++++++++++++
3 files changed, 17 insertions(+), 9 deletions(-)
diff --git a/libselinux/man/man3/avc_netlink_loop.3 b/libselinux/man/man3/avc_netlink_loop.3
index 67df6e4..785be4c 100644
--- a/libselinux/man/man3/avc_netlink_loop.3
+++ b/libselinux/man/man3/avc_netlink_loop.3
@@ -41,12 +41,9 @@ descriptor is stored internally; use
.BR avc_netlink_acquire_fd (3)
to take ownership of it in application code. The
.I blocking
-argument specifies whether read operations on the socket will block.
+argument controls whether the O_NONBLOCK flag is set on the socket descriptor.
.BR avc_open (3)
-calls this function internally, specifying non-blocking behavior (unless
-threading callbacks were explicitly set using the deprecated
-.BR avc_init (3)
-interface, in which case blocking behavior is set).
+calls this function internally, specifying non-blocking behavior.
.B avc_netlink_close
closes the netlink socket. This function is called automatically by
@@ -66,9 +63,7 @@ checks the netlink socket for pending messages and processes them.
Callbacks for policyload and enforcing changes will be called;
see
.BR selinux_set_callback (3).
-This function does not block unless
-.BR avc_netlink_open (3)
-specified blocking behavior.
+This function does not block.
.B avc_netlink_loop
enters a loop blocking on the netlink socket and processing messages as they
diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
index 881b915..5c8def0 100644
--- a/libselinux/src/avc.c
+++ b/libselinux/src/avc.c
@@ -222,7 +222,7 @@ int avc_init(const char *prefix,
avc_enforcing = rc;
}
- rc = avc_netlink_open(avc_using_threads);
+ rc = avc_netlink_open(0);
if (rc < 0) {
avc_log(SELINUX_ERROR,
"%s: can't open netlink socket: %d (%s)\n",
diff --git a/libselinux/src/avc_internal.c b/libselinux/src/avc_internal.c
index 8372f52..7a39c61 100644
--- a/libselinux/src/avc_internal.c
+++ b/libselinux/src/avc_internal.c
@@ -15,6 +15,7 @@
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
+#include <poll.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/types.h>
@@ -205,8 +206,18 @@ int avc_netlink_check_nb(void)
{
int rc;
char buf[1024] __attribute__ ((aligned));
+ struct pollfd pfd = { fd, POLLIN | POLLPRI, 0 };
while (1) {
+ rc = poll(&pfd, 1, 0);
+ if (rc == 0)
+ return 0;
+ if (rc < 0) {
+ avc_log(SELINUX_ERROR, "%s: netlink poll: error %d\n",
+ avc_prefix, errno);
+ return rc;
+ }
+
errno = 0;
rc = avc_netlink_receive(buf, sizeof(buf));
if (rc < 0) {
@@ -233,6 +244,8 @@ void avc_netlink_loop(void)
int rc;
char buf[1024] __attribute__ ((aligned));
+ fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
+
while (1) {
errno = 0;
rc = avc_netlink_receive(buf, sizeof(buf));
--
Eamon Walsh
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
2010-03-02 17:29 ` Eamon Walsh
@ 2010-03-03 0:30 ` KaiGai Kohei
2010-03-08 23:19 ` Eamon Walsh
0 siblings, 1 reply; 8+ messages in thread
From: KaiGai Kohei @ 2010-03-03 0:30 UTC (permalink / raw)
To: Eamon Walsh; +Cc: selinux, Joshua Brindle
[-- Attachment #1: Type: text/plain, Size: 5706 bytes --]
(2010/03/03 2:29), Eamon Walsh wrote:
> On 03/01/2010 09:48 PM, KaiGai Kohei wrote:
>> (2010/02/27 5:56), Eamon Walsh wrote:
>>
>>> avc_open() creates the netlink socket in nonblocking mode. If the
>>> application later takes control of the netlink socket with
>>> avc_netlink_acquire_fd() and then calls avc_netlink_loop(), it
>>> will fail with EWOULDBLOCK.
>>>
>>> To remedy this, remove the O_NONBLOCK flag from the netlink socket
>>> at the start of avc_netlink_loop(). Also, with this fix, there is
>>> no need for avc_open() to ever create a blocking socket, so change
>>> that and update the man page.
>>>
>> Apart from this design is sane, the libselinux allows applications to
>> call avc_netlink_check_nb() directly.
>> If we call the function although its worker thread calls avc_netlink_loop(),
>> the invocation of avc_netlink_check_nb() can be blocked, because it
>> assumes the internal netlink socket is non-blocking mode.
>> (Of course, we will not see the matter in most of sane applications.)
>>
>> I think a better approach is to put select(2) with zero or infinite
>> timeout just before avc_netlink_receive() calls to check whether the
>> unread message is in the netlink socket, or not.
>> And the 'blocking' argument of avc_netlink_open() shall be obsoleted,
>> because this design makes nonsense whether the socket has O_NONBLOCK
>> flag, or not.
>>
>
> OK I see your point. How about the following:
>
> libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
>
> avc_open() creates the netlink socket in nonblocking mode. If the
> application later takes control of the netlink socket with
> avc_netlink_acquire_fd() and then calls avc_netlink_loop(), it
> will fail with EWOULDBLOCK.
>
> To remedy this, remove the O_NONBLOCK flag from the netlink socket
> at the start of avc_netlink_loop(). Also, with this fix, there is
> no need for avc_open() to ever create a blocking socket, so change
> that and update the man page.
>
> -v2: use poll() in avc_netlink_check_nb(). This makes both
> avc_netlink_loop() and avc_netlink_check_nb() independent of the
> O_NONBLOCK flag.
It seems to me ok basically.
It is just my preference. Can you move the poll(2) at the head of
the avc_netlink_receive() call, like as the attachment?
How should I say...it seems to me itchy to change non-blocking mode
into blocking mode implicitly at avc_netlink_loop(), although we can
specify the mode at creation time (avc_netlink_open()).
Thanks,
> Signed-off-by: Eamon Walsh<ewalsh@tycho.nsa.gov>
> --
>
> man/man3/avc_netlink_loop.3 | 11 +++--------
> src/avc.c | 2 +-
> src/avc_internal.c | 13 +++++++++++++
> 3 files changed, 17 insertions(+), 9 deletions(-)
>
>
> diff --git a/libselinux/man/man3/avc_netlink_loop.3 b/libselinux/man/man3/avc_netlink_loop.3
> index 67df6e4..785be4c 100644
> --- a/libselinux/man/man3/avc_netlink_loop.3
> +++ b/libselinux/man/man3/avc_netlink_loop.3
> @@ -41,12 +41,9 @@ descriptor is stored internally; use
> .BR avc_netlink_acquire_fd (3)
> to take ownership of it in application code. The
> .I blocking
> -argument specifies whether read operations on the socket will block.
> +argument controls whether the O_NONBLOCK flag is set on the socket descriptor.
> .BR avc_open (3)
> -calls this function internally, specifying non-blocking behavior (unless
> -threading callbacks were explicitly set using the deprecated
> -.BR avc_init (3)
> -interface, in which case blocking behavior is set).
> +calls this function internally, specifying non-blocking behavior.
>
> .B avc_netlink_close
> closes the netlink socket. This function is called automatically by
> @@ -66,9 +63,7 @@ checks the netlink socket for pending messages and processes them.
> Callbacks for policyload and enforcing changes will be called;
> see
> .BR selinux_set_callback (3).
> -This function does not block unless
> -.BR avc_netlink_open (3)
> -specified blocking behavior.
> +This function does not block.
>
> .B avc_netlink_loop
> enters a loop blocking on the netlink socket and processing messages as they
> diff --git a/libselinux/src/avc.c b/libselinux/src/avc.c
> index 881b915..5c8def0 100644
> --- a/libselinux/src/avc.c
> +++ b/libselinux/src/avc.c
> @@ -222,7 +222,7 @@ int avc_init(const char *prefix,
> avc_enforcing = rc;
> }
>
> - rc = avc_netlink_open(avc_using_threads);
> + rc = avc_netlink_open(0);
> if (rc< 0) {
> avc_log(SELINUX_ERROR,
> "%s: can't open netlink socket: %d (%s)\n",
> diff --git a/libselinux/src/avc_internal.c b/libselinux/src/avc_internal.c
> index 8372f52..7a39c61 100644
> --- a/libselinux/src/avc_internal.c
> +++ b/libselinux/src/avc_internal.c
> @@ -15,6 +15,7 @@
> #include<unistd.h>
> #include<fcntl.h>
> #include<string.h>
> +#include<poll.h>
> #include<sys/types.h>
> #include<sys/socket.h>
> #include<linux/types.h>
> @@ -205,8 +206,18 @@ int avc_netlink_check_nb(void)
> {
> int rc;
> char buf[1024] __attribute__ ((aligned));
> + struct pollfd pfd = { fd, POLLIN | POLLPRI, 0 };
>
> while (1) {
> + rc = poll(&pfd, 1, 0);
> + if (rc == 0)
> + return 0;
> + if (rc< 0) {
> + avc_log(SELINUX_ERROR, "%s: netlink poll: error %d\n",
> + avc_prefix, errno);
> + return rc;
> + }
> +
> errno = 0;
> rc = avc_netlink_receive(buf, sizeof(buf));
> if (rc< 0) {
> @@ -233,6 +244,8 @@ void avc_netlink_loop(void)
> int rc;
> char buf[1024] __attribute__ ((aligned));
>
> + fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0)& ~O_NONBLOCK);
> +
> while (1) {
> errno = 0;
> rc = avc_netlink_receive(buf, sizeof(buf));
>
>
>
--
KaiGai Kohei <kaigai@ak.jp.nec.com>
[-- Attachment #2: avc-netlink-poll.2.patch --]
[-- Type: application/octect-stream, Size: 3488 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode.
2010-03-03 0:30 ` KaiGai Kohei
@ 2010-03-08 23:19 ` Eamon Walsh
0 siblings, 0 replies; 8+ messages in thread
From: Eamon Walsh @ 2010-03-08 23:19 UTC (permalink / raw)
To: KaiGai Kohei; +Cc: selinux, Joshua Brindle
On 03/02/2010 07:30 PM, KaiGai Kohei wrote:
>
> It seems to me ok basically.
>
> It is just my preference. Can you move the poll(2) at the head of
> the avc_netlink_receive() call, like as the attachment?
> How should I say...it seems to me itchy to change non-blocking mode
> into blocking mode implicitly at avc_netlink_loop(), although we can
> specify the mode at creation time (avc_netlink_open()).
>
> Thanks,
>
I have pushed this patch, thanks.
--
Eamon Walsh
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2010-03-08 23:19 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-02-03 6:19 avc_open() and netlink_loop() KaiGai Kohei
2010-02-26 19:14 ` Eamon Walsh
2010-02-26 20:49 ` Eamon Walsh
2010-02-26 20:56 ` [PATCH] libselinux: fix avc_netlink_loop() error caused by nonblocking mode Eamon Walsh
2010-03-02 2:48 ` KaiGai Kohei
2010-03-02 17:29 ` Eamon Walsh
2010-03-03 0:30 ` KaiGai Kohei
2010-03-08 23:19 ` Eamon Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.