Re: [PATCH v2 4/5] selinux: keep pending boolean values across policy loads

[sashiko-bot@kernel.org]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> Setting a boolean via selinuxfs takes two steps: writing the pending
> value to /sys/fs/selinux/booleans/<name> and then committing all pending
> values via /sys/fs/selinux/commit_pending_bools.  A policy load in
> between recreates the pending values from the committed ones of the new
> policy, so the subsequent commit silently drops the change, while both
> writes report success.  With concurrent policy loads, setsebool(8)
> therefore occasionally loses updates.
> 
> Carry over the pending values of the booleans present in both the old
> and the new policy.  For booleans without a pending change this is a
> no-op, since security_preserve_bools() already transfers the committed
> values to the new policy.  Both the pending values and the policy load
> are serialized by the policy mutex.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109153802.76176-5-cgoettsche@seltendoof.de?part=4