summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2013-05-09 02:05:41 +0400
committerJ. Bruce Fields <bfields@redhat.com>2013-05-13 18:11:46 +0400
commit0d422afb892e3f993cf934b76a2c2ef839c446e0 (patch)
tree3452717e0d811102b87ad71e9039df39cf7ef112
parent4f540e29dc20b87d460559bce184d2238237f48b (diff)
downloadlinux-0d422afb892e3f993cf934b76a2c2ef839c446e0.tar.xz
security: cap_inode_getsecctx returning garbage
We shouldn't be returning success from this function without also filling in the return values ctx and ctxlen. Note currently this doesn't appear to cause bugs since the only inode_getsecctx caller I can find is fs/sysfs/inode.c, which only calls this if security_inode_setsecurity succeeds. Assuming security_inode_setsecurity is set to cap_inode_setsecurity whenever inode_getsecctx is set to cap_inode_getsecctx, this function can never actually called. So I noticed this only because the server labeled NFS patches add a real caller. Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
-rw-r--r--security/capability.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/capability.c b/security/capability.c
index 1728d4e375db..83efc90b344d 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -843,7 +843,7 @@ static int cap_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
static int cap_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
{
- return 0;
+ return -EOPNOTSUPP;
}
#ifdef CONFIG_KEYS
static int cap_key_alloc(struct key *key, const struct cred *cred,