selinux prevents msgrcv on restore message queues?

[Nathan Lynch]

On Tue, 2010-03-02 at 19:19 -0600, Serge E. Hallyn wrote:
> Quoting Serge E. Hallyn (serue at us.ibm.com):
> > Quoting Nathan Lynch (ntl at pobox.com):
> > > Hi,
> > > 
> > > With ckpt-v19-rc3 the test-mq.sh testcase in cr_tests fails when SELinux
> > > is enabled on my test system (64-bit powerpc kernel).  The testcase
> > > sleeps in do_msgrcv after restart and never wakes up.  When SELinux is
> > > disabled, the messages are received and the testcase passes.
> > > 
> > > I've established that the messages are being restored during restart --
> > > msgctl(IPC_STAT) shows one message in each queue before calling msgrcv.
> > > Adding the IPC_NOWAIT flag to the msgrcv calls gets ENOMSG, however.
> > > 
> > > I managed to narrow this down to security_msg_queue_msgrcv ->
> > > selinux_msg_queue_msgrcv.  avc_has_perm(SECCLASS_MSG, MSG__RECEIVE) gets
> > > -EACCESS, so I guess something is going awry in selinux restore hooks?
> > > 
> > > Any ideas?
> > 
> > Hmm, wait.  security_msg_msg_alloc() is being called after
> > security_msg_msg_restore.  That may not be what is causing
> > your troubles, but it's certainly not right.
> 
> Can you try the following patch?
> 
> Also, to actually restore the LSM labels you need to add -k to your
> restart flags, but without the -k you should get a sane default
> security label.

Thanks, the ipc/mq tests pass with this patch and restart -k.  Without
-k the tests still fail in the same manner (msgrcv fails).  Is that the
behavior you'd expect?