selinux prevents msgrcv on restore message queues?
Serge E. Hallyn
serue at us.ibm.com
Tue Mar 2 17:19:41 PST 2010
Quoting Serge E. Hallyn (serue at us.ibm.com):
> Quoting Nathan Lynch (ntl at pobox.com):
> > Hi,
> >
> > With ckpt-v19-rc3 the test-mq.sh testcase in cr_tests fails when SELinux
> > is enabled on my test system (64-bit powerpc kernel). The testcase
> > sleeps in do_msgrcv after restart and never wakes up. When SELinux is
> > disabled, the messages are received and the testcase passes.
> >
> > I've established that the messages are being restored during restart --
> > msgctl(IPC_STAT) shows one message in each queue before calling msgrcv.
> > Adding the IPC_NOWAIT flag to the msgrcv calls gets ENOMSG, however.
> >
> > I managed to narrow this down to security_msg_queue_msgrcv ->
> > selinux_msg_queue_msgrcv. avc_has_perm(SECCLASS_MSG, MSG__RECEIVE) gets
> > -EACCESS, so I guess something is going awry in selinux restore hooks?
> >
> > Any ideas?
>
> Hmm, wait. security_msg_msg_alloc() is being called after
> security_msg_msg_restore. That may not be what is causing
> your troubles, but it's certainly not right.
Can you try the following patch?
Also, to actually restore the LSM labels you need to add -k to your
restart flags, but without the -k you should get a sane default
security label.
More information about the Containers
mailing list