Mirrors/criu
1
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu.git synced 2026-07-17 16:47:50 +00:00
Code Issues Projects Releases Wiki Activity

lsm: get host lsm type from the host mntns

Browse source 
We check files in /sys, so we must do this from host mount namespaces.

The write_img_inventory() is called after kerndat_init() and it's only
called on dump. The bug is triggered on restore, because the mount
namespace of the restored process doesn't have
/sys/kernel/security/apparmor/

I think it's better to initialize the host lsm in a one place for dump
and restore.

Currently we initialize the host lsm when we try to use it at a first
time. It works fine for the dump operation. On restore it doesn't work
because criu checks files in a restored mount namespace and it does this
for each process, what isn't optimal.

Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This commit is contained in:
Andrey Vagin 2015-05-18 21:50:39 +03:00 • committed by Pavel Emelyanov
parent a6e13e1a44
commit 7424ccaae8
3 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

5
include/lsm.h
View file

@ -9,6 +9,11 @@
*/
extern Lsmtype host_lsm_type();
/*
* Initilize the Lsmtype for the current host
*/
extern void kerndat_lsm();
/*
* Read the LSM profile for the pstree item
*/

5
kerndat.c
View file

@ -18,6 +18,7 @@
#include "asm/types.h"
#include "cr_options.h"
#include "util.h"
#include "lsm.h"
struct kerndat_s kdat = {
.tcp_max_rshare = 3U << 20,
@ -323,6 +324,8 @@ int kerndat_init(void)
if (!ret)
ret = kerndat_fdinfo_has_lock();
kerndat_lsm();
return ret;
}
@ -342,5 +345,7 @@ int kerndat_init_rst(void)
if (!ret)
ret = kerndat_has_memfd_create();
kerndat_lsm();
return ret;
}

11
lsm.c
View file

@ -102,7 +102,7 @@ static int selinux_get_label(pid_t pid, char **output)
}
#endif
static void get_host_lsm()
void kerndat_lsm()
{
if (access("/sys/kernel/security/apparmor", F_OK) == 0) {
get_label = apparmor_get_label;
@ -132,17 +132,11 @@ static void get_host_lsm()
Lsmtype host_lsm_type()
{
if (name == NULL)
get_host_lsm();
return lsmtype;
}
int collect_lsm_profile(pid_t pid, CredsEntry *ce)
{
if (name == NULL)
get_host_lsm();
ce->lsm_profile = NULL;
if (lsmtype == LSMTYPE__NO_LSM)
@ -162,9 +156,6 @@ extern Lsmtype image_lsm;
int validate_lsm(CredsEntry *ce)
{
if (name == NULL)
get_host_lsm();
if (image_lsm == LSMTYPE__NO_LSM || image_lsm == lsmtype)
return 0;