From 7424ccaae832d3f3c5846ed57283667ed22bb5af Mon Sep 17 00:00:00 2001
From: Andrey Vagin <avagin@openvz.org>
Date: Mon, 18 May 2015 21:50:39 +0300
Subject: [PATCH] lsm: get host lsm type from the host mntns

We check files in /sys, so we must do this from host mount namespaces.

The write_img_inventory() is called after kerndat_init() and it's only
called on dump. The bug is triggered on restore, because the mount
namespace of the restored process doesn't have
/sys/kernel/security/apparmor/

I think it's better to initialize the host lsm in a one place for dump
and restore.

Currently we initialize the host lsm when we try to use it at a first
time. It works fine for the dump operation. On restore it doesn't work
because criu checks files in a restored mount namespace and it does this
for each process, what isn't optimal.

Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
---
 include/lsm.h |  5 +++++
 kerndat.c     |  5 +++++
 lsm.c         | 11 +----------
 3 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/include/lsm.h b/include/lsm.h
index d3b0c973c..05737ffbd 100644
--- a/include/lsm.h
+++ b/include/lsm.h
@@ -9,6 +9,11 @@
  */
 extern Lsmtype host_lsm_type();
 
+/*
+ * Initilize the Lsmtype for the current host
+ */
+extern void kerndat_lsm();
+
 /*
  * Read the LSM profile for the pstree item
  */
diff --git a/kerndat.c b/kerndat.c
index 65e2c7539..54ba8c744 100644
--- a/kerndat.c
+++ b/kerndat.c
@@ -18,6 +18,7 @@
 #include "asm/types.h"
 #include "cr_options.h"
 #include "util.h"
+#include "lsm.h"
 
 struct kerndat_s kdat = {
 	.tcp_max_rshare = 3U << 20,
@@ -323,6 +324,8 @@ int kerndat_init(void)
 	if (!ret)
 		ret = kerndat_fdinfo_has_lock();
 
+	kerndat_lsm();
+
 	return ret;
 }
 
@@ -342,5 +345,7 @@ int kerndat_init_rst(void)
 	if (!ret)
 		ret = kerndat_has_memfd_create();
 
+	kerndat_lsm();
+
 	return ret;
 }
diff --git a/lsm.c b/lsm.c
index 90b395f5d..5acaa4244 100644
--- a/lsm.c
+++ b/lsm.c
@@ -102,7 +102,7 @@ static int selinux_get_label(pid_t pid, char **output)
 }
 #endif
 
-static void get_host_lsm()
+void kerndat_lsm()
 {
 	if (access("/sys/kernel/security/apparmor", F_OK) == 0) {
 		get_label = apparmor_get_label;
@@ -132,17 +132,11 @@ static void get_host_lsm()
 
 Lsmtype host_lsm_type()
 {
-	if (name == NULL)
-		get_host_lsm();
-
 	return lsmtype;
 }
 
 int collect_lsm_profile(pid_t pid, CredsEntry *ce)
 {
-	if (name == NULL)
-		get_host_lsm();
-
 	ce->lsm_profile = NULL;
 
 	if (lsmtype == LSMTYPE__NO_LSM)
@@ -162,9 +156,6 @@ extern Lsmtype image_lsm;
 
 int validate_lsm(CredsEntry *ce)
 {
-	if (name == NULL)
-		get_host_lsm();
-
 	if (image_lsm == LSMTYPE__NO_LSM || image_lsm == lsmtype)
 		return 0;