[0/2] Fix ENOMEM errors during policy reload

Message

Ondrej Mosnacek Oct. 31, 2018, 12:27 p.m. UTC

This patchset revamps the SID table implementation to fix ENOMEM errors returned from sidtab_context_to_sid() during policy reload.

The first patch prepares the way for the second one by moving the handling of initial SIDs to a separate table. This is needed since the second patch will do the sidtab conversion in-place and handling the initial SIDs would complicate things too much.

The second patch changes the way that sidtab is transitioned to the new policy so that it does not need to be frozen for modifications during the conversion of entries to the new policy.

See individual patches for more details.

Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/38
Testing:
 - passed selinux-testsuite
 - verified using the reproducer from GH issue
 - tested with the following stress test on SMP (with lock debugging enabled):

function rand_cat() {
	echo $(( $RANDOM % 1024 ))
}

function do_work() {
	while runcon -l s0:c$(rand_cat),c$(rand_cat) echo -n x; do :; done
}

do_work >/dev/null &
do_work >/dev/null &
do_work >/dev/null &

while load_policy; do echo -n .; sleep 0.1; done

kill %1
kill %2
kill %3

--
Ondrej Mosnacek (2):
  selinux: use separate table for initial SID lookup
  selinux: fix ENOMEM errors during policy reload

 security/selinux/include/security.h |   3 +
 security/selinux/ss/mls.c           |  22 +-
 security/selinux/ss/mls.h           |   5 +-
 security/selinux/ss/policydb.c      |  24 ++-
 security/selinux/ss/policydb.h      |  26 ++-
 security/selinux/ss/services.c      | 314 +++++++++++++---------------
 security/selinux/ss/services.h      |   1 +
 security/selinux/ss/sidtab.c        | 141 +++++++------
 security/selinux/ss/sidtab.h        |  26 +--
 9 files changed, 296 insertions(+), 266 deletions(-)