kevin/linux
1
Fork 0
Code

ipe: return -ESTALE instead of -EINVAL on update when new policy has a lower version

Browse Source 
When loading policies in userspace we want a recognizable error when an
update attempts to use an old policy, as that is an error that needs
to be treated differently from an invalid policy. Use -ESTALE as it is
clear enough for an update mechanism.

Signed-off-by: Luca Boccassi <bluca@debian.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Fan Wu <wufan@kernel.org>
This commit is contained in:
Luca Boccassi 2024-09-25 23:01:33 +02:00 committed by Fan Wu
parent 8e929cb546
commit 579941899d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/ipe/policy.c
View File

@ -107,7 +107,7 @@ int ipe_update_policy(struct inode *root, const char *text, size_t textlen,
}
if (ver_to_u64(old) > ver_to_u64(new)) {
rc = -EINVAL;
rc = -ESTALE;
goto err;
}