On 08/07/2012 03:17 PM, Serge E. Hallyn wrote:[snip]Quoting Paul Moore (paul@xxxxxxxxxxxxxx):On Tue, Aug 7, 2012 at 5:58 PM, John Stultz <john.stultz@xxxxxxxxxx> wrote:On 08/07/2012 02:50 PM, Paul Moore wrote:On Tue, Aug 7, 2012 at 2:12 PM, John Stultz <john.stultz@xxxxxxxxxx>
wrote:
Hi,
With my kvm environment using 3.6-rc1+, I'm seeing NULL pointer
dereferences in selinux_ip_postroute_compat(). It looks like the sksec
value
is null and we die in the following line:
if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
This triggers every time I shutdown the machine, but has also triggered
randomly after a few hours.
The problem seems to be that selinux_nf_ip_init() was called, whichThis sounds about right:
registers the selinux_ipv4_ops (and ipv6). Those should not get registered
if selinux ends up not being loaded (as in, if apparmor is loaded first),
since as you've found here the selinux lsm hooks won't be called to set
call selinux_sk_alloc_security().
root@testvm:~# dmesg | grep SELinux
[ 0.004578] SELinux: Initializing.
[ 0.005704] SELinux: Starting in permissive mode
[ 2.235034] SELinux: Registering netfilter hooks
I assume what's happening is that CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE wasThis looks right as well:
set to 1, but selinux ended up being set to disabled after the
__initcall(selinux_nf_ip_init) ran? Weird.
# zcat config.gz | grep SELINUX
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
CONFIG_SECURITY_SELINUX_DISABLE=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
# CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
CONFIG_DEFAULT_SECURITY_SELINUX=y
Since the problem isn't completely obvious, I'm starting a bisection to narrow this down some more.