Commit 57994189 authored by Luca Boccassi's avatar Luca Boccassi Committed by Fan Wu
Browse files

ipe: return -ESTALE instead of -EINVAL on update when new policy has a lower version 



When loading policies in userspace we want a recognizable error when an
update attempts to use an old policy, as that is an error that needs
to be treated differently from an invalid policy. Use -ESTALE as it is
clear enough for an update mechanism.

Signed-off-by: default avatarLuca Boccassi <bluca@debian.org>
Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
Signed-off-by: default avatarFan Wu <wufan@kernel.org>
parent 8e929cb5

security/ipe/policy.c

+1 −1
Original line number Diff line number Diff line
@@ -107,7 +107,7 @@ int ipe_update_policy(struct inode *root, const char *text, size_t textlen, 
	}



	if (ver_to_u64(old) > ver_to_u64(new)) {

		rc = -EINVAL;

		rc = -ESTALE;

		goto err;

	}