path: root/xlators/cluster/ec/src/ec.c
diff options
authorXavier Hernandez <>2017-01-13 13:54:35 +0100
committerJeff Darcy <>2017-02-02 07:02:28 -0500
commitdb80efc8d5cc24597de636d8df2e5a9ce81d670d (patch)
tree1ee68e485a8d9dc70028a7e1afc19907d75df723 /xlators/cluster/ec/src/ec.c
parent85d7f1d1ee24ac400d4aa223478727643532693a (diff)
cluster/ec: fix selinux issues with mmap()
EC uses mmap() to create a memory area for the dynamic code. Since the code is created on the fly and executed when needed, this region of memory needs to have write and execution privileges. This combination is not allowed by default by selinux. To solve the problem a file is used as a backend storage for the dynamic code and it's mapped into two distinct memory regions, one with write access and the other one with execution access. This approach is the recommended way to create dynamic code by a program in a more secure way, and selinux allows it. Additionally selinux requires that the backend file be stored in a directory marked with type bin_t to be able to map it in an executable area. To satisfy this condition, GLUSTERFS_LIBEXECDIR has been used. This fix also changes the error check for mmap(), that was done incorrectly (it checked against NULL instead of MAP_FAILED), and it also correctly propagates the error codes and makes sure they aren't silently ignored. Change-Id: I71c2f88be4e4d795b6cfff96ab3799c362c54291 BUG: 1402661 Signed-off-by: Xavier Hernandez <> Reviewed-on: Smoke: Gluster Build System <> NetBSD-regression: NetBSD Build System <> CentOS-regression: Gluster Build System <> Reviewed-by: Jeff Darcy <>
Diffstat (limited to 'xlators/cluster/ec/src/ec.c')
1 files changed, 8 insertions, 4 deletions
diff --git a/xlators/cluster/ec/src/ec.c b/xlators/cluster/ec/src/ec.c
index 7b16f8fd255..e467fea28b8 100644
--- a/xlators/cluster/ec/src/ec.c
+++ b/xlators/cluster/ec/src/ec.c
@@ -266,6 +266,7 @@ reconfigure (xlator_t *this, dict_t *options)
uint32_t heal_wait_qlen = 0;
uint32_t background_heals = 0;
int32_t ret = -1;
+ int32_t err;
GF_OPTION_RECONF ("cpu-extensions", extensions, options, str, failed);
@@ -295,7 +296,8 @@ reconfigure (xlator_t *this, dict_t *options)
ret = -1;
- if (!ec_method_update(this, &ec->matrix, extensions)) {
+ err = ec_method_update(this, &ec->matrix, extensions);
+ if (err != 0) {
ret = -1;
@@ -588,6 +590,7 @@ init (xlator_t *this)
ec_t *ec = NULL;
char *read_policy = NULL;
char *extensions = NULL;
+ int32_t err;
if (this->parents == NULL)
@@ -644,9 +647,10 @@ init (xlator_t *this)
GF_OPTION_INIT("cpu-extensions", extensions, str, failed);
- if (!ec_method_init(this, &ec->matrix, ec->fragments, ec->nodes,
- ec->nodes * 2, extensions)) {
- gf_msg (this->name, GF_LOG_ERROR, 0, EC_MSG_MATRIX_FAILED,
+ err = ec_method_init(this, &ec->matrix, ec->fragments, ec->nodes,
+ ec->nodes * 2, extensions);
+ if (err != 0) {
+ gf_msg (this->name, GF_LOG_ERROR, -err, EC_MSG_MATRIX_FAILED,
"Failed to initialize matrix management");
goto failed;