tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libselinux: Mapped compute functions now obey deny_unknown flag

Browse source 
If selinux_set_mapping(3) is used to map classes, and an invalid class is used
to compute a decision (tclass = 0), the result did not obey the status of the
deny_unknown flag.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Richard Haines 2011-11-27 16:06:57 +00:00 committed by Eric Paris
parent 98234cf543
commit d0a8d81882
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
libselinux/src/compute_av.c
View file

@ -60,7 +60,9 @@ int security_compute_av_flags_raw(const security_context_t scon,
} else if (ret < 6)
avd->flags = 0;
map_decision(tclass, avd);
/* If tclass invalid, kernel sets avd according to deny_unknown flag */
if (tclass != 0)
map_decision(tclass, avd);
ret = 0;
out2: