[prev in list] [next in list] [prev in thread] [next in thread] 

List:       selinux
Subject:    [PATCH][SELINUX] Change context_to_sid handling for no-policy case
From:       Stephen Smalley <sds () epoch ! ncsc ! mil>
Date:       2004-04-20 15:11:17
Message-ID: 1082473877.7481.37.camel () moss-spartans ! epoch ! ncsc ! mil
[Download RAW message or body]

This patch against 2.6.6-rc1-mm1 changes the behavior of
security_context_to_sid in the no-policy case so that it simply accepts
all contexts and maps them to the kernel SID rather than rejecting
anything other than an initial SID.  The change avoids error conditions
when using SELinux in permissive/no-policy mode, so that any file
contexts left on disk from prior use of SELinux with a policy will not
cause an error when they are looked up and userspace attempts to set
contexts can succeed.  Please apply.

 security/selinux/ss/services.c |    4 +---
 1 files changed, 1 insertion(+), 3 deletions(-)

diff -X /home/sds/dontdiff -ru linux-2.6.old/security/selinux/ss/services.c \
                linux-2.6/security/selinux/ss/services.c
--- linux-2.6.old/security/selinux/ss/services.c	2004-04-20 09:37:45.000000000 -0400
+++ linux-2.6/security/selinux/ss/services.c	2004-04-20 09:53:02.834624857 -0400
@@ -456,9 +456,7 @@
 				goto out;
 			}
 		}
-		printk(KERN_ERR "security_context_to_sid: called before "
-		       "initial load_policy on unknown context %s\n", scontext);
-		rc = -EINVAL;
+		*sid = SECINITSID_KERNEL;
 		goto out;
 	}
 	*sid = SECSID_NULL;


-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.


[prev in list] [next in list] [prev in thread] [next in thread]