This modifies the mls constraint for polmatch in the association class.

Specifically:

- polmatch need no longer make an exception for unlabeled_t
  since a flow will now always match SPD rules with no contexts (per
  the IPSec leak fix patch upstreamed a few weeks back), as
  opposed to needing polmatch access to unlabeled_t.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>

Changelog

@@ -1,3 +1,5 @@
+- Association polmatch MLS constraint making unlabeled_t an exception
+  is no longer needed, patch from Venkat Yekkirala.
 - Context contains checking for PAM and cron from James Antill.
 - Add a reload target to Modules.devel and change the load
   target to only insert modules that were changed.

policy/mls

@@ -585,8 +585,7 @@ mlsconstrain association { sendto }
 	 ( t2 == unlabeled_t ));
 
 mlsconstrain association { polmatch }
-	((( l1 dom l2 ) and ( h1 domby h2 )) or
+	(( l1 dom l2 ) and ( h1 domby h2 ));
-	 ( t2 == unlabeled_t ));