From 2ef297d4c80b7e55d9a33e20b44c540ffc6ad351 Mon Sep 17 00:00:00 2001 From: Harry Ciao Date: Sat, 25 Feb 2012 09:40:08 +0800 Subject: [PATCH] libsepol: role_fix_callback skips out-of-scope roles during expansion. If a role identifier is out of scope it would be skipped over during expansion, accordingly, be it a role attribute, it should be skipped over as well when role_fix_callback tries to propagate its capability to all its sub-roles. Signed-off-by: Harry Ciao Signed-off-by: Eric Paris --- libsepol/src/expand.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c index 358c25c4..2003eb64 100644 --- a/libsepol/src/expand.c +++ b/libsepol/src/expand.c @@ -723,6 +723,11 @@ static int role_fix_callback(hashtab_key_t key, hashtab_datum_t datum, return 0; } + if (!is_id_enabled(id, state->base, SYM_ROLES)) { + /* identifier's scope is not enabled */ + return 0; + } + if (role->flavor != ROLE_ATTRIB) return 0;