RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libselinux: Mapped compute functions now obey deny_unknown flag 

If selinux_set_mapping(3) is used to map classes, and an invalid class is used
to compute a decision (tclass = 0), the result did not obey the status of the
deny_unknown flag.

Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
This commit is contained in:
Richard Haines 2011-11-27 16:06:57 +00:00 committed by Eric Paris
parent 98234cf543
commit d0a8d81882
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libselinux/src/compute_av.c
View File

@ -60,6 +60,8 @@ int security_compute_av_flags_raw(const security_context_t scon,
} else if (ret < 6) } else if (ret < 6)
avd->flags = 0; avd->flags = 0;
/* If tclass invalid, kernel sets avd according to deny_unknown flag */
if (tclass != 0)
map_decision(tclass, avd); map_decision(tclass, avd);
ret = 0; ret = 0;