The patch titled selinux: change handling of invalid classes has been removed from the -mm tree. Its filename was selinux-change-handling-of-invalid-classes.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: selinux: change handling of invalid classes From: Stephen Smalley <sds@xxxxxxxxxxxxx> On Mon, 2008-06-09 at 01:24 -0700, Andrew Morton wrote: > Getting a few of these with FC5: > > SELinux: context_struct_compute_av: unrecognized class 69 > SELinux: context_struct_compute_av: unrecognized class 69 > > one came out when I logged in. > > No other symptoms, yet. Change handling of invalid classes by SELinux, reporting class values unknown to the kernel as errors (w/ ratelimit applied) and handling class values unknown to policy as normal denials. Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx> Acked-by: Eric Paris <eparis@xxxxxxxxxx> Cc: James Morris <jmorris@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- security/selinux/ss/services.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff -puN security/selinux/ss/services.c~selinux-change-handling-of-invalid-classes security/selinux/ss/services.c --- a/security/selinux/ss/services.c~selinux-change-handling-of-invalid-classes +++ a/security/selinux/ss/services.c @@ -415,9 +415,19 @@ static int context_struct_compute_av(str return 0; inval_class: - printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", __func__, - tclass); - return -EINVAL; + if (!tclass || tclass > kdefs->cts_len || + !kdefs->class_to_string[tclass]) { + if (printk_ratelimit()) + printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", + __func__, tclass); + return -EINVAL; + } + + /* + * Known to the kernel, but not to the policy. + * Handle as a denial (allowed is 0). + */ + return 0; } /* _ Patches currently in -mm which might be from sds@xxxxxxxxxxxxx are origin.patch capabilities-add-back-dummy-support-for-keepcaps.patch linux-next.patch git-unionfs.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html