On Tue, 2008-03-18 at 10:02 +1100, James Morris wrote: > On Mon, 17 Mar 2008, Eric Paris wrote: > > > > Fixes the problem I was seeing. Applied to for-akpm. > > > > Are you at least now seeing a FILE__IOCTL avc for mdadm? If not why > > would mdadm have that permission for /dev/null? > > kernel: [ 4.779280] type=1400 audit(1205792724.308:4): avc: granted null > for pid=1792 comm="mdadm" name="null" dev=tmpfs ino=189 > scontext=system_u:system_r:mdadm_t:s0 > tcontext=system_u:object_r:null_device_t:s0 tclass=chr_file > > Possibly related. Did that happen before or after the patch was applied? That indicates that we had a requested==0 value passed into the avc, so it should have hit the BUG_ON if it happened after Eric's earlier patch, and my patch should have eliminated the case altogether. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
