On Tuesday 19 May 2009 05:53:52 pm Eric Paris wrote: > Sometimes I'm an idiot, messed up TWO e-mail addresses.... stable > and selinux, so I'm hitting both of those lists with this reply... ... and I fell for it too when ack'ing the patch. I may write buggy code but at least I submit it to the write addresses ;) Anyway, looks good to me. Acked-by: Paul Moore <paul.moore@xxxxxx> > On Tue, May 19, 2009 at 5:41 PM, Eric Paris <eparis@xxxxxxxxxx> wrote: > > This patch is not applicable to Linus's tree as the code in question has > > been removed for 2.6.30. I'm sending in case any of the stable > > maintainers would like to push to their branches (which I think anything > > pre 2.6.30 would like to do). > > > > Ubuntu users were experiencing a kernel panic when they enabled SELinux > > due to an old bug in our handling of the compatibility mode network > > controls, introduced Jan 1 2008 effad8df44261031a882e1a895415f7186a5098e > > Most distros have not used the compat_net code since the new code was > > introduced and so noone has hit this problem before. Ubuntu is the only > > distro I know that enabled that legacy cruft by default. But, I was ask > > to look at it and found that the above patch changed a call to > > avc_has_perm from if(send_perm) to if(!send_perm) in > > selinux_ip_postroute_iptables_compat(). The result is that users who > > turn on SELinux and have compat_net set can (and oftern will) BUG() in > > avc_has_perm_noaudit since they are requesting 0 permissions. > > > > This patch corrects that accidental bug introduction. > > > > Signed-off-by: Eric Paris <eparis@xxxxxxxxxx> > > > > --- > > > > security/selinux/hooks.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff -up linux-source-2.6.28/security/selinux/hooks.c.pre.send > > linux-source-2.6.28/security/selinux/hooks.c --- > > linux-source-2.6.28/security/selinux/hooks.c.pre.send 2009-05-18 > > 13:23:16.043632602 -0400 +++ linux-source-2.6.28/security/selinux/hooks.c > > 2009-05-18 13:23:27.899632772 -0400 @@ -4561,7 +4561,7 @@ static > > int selinux_ip_postroute_iptables > > if (err) > > return err; > > > > - if (send_perm != 0) > > + if (!send_perm) > > return 0; > > > > err = sel_netport_sid(sk->sk_protocol, > > > > > > -- > > To unsubscribe from this list: send the line "unsubscribe linux-kernel" > > in the body of a message to majordomo@xxxxxxxxxxxxxxx > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > Please read the FAQ at http://www.tux.org/lkml/ -- paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
