On Thursday 17 December 2009 02:59:29 am James Morris wrote: > On Wed, 16 Dec 2009, Paul Moore wrote: > > It is possible security_compute_av() to return -EINVAL, even when in > > permissive mode, due to unknown object classes and SIDs. This patch > > fixes this by doing away with the return value for security_compute_av() > > and treating unknown classes and SIDs as permission denials. > > > > NOTE: I've only tested this on Fedora/Rawhide using the standard policy, > > so while I'm fairly confident there are no regressions in the common case > > the error case hasn't been fully tested yet; I'm posting this to solicit > > comments on the basic approach. > > Looks ok to me. Me too. I tested today with a hacked Fedora/Rawhide policy that didn't have the tun_socket class; it worked as expected both when set to allow and deny unknown classes. As far as I'm concerned you can feel free to merge this patch when appropriate. Andrew, I'll make sure this applies cleanly to 2.6.32 tomorrow, if not I'll send you a backported patch. -- paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
