-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch looks good to me. acked. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk45tB4ACgkQrlYvE4MpobNbVwCgpzlYBRsKdMJ2+MTRcR/JTEt4 VmIAoJjd8nTHf9WyoIJDrs61wl5XaWkM =MfbT -----END PGP SIGNATURE-----
>From 576af10294e14d03660708d3f7eddf49e71897d7 Mon Sep 17 00:00:00 2001
From: Eric Paris <eparis@xxxxxxxxxx>
Date: Tue, 28 Jun 2011 21:37:38 -0400
Subject: [PATCH 006/155] libselinux: do not check fcontext duplicates on use
Tools like restorecon or systemd, which load the fcontext database to
make labeling decisions do not need to check for duplicate rules. Only
the first rule will be used. Instead we should only check for
duplicates when new rules are added to the database. And fail the
transaction if we find one.
Signed-off-by: Eric Paris <eparis@xxxxxxxxxx>
---
libselinux/src/label_file.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index af7fd8f..3b8346d 100644
--- a/libselinux/src/label_file.c
+++ b/libselinux/src/label_file.c
@@ -485,7 +485,7 @@ static int init(struct selabel_handle *rec, struct selinux_opt *opts,
pass, ++lineno) != 0)
goto finish;
}
- if (pass == 1) {
+ if (pass == 1 && rec->validating) {
status = nodups_specs(data, path);
if (status)
goto finish;
--
1.7.6
Attachment:
0006-libselinux-do-not-check-fcontext-duplicates-on-use.patch.sig
Description: PGP signature
