applied to my devel branch. This one messed up the formatting, since you should have indented the map_decision() call after you put it 'inside' the conditional. I fixed it before I applied. -Eric On Sun, Nov 27, 2011 at 11:06 AM, Richard Haines <richard_c_haines@xxxxxxxxxxxxxx> wrote: > If selinux_set_mapping(3) is used to map classes, and an invalid class is used to compute a decision (tclass = 0), the result did not obey the status of the deny_unknown flag. > > Signed-off-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx> > --- > libselinux/src/compute_av.c | 2 ++ > 1 files changed, 2 insertions(+), 0 deletions(-) > > diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c > index 86ff274..ec5a096 100644 > --- a/libselinux/src/compute_av.c > +++ b/libselinux/src/compute_av.c > @@ -60,6 +60,8 @@ int security_compute_av_flags_raw(const security_context_t scon, > } else if (ret < 6) > avd->flags = 0; > > + /* If tclass invalid, kernel sets avd according to deny_unknown flag */ > + if (tclass != 0) > map_decision(tclass, avd); > > ret = 0; > -- > 1.7.7.1 > > > Richard > > > -- > This message was distributed to subscribers of the selinux mailing list. > If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with > the words "unsubscribe selinux" without quotes as the message. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
