On 2/11/20 5:14 AM, Petr Lautrbach wrote:
get_ordered_context_list() code used to ask the kernel to compute the complete set of reachable contexts using /sys/fs/selinux/user aka security_compute_user(). This set can be so huge so that it doesn't fit into a kernel page and security_compute_user() fails. Even if it doesn't fail, get_ordered_context_list() throws away the vast majority of the returned contexts because they don't match anything in /etc/selinux/targeted/contexts/default_contexts or /etc/selinux/targeted/contexts/users/ get_ordered_context_list() is rewritten to compute set of contexts based on /etc/selinux/targeted/contexts/users/ and /etc/selinux/targeted/contexts/default_contexts files and to return only valid contexts, using security_check_context(), from this set. Fixes: https://github.com/SELinuxProject/selinux/issues/28 Signed-off-by: Petr Lautrbach <plautrba@xxxxxxxxxx>
This looks fine to me; I'll wait to see if Ondrej has any further comments, but you can add my:
Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx> Then maybe in a decade we can actually remove /sys/fs/selinux/user...
