forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: make mls_compute_sid always polyinstantiate

Browse source 
This patch removes the requirement that the new and related object types
differ in order to polyinstantiate by MLS level.  This allows MLS
polyinstantiation to occur in the absence of explicit type_member rules or
when the type has not changed.

Potential users of this support include pam_namespace.so (directory
polyinstantiation) and the SELinux X support (property polyinstantiation).

Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Eamon Walsh 2008-01-24 15:30:52 -05:00 • committed by James Morris
parent 1996a10948
commit 2e08c0c1c3
1 changed files with 2 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

11
security/selinux/ss/mls.c
View file

@ -537,15 +537,8 @@ int mls_compute_sid(struct context *scontext,
/* Use the process effective MLS attributes. */ /* Use the process effective MLS attributes. */
return mls_context_cpy_low(newcontext, scontext); return mls_context_cpy_low(newcontext, scontext);
case AVTAB_MEMBER: case AVTAB_MEMBER:
/* Only polyinstantiate the MLS attributes if /* Use the process effective MLS attributes. */
the type is being polyinstantiated */ return mls_context_cpy_low(newcontext, scontext);
if (newcontext->type != tcontext->type) {
/* Use the process effective MLS attributes. */
return mls_context_cpy_low(newcontext, scontext);
} else {
/* Use the related object MLS attributes. */
return mls_context_cpy(newcontext, tcontext);
}
default: default:
return -EINVAL; return -EINVAL;
} }