Commit 77782961 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] selinux: change context_to_sid handling for no-policy case

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch changes the behavior of security_context_to_sid in the no-policy
case so that it simply accepts all contexts and maps them to the kernel SID
rather than rejecting anything other than an initial SID.  The change avoids
error conditions when using SELinux in permissive/no-policy mode, so that any
file contexts left on disk from prior use of SELinux with a policy will not
cause an error when they are looked up and userspace attempts to set contexts
can succeed.
parent 014df416
...@@ -456,9 +456,7 @@ int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid) ...@@ -456,9 +456,7 @@ int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid)
goto out; goto out;
} }
} }
printk(KERN_ERR "security_context_to_sid: called before " *sid = SECINITSID_KERNEL;
"initial load_policy on unknown context %s\n", scontext);
rc = -EINVAL;
goto out; goto out;
} }
*sid = SECSID_NULL; *sid = SECSID_NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment