Commit 900fde06 authored by Gary Tierney's avatar Gary Tierney Committed by Paul Moore

selinux: default to security isid in sel_make_bools() if no sid is found

Use SECINITSID_SECURITY as the default SID for booleans which don't have
a matching SID returned from security_genfs_sid(), also update the
error message to a warning which matches this.

This prevents the policy failing to load (and consequently the system
failing to boot) when there is no default genfscon statement matched for
the selinuxfs in the new policy.
Signed-off-by: default avatarGary Tierney <gary.tierney@gmx.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 4262fb51
...@@ -1311,9 +1311,9 @@ static int sel_make_bools(void) ...@@ -1311,9 +1311,9 @@ static int sel_make_bools(void)
isec = (struct inode_security_struct *)inode->i_security; isec = (struct inode_security_struct *)inode->i_security;
ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid); ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
if (ret) { if (ret) {
pr_err("SELinux: failed to lookup sid for %s\n", page); pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n",
goto out; page);
sid = SECINITSID_SECURITY;
} }
isec->sid = sid; isec->sid = sid;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment