iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

selinux: default to security isid in sel_make_bools() if no sid is found

Browse Source 
Use SECINITSID_SECURITY as the default SID for booleans which don't have
a matching SID returned from security_genfs_sid(), also update the
error message to a warning which matches this.

This prevents the policy failing to load (and consequently the system
failing to boot) when there is no default genfscon statement matched for
the selinuxfs in the new policy.

Signed-off-by: Gary Tierney <gary.tierney@gmx.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Gary Tierney 2017-01-09 10:07:32 -05:00 committed by Paul Moore
parent 4262fb51c9
commit 900fde06cb
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
security/selinux/selinuxfs.c
View File

@ -1311,9 +1311,9 @@ static int sel_make_bools(void)
isec = (struct inode_security_struct *)inode->i_security; isec = (struct inode_security_struct *)inode->i_security;
ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid); ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
if (ret) { if (ret) {
pr_err("SELinux: failed to lookup sid for %s\n", page); pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n",
goto out; page);
sid = SECINITSID_SECURITY;
} }
isec->sid = sid; isec->sid = sid;