[PATCH][SELINUX] Change context_to_sid handling for no-policy case

From: Stephen Smalley
Date: Tue Apr 20 2004 - 10:13:17 EST

This patch against 2.6.6-rc1-mm1 changes the behavior of
security_context_to_sid in the no-policy case so that it simply accepts
all contexts and maps them to the kernel SID rather than rejecting
anything other than an initial SID. The change avoids error conditions
when using SELinux in permissive/no-policy mode, so that any file
contexts left on disk from prior use of SELinux with a policy will not
cause an error when they are looked up and userspace attempts to set
contexts can succeed. Please apply.

security/selinux/ss/services.c | 4 +---
1 files changed, 1 insertion(+), 3 deletions(-)

diff -X /home/sds/dontdiff -ru linux-2.6.old/security/selinux/ss/services.c linux-2.6/security/selinux/ss/services.c
--- linux-2.6.old/security/selinux/ss/services.c 2004-04-20 09:37:45.000000000 -0400
+++ linux-2.6/security/selinux/ss/services.c 2004-04-20 09:53:02.834624857 -0400
@@ -456,9 +456,7 @@
goto out;
- printk(KERN_ERR "security_context_to_sid: called before "
- "initial load_policy on unknown context %s\n", scontext);
- rc = -EINVAL;
goto out;

Stephen Smalley <sds@xxxxxxxxxxxxxx>
National Security Agency

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/