This patch against 2.6.6-rc1-mm1 changes the behavior of
security_context_to_sid in the no-policy case so that it simply accepts
all contexts and maps them to the kernel SID rather than rejecting
anything other than an initial SID. The change avoids error conditions
when using SELinux in permissive/no-policy mode, so that any file
contexts left on disk from prior use of SELinux with a policy will not
cause an error when they are looked up and userspace attempts to set
contexts can succeed. Please apply.
security/selinux/ss/services.c | 4 +---
1 files changed, 1 insertion(+), 3 deletions(-)
diff -X /home/sds/dontdiff -ru linux-2.6.old/security/selinux/ss/services.c linux-2.6/security/selinux/ss/services.c
--- linux-2.6.old/security/selinux/ss/services.c 2004-04-20 09:37:45.000000000 -0400
+++ linux-2.6/security/selinux/ss/services.c 2004-04-20 09:53:02.834624857 -0400
@@ -456,9 +456,7 @@
goto out;
}
}
- printk(KERN_ERR "security_context_to_sid: called before "
- "initial load_policy on unknown context %s\n", scontext);
- rc = -EINVAL;
+ *sid = SECINITSID_KERNEL;
goto out;
}
*sid = SECSID_NULL;
--
Stephen Smalley <[email protected]>
National Security Agency