>>> # semanage login -l
>>>
>>> Login Name SELinux User MLS/MCS Range
>>>
>>> root root __default__:user_u
That doesn't look like a valid MLS range. What exactly is in your seusers file?
>
> #2 0x00476143 in sepol_mls_contains (handle=0x8b06b70,
> policydb=0x8b30a78, mls1=0x0, mls2=0x8b2fd98 "s0", response=0xbfdc7068)
This indicates the seuser has an mls range s0, but the user does not. The mls check is conditional on the seuser's mls range, which is why it proceeds. I can add a check that makes sure neither exists, but it shouldn't be necessary - on a non-MLS system the seuser should not have an mls range.

I'm not sure how a situation would occur where the seuser has an mls range on a non-mls system. I guess seuser_print will write out an mls field if it finds one, so maybe that's how this happens...it gets an mls field from the policy package, and fails to ignore it. Need more info.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.