> It's an invalid context, I don't think there is anything you *can* do
> except fatally error. Consider what would happen if there was a proper
> MLS context with multiple levels on an MCS policy...

Well, in that case, patch attached. Also fixes printing of mls_range in 
the error case for seuser_validate.
Applies on top of the previous one.

That leaves the semanage tool to audit and fix for non-MLS issues.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



text/x-patch attachment: libsemanage.sepol.mls_fix2.diff