Re: Process Transition

On Thu, 2004-03-11 at 15:49, Chad Hanson wrote:
> We found a piece of process transition code that should be updated to work
> as expected.
>
> In ss/services.c context_struct_compute_av() the following should be
> changed:
>
> if (tclass == SECCLASS_PROCESS &&
> bug >> avd->allowed && PROCESS__TRANSITION &&
> scontext->role != tcontext->role) {
> for (ra = policydb.role_allow; ra; ra = ra->next) {
> if (scontext->role == ra->role &&
> tcontext->role == ra->new_role)
> break;
> }
> if (!ra)
> avd->allowed = (avd->allowed) &
> ~(PROCESS__TRANSITION);
> }
>
> it should be
>
> if (tclass == SECCLASS_PROCESS &&
> avd->allowed & PROCESS__TRANSITION &&
> scontext->role != tcontext->role) {

Thanks; patch attached. The existing buggy code will still produce the right access computation; it just causes unnecessary processing to occur when the transition permission wasn't granted in the first place by the TE configuration.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



text/x-patch attachment: selinux-fixtrans.patch__charset_UTF-8