openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

scripts/selinux/mdp: fix initial SID handling 

commit e3e0b582c3 ("selinux: remove unused initial SIDs and improve
handling") broke scripts/selinux/mdp since the unused initial SID names
were removed and the corresponding generation of policy initial SID
definitions by mdp was not updated accordingly.  Fix it.  With latest
upstream checkpolicy it is no longer necessary to include the SID context
definitions for the unused initial SIDs but retain them for compatibility
with older checkpolicy.

Fixes: e3e0b582c3 ("selinux: remove unused initial SIDs and improve handling")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Stephen Smalley 2020-06-17 15:22:16 -04:00 committed by Paul Moore
parent c8e222616c
commit 382c2b5d23
1 changed files with 18 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
scripts/selinux/mdp/mdp.c
View File

@ -67,8 +67,14 @@ int main(int argc, char *argv[])
initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
/* print out the sids */
for (i = 1; i < initial_sid_to_string_len; i++)
fprintf(fout, "sid %s\n", initial_sid_to_string[i]);
for (i = 1; i < initial_sid_to_string_len; i++) {
const char *name = initial_sid_to_string[i];
if (name)
fprintf(fout, "sid %s\n", name);
else
fprintf(fout, "sid unused%d\n", i);
}
fprintf(fout, "\n");
/* print out the class permissions */
@ -126,9 +132,16 @@ int main(int argc, char *argv[])
#define OBJUSERROLETYPE "user_u:object_r:base_t"
/* default sids */
for (i = 1; i < initial_sid_to_string_len; i++)
fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n",
initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");
for (i = 1; i < initial_sid_to_string_len; i++) {
const char *name = initial_sid_to_string[i];
if (name)
fprintf(fout, "sid %s ", name);
else
fprintf(fout, "sid unused%d\n", i);
fprintf(fout, SUBJUSERROLETYPE "%s\n",
mls ? ":" SYSTEMLOW : "");
}
fprintf(fout, "\n");
#define FS_USE(behavior, fstype) \