On Thu, 2007-02-08 at 15:55 -0700, Eric W. Biederman wrote: > I goofed and when reenabling the fine grained selinux labels for > sysctls and forgot to add the "/sys" prefix before consulting > the policy database. When computing the same path using > proc_dir_entries we got the "/sys" for free as it was part > of the tree, but it isn't true for clt_table trees. > > Signed-off-by: Eric W. Biederman <[EMAIL PROTECTED]>
Acked-by: Stephen Smalley <[EMAIL PROTECTED]> > --- > security/selinux/hooks.c | 6 ++++++ > 1 files changed, 6 insertions(+), 0 deletions(-) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 47fb937..de16b9f 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -1445,6 +1445,12 @@ static int selinux_sysctl_get_sid(ctl_table *table, > u16 tclass, u32 *sid) > path = end; > table = table->parent; > } > + buflen -= 4; > + if (buflen < 0) > + goto out_free; > + end -= 4; > + memcpy(end, "/sys", 4); > + path = end; > rc = security_genfs_sid("proc", path, tclass, sid); > out_free: > free_page((unsigned long)buffer); -- Stephen Smalley National Security Agency - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/