From: Stephen Smalley Date: Mon, 9 Jun 2008 20:03:56 +0000 (-0400) Subject: selinux: change handling of invalid classes (Was: Re: 2.6.26-rc5-mm1 selinux whine) X-Git-Tag: v2.6.27-rc1~1109^2~10 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=22df4adb049a5cbb340dd935f5bbfa1ab3947562;p=linux-2.6 selinux: change handling of invalid classes (Was: Re: 2.6.26-rc5-mm1 selinux whine) On Mon, 2008-06-09 at 01:24 -0700, Andrew Morton wrote: > Getting a few of these with FC5: > > SELinux: context_struct_compute_av: unrecognized class 69 > SELinux: context_struct_compute_av: unrecognized class 69 > > one came out when I logged in. > > No other symptoms, yet. Change handling of invalid classes by SELinux, reporting class values unknown to the kernel as errors (w/ ratelimit applied) and handling class values unknown to policy as normal denials. Signed-off-by: Stephen Smalley Acked-by: Eric Paris Signed-off-by: James Morris --- diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 543fd0f31b..04c0b70c80 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -407,9 +407,19 @@ static int context_struct_compute_av(struct context *scontext, return 0; inval_class: - printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", __func__, - tclass); - return -EINVAL; + if (!tclass || tclass > kdefs->cts_len || + !kdefs->class_to_string[tclass]) { + if (printk_ratelimit()) + printk(KERN_ERR "SELinux: %s: unrecognized class %d\n", + __func__, tclass); + return -EINVAL; + } + + /* + * Known to the kernel, but not to the policy. + * Handle as a denial (allowed is 0). + */ + return 0; } /*