Commit 39c9aede authored by Eric Paris's avatar Eric Paris Committed by James Morris

SELinux: Use unknown perm handling to handle unknown netlink msg types

Currently when SELinux has not been updated to handle a netlink message
type the operation is denied with EINVAL.  This patch will leave the
audit/warning message so things get fixed but if policy chose to allow
unknowns this will allow the netlink operation.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 1f29fae2
...@@ -4395,7 +4395,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) ...@@ -4395,7 +4395,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
"SELinux: unrecognized netlink message" "SELinux: unrecognized netlink message"
" type=%hu for sclass=%hu\n", " type=%hu for sclass=%hu\n",
nlh->nlmsg_type, isec->sclass); nlh->nlmsg_type, isec->sclass);
if (!selinux_enforcing) if (!selinux_enforcing || security_get_allow_unknown())
err = 0; err = 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment