Commit b1aa5301 authored by Stephen Smalley's avatar Stephen Smalley Committed by James Morris

selinux: fix labeling of /proc/net inodes

The proc net rewrite had a side effect on selinux, leading it to mislabel
the /proc/net inodes, thereby leading to incorrect denials.  Fix
security_genfs_sid to ignore extra leading / characters in the path supplied
by selinux_proc_get_sid since we now get "//net/..." rather than "/net/...".
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 99f1c97d
...@@ -1744,6 +1744,9 @@ int security_genfs_sid(const char *fstype, ...@@ -1744,6 +1744,9 @@ int security_genfs_sid(const char *fstype,
struct ocontext *c; struct ocontext *c;
int rc = 0, cmp = 0; int rc = 0, cmp = 0;
while (path[0] == '/' && path[1] == '/')
path++;
POLICY_RDLOCK; POLICY_RDLOCK;
for (genfs = policydb.genfs; genfs; genfs = genfs->next) { for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment