Commit 382c2b5d authored by Stephen Smalley's avatar Stephen Smalley Committed by Paul Moore

scripts/selinux/mdp: fix initial SID handling

commit e3e0b582 ("selinux: remove unused initial SIDs and improve
handling") broke scripts/selinux/mdp since the unused initial SID names
were removed and the corresponding generation of policy initial SID
definitions by mdp was not updated accordingly.  Fix it.  With latest
upstream checkpolicy it is no longer necessary to include the SID context
definitions for the unused initial SIDs but retain them for compatibility
with older checkpolicy.

Fixes: e3e0b582 ("selinux: remove unused initial SIDs and improve handling")
Signed-off-by: default avatarStephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent c8e22261
...@@ -67,8 +67,14 @@ int main(int argc, char *argv[]) ...@@ -67,8 +67,14 @@ int main(int argc, char *argv[])
initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *); initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
/* print out the sids */ /* print out the sids */
for (i = 1; i < initial_sid_to_string_len; i++) for (i = 1; i < initial_sid_to_string_len; i++) {
fprintf(fout, "sid %s\n", initial_sid_to_string[i]); const char *name = initial_sid_to_string[i];
if (name)
fprintf(fout, "sid %s\n", name);
else
fprintf(fout, "sid unused%d\n", i);
}
fprintf(fout, "\n"); fprintf(fout, "\n");
/* print out the class permissions */ /* print out the class permissions */
...@@ -126,9 +132,16 @@ int main(int argc, char *argv[]) ...@@ -126,9 +132,16 @@ int main(int argc, char *argv[])
#define OBJUSERROLETYPE "user_u:object_r:base_t" #define OBJUSERROLETYPE "user_u:object_r:base_t"
/* default sids */ /* default sids */
for (i = 1; i < initial_sid_to_string_len; i++) for (i = 1; i < initial_sid_to_string_len; i++) {
fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n", const char *name = initial_sid_to_string[i];
initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");
if (name)
fprintf(fout, "sid %s ", name);
else
fprintf(fout, "sid unused%d\n", i);
fprintf(fout, SUBJUSERROLETYPE "%s\n",
mls ? ":" SYSTEMLOW : "");
}
fprintf(fout, "\n"); fprintf(fout, "\n");
#define FS_USE(behavior, fstype) \ #define FS_USE(behavior, fstype) \
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment