From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Smalley To: selinux@tycho.nsa.gov Cc: nnk@google.com, Stephen Smalley Subject: [PATCH] libsepol: fix checkpolicy dontaudit compiler bug Date: Mon, 14 Nov 2016 10:59:05 -0500 Message-Id: <1479139145-32596-1-git-send-email-sds@tycho.nsa.gov> List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: The combining logic for dontaudit rules was wrong, causing a dontaudit A B:C *; rule to be clobbered by a dontaudit A B:C p; rule. Reported-by: Nick Kralevich Signed-off-by: Stephen Smalley --- libsepol/src/expand.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c index 004a029..cdfb792 100644 --- a/libsepol/src/expand.c +++ b/libsepol/src/expand.c @@ -1850,10 +1850,7 @@ static int expand_avrule_helper(sepol_handle_t * handle, */ avdatump->data &= cur->data; } else if (specified & AVRULE_DONTAUDIT) { - if (avdatump->data) - avdatump->data &= ~cur->data; - else - avdatump->data = ~cur->data; + avdatump->data &= ~cur->data; } else if (specified & AVRULE_XPERMS) { xperms = avdatump->xperms; if (!xperms) { -- 2.7.4