* [PATCH] libsepol: fix checkpolicy dontaudit compiler bug
@ 2016-11-14 15:59 Stephen Smalley
2016-11-14 16:07 ` Stephen Smalley
0 siblings, 1 reply; 2+ messages in thread
From: Stephen Smalley @ 2016-11-14 15:59 UTC (permalink / raw)
To: selinux; +Cc: nnk, Stephen Smalley
The combining logic for dontaudit rules was wrong, causing
a dontaudit A B:C *; rule to be clobbered by a dontaudit A B:C p;
rule.
Reported-by: Nick Kralevich <nnk@google.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
libsepol/src/expand.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 004a029..cdfb792 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -1850,10 +1850,7 @@ static int expand_avrule_helper(sepol_handle_t * handle,
*/
avdatump->data &= cur->data;
} else if (specified & AVRULE_DONTAUDIT) {
- if (avdatump->data)
- avdatump->data &= ~cur->data;
- else
- avdatump->data = ~cur->data;
+ avdatump->data &= ~cur->data;
} else if (specified & AVRULE_XPERMS) {
xperms = avdatump->xperms;
if (!xperms) {
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] libsepol: fix checkpolicy dontaudit compiler bug
2016-11-14 15:59 [PATCH] libsepol: fix checkpolicy dontaudit compiler bug Stephen Smalley
@ 2016-11-14 16:07 ` Stephen Smalley
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Smalley @ 2016-11-14 16:07 UTC (permalink / raw)
To: selinux
On 11/14/2016 10:59 AM, Stephen Smalley wrote:
> The combining logic for dontaudit rules was wrong, causing
> a dontaudit A B:C *; rule to be clobbered by a dontaudit A B:C p;
> rule.
>
> Reported-by: Nick Kralevich <nnk@google.com>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Sorry, that's not correct either. NAKing my own patch.
> ---
> libsepol/src/expand.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
> index 004a029..cdfb792 100644
> --- a/libsepol/src/expand.c
> +++ b/libsepol/src/expand.c
> @@ -1850,10 +1850,7 @@ static int expand_avrule_helper(sepol_handle_t * handle,
> */
> avdatump->data &= cur->data;
> } else if (specified & AVRULE_DONTAUDIT) {
> - if (avdatump->data)
> - avdatump->data &= ~cur->data;
> - else
> - avdatump->data = ~cur->data;
> + avdatump->data &= ~cur->data;
> } else if (specified & AVRULE_XPERMS) {
> xperms = avdatump->xperms;
> if (!xperms) {
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-11-14 16:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-14 15:59 [PATCH] libsepol: fix checkpolicy dontaudit compiler bug Stephen Smalley
2016-11-14 16:07 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.