Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30d55280 authored by Stephen Smalley's avatar Stephen Smalley Committed by Linus Torvalds
Browse files

[PATCH] selinux: Clear selinux_enabled flag upon runtime disable. 



Clear selinux_enabled flag upon runtime disable of SELinux by userspace,
and make sure it is defined even if selinux= boot parameter support is
not enabled in configuration.

Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Acked-by: default avatarJames Morris <jmorris@namei.org>
Tested-by: default avatarJon Smirl <jonsmirl@gmail.com>
Acked-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent e17df688

security/selinux/hooks.c

+3 −0
Original line number Diff line number Diff line
@@ -101,6 +101,8 @@ static int __init selinux_enabled_setup(char *str) 
	return 1;

}

__setup("selinux=", selinux_enabled_setup);

#else

int selinux_enabled = 1;

#endif



/* Original (dummy) security module. */
@@ -4535,6 +4537,7 @@ int selinux_disable(void) 
	printk(KERN_INFO "SELinux:  Disabled at runtime.\n");



	selinux_disabled = 1;

	selinux_enabled = 0;



	/* Reset security_ops to the secondary module, dummy or capability. */

	security_ops = secondary_ops;

security/selinux/include/security.h

+0 −5
Original line number Diff line number Diff line
@@ -29,12 +29,7 @@ 
#define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE

#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_AVTAB



#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM

extern int selinux_enabled;

#else

#define selinux_enabled 1

#endif



extern int selinux_mls_enabled;



int security_load_policy(void * data, size_t len);