Commit b599fdfd authored Feb 14, 2007 by Eric W. Biederman Committed by Linus Torvalds Feb 14, 2007

[PATCH] sysctl: fix the selinux_sysctl_get_sid



I goofed and when reenabling the fine grained selinux labels for
sysctls and forgot to add the "/sys" prefix before consulting
the policy database.  When computing the same path using
proc_dir_entries we got the "/sys" for free as it was part
of the tree, but it isn't true for clt_table trees.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 3fbfa981

security/selinux/hooks.c

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1451,6 +1451,12 @@ static int selinux_sysctl_get_sid(ctl_table table, u16 tclass, u32 sid)
	path = end;		path = end;
	table = table->parent;		table = table->parent;
	}		}
			buflen -= 4;
			if (buflen < 0)
			goto out_free;
			end -= 4;
			memcpy(end, "/sys", 4);
			path = end;
	rc = security_genfs_sid("proc", path, tclass, sid);		rc = security_genfs_sid("proc", path, tclass, sid);
	out_free:		out_free:
	free_page((unsigned long)buffer);		free_page((unsigned long)buffer);