Home Home > GIT Browse
diff options
authorEric Paris <eparis@redhat.com>2009-06-01 10:21:05 -0400
committerGreg Kroah-Hartman <gregkh@suse.de>2009-06-15 09:40:10 -0700
commit881db0622f9e7ccef8adfd5968b6fe547162ea87 (patch)
parente00f8a824904848780c649c86947366f50c8623c (diff)
SELinux: BUG in SELinux compat_net code
This patch is not applicable to Linus's tree as the code in question has been removed for 2.6.30. I'm sending in case any of the stable maintainers would like to push to their branches (which I think anything pre 2.6.30 would like to do). Ubuntu users were experiencing a kernel panic when they enabled SELinux due to an old bug in our handling of the compatibility mode network controls, introduced Jan 1 2008 effad8df44261031a882e1a895415f7186a5098e Most distros have not used the compat_net code since the new code was introduced and so noone has hit this problem before. Ubuntu is the only distro I know that enabled that legacy cruft by default. But, I was ask to look at it and found that the above patch changed a call to avc_has_perm from if(send_perm) to if(!send_perm) in selinux_ip_postroute_iptables_compat(). The result is that users who turn on SELinux and have compat_net set can (and oftern will) BUG() in avc_has_perm_noaudit since they are requesting 0 permissions. This patch corrects that accidental bug introduction. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1 files changed, 1 insertions, 1 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8d24c91cfe2e..9d62f299f155 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4648,7 +4648,7 @@ static int selinux_ip_postroute_iptables_compat(struct sock *sk,
if (err)
return err;
- if (send_perm != 0)
+ if (!send_perm)
return 0;
err = sel_netport_sid(sk->sk_protocol,