From patchwork Fri Oct 14 17:40:02 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 9377117 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A462C607FD for ; Fri, 14 Oct 2016 17:38:24 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 94C1E2A545 for ; Fri, 14 Oct 2016 17:38:24 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 872972A54A; Fri, 14 Oct 2016 17:38:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (emsm-gh1-uea11.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BBFA62A545 for ; Fri, 14 Oct 2016 17:38:23 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.31,493,1473120000"; d="scan'208";a="20081342" IronPort-PHdr: =?us-ascii?q?9a23=3Asmc+uBMLvCGO6hS+2zwl6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0KPn6rarrMEGX3/hxlliBBdydsKMezbaI+Pm5AyQp2tWoiDg6aptCVhsI24?= =?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6kO74TNaIBjjLw09?= =?us-ascii?q?fr2zQd+IyZjpnLnrodX6WEZhvHKFe7R8LRG7/036l/I9ps9cEJs30QbDuXBSeu?= =?us-ascii?q?5blitCLFOXmAvgtI/rpMYwuxlKv7od0+IIEeCgJ+VrBYBfWS8rN2Ez+d3DqQjI?= =?us-ascii?q?TQzJ4GAVFGoRjElmGQ/AuSrmU4/xvy2yje903C2XLIWiVrwvcSiz5KdsDhnzgW?= =?us-ascii?q?EIMCBvozKfsdB5kK8O+EHpnBd42YOBJdvNOQ=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2FlBAC7FgFY/wHyM5BcGwEBAQMBAQEJAQEBFwEBBAEBCgE?= =?us-ascii?q?BgxEBAQEBAR2BRA+6byeIHkwBAQEBAQEBAQIBAlsngjIEAxMFghgCJBMUIAsDA?= =?us-ascii?q?wkCFykICAMBLRUfCwUYBIgxwygmjGCCSQIRAWiFEwWaBpAAAol+hXMCkHhURAY?= =?us-ascii?q?IhQVWhgYPFwRdgSgBAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 14 Oct 2016 17:38:20 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u9EHc2GF008354; Fri, 14 Oct 2016 13:38:08 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u9EHc1Ob080143 for ; Fri, 14 Oct 2016 13:38:01 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u9EHc1Cb008330; Fri, 14 Oct 2016 13:38:01 -0400 From: Stephen Smalley To: selinux@tycho.nsa.gov Subject: [PATCH] libsemanage: genhomedircon: only set MLS level if MLS is enabled Date: Fri, 14 Oct 2016 13:40:02 -0400 Message-Id: <1476466802-8500-1-git-send-email-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.7.4 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Stephen Smalley MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP When a non-MLS policy was used with genhomedircon context_from_record() in sepol would report an error because an MLS level was present when MLS is disabled. Based on a patch by Gary Tierney, amended to use sepol_policydb_mls_enabled rather than semanage_mls_enabled because we are testing the temporary working policy, not the active policy. Reported-by: Jason Zaman Signed-off-by: Stephen Smalley --- libsemanage/src/genhomedircon.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libsemanage/src/genhomedircon.c b/libsemanage/src/genhomedircon.c index 6991fff..5e9d722 100644 --- a/libsemanage/src/genhomedircon.c +++ b/libsemanage/src/genhomedircon.c @@ -638,7 +638,11 @@ static int write_contexts(genhomedircon_settings_t *s, FILE *out, goto fail; } - if (sepol_context_set_user(sepolh, context, user->sename) < 0 || + if (sepol_context_set_user(sepolh, context, user->sename) < 0) { + goto fail; + } + + if (sepol_policydb_mls_enabled(s->policydb) && sepol_context_set_mls(sepolh, context, user->level) < 0) { goto fail; }