scripts/selinux/mdp: fix initial SID handling (382c2b5d) · Commits · 戴 / test

commit ("selinux: remove unused initial SIDs and improve handling") broke scripts/selinux/mdp since the unused initial SID names were removed and the corresponding generation of policy initial SID definitions by mdp was not updated accordingly. Fix it. With latest upstream checkpolicy it is no longer necessary to include the SID context definitions for the unused initial SIDs but retain them for compatibility with older checkpolicy. Fixes: ("selinux: remove unused initial SIDs and improve handling") Signed-off-by:

Stephen Smalley <stephen.smalley.work@gmail.com> Signed-off-by:

Paul Moore <paul@paul-moore.com>

scripts/selinux/mdp/mdp.c

+18 −5

Original line number	Diff line number	Diff line
		@@ -67,8 +67,14 @@ int main(int argc, char *argv[])

		initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
		/* print out the sids */
		for (i = 1; i < initial_sid_to_string_len; i++)
		fprintf(fout, "sid %s\n", initial_sid_to_string[i]);
		for (i = 1; i < initial_sid_to_string_len; i++) {
		const char *name = initial_sid_to_string[i];

		if (name)
		fprintf(fout, "sid %s\n", name);
		else
		fprintf(fout, "sid unused%d\n", i);
		}
		fprintf(fout, "\n");

		/* print out the class permissions */
		@@ -126,9 +132,16 @@ int main(int argc, char *argv[])
		#define OBJUSERROLETYPE "user_u:object_r:base_t"

		/* default sids */
		for (i = 1; i < initial_sid_to_string_len; i++)
		fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n",
		initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");
		for (i = 1; i < initial_sid_to_string_len; i++) {
		const char *name = initial_sid_to_string[i];

		if (name)
		fprintf(fout, "sid %s ", name);
		else
		fprintf(fout, "sid unused%d\n", i);
		fprintf(fout, SUBJUSERROLETYPE "%s\n",
		mls ? ":" SYSTEMLOW : "");
		}
		fprintf(fout, "\n");

		#define FS_USE(behavior, fstype) \

Admin message