Re: [PATCH] libsepol users in non-mls policy bugfix

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

On Mon, 2006-10-30 at 08:59 -0500, Joshua Brindle wrote:
> This patch fixes a bug where adding a user in a non-mls module would
> cause a segfault at link time.
> 
> 
> diff -pruN trunk/libsepol/src/link.c user_mls_fix/libsepol/src/link.c
> --- trunk/libsepol/src/link.c	2006-10-28 15:35:26.000000000 -0400
> +++ user_mls_fix/libsepol/src/link.c	2006-10-28 15:26:44.000000000 -0400
> @@ -994,11 +994,15 @@ static int user_fix_callback(hashtab_key
>  		goto cleanup;
>  	}
>  
> -	if (mls_range_convert(&user->range, &new_user->range, mod))
> -		goto cleanup;
> +	if (mod->policy->mls) {
>  
> -	if (mls_level_convert(&user->dfltlevel, &new_user->dfltlevel, mod))
> -		goto cleanup;
> +		if (mls_range_convert(&user->range, &new_user->range, mod))
> +			goto cleanup;
> +
> +		if (mls_level_convert(&user->dfltlevel, &new_user->dfltlevel, mod))
> +			goto cleanup;
> +
> +	}
>  
>  	return 0;
>  
> 

This patch looks ok, but shouldn't we also stop the segfault in
mls_level_convert? The use of assert there looks like it is catching
what should be a runtime error that should cause an error message rather
than bailing.

Otherwise:

Acked by: Karl MacMillan <kmacmillan@mentalrootkit.com>

> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.