Re: libselinux rpm_execon should not fail in permissive mode.

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Mon, 2005-01-24 at 15:43, Daniel J Walsh wrote:
>  
>
>>diff --exclude-from=exclude -N -u -r nsalibselinux/src/rpm.c libselinux-1.21.1/src/rpm.c
>>--- nsalibselinux/src/rpm.c	2004-11-09 09:13:54.000000000 -0500
>>+++ libselinux-1.21.1/src/rpm.c	2005-01-24 15:24:33.000000000 -0500
>>@@ -41,8 +41,10 @@
>> 	rc = setexeccon(newcon);
>> 	if (rc < 0) 
>> 		goto out;
>>-	rc = execve(filename, argv, envp);
>> out:
>>+	if ( ( rc == 0 ) || 
>>+	     (security_getenforce() == 0 ))
>>+	  rc = execve(filename, argv, envp);
>> 	context_free(con);
>> 	freecon(newcon);
>> 	freecon(fcon);
>>    
>>
>
>What failure are you encountering in permissive mode?  Possibly the file
>might lack a context and we should handle that more cleanly, but I
>wouldn't recommend this patch.  The setexeccon() shouldn't fail in
>permissive mode.
> 
>  
>
Basically running rpm --root

Bugzilla %145770


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.