Re: semanage non MLS breakage

[Ivan Gyurdiev <ivg2@cornell.edu>]

>>> # semanage login -l
>>>
>>> Login Name                SELinux User              MLS/MCS Range
>>>
>>> root                      root                      __default__:user_u
That doesn't look like a valid MLS range.
What exactly is in your seusers file?
>
> #2  0x00476143 in sepol_mls_contains (handle=0x8b06b70, 
> policydb=0x8b30a78, mls1=0x0, mls2=0x8b2fd98 "s0", response=0xbfdc7068)
This indicates the seuser has an mls range s0, but the user does not. 
The mls check is conditional on the seuser's mls range, which is why it 
proceeds.  I can add a check that makes sure neither exists, but it 
shouldn't be necessary - on a non-MLS system the seuser should not have 
an mls range.

I'm not sure how a situation would occur where the seuser has an mls 
range on a non-mls system. I guess seuser_print will write out an mls 
field if it finds one, so maybe that's how this happens...it gets an mls 
field from the policy package, and fails to ignore it. Need more info.



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.