Re: Question about setsebool.c

[Joshua Brindle <jbrindle@tresys.com>]

Karl MacMillan wrote:
> Yuichi Nakamura wrote:
>> Hi, I looked at the latest policycoreutils code.
>> (policycoreutils-1.33.1-9.fc7.src.rpm)
>>
>> And found strange code, in setsebool.c.
>>
>>     94  /* Apply (permanent) boolean changes to policy via 
>> libsemanage */
>>     95  static int semanage_set_boolean_list(size_t boolcnt,
>>     96                                       SELboolean * boollist, 
>> int perm)
>>     97  {
>>    <snip>
>>    117          } else if (managed == 0) {
>>    118                  if (selinux_set_boolean_list(boolcnt, 
>> boollist, 1) < 0)
>>    119                          goto err;
>>    120                  goto out;
>>    121          }
>>
>> Why 3rd arg for selinux_set_boolean_list is "1"?
>> Should it be "perm"?
>>
>
> Looks that way to me. Additionally, is it even possible to make 
> non-permanent change to a boolean via semanage? If not, then this code 
> path should check for that. Josh?
>
libsemanage is only responsible for the persistent changes, sesetbool 
sets the non-persistent directly, in fact demonstrated by the code 
snippet above. This does look like a bug and if someone uses setsebool 
to set a non-persistent boolean on an unmanaged system it appears that 
it will indeed make it permanent.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.