[refpolicy] l1 domby l2 for contains MLS constraint

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 02/14/11 21:40, HarryCiao wrote:
> Hi Chris,
> 
> With help from Stephan Smalley I think we should take into consideration
> of a user's low MLS level for the constraint for the contains permission
> of the context class, so that mls_systemlow is no longer regarded
> contained in mls_systemhigh.
> 
> With the attached patch the compute_av command could yield expected
> result now:
> 
> [root/sysadm_r/s0 at QtCao ~]# compute_av
> root:sysadm_r:sysadm_t:s0-s15:c0.c1023 root:sysadm_r:sysadm_t:s0 context
> allowed= { contains }
> [root/sysadm_r/s0 at QtCao ~]#
> [root/sysadm_r/s0 at QtCao ~]# compute_av
> root:sysadm_r:sysadm_t:s15:c0.c1023 root:sysadm_r:sysadm_t:s0 context
> allowed= null
> [root/sysadm_r/s0 at QtCao ~]#

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com