Stephen Smalley f3bef67992 selinux: fix bug in conditional rules handling ... commit fa1aa143ac ("selinux: extended permissions for ioctls") introduced a bug into the handling of conditional rules, skipping the processing entirely when the caller does not provide an extended permissions (xperms) structure. Access checks from userspace using /sys/fs/selinux/access do not include such a structure since that interface does not presently expose extended permission information. As a result, conditional rules were being ignored entirely on userspace access requests, producing denials when access was allowed by conditional rules in the policy. Fix the bug by only skipping computation of extended permissions in this situation, not the entire conditional rules processing. Reported-by: Laurent Bigonville <bigon@debian.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: fixed long lines in patch description] Cc: stable@vger.kernel.org # 4.3 Signed-off-by: Paul Moore <pmoore@redhat.com>		2015-11-24 13:44:32 -05:00
..
include	selinux: introduce security_context_str_to_sid	2015-10-21 17:44:25 -04:00
ss	selinux: fix bug in conditional rules handling	2015-11-24 13:44:32 -05:00
.gitignore	SELinux: add .gitignore files for dynamic classes	2009-10-24 09:42:27 +08:00
avc.c	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	2015-08-15 13:29:57 +10:00
exports.c	selinux: sparse fix: include selinux.h in exports.c	2011-09-09 16:56:32 -07:00
hooks.c	selinux: Use a kmem_cache for allocation struct file_security_struct	2015-10-21 17:44:30 -04:00
Kconfig	selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default	2015-10-21 17:44:25 -04:00
Makefile	selinux: change to new flag variable	2010-10-21 10:12:40 +11:00
netif.c	Merge commit 'v3.17' into next	2014-11-19 21:32:12 +11:00
netlabel.c	selinux: ensure that the cached NetLabel secattr matches the desired SID	2013-12-04 16:08:17 -05:00
netlink.c	selinux: replace obsolete NLMSG_* with type safe nlmsg_*	2013-03-28 14:25:49 -04:00
netnode.c	selinux: remove unused variabled in the netport, netnode, and netif caches	2014-08-07 20:55:30 -04:00
netport.c	selinux: remove unused variabled in the netport, netnode, and netif caches	2014-08-07 20:55:30 -04:00
nlmsgtab.c	selinux/nlmsg: add a build time check for rtnl/xfrm cmds	2015-04-13 13:09:44 -04:00
selinuxfs.c	selinux: introduce security_context_str_to_sid	2015-10-21 17:44:25 -04:00
xfrm.c	netfilter: Remove spurios included of netfilter.h	2015-06-18 21:14:32 +02:00