On Sat, 26 Jan 2008, Jarod Wilson wrote:
On Saturday 26 January 2008 05:19:14 am Roland McGrath wrote:
> Is F-[78] going to stay on 2.6.23 for a while, or switch to 2.6.24 fairly
> soon?
Chuck was talking about branching in cvs to start doing 2.6.24 builds for at
least F8 as soon as possible for people to test w/o committing to an
immediate upgrade from 2.6.23, but I'd assume if testing goes well with
2.6.24, we'll move to it fairly soon.
2.6.24 (and recent 2.6.23 kernels) need the following patch to avoid
spurious SELinux denials for files in /proc. It's been sent to Linus &
stable folk, but may take a few days to be merged due to LCA. I suggest
applying this to rawhide asap.
commit b1aa5301b9f88a4891061650c591fb8fe1c1d1da
Author: Stephen Smalley <sds(a)tycho.nsa.gov>
Date: Fri Jan 25 13:03:42 2008 -0500
selinux: fix labeling of /proc/net inodes
The proc net rewrite had a side effect on selinux, leading it to mislabel
the /proc/net inodes, thereby leading to incorrect denials. Fix
security_genfs_sid to ignore extra leading / characters in the path supplied
by selinux_proc_get_sid since we now get "//net/..." rather than
"/net/...".
Signed-off-by: Stephen Smalley <sds(a)tycho.nsa.gov>
Signed-off-by: James Morris <jmorris(a)namei.org>
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index f83b19d..4bf715d 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1744,6 +1744,9 @@ int security_genfs_sid(const char *fstype,
struct ocontext *c;
int rc = 0, cmp = 0;
+ while (path[0] == '/' && path[1] == '/')
+ path++;
+
POLICY_RDLOCK;
for (genfs = policydb.genfs; genfs; genfs = genfs->next) {