Date: Tue, 15 Aug 2006 18:02:47 GMT From: Todd Miller <millert@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 104078 for review Message-ID: <200608151802.k7FI2lgf037321@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=104078 Change 104078 by millert@millert_macbook on 2006/08/15 18:01:55 If the message number is bad, only return failure if we are in enforcing mode. Fix some whitespace here too. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/ss/mach_av.c#2 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/ss/mach_av.c#2 (text+ko) ==== @@ -129,8 +129,8 @@ sebsd_check_ipc_method1(int subj, int obj, int msgid) { struct msgid_classinfo *mcl; - u32 perms; - int cl; + u32 perms; + int cl; /* * Return allowed for messages in an unknown subsystem. @@ -142,10 +142,14 @@ return 0; cl = (msgid - mcl->baseid) / (8 * sizeof(u32)); - if (cl >= mcl->nclasses) - return (1); /* bad message, access denied */ + if (cl >= mcl->nclasses) { + /* bad message */ + if (selinux_enforcing) + return (EACCES); + else + return (0); + } - perms = (u32)1 << - (msgid - mcl->baseid - (cl * 8 * sizeof(u32))); + perms = (u32)1 << (msgid - mcl->baseid - (cl * 8 * sizeof(u32))); return avc_has_perm(subj, obj, mcl->classes[cl], perms, NULL); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200608151802.k7FI2lgf037321>