SELinux: Use unknown perm handling to handle unknown netlink msg types
authorEric Paris <eparis@redhat.com>
Wed, 5 Nov 2008 14:34:42 +0000 (09:34 -0500)
committerJames Morris <jmorris@namei.org>
Sat, 8 Nov 2008 23:33:18 +0000 (07:33 +0800)
Currently when SELinux has not been updated to handle a netlink message
type the operation is denied with EINVAL.  This patch will leave the
audit/warning message so things get fixed but if policy chose to allow
unknowns this will allow the netlink operation.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
security/selinux/hooks.c

index f71de5a64d0c9ac1f01b0f79fb43418c5d6a7343..7fd4de46b2a91be21cf90d7a5b947ea8b6b56886 100644 (file)
@@ -4395,7 +4395,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
                                  "SELinux:  unrecognized netlink message"
                                  " type=%hu for sclass=%hu\n",
                                  nlh->nlmsg_type, isec->sclass);
-                       if (!selinux_enforcing)
+                       if (!selinux_enforcing || security_get_allow_unknown())
                                err = 0;
                }