Eric Paris 0bce952799 SELinux: print denials for buggy kernel with unknown perms ... Historically we've seen cases where permissions are requested for classes where they do not exist. In particular we have seen CIFS forget to set i_mode to indicate it is a directory so when we later check something like remove_name we have problems since it wasn't defined in tclass file. This used to result in a avc which included the permission 0x2000 or something. Currently the kernel will deny the operations (good thing) but will not print ANY information (bad thing). First the auditdeny field is no extended to include unknown permissions. After that is fixed the logic in avc_dump_query to output this information isn't right since it will remove the permission from the av and print the phrase "<NULL>". This takes us back to the behavior before the classmap rewrite. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>		2009-11-24 14:30:49 +11:00
..
avtab.c
avtab.h
conditional.c
conditional.h
constraint.h
context.h
ebitmap.c
ebitmap.h
hashtab.c
hashtab.h
Makefile	selinux: generate flask headers during kernel build	2009-10-07 21:56:44 +11:00
mls_types.h
mls.c	selinux: dynamic class/perm discovery	2009-10-07 21:56:42 +11:00
mls.h
policydb.c	selinux: dynamic class/perm discovery	2009-10-07 21:56:42 +11:00
policydb.h	selinux: dynamic class/perm discovery	2009-10-07 21:56:42 +11:00
services.c	SELinux: print denials for buggy kernel with unknown perms	2009-11-24 14:30:49 +11:00
services.h
sidtab.c
sidtab.h
symtab.c
symtab.h