[PATCH 1/1] role_fix_callback skips out-of-scope roles during expansion.

[Harry Ciao <qingtao.cao@xxxxxxxxxxxxx>]

If a role identifier is out of scope it would be skipped over during
expansion, accordingly, be it a role attribute, it should be skipped
over as well when role_fix_callback tries to propagate its capability
to all its sub-roles.

BTW, it's worthwhile to note that the symtab and rules of an optional
block in a loadable module will be written to its pp. However, for the
base module the entire optional block will be omitted if its exterior
dependency cannot be properly satisfied.

Signed-off-by: Harry Ciao <qingtao.cao@xxxxxxxxxxxxx>
---
 libsepol/src/expand.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 493e478..befb720 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -688,6 +688,11 @@ static int role_fix_callback(hashtab_key_t key, hashtab_datum_t datum,
 		return 0;
 	}
 
+	if (!is_id_enabled(id, state->base, SYM_ROLES)) {
+		/* identifier's scope is not enabled */
+		return 0;
+	}
+
 	if (role->flavor != ROLE_ATTRIB)
 		return 0;
 
-- 
1.7.0.4


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.