diff options
| author | Christian Göttsche <cgzones@googlemail.com> | 2026-09-17 16:20:38 +0200 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-09-24 17:08:03 -0400 |
| commit | 508d1fcc2d099e1e8d9b6fc14cb150adb8c4b092 (patch) | |
| tree | 686d21cfbdcbee1d1b55bbd9b862f0e264184ea1 /scripts/Makefile.thinlto | |
| parent | e6b4f0bac981dcb5c1fd682be0d7a8d69892f5e1 (diff) | |
| download | linux-next-508d1fcc2d099e1e8d9b6fc14cb150adb8c4b092.tar.gz linux-next-508d1fcc2d099e1e8d9b6fc14cb150adb8c4b092.zip | |
selinux: reject a policy that both rejects and allows unknown classes
handle-unknown is a single three-valued choice - deny, reject or allow -
but the policydb header spells it as two independent bits and
policydb_read() takes any combination of them.
libsepol writes exactly one of the three values
(POLICYDB_CONFIG_UNKNOWN_MASK & p->handle_unknown), so no policy built by
the reference toolchain carries this combination.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions