From: Stephen Smalley This patch fixes a bug in the SELinux compute_av code; the current code yields the right access computation but can cause unnecessary (but harmless) processing to occur when transition permission wasn't granted in the first place by the TE configuration. Thanks to Chad Hanson of TCS for reporting the bug. --- 25-akpm/security/selinux/ss/services.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff -puN security/selinux/ss/services.c~selinux-compute_av-fix security/selinux/ss/services.c --- 25/security/selinux/ss/services.c~selinux-compute_av-fix Fri Mar 12 15:14:41 2004 +++ 25-akpm/security/selinux/ss/services.c Fri Mar 12 15:14:41 2004 @@ -262,7 +262,7 @@ static int context_struct_compute_av(str * pair. */ if (tclass == SECCLASS_PROCESS && - avd->allowed && PROCESS__TRANSITION && + (avd->allowed & PROCESS__TRANSITION) && scontext->role != tcontext->role) { for (ra = policydb.role_allow; ra; ra = ra->next) { if (scontext->role == ra->role && _