Re: [PATCH 7/7] secid reconciliation-v02: Enforcement for SELinux

On Fri, 8 Sep 2006, Venkat Yekkirala wrote:

+	if (selinux_compat_net) {
+		err = selinux_xfrm_decode_session(skb, &peersid, 0);
+		BUG_ON(err);

I'm pretty sure this should not be a BUG_ON.  IIUC, you want to panic the 
kernel because one of the nested SAs has a different security context.

+	err = selinux_xfrm_decode_session(skb, &xfrm_sid, 0);
+	BUG_ON(err);

Same.


-- 
James Morris
[off-list ref]