From: Eric Paris <eparis@redhat.com>
Date: Wed, 13 Oct 2010 21:50:14 +0000 (-0400)
Subject: SELinux: deterministic ordering of range transition rules
X-Git-Tag: v2.6.37-rc1~218^2~5
X-Git-Url: https://bbs.cooldavid.org/git/?p=net-next-2.6.git;a=commitdiff_plain;h=4419aae1f4f380a3fba0f4f12ffbbbdf3f267c51

SELinux: deterministic ordering of range transition rules

Range transition rules are placed in the hash table in an (almost)
arbitrary order.  This patch inserts them in a fixed order to make policy
retrival more predictable.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
---

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index aa5a2fd1cc0..97fb0cf0eb6 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -185,9 +185,19 @@ static u32 rangetr_hash(struct hashtab *h, const void *k)
 static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2)
 {
 	const struct range_trans *key1 = k1, *key2 = k2;
-	return (key1->source_type != key2->source_type ||
-		key1->target_type != key2->target_type ||
-		key1->target_class != key2->target_class);
+	int v;
+
+	v = key1->source_type - key2->source_type;
+	if (v)
+		return v;
+
+	v = key1->target_type - key2->target_type;
+	if (v)
+		return v;
+
+	v = key1->target_class - key2->target_class;
+
+	return v;
 }
 
 /*