SELinux: flush the avc before disabling SELinux
Eric Paris [Sun, 13 Sep 2009 02:54:23 +0000 (22:54 -0400)]
Before SELinux is disabled at boot it can create AVC entries.  This patch
will flush those entries before disabling SELinux.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>

security/selinux/avc.c

index f601246..1ed0f07 100644 (file)
@@ -868,6 +868,8 @@ u32 avc_policy_seqno(void)
 
 void avc_disable(void)
 {
+       avc_flush();
+       synchronize_rcu();
        if (avc_node_cachep)
                kmem_cache_destroy(avc_node_cachep);
 }