On 04/22/2013 02:09 PM, Jarkko Sakkinen wrote:
> On Mon, Apr 22, 2013, at 13:15, Pádraig Brady wrote:
>> On 04/17/2013 09:30 PM, Jarkko Sakkinen wrote:
>>> diff --git a/src/id.c b/src/id.c
>>> @@ -189,14 +199,17 @@ main (int argc, char **argv)
>>> and we're not in POSIXLY_CORRECT mode, get our context. Otherwise,
>>> leave the context variable alone - it has been initialized to an
>>> invalid value that will be not displayed in print_full_info(). */
>>> - if (selinux_enabled
>>> - && n_ids == 0
>>> + if (n_ids == 0
>>> && (just_context
>>> || (default_format && ! getenv ("POSIXLY_CORRECT"))))
>>> {
>>> /* Report failure only if --context (-Z) was explicitly requested.
>>> */
>>> - if (getcon (&context) && just_context)
>>> + if (selinux_enabled && getcon (&context) && just_context)
>>> + error (EXIT_FAILURE, 0, _("can't get process context"));
>>> +#ifdef HAVE_SMACK
>>> + else if (smack_enabled && smack_new_label_from_self ((char **)
>>> &context))
>>> error (EXIT_FAILURE, 0, _("can't get process context"));
>>> +#endif
>>
>> So smack defers to SELinux.
>> In that case you probably don't want --with-smack above,
>> and instead auto detect smack availability.
>
> Well, actually you couldn't have SELinux and SMACK active in the
> kernel at the same time. Kernel can only have one LSM enabled at
> a time (and you cannot switch or disable LSM). So this essentially
> detects, which one is enabled in the kernel.
It seems like this will no longer be the case:
https://lkml.org/lkml/2013/7/25/482
thanks,
Pádraig.
