Check security_deny_unknown() after calling string_to_security_class()/string_to_av_perm()

[bigon]

Hello,

The code is currently either always allowing or denying access in case the SELinux class or access vector is not defined.

IMVHO, this is not OK and you should use security_deny_unknown() after the calls to string_to_security_class() and string_to_av_perm() are failing.

The man page states:

security_deny_unknown() returns 0 if SELinux treats policy queries on undefined object classes or permissions as being allowed, 1 if such queries are denied, and -1 on error.

So it should be something like

	tclass = string_to_security_class("file");
	if (!tclass) {
		log_it("CRON", getpid(), "ERROR", "Failed to translate security class file", errno);
		if(security_deny_unknown() == 0)
			return 0;
		else
			return -1;
	}

[t8m]

Hello, I am sorry for not getting to this request earlier. Would you like to write a pull request with such change?