linux

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-12 08:09:56 +00:00

History

Stephen Smalley db59000ab7 selinux: only invoke capabilities and selinux for CAP_MAC_ADMIN checks

SELinux uses CAP_MAC_ADMIN to control the ability to get or set a raw,
uninterpreted security context unknown to the currently loaded security
policy. When performing these checks, we only want to perform a base
capabilities check and a SELinux permission check.  If any other
modules that implement a capable hook are stacked with SELinux, we do
not want to require them to also have to authorize CAP_MAC_ADMIN,
since it may have different implications for their security model.
Rework the CAP_MAC_ADMIN checks within SELinux to only invoke the
capabilities module and the SELinux permission checking.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>

2017-05-23 10:23:22 -04:00

include

prlimit,security,selinux: add a security hook for prlimit

2017-03-06 10:43:47 +11:00

selinux: Return an error code only as a constant in sidtab_insert()

2017-05-23 10:23:17 -04:00

.gitignore

SELinux: add .gitignore files for dynamic classes

2009-10-24 09:42:27 +08:00

avc.c

Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next

2015-08-15 13:29:57 +10:00