Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2] | Date | Mon, 14 Jan 2008 14:06:17 +0000 |
| |
David Howells <dhowells@redhat.com> wrote:
> Okay... It looks like I want four security operations/hooks for cachefiles:
FYI, I added the following vectors:
# kernel services that need to override task security class kernel_service { use_as_override create_files_as }
The first allows:
avc_has_perm(daemon_tsec->sid, nominated_sid, SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__USE_AS_OVERRIDE, NULL);
And the second something like:
avc_has_perm(tsec->sid, inode->sid, SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__CREATE_FILES_AS, NULL);
Rather than specifically dedicating them to the cache, I made them general.
David
| |