lkml.org 
[lkml]   [2008]   [Jan]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 08/28] SECURITY: Allow kernel services to override LSM settings for task actions [try #2]
    From
    Date

    On Mon, 2008-01-14 at 14:06 +0000, David Howells wrote:
    > David Howells <dhowells@redhat.com> wrote:
    >
    > > Okay... It looks like I want four security operations/hooks for cachefiles:
    >
    > FYI, I added the following vectors:
    >
    > # kernel services that need to override task security
    > class kernel_service
    > {
    > use_as_override
    > create_files_as
    > }
    >
    > The first allows:
    >
    > avc_has_perm(daemon_tsec->sid, nominated_sid,
    > SECCLASS_KERNEL_SERVICE,
    > KERNEL_SERVICE__USE_AS_OVERRIDE,
    > NULL);
    >
    > And the second something like:
    >
    > avc_has_perm(tsec->sid, inode->sid,
    > SECCLASS_KERNEL_SERVICE,
    > KERNEL_SERVICE__CREATE_FILES_AS,
    > NULL);
    >
    > Rather than specifically dedicating them to the cache, I made them general.

    Make sure that you or Dan submits a policy patch to register these
    classes and permissions in the policy when the kernel patch is queued
    for merge.

    --
    Stephen Smalley
    National Security Agency



    \
     
     \ /
      Last update: 2008-01-15 16:01    [W:0.035 / U:0.432 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site