lkml.org 
[lkml]   [2008]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 10/27] Security: Add a kernel_service object class to SELinux
    Date
    Add a 'kernel_service' object class to SELinux and give this object class two
    access vectors: 'use_as_override' and 'create_files_as'.

    The first vector is used to grant a process the right to nominate an alternate
    process security ID for the kernel to use as an override for the SELinux
    subjective security when accessing stuff on behalf of another process.

    For example, CacheFiles when accessing the cache on behalf on a process
    accessing an NFS file needs to use a subjective security ID appropriate to the
    cache rather then the one the calling process is using. The cachefilesd
    daemon will nominate the security ID to be used.

    The second vector is used to grant a process the right to nominate a file
    creation label for a kernel service to use.

    Signed-off-by: David Howells <dhowells@redhat.com>
    ---

    security/selinux/include/av_perm_to_string.h | 2 ++
    security/selinux/include/av_permissions.h | 2 ++
    security/selinux/include/class_to_string.h | 1 +
    security/selinux/include/flask.h | 1 +
    4 files changed, 6 insertions(+), 0 deletions(-)


    diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
    index caa0634..6ba8200 100644
    --- a/security/selinux/include/av_perm_to_string.h
    +++ b/security/selinux/include/av_perm_to_string.h
    @@ -164,3 +164,5 @@
    S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
    S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")
    S_(SECCLASS_PEER, PEER__RECV, "recv")
    + S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__USE_AS_OVERRIDE, "use_as_override")
    + S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__CREATE_FILES_AS, "create_files_as")
    diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
    index c2b5bb2..9500ba3 100644
    --- a/security/selinux/include/av_permissions.h
    +++ b/security/selinux/include/av_permissions.h
    @@ -829,3 +829,5 @@
    #define DCCP_SOCKET__NAME_CONNECT 0x00800000UL
    #define MEMPROTECT__MMAP_ZERO 0x00000001UL
    #define PEER__RECV 0x00000001UL
    +#define KERNEL_SERVICE__USE_AS_OVERRIDE 0x00000001UL
    +#define KERNEL_SERVICE__CREATE_FILES_AS 0x00000002UL
    diff --git a/security/selinux/include/class_to_string.h b/security/selinux/include/class_to_string.h
    index b1b0d1d..efe9efa 100644
    --- a/security/selinux/include/class_to_string.h
    +++ b/security/selinux/include/class_to_string.h
    @@ -71,3 +71,4 @@
    S_(NULL)
    S_(NULL)
    S_("peer")
    + S_("kernel_service")
    diff --git a/security/selinux/include/flask.h b/security/selinux/include/flask.h
    index 09e9dd2..2bc251a 100644
    --- a/security/selinux/include/flask.h
    +++ b/security/selinux/include/flask.h
    @@ -51,6 +51,7 @@
    #define SECCLASS_DCCP_SOCKET 60
    #define SECCLASS_MEMPROTECT 61
    #define SECCLASS_PEER 68
    +#define SECCLASS_KERNEL_SERVICE 69

    /*
    * Security identifier indices for initial entities


    \
     
     \ /
      Last update: 2008-01-23 01:53    [W:0.031 / U:62.240 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site