Messages in this thread | | | Date | Wed, 22 Jul 2009 23:53:44 +1000 (EST) | From | James Morris <> | Subject | Re: [PATCH -v2 1/2] VM/SELinux: require CAP_SYS_RAWIO for all mmap_zero operations |
| |
On Tue, 21 Jul 2009, Eric Paris wrote:
> error = security_file_mmap(file, reqprot, prot, flags, addr, 0); > if (error) > return error; > + > + if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO)) > + return -EACCES; > +
These DAC checks should happen before the LSM hook, in keeping with the general design goal of LSM of "DAC before MAC", so that application behavior remains as consistent as possible.
- James -- James Morris <jmorris@namei.org>
| |