aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux/include/av_perm_to_string.h
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2008-11-14 10:39:27 +1100
committerJames Morris <jmorris@namei.org>2008-11-14 10:39:27 +1100
commit1bfdc75ae077d60a01572a7781ec6264d55ab1b9 (patch)
tree627cbbca1232725bbea68677cb904bf36e73b35c /security/selinux/include/av_perm_to_string.h
parent3b11a1decef07c19443d24ae926982bc8ec9f4c0 (diff)
downloadmrst-s0i3-test-1bfdc75ae077d60a01572a7781ec6264d55ab1b9.tar.gz
mrst-s0i3-test-1bfdc75ae077d60a01572a7781ec6264d55ab1b9.tar.xz
mrst-s0i3-test-1bfdc75ae077d60a01572a7781ec6264d55ab1b9.zip
CRED: Add a kernel_service object class to SELinux
Add a 'kernel_service' object class to SELinux and give this object class two access vectors: 'use_as_override' and 'create_files_as'. The first vector is used to grant a process the right to nominate an alternate process security ID for the kernel to use as an override for the SELinux subjective security when accessing stuff on behalf of another process. For example, CacheFiles when accessing the cache on behalf on a process accessing an NFS file needs to use a subjective security ID appropriate to the cache rather then the one the calling process is using. The cachefilesd daemon will nominate the security ID to be used. The second vector is used to grant a process the right to nominate a file creation label for a kernel service to use. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/include/av_perm_to_string.h')
-rw-r--r--security/selinux/include/av_perm_to_string.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index 1223b4ff9be..c0c885427b9 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -176,3 +176,5 @@
S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")
S_(SECCLASS_PEER, PEER__RECV, "recv")
+ S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__USE_AS_OVERRIDE, "use_as_override")
+ S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__CREATE_FILES_AS, "create_files_as")