1. 18 6月, 2009 2 次提交
    • K
      Add audit messages on type boundary violations · 44c2d9bd
      KaiGai Kohei 提交于
      The attached patch adds support to generate audit messages on two cases.
      
      The first one is a case when a multi-thread process tries to switch its
      performing security context using setcon(3), but new security context is
      not bounded by the old one.
      
        type=SELINUX_ERR msg=audit(1245311998.599:17):        \
            op=security_bounded_transition result=denied      \
            oldcontext=system_u:system_r:httpd_t:s0           \
            newcontext=system_u:system_r:guest_webapp_t:s0
      
      The other one is a case when security_compute_av() masked any permissions
      due to the type boundary violation.
      
        type=SELINUX_ERR msg=audit(1245312836.035:32):	\
            op=security_compute_av reason=bounds              \
            scontext=system_u:object_r:user_webapp_t:s0       \
            tcontext=system_u:object_r:shadow_t:s0:c0         \
            tclass=file perms=getattr,open
      Signed-off-by: NKaiGai Kohei <kaigai@ak.jp.nec.com>
      Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: NJames Morris <jmorris@namei.org>
      44c2d9bd
    • K
      cleanup in ss/services.c · caabbdc0
      KaiGai Kohei 提交于
      It is a cleanup patch to cut down a line within 80 columns.
      Signed-off-by: NKaiGai Kohei <kaigai@ak.jp.nec.com>
      --
       security/selinux/ss/services.c |    6 +++---
       1 files changed, 3 insertions(+), 3 deletions(-)
      Signed-off-by: NJames Morris <jmorris@namei.org>
      caabbdc0
  2. 11 6月, 2009 29 次提交
  3. 10 6月, 2009 9 次提交