diff options
| author | Eric Paris <eparis@redhat.com> | 2012-03-20 14:35:12 -0400 |
|---|---|---|
| committer | Brett Rogers <brettrogers11@gmail.com> | 2015-11-07 23:28:20 -0800 |
| commit | aa5083ab363ce861304d788f31a5387d6f6a8eb0 (patch) | |
| tree | 96301055bb3eff7781469d3663710d91ec6f5bb6 /security/selinux/include/security.h | |
| parent | e3c7a358e9e78b085c8db7446dd4b854a0faeffe (diff) | |
| download | kernel_samsung_smdk4412-aa5083ab363ce861304d788f31a5387d6f6a8eb0.zip kernel_samsung_smdk4412-aa5083ab363ce861304d788f31a5387d6f6a8eb0.tar.gz kernel_samsung_smdk4412-aa5083ab363ce861304d788f31a5387d6f6a8eb0.tar.bz2 | |
SELinux: allow default source/target selectors for user/role/range
When new objects are created we have great and flexible rules to
determine the type of the new object. We aren't quite as flexible or
mature when it comes to determining the user, role, and range. This
patch adds a new ability to specify the place a new objects user, role,
and range should come from. For users and roles it can come from either
the source or the target of the operation. aka for files the user can
either come from the source (the running process and todays default) or
it can come from the target (aka the parent directory of the new file)
examples always are done with
directory context: system_u:object_r:mnt_t:s0-s0:c0.c512
process context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[no rule]
unconfined_u:object_r:mnt_t:s0 test_none
[default user source]
unconfined_u:object_r:mnt_t:s0 test_user_source
[default user target]
system_u:object_r:mnt_t:s0 test_user_target
[default role source]
unconfined_u:unconfined_r:mnt_t:s0 test_role_source
[default role target]
unconfined_u:object_r:mnt_t:s0 test_role_target
[default range source low]
unconfined_u:object_r:mnt_t:s0 test_range_source_low
[default range source high]
unconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high
[default range source low-high]
unconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high
[default range target low]
unconfined_u:object_r:mnt_t:s0 test_range_target_low
[default range target high]
unconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high
[default range target low-high]
unconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high
upstream commit aa893269de6277b44be88e25dcd5331c934c29c4
Change-Id: Ic8f33d05793bf742c70c68ea79e33c7f40ffbd53
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'security/selinux/include/security.h')
| -rw-r--r-- | security/selinux/include/security.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 3ba4feb..e08376a 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -31,13 +31,14 @@ #define POLICYDB_VERSION_BOUNDARY 24 #define POLICYDB_VERSION_FILENAME_TRANS 25 #define POLICYDB_VERSION_ROLETRANS 26 +#define POLICYDB_VERSION_NEW_OBJECT_DEFAULTS 27 /* Range of policy versions we understand*/ #define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX #define POLICYDB_VERSION_MAX CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE #else -#define POLICYDB_VERSION_MAX POLICYDB_VERSION_ROLETRANS +#define POLICYDB_VERSION_MAX POLICYDB_VERSION_NEW_OBJECT_DEFAULTS #endif /* Mask for just the mount related flags */ |