linux-toradex.git/security/selinux/include/security.h, branch v3.4.64

selinux: sparse fix: fix warnings in netlink code

2011-09-09T23:56:31+00:00

Fix sparse warnings in SELinux Netlink code.

Signed-off-by: James Morris

selinux: sparse fix: eliminate warnings for selinuxfs

2011-09-09T23:56:30+00:00

Fixes several sparse warnings for selinuxfs.c

Signed-off-by: James Morris

selinux: sparse fix: declare selinux_disable() in security.h

2011-09-09T23:56:26+00:00

Sparse fix: declare selinux_disable() in security.h

Signed-off-by: James Morris

selinux: sparse fix: move selinux_complete_init

2011-09-09T23:56:26+00:00

Sparse fix: move selinux_complete_init

Signed-off-by: James Morris

SELinux: security_read_policy should take a size_t not ssize_t

2011-04-25T14:19:02+00:00

The len should be an size_t but is a ssize_t.  Easy enough fix to silence
build warnings.  We have no need for signed-ness.

Signed-off-by: Eric Paris 
Reviewed-by: James Morris

selinux: add type_transition with name extension support for selinuxfs

2011-04-01T21:13:23+00:00

The attached patch allows /selinux/create takes optional 4th argument
to support TYPE_TRANSITION with name extension for userspace object
managers.
If 4th argument is not supplied, it shall perform as existing kernel.
In fact, the regression test of SE-PostgreSQL works well on the patched
kernel.

Thanks,

Signed-off-by: KaiGai Kohei 
[manually verify fuzz was not an issue, and it wasn't: eparis]
Signed-off-by: Eric Paris

SELinux: Add class support to the role_trans structure

2011-03-28T18:20:58+00:00

If kernel policy version is >= 26, then the binary representation of
the role_trans structure supports specifying the class for the current
subject or the newly created object.

If kernel policy version is < 26, then the class field would be default
to the process class.

Signed-off-by: Harry Ciao 
Acked-by:  Stephen Smalley 
Signed-off-by: Eric Paris

SELinux: Use dentry name in new object labeling

2011-02-01T16:12:30+00:00

Currently SELinux has rules which label new objects according to 3 criteria.
The label of the process creating the object, the label of the parent
directory, and the type of object (reg, dir, char, block, etc.)  This patch
adds a 4th criteria, the dentry name, thus we can distinguish between
creating a file in an etc_t directory called shadow and one called motd.

There is no file globbing, regex parsing, or anything mystical.  Either the
policy exactly (strcmp) matches the dentry name of the object or it doesn't.
This patch has no changes from today if policy does not implement the new
rules.

Signed-off-by: Eric Paris

SELinux: allow userspace to read policy back out of the kernel

2010-10-20T23:12:58+00:00

There is interest in being able to see what the actual policy is that was
loaded into the kernel.  The patch creates a new selinuxfs file
/selinux/policy which can be read by userspace.  The actual policy that is
loaded into the kernel will be written back out to userspace.

Signed-off-by: Eric Paris 
Signed-off-by: James Morris

secmark: make secmark object handling generic

2010-10-20T23:12:48+00:00

Right now secmark has lots of direct selinux calls.  Use all LSM calls and
remove all SELinux specific knowledge.  The only SELinux specific knowledge
we leave is the mode.  The only point is to make sure that other LSMs at
least test this generic code before they assume it works.  (They may also
have to make changes if they do not represent labels as strings)

Signed-off-by: Eric Paris 
Acked-by: Paul Moore 
Acked-by: Patrick McHardy 
Signed-off-by: James Morris