linux-toradex.git/security/selinux/include/security.h, branch v3.6.1

switch dentry_open() to struct path, make it grab references itself

2012-07-22T20:01:29+00:00

Signed-off-by: Al Viro

SELinux: add default_type statements

2012-04-09T16:22:48+00:00

Because Fedora shipped userspace based on my development tree we now
have policy version 27 in the wild defining only default user, role, and
range.  Thus to add default_type we need a policy.28.

Signed-off-by: Eric Paris

SELinux: allow default source/target selectors for user/role/range

2012-04-09T16:22:47+00:00

When new objects are created we have great and flexible rules to
determine the type of the new object.  We aren't quite as flexible or
mature when it comes to determining the user, role, and range.  This
patch adds a new ability to specify the place a new objects user, role,
and range should come from.  For users and roles it can come from either
the source or the target of the operation.  aka for files the user can
either come from the source (the running process and todays default) or
it can come from the target (aka the parent directory of the new file)

examples always are done with
directory context: system_u:object_r:mnt_t:s0-s0:c0.c512
process context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[no rule]
	unconfined_u:object_r:mnt_t:s0   test_none
[default user source]
	unconfined_u:object_r:mnt_t:s0   test_user_source
[default user target]
	system_u:object_r:mnt_t:s0       test_user_target
[default role source]
	unconfined_u:unconfined_r:mnt_t:s0 test_role_source
[default role target]
	unconfined_u:object_r:mnt_t:s0   test_role_target
[default range source low]
	unconfined_u:object_r:mnt_t:s0 test_range_source_low
[default range source high]
	unconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high
[default range source low-high]
	unconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high
[default range target low]
	unconfined_u:object_r:mnt_t:s0 test_range_target_low
[default range target high]
	unconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high
[default range target low-high]
	unconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high

Signed-off-by: Eric Paris

selinux: sparse fix: fix warnings in netlink code

2011-09-09T23:56:31+00:00

Fix sparse warnings in SELinux Netlink code.

Signed-off-by: James Morris

selinux: sparse fix: eliminate warnings for selinuxfs

2011-09-09T23:56:30+00:00

Fixes several sparse warnings for selinuxfs.c

Signed-off-by: James Morris

selinux: sparse fix: declare selinux_disable() in security.h

2011-09-09T23:56:26+00:00

Sparse fix: declare selinux_disable() in security.h

Signed-off-by: James Morris

selinux: sparse fix: move selinux_complete_init

2011-09-09T23:56:26+00:00

Sparse fix: move selinux_complete_init

Signed-off-by: James Morris

SELinux: security_read_policy should take a size_t not ssize_t

2011-04-25T14:19:02+00:00

The len should be an size_t but is a ssize_t.  Easy enough fix to silence
build warnings.  We have no need for signed-ness.

Signed-off-by: Eric Paris 
Reviewed-by: James Morris

selinux: add type_transition with name extension support for selinuxfs

2011-04-01T21:13:23+00:00

The attached patch allows /selinux/create takes optional 4th argument
to support TYPE_TRANSITION with name extension for userspace object
managers.
If 4th argument is not supplied, it shall perform as existing kernel.
In fact, the regression test of SE-PostgreSQL works well on the patched
kernel.

Thanks,

Signed-off-by: KaiGai Kohei 
[manually verify fuzz was not an issue, and it wasn't: eparis]
Signed-off-by: Eric Paris

SELinux: Add class support to the role_trans structure

2011-03-28T18:20:58+00:00

If kernel policy version is >= 26, then the binary representation of
the role_trans structure supports specifying the class for the current
subject or the newly created object.

If kernel policy version is < 26, then the class field would be default
to the process class.

Signed-off-by: Harry Ciao 
Acked-by:  Stephen Smalley 
Signed-off-by: Eric Paris