Stephen Smalley b6cac5a30b selinux: Only audit permissions specified in policy ...

Only audit the permissions specified by the policy rules.

Before:
type=AVC msg=audit(01/28/2010 14:30:46.690:3250) : avc:  denied  { read
append } for  pid=14092 comm=foo name=test_file dev=dm-1 ino=132932
scontext=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:rpm_tmp_t:s0 tclass=file

After:
type=AVC msg=audit(01/28/2010 14:52:37.448:26) : avc:  denied
{ append } for  pid=1917 comm=foo name=test_file dev=dm-1 ino=132932
scontext=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:rpm_tmp_t:s0 tclass=file

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=558499

Reported-by: Tom London <selinux@gmail.com>
Signed-off-by: Stephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

2010-02-03 08:49:10 +11:00

..

integrity/ima

ima: limit imbalance msg

2009-12-16 12:16:48 -05:00

keys

Keys: KEYCTL_SESSION_TO_PARENT needs TIF_NOTIFY_RESUME architecture support

2009-12-17 09:27:59 +11:00

selinux

selinux: Only audit permissions specified in policy

2010-02-03 08:49:10 +11:00

smack

net: rename skb->iif to skb->skb_iif

2009-11-20 15:35:04 -08:00

tomoyo

TOMOYO: Remove usage counter for temporary memory.

2010-01-27 08:20:48 +11:00

capability.c

security: report the module name to security_module_request

2009-11-10 09:33:46 +11:00

commoncap.c

remove CONFIG_SECURITY_FILE_CAPABILITIES compile option

2009-11-24 15:06:47 +11:00

device_cgroup.c

cgroups: let ss->can_attach and ss->attach do whole threadgroups at a time

2009-09-24 07:20:58 -07:00

inode.c

securityfs: securityfs_remove should handle IS_ERR pointers

2009-05-12 11:06:11 +10:00

Kconfig

remove CONFIG_SECURITY_FILE_CAPABILITIES compile option

2009-11-24 15:06:47 +11:00

lsm_audit.c

Merge branch 'master' of /home/davem/src/GIT/linux-2.6/

2009-12-05 15:22:26 -08:00

Makefile

NOMMU: Optimise away the {dac_,}mmap_min_addr tests

2009-12-17 09:25:19 +11:00

min_addr.c

security/min_addr.c: make init_mmap_min_addr() static

2009-12-17 09:24:22 +11:00

security.c

security: correct error returns for get/set security with private inodes

2010-01-15 08:23:57 +11:00