| commit | 25354c4fee169710fd9da15f3bb2abaa24dcf933 | |
| author | Eric Paris <eparis@redhat.com> | |
| Thu, 13 Aug 2009 13:45:03 +0000 (13 09:45 -0400) | ||
| committer | James Morris <jmorris@namei.org> | |
| Fri, 14 Aug 2009 01:18:40 +0000 (14 11:18 +1000) | ||
| tree | 7fb462945c15ce09392ae858c8ae757290b5ed2d | treesnapshot (tar.gz zip) |
| parent | 9188499cdb117d86a1ea6b04374095b098d56936 | commitdiff |
SELinux: add selinux_kernel_module_request
This patch adds a new selinux hook so SELinux can arbitrate if a given
process should be allowed to trigger a request for the kernel to try to
load a module. This is a different operation than a process trying to load
a module itself, which is already protected by CAP_SYS_MODULE.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
This patch adds a new selinux hook so SELinux can arbitrate if a given
process should be allowed to trigger a request for the kernel to try to
load a module. This is a different operation than a process trying to load
a module itself, which is already protected by CAP_SYS_MODULE.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
| security/selinux/hooks.c | diffblobblamehistory | |
| security/selinux/include/av_perm_to_string.h | diffblobblamehistory | |
| security/selinux/include/av_permissions.h | diffblobblamehistory |