linux/Documentation/admin-guide/LSM
Micah Morton aeca4e2ca6 LSM: add SafeSetID module that gates setid calls
SafeSetID gates the setid family of syscalls to restrict UID/GID
transitions from a given UID/GID to only those approved by a
system-wide whitelist. These restrictions also prohibit the given
UIDs/GIDs from obtaining auxiliary privileges associated with
CAP_SET{U/G}ID, such as allowing a user to set up user namespace UID
mappings. For now, only gating the set*uid family of syscalls is
supported, with support for set*gid coming in a future patch set.

Signed-off-by: Micah Morton <mortonm@chromium.org>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>
2019-01-25 11:22:45 -08:00
..
LoadPin.rst doc: ReSTify LoadPin.txt 2017-05-18 10:33:12 -06:00
SELinux.rst Documentation: Update SELinux reference policy URL 2018-11-19 12:40:48 -05:00
SafeSetID.rst LSM: add SafeSetID module that gates setid calls 2019-01-25 11:22:45 -08:00
Smack.rst Smack: Improve Documentation 2018-12-13 13:31:01 -08:00
Yama.rst yama: clarify ptrace_scope=2 in Yama documentation 2018-10-07 09:16:38 -06:00
apparmor.rst apparmor: update git and wiki locations in AppArmor docs 2018-06-07 01:50:47 -07:00
index.rst LSM: add SafeSetID module that gates setid calls 2019-01-25 11:22:45 -08:00
tomoyo.rst tomoyo: Update URLs in Documentation/admin-guide/LSM/tomoyo.rst 2017-07-25 11:00:26 +10:00