linux/security/selinux
Eric Paris 0bce952799 SELinux: print denials for buggy kernel with unknown perms
Historically we've seen cases where permissions are requested for classes
where they do not exist.  In particular we have seen CIFS forget to set
i_mode to indicate it is a directory so when we later check something like
remove_name we have problems since it wasn't defined in tclass file.  This
used to result in a avc which included the permission 0x2000 or something.
Currently the kernel will deny the operations (good thing) but will not
print ANY information (bad thing).  First the auditdeny field is no
extended to include unknown permissions.  After that is fixed the logic in
avc_dump_query to output this information isn't right since it will remove
the permission from the av and print the phrase "<NULL>".  This takes us
back to the behavior before the classmap rewrite.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2009-11-24 14:30:49 +11:00
..
include selinux: generate flask headers during kernel build 2009-10-07 21:56:44 +11:00
ss SELinux: print denials for buggy kernel with unknown perms 2009-11-24 14:30:49 +11:00
.gitignore SELinux: add .gitignore files for dynamic classes 2009-10-24 09:42:27 +08:00
Kconfig selinux: Deprecate and schedule the removal of the the compat_net functionality 2008-12-31 12:54:11 -05:00
Makefile selinux: generate flask headers during kernel build 2009-10-07 21:56:44 +11:00
avc.c SELinux: print denials for buggy kernel with unknown perms 2009-11-24 14:30:49 +11:00
exports.c Creds: creds->security can be NULL is selinux is disabled 2009-09-14 12:34:07 +10:00
hooks.c security: report the module name to security_module_request 2009-11-10 09:33:46 +11:00
netif.c SELinux fixups needed for preemptable RCU from -rt 2008-04-22 15:37:23 +10:00
netlabel.c SELinux: Convert avc_audit to use lsm_audit.h 2009-08-17 08:37:18 +10:00
netlink.c SELinux: netlink.c whitespace, syntax, and static declaraction cleanups 2008-04-21 19:05:05 +10:00
netnode.c SELinux: keep the code clean formating and syntax 2008-07-14 15:01:36 +10:00
netport.c SELinux: keep the code clean formating and syntax 2008-07-14 15:01:36 +10:00
nlmsgtab.c SELinux: define audit permissions for audit tree netlink messages 2009-06-03 07:44:53 +10:00
selinuxfs.c selinux: dynamic class/perm discovery 2009-10-07 21:56:42 +11:00
xfrm.c SELinux: Convert avc_audit to use lsm_audit.h 2009-08-17 08:37:18 +10:00