Chad Sellers b94c7e677b SELinux: validate kernel object classes and permissions ... This is a new object class and permission validation scheme that validates against the defined kernel headers. This scheme allows extra classes and permissions that do not conflict with the kernel definitions to be added to the policy. This validation is now done for all policy loads, not just subsequent loads after the first policy load. The implementation walks the three structrures containing the defined object class and permission values and ensures their values are the same in the policy being loaded. This includes verifying the object classes themselves, the permissions they contain, and the permissions they inherit from commons. Classes or permissions that are present in the kernel but missing from the policy cause a warning (printed to KERN_INFO) to be printed, but do not stop the policy from loading, emulating current behavior. Any other inconsistencies cause the load to fail. Signed-off-by: Chad Sellers <csellers@tresys.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>		2006-11-28 12:04:38 -05:00
..
keys
selinux	SELinux: validate kernel object classes and permissions	2006-11-28 12:04:38 -05:00
capability.c
commoncap.c	[PATCH] pidspace: is_init()	2006-09-29 09:18:12 -07:00
dummy.c	IPsec: correct semantics for SELinux policy matching	2006-10-11 23:59:37 -07:00
inode.c	[PATCH] r/o bind mount prepwork: inc_nlink() helper	2006-10-01 00:39:30 -07:00
Kconfig	[PATCH] LSM: remove BSD secure level security module	2006-09-29 09:18:10 -07:00
Makefile	[PATCH] LSM: remove BSD secure level security module	2006-09-29 09:18:10 -07:00
root_plug.c
security.c