linux/security/selinux
Eric Paris 788084aba2 Security/SELinux: seperate lsm specific mmap_min_addr
Currently SELinux enforcement of controls on the ability to map low memory
is determined by the mmap_min_addr tunable.  This patch causes SELinux to
ignore the tunable and instead use a seperate Kconfig option specific to how
much space the LSM should protect.

The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
permissions will always protect the amount of low memory designated by
CONFIG_LSM_MMAP_MIN_ADDR.

This allows users who need to disable the mmap_min_addr controls (usual reason
being they run WINE as a non-root user) to do so and still have SELinux
controls preventing confined domains (like a web server) from being able to
map some area of low memory.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2009-08-17 15:09:11 +10:00
..
include SELinux: move SELINUX_MAGIC into magic.h 2009-05-19 08:19:00 +10:00
ss Permissive domain in userspace object manager 2009-04-02 09:23:45 +11:00
avc.c Permissive domain in userspace object manager 2009-04-02 09:23:45 +11:00
exports.c CRED: Wrap current->cred and a few other accessors 2008-11-14 10:39:18 +11:00
hooks.c Security/SELinux: seperate lsm specific mmap_min_addr 2009-08-17 15:09:11 +10:00
Kconfig selinux: Deprecate and schedule the removal of the the compat_net functionality 2008-12-31 12:54:11 -05:00
Makefile SELinux: Add network port SID cache 2008-04-18 20:26:16 +10:00
netif.c SELinux fixups needed for preemptable RCU from -rt 2008-04-22 15:37:23 +10:00
netlabel.c netlabel: Label incoming TCP connections correctly in SELinux 2009-03-28 15:01:36 +11:00
netlink.c SELinux: netlink.c whitespace, syntax, and static declaraction cleanups 2008-04-21 19:05:05 +10:00
netnode.c SELinux: keep the code clean formating and syntax 2008-07-14 15:01:36 +10:00
netport.c SELinux: keep the code clean formating and syntax 2008-07-14 15:01:36 +10:00
nlmsgtab.c SELinux: define audit permissions for audit tree netlink messages 2009-06-03 07:44:53 +10:00
selinuxfs.c selinux: remove obsolete read buffer limit from sel_read_bool 2009-05-19 23:56:11 +10:00
xfrm.c net: skb->dst accessors 2009-06-03 02:51:04 -07:00