From 64dbf07474d011540ca479a2e87fe998f570d6e3 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Mon, 31 Mar 2008 12:17:33 +1100 Subject: selinux: introduce permissive types Introduce the concept of a permissive type. A new ebitmap is introduced to the policy database which indicates if a given type has the permissive bit set or not. This bit is tested for the scontext of any denial. The bit is meaningless on types which only appear as the target of a decision and never the source. A domain running with a permissive type will be allowed to perform any action similarly to when the system is globally set permissive. Signed-off-by: Eric Paris Acked-by: Stephen Smalley Signed-off-by: James Morris --- security/selinux/avc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'security/selinux/avc.c') diff --git a/security/selinux/avc.c b/security/selinux/avc.c index cb3f0ce0b00a..a4fc6e6d038a 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -893,12 +893,13 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid, denied = requested & ~(p_ae->avd.allowed); if (denied) { - if (selinux_enforcing || (flags & AVC_STRICT)) + if (flags & AVC_STRICT) rc = -EACCES; + else if (!selinux_enforcing || security_permissive_sid(ssid)) + avc_update_node(AVC_CALLBACK_GRANT, requested, ssid, + tsid, tclass); else - if (node) - avc_update_node(AVC_CALLBACK_GRANT,requested, - ssid,tsid,tclass); + rc = -EACCES; } rcu_read_unlock(); -- cgit v1.2.3