788084aba2
Currently SELinux enforcement of controls on the ability to map low memory is determined by the mmap_min_addr tunable. This patch causes SELinux to ignore the tunable and instead use a seperate Kconfig option specific to how much space the LSM should protect. The tunable will now only control the need for CAP_SYS_RAWIO and SELinux permissions will always protect the amount of low memory designated by CONFIG_LSM_MMAP_MIN_ADDR. This allows users who need to disable the mmap_min_addr controls (usual reason being they run WINE as a non-root user) to do so and still have SELinux controls preventing confined domains (like a web server) from being able to map some area of low memory. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
29 lines
896 B
Makefile
29 lines
896 B
Makefile
#
|
|
# Makefile for the kernel security code
|
|
#
|
|
|
|
obj-$(CONFIG_KEYS) += keys/
|
|
subdir-$(CONFIG_SECURITY_SELINUX) += selinux
|
|
subdir-$(CONFIG_SECURITY_SMACK) += smack
|
|
subdir-$(CONFIG_SECURITY_TOMOYO) += tomoyo
|
|
|
|
# always enable default capabilities
|
|
obj-y += commoncap.o min_addr.o
|
|
|
|
# Object file lists
|
|
obj-$(CONFIG_SECURITY) += security.o capability.o
|
|
obj-$(CONFIG_SECURITYFS) += inode.o
|
|
# Must precede capability.o in order to stack properly.
|
|
obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o
|
|
obj-$(CONFIG_SECURITY_SMACK) += smack/built-in.o
|
|
ifeq ($(CONFIG_AUDIT),y)
|
|
obj-$(CONFIG_SECURITY_SMACK) += lsm_audit.o
|
|
endif
|
|
obj-$(CONFIG_SECURITY_TOMOYO) += tomoyo/built-in.o
|
|
obj-$(CONFIG_SECURITY_ROOTPLUG) += root_plug.o
|
|
obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o
|
|
|
|
# Object integrity file lists
|
|
subdir-$(CONFIG_IMA) += integrity/ima
|
|
obj-$(CONFIG_IMA) += integrity/ima/built-in.o
|