kernel-ark/security
Eric Paris 788084aba2 Security/SELinux: seperate lsm specific mmap_min_addr
Currently SELinux enforcement of controls on the ability to map low memory
is determined by the mmap_min_addr tunable.  This patch causes SELinux to
ignore the tunable and instead use a seperate Kconfig option specific to how
much space the LSM should protect.

The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
permissions will always protect the amount of low memory designated by
CONFIG_LSM_MMAP_MIN_ADDR.

This allows users who need to disable the mmap_min_addr controls (usual reason
being they run WINE as a non-root user) to do so and still have SELinux
controls preventing confined domains (like a web server) from being able to
map some area of low memory.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
2009-08-17 15:09:11 +10:00
..
integrity/ima integrity: add ima_counts_put (updated) 2009-06-29 08:59:10 +10:00
keys keys: Handle there being no fallback destination keyring for request_key() 2009-04-09 10:41:19 -07:00
selinux Security/SELinux: seperate lsm specific mmap_min_addr 2009-08-17 15:09:11 +10:00
smack Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 2009-06-11 10:01:41 -07:00
tomoyo TOMOYO: Add description of lists and structures. 2009-06-09 09:30:24 +10:00
capability.c Capabilities: move cap_file_mmap to commoncap.c 2009-08-17 15:08:35 +10:00
commoncap.c Security/SELinux: seperate lsm specific mmap_min_addr 2009-08-17 15:09:11 +10:00
device_cgroup.c devcgroup: skip superfluous checks when found the DEV_ALL elem 2009-06-18 13:03:47 -07:00
inode.c securityfs: securityfs_remove should handle IS_ERR pointers 2009-05-12 11:06:11 +10:00
Kconfig Security/SELinux: seperate lsm specific mmap_min_addr 2009-08-17 15:09:11 +10:00
lsm_audit.c smack: implement logging V3 2009-04-14 09:00:19 +10:00
Makefile Security/SELinux: seperate lsm specific mmap_min_addr 2009-08-17 15:09:11 +10:00
min_addr.c Security/SELinux: seperate lsm specific mmap_min_addr 2009-08-17 15:09:11 +10:00
root_plug.c rootplug: Remove redundant initialization. 2009-05-27 13:30:46 +10:00
security.c security: use mmap_min_addr indepedently of security models 2009-06-04 12:07:48 +10:00