selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID.

Browse source

If the callee SID is bounded by the caller SID, then allowing
the transition to occur poses no risk of privilege escalation and we can
therefore safely allow the transition to occur.  Add this exemption
for both the case where a transition was explicitly requested by the
application and the case where an automatic transition is defined in
policy.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Paul Moore <pmoore@redhat.com>

...

This commit is contained in:

Stephen Smalley 2014-08-04 13:36:49 -04:00 • committed by Paul Moore

parent aa9e0de81b

commit 7b0d0b40cd

1 changed files with 47 additions and 12 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

59

security/selinux/hooks.c

View file