selinux lsm IB/core: Implement LSM notification system

Browse source

Add a generic notificaiton mechanism in the LSM. Interested consumers
can register a callback with the LSM and security modules can produce
events.

Because access to Infiniband QPs are enforced in the setup phase of a
connection security should be enforced again if the policy changes.
Register infiniband devices for policy change notification and check all
QPs on that device when the notification is received.

Add a call to the notification mechanism from SELinux when the AVC
cache changes or setenforce is cleared.

Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Acked-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Daniel Jurgens 2017-05-19 15:48:53 +03:00 • committed by Paul Moore

parent d291f1a652

commit 8f408ab64b

5 changed files with 109 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

53

drivers/infiniband/core/device.c

View file

23

include/linux/security.h

View file

20

security/security.c

View file

11

security/selinux/hooks.c

View file

2

security/selinux/selinuxfs.c

View file