kernel/linux.git/security/selinux/Kconfig, branch linux-4.4.y

selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default

2015-10-21T21:44:25+00:00

Change the SELinux checkreqprot default value to 0 so that SELinux performs access control checking on the actual memory protections used by the kernel and not those requested by the application. Signed-off-by: Paul Moore

selinux: Deprecate and schedule the removal of the the compat_net functionality

2008-12-31T17:54:11+00:00

This patch is the first step towards removing the old "compat_net" code from the kernel. Secmark, the "compat_net" replacement was first introduced in 2.6.18 (September 2006) and the major Linux distributions with SELinux support have transitioned to Secmark so it is time to start deprecating the "compat_net" mechanism. Testing a patched version of 2.6.28-rc6 with the initial release of Fedora Core 5 did not show any problems when running in enforcing mode. This patch adds an entry to the feature-removal-schedule.txt file and removes the SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT configuration option, forcing Secmark on by default although it can still be disabled at runtime. The patch also makes the Secmark permission checks "dynamic" in the sense that they are only executed when Secmark is configured; this should help prevent problems with older distributions that have not yet migrated to Secmark. Signed-off-by: Paul Moore Acked-by: James Morris

Update selinux info in MAINTAINERS and Kconfig help text

2008-09-11T14:44:08+00:00

Update the SELinux entry in MAINTAINERS and drop the obsolete information from the selinux Kconfig help text. Signed-off-by: Stephen Smalley Signed-off-by: James Morris

selinux: introduce permissive types

2008-04-18T10:26:11+00:00

Introduce the concept of a permissive type. A new ebitmap is introduced to the policy database which indicates if a given type has the permissive bit set or not. This bit is tested for the scontext of any denial. The bit is meaningless on types which only appear as the target of a decision and never the source. A domain running with a permissive type will be allowed to perform any action similarly to when the system is globally set permissive. Signed-off-by: Eric Paris Acked-by: Stephen Smalley Signed-off-by: James Morris

SELinux: Add a capabilities bitmap to SELinux policy version 22

2008-01-29T21:17:23+00:00

Add a new policy capabilities bitmap to SELinux policy version 22. This bitmap will enable the security server to query the policy to determine which features it supports. Signed-off-by: Paul Moore Signed-off-by: James Morris

Fix trivial typos in Kconfig* files

2007-05-09T05:12:20+00:00

Fix several typos in help text in Kconfig* files. Signed-off-by: David Sterba Signed-off-by: Adrian Bunk

Still more typo fixes

2006-10-03T20:36:44+00:00

Signed-off-by: Adrian Bunk

more misc typo fixes

2006-10-03T20:34:14+00:00

Signed-off-by: Adrian Bunk

[PATCH] selinux: add support for range transitions on object classes

2006-09-26T15:48:52+00:00

Introduces support for policy version 21. This version of the binary kernel policy allows for defining range transitions on security classes other than the process security class. As always, backwards compatibility for older formats is retained. The security class is read in as specified when using the new format, while the "process" security class is assumed when using an older policy format. Signed-off-by: Darrel Goeddel Signed-off-by: Stephen Smalley Acked-by: James Morris Acked-by: Eric Paris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] selinux: enable configuration of max policy version

2006-09-26T15:48:52+00:00

Enable configuration of SELinux maximum supported policy version to support legacy userland (init) that does not gracefully handle kernels that support newer policy versions two or more beyond the installed policy, as in FC3 and FC4. [bunk@stusta.de: improve Kconfig help text] Signed-off-by: Stephen Smalley Acked-by: James Morris Acked-by: Eric Paris Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds