diff options
| author | Eric Paris <eparis@redhat.com> | 2010-07-23 11:44:15 -0400 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2010-08-02 15:35:09 +1000 |
| commit | b424485abe2b16580a178b469917a7b6ee0c152a (patch) | |
| tree | d90d4662dd1ad229976354e4caa1a7632fb2a6d3 /security | |
| parent | 49b7b8de46d293113a0a0bb026ff7bd833c73367 (diff) | |
SELinux: Move execmod to the common perms
execmod "could" show up on non regular files and non chr files. The current
implementation would actually make these checks against non-existant bits
since the code assumes the execmod permission is same for all file types.
To make this line up for chr files we had to define execute_no_trans and
entrypoint permissions. These permissions are unreachable and only existed
to to make FILE__EXECMOD and CHR_FILE__EXECMOD the same. This patch drops
those needless perms as well.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/include/classmap.h | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index 41990cbba76..b4c9eb4bd6f 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -3,7 +3,7 @@ #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ "rename", "execute", "swapon", "quotaon", "mounton", "audit_access", \ - "open" + "open", "execmod" #define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \ "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \ @@ -44,7 +44,7 @@ struct security_class_mapping secclass_map[] = { "quotaget", NULL } }, { "file", { COMMON_FILE_PERMS, - "execute_no_trans", "entrypoint", "execmod", NULL } }, + "execute_no_trans", "entrypoint", NULL } }, { "dir", { COMMON_FILE_PERMS, "add_name", "remove_name", "reparent", "search", "rmdir", NULL } }, @@ -52,8 +52,7 @@ struct security_class_mapping secclass_map[] = { { "lnk_file", { COMMON_FILE_PERMS, NULL } }, { "chr_file", - { COMMON_FILE_PERMS, - "execute_no_trans", "entrypoint", "execmod", NULL } }, + { COMMON_FILE_PERMS, NULL } }, { "blk_file", { COMMON_FILE_PERMS, NULL } }, { "sock_file", |