diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2017-05-18 16:58:31 -0400 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2017-05-23 10:23:50 -0400 |
| commit | 4dc2fce342f8e5b165e2eda29a39446bb07b2457 (patch) | |
| tree | 29e9f11e0be92036b11c47c7cb75d38752e9ebba /security/selinux/selinuxfs.c | |
| parent | ccb544781d34afdb73a9a73ae53035d824d193bf (diff) | |
selinux: log policy capability state when a policy is loaded
Log the state of SELinux policy capabilities when a policy is loaded.
For each policy capability known to the kernel, log the policy capability
name and the value set in the policy. For policy capabilities that are
set in the loaded policy but unknown to the kernel, log the policy
capability index, since this is the only information presently available
in the policy.
Sample output with a policy created with a new capability defined
that is not known to the kernel:
SELinux: policy capability network_peer_controls=1
SELinux: policy capability open_perms=1
SELinux: policy capability extended_socket_class=1
SELinux: policy capability always_check_network=0
SELinux: policy capability cgroup_seclabel=0
SELinux: unknown policy capability 5
Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/32
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/selinuxfs.c')
| -rw-r--r-- | security/selinux/selinuxfs.c | 13 |
1 files changed, 2 insertions, 11 deletions
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 50062e70140d..82adb78a58f7 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c | |||
| @@ -41,15 +41,6 @@ | |||
| 41 | #include "objsec.h" | 41 | #include "objsec.h" |
| 42 | #include "conditional.h" | 42 | #include "conditional.h" |
| 43 | 43 | ||
| 44 | /* Policy capability filenames */ | ||
| 45 | static char *policycap_names[] = { | ||
| 46 | "network_peer_controls", | ||
| 47 | "open_perms", | ||
| 48 | "extended_socket_class", | ||
| 49 | "always_check_network", | ||
| 50 | "cgroup_seclabel" | ||
| 51 | }; | ||
| 52 | |||
| 53 | unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; | 44 | unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; |
| 54 | 45 | ||
| 55 | static int __init checkreqprot_setup(char *str) | 46 | static int __init checkreqprot_setup(char *str) |
| @@ -1750,9 +1741,9 @@ static int sel_make_policycap(void) | |||
| 1750 | sel_remove_entries(policycap_dir); | 1741 | sel_remove_entries(policycap_dir); |
| 1751 | 1742 | ||
| 1752 | for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) { | 1743 | for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) { |
| 1753 | if (iter < ARRAY_SIZE(policycap_names)) | 1744 | if (iter < ARRAY_SIZE(selinux_policycap_names)) |
| 1754 | dentry = d_alloc_name(policycap_dir, | 1745 | dentry = d_alloc_name(policycap_dir, |
| 1755 | policycap_names[iter]); | 1746 | selinux_policycap_names[iter]); |
| 1756 | else | 1747 | else |
| 1757 | dentry = d_alloc_name(policycap_dir, "unknown"); | 1748 | dentry = d_alloc_name(policycap_dir, "unknown"); |
| 1758 | 1749 | ||