• Eric Paris's avatar
    Security/SELinux: seperate lsm specific mmap_min_addr · 788084ab
    Eric Paris authored
    Currently SELinux enforcement of controls on the ability to map low memory
    is determined by the mmap_min_addr tunable.  This patch causes SELinux to
    ignore the tunable and instead use a seperate Kconfig option specific to how
    much space the LSM should protect.
    
    The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
    permissions will always protect the amount of low memory designated by
    CONFIG_LSM_MMAP_MIN_ADDR.
    
    This allows users who need to disable the mmap_min_addr controls (usual reason
    being they run WINE as a non-root user) to do so and still have SELinux
    controls preventing confined domains (like a web server) from being able to
    map some area of low memory.
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    788084ab
commoncap.c 27.8 KB