]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit - security/selinux/hooks.c
selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID.
authorStephen Smalley <sds@tycho.nsa.gov>
Mon, 4 Aug 2014 17:36:49 +0000 (13:36 -0400)
committerPaul Moore <pmoore@redhat.com>
Thu, 28 Aug 2014 15:37:12 +0000 (11:37 -0400)
commit7b0d0b40cd78cadb525df760ee4cac151533c2b5
treeab2fa10cfd86c0db24135b34bcaf7cbff8674c75
parentaa9e0de81b5b257f6dae48efe2ed5f255f066497
selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID.

If the callee SID is bounded by the caller SID, then allowing
the transition to occur poses no risk of privilege escalation and we can
therefore safely allow the transition to occur.  Add this exemption
for both the case where a transition was explicitly requested by the
application and the case where an automatic transition is defined in
policy.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Paul Moore <pmoore@redhat.com>
security/selinux/hooks.c