summaryrefslogtreecommitdiff
path: root/Documentation
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2014-11-05 07:53:55 -0500
committerSasha Levin <sasha.levin@oracle.com>2015-08-27 13:25:53 -0400
commit36ac1d14682122e3d792c66c8ae8d6d1bd093547 (patch)
tree589fb540dd00bdf0aac4ac2bcff567185dd71e51 /Documentation
parent9a957a6622ab900a78a256d8c9d941b618135980 (diff)
downloadlwn-36ac1d14682122e3d792c66c8ae8d6d1bd093547.tar.gz
lwn-36ac1d14682122e3d792c66c8ae8d6d1bd093547.zip
ima: extend "mask" policy matching support
[ Upstream commit 747cadeb108665b0474624a374aa9e13f12c9274 ] commit 4351c294b8c1028077280f761e158d167b592974 upstream. The current "mask" policy option matches files opened as MAY_READ, MAY_WRITE, MAY_APPEND or MAY_EXEC. This patch extends the "mask" option to match files opened containing one of these modes. For example, "mask=^MAY_READ" would match files opened read-write. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Dr. Greg Wettstein <gw@idfusion.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'Documentation')
-rw-r--r--Documentation/ABI/testing/ima_policy3
1 files changed, 2 insertions, 1 deletions
diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 9d0f54176a75..724cd429eac6 100644
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -27,7 +27,8 @@ Description:
base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
[FIRMWARE_CHECK]
- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
+ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
+ [[^]MAY_EXEC]
fsmagic:= hex value
fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
uid:= decimal value