diff options
| author | Eric Paris <eparis@redhat.com> | 2008-03-31 12:17:33 +1100 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2008-04-18 20:26:11 +1000 |
| commit | 64dbf07474d011540ca479a2e87fe998f570d6e3 (patch) | |
| tree | 364ae3f3a29f06246dd2097674586fe508c4445f /security/selinux/Kconfig | |
| parent | 0356357c5158c71d4cbf20196b2f784435dd916c (diff) | |
| download | lwn-64dbf07474d011540ca479a2e87fe998f570d6e3.tar.gz lwn-64dbf07474d011540ca479a2e87fe998f570d6e3.zip | |
selinux: introduce permissive types
Introduce the concept of a permissive type. A new ebitmap is introduced to
the policy database which indicates if a given type has the permissive bit
set or not. This bit is tested for the scontext of any denial. The bit is
meaningless on types which only appear as the target of a decision and never
the source. A domain running with a permissive type will be allowed to
perform any action similarly to when the system is globally set permissive.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/Kconfig')
| -rw-r--r-- | security/selinux/Kconfig | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig index 2b517d618672..a436d1cfa88b 100644 --- a/security/selinux/Kconfig +++ b/security/selinux/Kconfig @@ -145,7 +145,7 @@ config SECURITY_SELINUX_POLICYDB_VERSION_MAX config SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE int "NSA SELinux maximum supported policy format version value" depends on SECURITY_SELINUX_POLICYDB_VERSION_MAX - range 15 22 + range 15 23 default 19 help This option sets the value for the maximum policy format version |