* [refpolicy] [PATCH] refpolicy: Define getrlimit permission for class process
@ 2017-05-17 15:33 Stephen Smalley
2017-05-17 21:59 ` Chris PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Stephen Smalley @ 2017-05-17 15:33 UTC (permalink / raw)
To: refpolicy
This permission was added to the kernel in commit 791ec491c372
("prlimit,security,selinux: add a security hook for prlimit")
circa Linux 4.12 in order to control the ability to get the resource
limits of another process. It is only checked when acting on another
process, so getrlimit permission is not required for use of getrlimit(2).
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
policy/flask/access_vectors | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index 69f69af..6204e68 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -383,6 +383,7 @@ class process
execheap
setkeycreate
setsockcreate
+ getrlimit
}
--
2.9.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH] refpolicy: Define getrlimit permission for class process
2017-05-17 15:33 [refpolicy] [PATCH] refpolicy: Define getrlimit permission for class process Stephen Smalley
@ 2017-05-17 21:59 ` Chris PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Chris PeBenito @ 2017-05-17 21:59 UTC (permalink / raw)
To: refpolicy
On 05/17/2017 11:33 AM, Stephen Smalley via refpolicy wrote:
> This permission was added to the kernel in commit 791ec491c372
> ("prlimit,security,selinux: add a security hook for prlimit")
> circa Linux 4.12 in order to control the ability to get the resource
> limits of another process. It is only checked when acting on another
> process, so getrlimit permission is not required for use of getrlimit(2).
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> policy/flask/access_vectors | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
> index 69f69af..6204e68 100644
> --- a/policy/flask/access_vectors
> +++ b/policy/flask/access_vectors
> @@ -383,6 +383,7 @@ class process
> execheap
> setkeycreate
> setsockcreate
> + getrlimit
> }
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-05-17 21:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-17 15:33 [refpolicy] [PATCH] refpolicy: Define getrlimit permission for class process Stephen Smalley
2017-05-17 21:59 ` Chris PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.