You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Eric Paris ed03218951 security: Protection for exploiting null dereference using mmap ... Add a new security check on mmap operations to see if the user is attempting to mmap to low area of the address space. The amount of space protected is indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to 0, preserving existing behavior. This patch uses a new SELinux security class "memprotect." Policy already contains a number of allow rules like a_t self:process * (unconfined_t being one of them) which mean that putting this check in the process class (its best current fit) would make it useless as all user processes, which we also want to protect against, would be allowed. By taking the memprotect name of the new class it will also make it possible for us to move some of the other memory protect permissions out of 'process' and into the new class next time we bump the policy version number (which I also think is a good future idea) Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>		18 years ago
..
av_inherit.h	…
av_perm_to_string.h	security: Protection for exploiting null dereference using mmap	18 years ago
av_permissions.h	security: Protection for exploiting null dereference using mmap	18 years ago
avc.h	SELinux: allow preemption between transition permission checks	18 years ago
avc_ss.h	…
class_to_string.h	security: Protection for exploiting null dereference using mmap	18 years ago
common_perm_to_string.h	…
conditional.h	…
flask.h	security: Protection for exploiting null dereference using mmap	18 years ago
initial_sid_to_string.h	…
netif.h	…
netlabel.h	SELinux: rename selinux_netlabel.h to netlabel.h	18 years ago
objsec.h	…
security.h	selinux: add selinuxfs structure for object class discovery	18 years ago
xfrm.h	…