summaryrefslogtreecommitdiff
path: root/lib/decompress.c
diff options
context:
space:
mode:
authorJeff Vander Stoep <jeffv@google.com>2016-04-05 13:06:27 -0700
committerPaul Moore <paul@paul-moore.com>2016-04-05 16:11:56 -0400
commit61d612ea731e57dc510472fb746b55cdc017f371 (patch)
treeb44c2c0228284fffaa2f7a09de7bae85da0a3d72 /lib/decompress.c
parent0c6181cb301fd04a5800920ba423be753b0a4a01 (diff)
selinux: restrict kernel module loading
Utilize existing kernel_read_file hook on kernel module load. Add module_load permission to the system class. Enforces restrictions on kernel module origin when calling the finit_module syscall. The hook checks that source type has permission module_load for the target type. Example for finit_module: allow foo bar_file:system module_load; Similarly restrictions are enforced on kernel module loading when calling the init_module syscall. The hook checks that source type has permission module_load with itself as the target object because the kernel module is sourced from the calling process. Example for init_module: allow foo foo:system module_load; Signed-off-by: Jeff Vander Stoep <jeffv@google.com> [PM: fixed return value of selinux_kernel_read_file()] Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'lib/decompress.c')
0 files changed, 0 insertions, 0 deletions