• Casey Schaufler's avatar
    smack: limit privilege by label · 15446235
    Casey Schaufler authored
    There have been a number of requests to make the Smack LSM
    enforce MAC even in the face of privilege, either capability
    based or superuser based. This is not universally desired,
    however, so it seems desirable to make it optional. Further,
    at least one legacy OS implemented a scheme whereby only
    processes running with one particular label could be exempt
    from MAC. This patch supports these three cases.
    
    If /smack/onlycap is empty (unset or null-string) privilege
    is enforced in the normal way.
    
    If /smack/onlycap contains a label only processes running with
    that label may be MAC exempt.
    
    If the label in /smack/onlycap is the star label ("*") the
    semantics of the star label combine with the privilege
    restrictions to prevent any violations of MAC, even in the
    presence of privilege.
    
    Again, this will be independent of the privilege scheme.
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    Reviewed-by: default avatarJames Morris <jmorris@namei.org>
    15446235
smack.h 5.56 KB