Re: [PATCH -v2 1/2] VM/SELinux: require CAP_SYS_RAWIO for allmmap_zero operations

[James Morris]

On Tue, 21 Jul 2009, Eric Paris wrote:

>  	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
>  	if (error)
>  		return error;
> +
> +	if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
> +		return -EACCES;
> +

These DAC checks should happen before the LSM hook, in keeping with the 
general design goal of LSM of "DAC before MAC", so that application 
behavior remains as consistent as possible.


- James
-- 
James Morris
<jmorris@xxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/