Hi,
Dan had mentioned that he wanted a new selinux permission to separate
the ability to turn on tty auditing from the ability of setting audit rules.
It looks to me like the process that reads also writes, so only one new
permission is needed.
Signed-off-by: Steve Grubb <sgrubb@xxxxxxxxxx>
security/selinux/include/av_permissions.h | 1 +
security/selinux/nlmsgtab.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff -urp linux-2.6.24.x86_64.orig/security/selinux/include/av_permissions.h linux-2.6.24.x86_64/security/selinux/include/av_permissions.h
--- linux-2.6.24.x86_64.orig/security/selinux/include/av_permissions.h 2008-03-06 17:13:22.000000000 -0500
+++ linux-2.6.24.x86_64/security/selinux/include/av_permissions.h 2008-03-06 17:41:29.000000000 -0500
@@ -702,6 +702,7 @@
#define NETLINK_AUDIT_SOCKET__NLMSG_WRITE 0x00800000UL
#define NETLINK_AUDIT_SOCKET__NLMSG_RELAY 0x01000000UL
#define NETLINK_AUDIT_SOCKET__NLMSG_READPRIV 0x02000000UL
+#define NETLINK_AUDIT_SOCKET__NLMSG_TTY 0x04000000UL
#define NETLINK_IP6FW_SOCKET__IOCTL 0x00000001UL
#define NETLINK_IP6FW_SOCKET__READ 0x00000002UL
#define NETLINK_IP6FW_SOCKET__WRITE 0x00000004UL
diff -urp linux-2.6.24.x86_64.orig/security/selinux/nlmsgtab.c linux-2.6.24.x86_64/security/selinux/nlmsgtab.c
--- linux-2.6.24.x86_64.orig/security/selinux/nlmsgtab.c 2008-03-06 17:13:22.000000000 -0500
+++ linux-2.6.24.x86_64/security/selinux/nlmsgtab.c 2008-03-06 17:41:09.000000000 -0500
@@ -110,8 +110,8 @@ static struct nlmsg_perm nlmsg_audit_per
{ AUDIT_DEL_RULE, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
{ AUDIT_USER, NETLINK_AUDIT_SOCKET__NLMSG_RELAY },
{ AUDIT_SIGNAL_INFO, NETLINK_AUDIT_SOCKET__NLMSG_READ },
- { AUDIT_TTY_GET, NETLINK_AUDIT_SOCKET__NLMSG_READ },
- { AUDIT_TTY_SET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
+ { AUDIT_TTY_GET, NETLINK_AUDIT_SOCKET__NLMSG_TTY },
+ { AUDIT_TTY_SET, NETLINK_AUDIT_SOCKET__NLMSG_TTY },
};
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
