On Tue, 21 Jul 2009, Eric Paris wrote: > error = security_file_mmap(file, reqprot, prot, flags, addr, 0); > if (error) > return error; > + > + if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO)) > + return -EACCES; > + These DAC checks should happen before the LSM hook, in keeping with the general design goal of LSM of "DAC before MAC", so that application behavior remains as consistent as possible. - James -- James Morris <jmorris@xxxxxxxxx> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
