[patch 2/4] permission mapping for sys_syslog operations

2006-12-24 Thread Zack Weinberg
As suggested by Stephen Smalley: map the various sys_syslog operations to a smaller set of privilege codes before calling security modules. This patch changes the security module interface! There should be no change in the actual security semantics enforced by dummy, capability, nor SELinux (with

Re: [patch 2/4] permission mapping for sys_syslog operations

2006-12-15 Thread Randy Dunlap
On Thu, 14 Dec 2006 17:21:25 -0800 Zack Weinberg wrote: > On 12/14/06, Randy Dunlap <[EMAIL PROTECTED]> wrote: > > > +#define security_syslog_or_fail(type) do { \ > > > + int error = security_syslog(type); \ > > > + if (error) \ >

Re: [patch 2/4] permission mapping for sys_syslog operations

2006-12-14 Thread Zack Weinberg
On 12/14/06, Randy Dunlap <[EMAIL PROTECTED]> wrote: > +#define security_syslog_or_fail(type) do { \ > + int error = security_syslog(type); \ > + if (error) \ > + return error; \ > + } wh

Re: [patch 2/4] permission mapping for sys_syslog operations

2006-12-14 Thread Randy Dunlap
On Thu, 14 Dec 2006 16:16:41 -0800 Zack Weinberg wrote: > As suggested by Stephen Smalley: map the various sys_syslog operations > to a smaller set of privilege codes before calling security modules. > This patch changes the security module interface! There should be no > change in the actual sec

[patch 2/4] permission mapping for sys_syslog operations

2006-12-14 Thread Zack Weinberg
As suggested by Stephen Smalley: map the various sys_syslog operations to a smaller set of privilege codes before calling security modules. This patch changes the security module interface! There should be no change in the actual security semantics enforced by dummy, capability, nor SELinux (with