Jeff Vander Stoep c2e10e5cb2 BACKPORT: selinux: restrict kernel module loading ... Backport notes: Backport uses kernel_module_from_file not kernel_read_file hook. kernel_read_file replaced kernel_module_from_file in the 4.6 kernel. There are no inode_security_() helper functions (also introduced in 4.6) so the inode lookup is done using the file_inode() helper which is standard for kernel version < 4.6. (Cherry picked from commit 61d612ea73) Utilize existing kernel_read_file hook on kernel module load. Add module_load permission to the system class. Enforces restrictions on kernel module origin when calling the finit_module syscall. The hook checks that source type has permission module_load for the target type. Example for finit_module: allow foo bar_file:system module_load; Similarly restrictions are enforced on kernel module loading when calling the init_module syscall. The hook checks that source type has permission module_load with itself as the target object because the kernel module is sourced from the calling process. Example for init_module: allow foo foo:system module_load; Bug: 27824855 Change-Id: I64bf3bd1ab2dc735321160642dc6bbfa996f8068 Signed-off-by: Jeff Vander Stoep <jeffv@google.com> Signed-off-by: Paul Moore <paul@paul-moore.com>		2016-05-19 12:32:41 +05:30
..
audit.h	SELinux: keep the code clean formating and syntax	2008-07-14 15:01:36 +10:00
avc.h	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	2015-08-15 13:29:57 +10:00
avc_ss.h	selinux: sparse fix: fix several warnings in the security server code	2011-09-09 16:56:32 -07:00
classmap.h	BACKPORT: selinux: restrict kernel module loading	2016-05-19 12:32:41 +05:30
conditional.h
initial_sid_to_string.h	selinux: const strings in tables	2010-03-08 09:33:53 +11:00
netif.h	selinux: make the netif cache namespace aware	2014-09-10 17:09:57 -04:00
netlabel.h	doc: Update the email address for Paul Moore in various source files	2011-08-01 17:58:33 -07:00
netnode.h	selinux: reduce the number of calls to synchronize_net() when flushing caches	2014-06-26 14:33:56 -04:00
netport.h	selinux: reduce the number of calls to synchronize_net() when flushing caches	2014-06-26 14:33:56 -04:00
objsec.h	selinux: make the netif cache namespace aware	2014-09-10 17:09:57 -04:00
security.h	selinux: introduce security_context_str_to_sid	2015-10-21 17:44:25 -04:00
xfrm.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-25 20:29:20 -04:00