• Tetsuo Handa's avatar
    TOMOYO: Allow domain transition without execve(). · 731d37aa
    Tetsuo Handa authored
    To be able to split permissions for Apache's CGI programs which are executed
    without execve(), add special domain transition which is performed by writing
    a TOMOYO's domainname to /sys/kernel/security/tomoyo/self_domain interface.
    
    This is an API for TOMOYO-aware userland applications. However, since I expect
    TOMOYO and other LSM modules to run in parallel, this patch does not use
    /proc/self/attr/ interface in order to avoid conflicts with other LSM modules
    when it became possible to run multiple LSM modules in parallel.
    Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    731d37aa
common.c 74.6 KB