• Eric Paris's avatar
    selinux: introduce permissive types · 64dbf074
    Eric Paris authored
    Introduce the concept of a permissive type.  A new ebitmap is introduced to
    the policy database which indicates if a given type has the permissive bit
    set or not.  This bit is tested for the scontext of any denial.  The bit is
    meaningless on types which only appear as the target of a decision and never
    the source.  A domain running with a permissive type will be allowed to
    perform any action similarly to when the system is globally set permissive.
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    64dbf074
policydb.h 7.92 KB