[PATCH] capabilities: audit capability use
Paul Moore
paul at paul-moore.com
Tue Jul 12 22:00:06 UTC 2016
On Tue, Jul 12, 2016 at 9:16 AM, Eric W. Biederman
<ebiederm at xmission.com> wrote:
> Not logging capabilities outside of the initial user namespace is
> certainly the conservative place to start, and what selinux does.
FYI, we added some basic userns capability smarts to SELinux in Linux 4.7.
commit 8e4ff6f228e4722cac74db716e308d1da33d744f
Author: Stephen Smalley <sds at tycho.nsa.gov>
Date: Fri Apr 8 13:52:00 2016 -0400
selinux: distinguish non-init user namespace capability checks
Distinguish capability checks against a target associated
with the init user namespace versus capability checks against
a target associated with a non-init user namespace by defining
and using separate security classes for the latter.
This is needed to support e.g. Chrome usage of user namespaces
for the Chrome sandbox without needing to allow Chrome to also
exercise capabilities on targets in the init user namespace.
Suggested-by: Dan Walsh <dwalsh at redhat.com>
Signed-off-by: Stephen Smalley <sds at tycho.nsa.gov>
Signed-off-by: Paul Moore <paul at paul-moore.com>
--
paul moore
www.paul-moore.com
More information about the Linux-audit
mailing list