)]}'
{
  "commit": "44c2d9bdd7022ca7d240d5adc009296fc1c6ce08",
  "tree": "33115ee8d7e167d2a26558c2af8e0edfdca099d5",
  "parents": [
    "caabbdc07df4249f2ed516b2c3e2d6b0973bcbb3"
  ],
  "author": {
    "name": "KaiGai Kohei",
    "email": "kaigai@ak.jp.nec.com",
    "time": "Thu Jun 18 17:26:13 2009 +0900"
  },
  "committer": {
    "name": "James Morris",
    "email": "jmorris@namei.org",
    "time": "Fri Jun 19 00:12:28 2009 +1000"
  },
  "message": "Add audit messages on type boundary violations\n\nThe attached patch adds support to generate audit messages on two cases.\n\nThe first one is a case when a multi-thread process tries to switch its\nperforming security context using setcon(3), but new security context is\nnot bounded by the old one.\n\n  type\u003dSELINUX_ERR msg\u003daudit(1245311998.599:17):        \\\n      op\u003dsecurity_bounded_transition result\u003ddenied      \\\n      oldcontext\u003dsystem_u:system_r:httpd_t:s0           \\\n      newcontext\u003dsystem_u:system_r:guest_webapp_t:s0\n\nThe other one is a case when security_compute_av() masked any permissions\ndue to the type boundary violation.\n\n  type\u003dSELINUX_ERR msg\u003daudit(1245312836.035:32):\t\\\n      op\u003dsecurity_compute_av reason\u003dbounds              \\\n      scontext\u003dsystem_u:object_r:user_webapp_t:s0       \\\n      tcontext\u003dsystem_u:object_r:shadow_t:s0:c0         \\\n      tclass\u003dfile perms\u003dgetattr,open\n\nSigned-off-by: KaiGai Kohei \u003ckaigai@ak.jp.nec.com\u003e\nAcked-by:  Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "7f9b5fac87793a19faf3d310a4e04f8a158bb476",
      "old_mode": 33188,
      "old_path": "security/selinux/avc.c",
      "new_id": "4bf5d08a1f5c721efb46e9035429f7bf67e91f02",
      "new_mode": 33188,
      "new_path": "security/selinux/avc.c"
    },
    {
      "type": "modify",
      "old_id": "d12ff1a9c0aa5e383347af29f9f03fe96e626ed2",
      "old_mode": 33188,
      "old_path": "security/selinux/include/avc.h",
      "new_id": "46a940d9af6738802b0923ddb9299ea0adc6ea15",
      "new_mode": 33188,
      "new_path": "security/selinux/include/avc.h"
    },
    {
      "type": "modify",
      "old_id": "cad5765ca1cbb10a48523f9a51f48d75e1aee039",
      "old_mode": 33188,
      "old_path": "security/selinux/ss/services.c",
      "new_id": "a90cab207d9aea5bca459832f61cbbd2e54dde57",
      "new_mode": 33188,
      "new_path": "security/selinux/ss/services.c"
    }
  ]
}