commit 25354c4fee169710fd9da15f3bb2abaa24dcf933
author Eric Paris <eparis@redhat.com> Thu Aug 13 09:45:03 2009 -0400
committer James Morris <jmorris@namei.org> Fri Aug 14 11:18:40 2009 +1000
tree 7fb462945c15ce09392ae858c8ae757290b5ed2d
parent 9188499cdb117d86a1ea6b04374095b098d56936

SELinux: add selinux_kernel_module_request

This patch adds a new selinux hook so SELinux can arbitrate if a given
process should be allowed to trigger a request for the kernel to try to
load a module.  This is a different operation than a process trying to load
a module itself, which is already protected by CAP_SYS_MODULE.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

security/selinux/include/av_permissions.h

diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index d645192..21c7226 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -508,6 +508,7 @@
 #define SYSTEM__SYSLOG_READ                       0x00000002UL
 #define SYSTEM__SYSLOG_MOD                        0x00000004UL
 #define SYSTEM__SYSLOG_CONSOLE                    0x00000008UL
+#define SYSTEM__MODULE_REQUEST                    0x00000010UL
 #define CAPABILITY__CHOWN                         0x00000001UL
 #define CAPABILITY__DAC_OVERRIDE                  0x00000002UL
 #define CAPABILITY__DAC_READ_SEARCH               0x00000004UL