Richard Haines 55d192691b selinux: allow FIOCLEX and FIONCLEX with policy capability ... [ Upstream commit 65881e1db4 ] These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux always allows too. Furthermore, a failed FIOCLEX could result in a file descriptor being leaked to a process that should not have access to it. As this patch removes access controls, a policy capability needs to be enabled in policy to always allow these ioctls. Based-on-patch-by: Demi Marie Obenour <demiobenour@gmail.com> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> [PM: subject line tweak] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-08 14:23:55 +02:00
..
include	selinux: allow FIOCLEX and FIONCLEX with policy capability	2022-04-08 14:23:55 +02:00
ss	selinux: fix double free of cond_list on error paths	2022-02-08 18:34:02 +01:00
.gitignore	…
Kconfig	…
Makefile	…
avc.c	…
hooks.c	selinux: allow FIOCLEX and FIONCLEX with policy capability	2022-04-08 14:23:55 +02:00
ibpkey.c	…
ima.c	selinux: fix misuse of mutex_is_locked()	2022-03-02 11:47:48 +01:00
netif.c	…
netlabel.c	…
netlink.c	…
netnode.c	…
netport.c	…
nlmsgtab.c	…
selinuxfs.c	selinux: check return value of sel_make_avc_files	2022-04-08 14:23:04 +02:00
status.c	…
xfrm.c	selinux: use correct type for context length	2022-04-08 14:23:55 +02:00