selinux: Only audit permissions specified in policy
authorStephen Smalley <sds@tycho.nsa.gov>
Tue, 2 Feb 2010 16:31:51 +0000 (11:31 -0500)
committerJames Morris <jmorris@namei.org>
Tue, 2 Feb 2010 21:49:10 +0000 (08:49 +1100)
commitb6cac5a30b325e14cda425670bb3568d3cad0aa8
tree276a3a2a985c862ac9439cb2f8facabb7d1f1944
parent8e2d39a1665e680c095545993aac2fcac6916eb9
selinux: Only audit permissions specified in policy

Only audit the permissions specified by the policy rules.

Before:
type=AVC msg=audit(01/28/2010 14:30:46.690:3250) : avc:  denied  { read
append } for  pid=14092 comm=foo name=test_file dev=dm-1 ino=132932
scontext=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:rpm_tmp_t:s0 tclass=file

After:
type=AVC msg=audit(01/28/2010 14:52:37.448:26) : avc:  denied
{ append } for  pid=1917 comm=foo name=test_file dev=dm-1 ino=132932
scontext=unconfined_u:unconfined_r:load_policy_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:rpm_tmp_t:s0 tclass=file

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=558499

Reported-by: Tom London <selinux@gmail.com>
Signed-off-by: Stephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
security/selinux/avc.c