summaryrefslogtreecommitdiff
path: root/kernel/audit.c
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2013-05-24 09:18:04 -0400
committerEric Paris <eparis@redhat.com>2013-11-05 11:08:13 -0500
commitd040e5af380554c23ffe0a034ae5f3e53da93a1d (patch)
tree637a2e206c56b1cd2be32f8ef92bea19e25a3e9c /kernel/audit.c
parent81407c84ace88368ff23abb81caaeacf050c8450 (diff)
audit: audit feature to only allow unsetting the loginuid
This is a new audit feature which only grants processes with CAP_AUDIT_CONTROL the ability to unset their loginuid. They cannot directly set it from a valid uid to another valid uid. The ability to unset the loginuid is nice because a priviledged task, like that of container creation, can unset the loginuid and then priv is not needed inside the container when a login daemon needs to set the loginuid. Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'kernel/audit.c')
-rw-r--r--kernel/audit.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/audit.c b/kernel/audit.c
index 29ee6a421c6c..fbfa3a74decb 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -144,7 +144,8 @@ static struct audit_features af = {.vers = AUDIT_FEATURE_VERSION,
.features = 0,
.lock = 0,};
-static char *audit_feature_names[0] = {
+static char *audit_feature_names[1] = {
+ "only_unset_loginuid",
};