Stephen Smalley 8e4ff6f228 selinux: distinguish non-init user namespace capability checks ... Distinguish capability checks against a target associated with the init user namespace versus capability checks against a target associated with a non-init user namespace by defining and using separate security classes for the latter. This is needed to support e.g. Chrome usage of user namespaces for the Chrome sandbox without needing to allow Chrome to also exercise capabilities on targets in the init user namespace. Suggested-by: Dan Walsh <dwalsh@redhat.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>		2016-04-26 15:41:43 -04:00
..
audit.h	SELinux: keep the code clean formating and syntax	2008-07-14 15:01:36 +10:00
avc_ss.h	selinux: sparse fix: fix several warnings in the security server code	2011-09-09 16:56:32 -07:00
avc.h	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	2015-08-15 13:29:57 +10:00
classmap.h	selinux: distinguish non-init user namespace capability checks	2016-04-26 15:41:43 -04:00
conditional.h	selinux: Change bool variable name to index.	2016-04-14 11:24:50 -04:00
initial_sid_to_string.h	selinux: const strings in tables	2010-03-08 09:33:53 +11:00
netif.h	selinux: make the netif cache namespace aware	2014-09-10 17:09:57 -04:00
netlabel.h	doc: Update the email address for Paul Moore in various source files	2011-08-01 17:58:33 -07:00
netnode.h	selinux: reduce the number of calls to synchronize_net() when flushing caches	2014-06-26 14:33:56 -04:00
netport.h	selinux: reduce the number of calls to synchronize_net() when flushing caches	2014-06-26 14:33:56 -04:00
objsec.h	selinux: simply inode label states to INVALID and INITIALIZED	2016-04-05 16:10:55 -04:00
security.h	selinux: export validatetrans decisions	2015-12-24 11:09:41 -05:00
xfrm.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-25 20:29:20 -04:00