smack: Implement the watch_key and post_notification hooks

Implement the watch_key security hook in Smack to make sure that a key grants the caller Read permission in order to set a watch on a key. Also implement the post_notification security hook to make sure that the notification source is granted Write permission by the watch queue. For the moment, the watch_devices security hook is left unimplemented as it's not obvious what the object should be since the queue is global and didn't previously exist.

David Howells committed 6 years ago

Commit a8478a61 parent 3e412cc2 files · +83 −1Browse files

Showing the changes to include/linux (1 of 2 files). Show all

Unified · Split

include/linux/lsm_audit.h+1−0

@@ -75,6 +75,7 @@ struct common_audit_data { · 74 unmodified lines
75	75	#define LSM_AUDIT_DATA_IBPKEY 13
76	76	#define LSM_AUDIT_DATA_IBENDPORT 14
77	77	#define LSM_AUDIT_DATA_LOCKDOWN 15
	78	+#define LSM_AUDIT_DATA_NOTIFICATION 16
78	79	union {
79	80	struct path path;
80	81	struct dentry *dentry;