diff options
| author | Eric Paris | 2013-05-24 15:18:04 +0200 |
|---|---|---|
| committer | Eric Paris | 2013-11-05 17:08:13 +0100 |
| commit | d040e5af380554c23ffe0a034ae5f3e53da93a1d (patch) | |
| tree | 637a2e206c56b1cd2be32f8ef92bea19e25a3e9c /include/uapi/linux/audit.h | |
| parent | audit: allow unsetting the loginuid (with priv) (diff) | |
| download | kernel-qcow2-linux-d040e5af380554c23ffe0a034ae5f3e53da93a1d.tar.gz kernel-qcow2-linux-d040e5af380554c23ffe0a034ae5f3e53da93a1d.tar.xz kernel-qcow2-linux-d040e5af380554c23ffe0a034ae5f3e53da93a1d.zip | |
audit: audit feature to only allow unsetting the loginuid
This is a new audit feature which only grants processes with
CAP_AUDIT_CONTROL the ability to unset their loginuid. They cannot
directly set it from a valid uid to another valid uid. The ability to
unset the loginuid is nice because a priviledged task, like that of
container creation, can unset the loginuid and then priv is not needed
inside the container when a login daemon needs to set the loginuid.
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'include/uapi/linux/audit.h')
| -rw-r--r-- | include/uapi/linux/audit.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index 9eddf2ca614f..05e5e8fc2ac4 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -386,7 +386,8 @@ struct audit_features { __u32 lock; /* which features to lock */ }; -#define AUDIT_LAST_FEATURE -1 +#define AUDIT_FEATURE_ONLY_UNSET_LOGINUID 0 +#define AUDIT_LAST_FEATURE AUDIT_FEATURE_ONLY_UNSET_LOGINUID #define audit_feature_valid(x) ((x) >= 0 && (x) <= AUDIT_LAST_FEATURE) #define AUDIT_FEATURE_TO_MASK(x) (1 << ((x) & 31)) /* mask for __u32 */ |