Lines Matching full:security

23  (*) Security model and SELinux.
25  (*) A note on security.
292 Security Model and SELinux
295 CacheFiles is implemented to deal properly with the LSM security features of
300 security context that is not appropriate for accessing the cache - either
305 The way CacheFiles works is to temporarily change the security context (fsuid,
306 fsgid and actor security label) that the process acts as - without changing the
307 security context of the process when it the target of an operation performed by
313  (1) Finds the security label attached to the root cache directory and uses
314      that as the security label with which it will create files.  By default,
319  (2) Finds the security label of the process which issued the bind request
324      and asks LSM to supply a security ID as which it should act given the
329      SELinux transitions the daemon's security ID to the module's security ID
339 The module's security ID gives it permission to create, move and remove files
344 The daemon's security ID gives it only a very restricted set of permissions: it
386 A Note on Security
389 CacheFiles makes use of the split security in the task_struct.  It allocates
394 bypassing security and calling inode ops directly.  Therefore the VFS and LSM
396 circumstances the caching code is running in the security context of whatever
399 Furthermore, should CacheFiles create a file or directory, the security
400 parameters with that object is created (UID, GID, security label) would be
405 What is required is to temporarily override the security of the process that
407 security data as that affects the process as an object, not just as a subject.
411 So CacheFiles makes use of a logical split in the security between the
412 objective security (task->real_cred) and the subjective security (task->cred).
413 The objective security holds the intrinsic security properties of a process and
418 The subjective security holds the active security properties of a process, and
424 for CacheFiles to run in a context of a specific security label, or to create
425 files and directories with another security label.