audit: audit feature to only allow unsetting the loginuid
authorEric Paris <eparis@redhat.com>
Fri, 24 May 2013 13:18:04 +0000 (09:18 -0400)
committerEric Paris <eparis@redhat.com>
Tue, 5 Nov 2013 16:08:13 +0000 (11:08 -0500)
commitd040e5af380554c23ffe0a034ae5f3e53da93a1d
tree637a2e206c56b1cd2be32f8ef92bea19e25a3e9c
parent81407c84ace88368ff23abb81caaeacf050c8450
audit: audit feature to only allow unsetting the loginuid

This is a new audit feature which only grants processes with
CAP_AUDIT_CONTROL the ability to unset their loginuid.  They cannot
directly set it from a valid uid to another valid uid.  The ability to
unset the loginuid is nice because a priviledged task, like that of
container creation, can unset the loginuid and then priv is not needed
inside the container when a login daemon needs to set the loginuid.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
include/uapi/linux/audit.h
kernel/audit.c
kernel/auditsc.c