Log the state of SELinux policy capabilities when a policy is loaded.
For each policy capability known to the kernel, log the policy capability
name and the value set in the policy. For policy capabilities that are
set in the loaded policy but unknown to the kernel, log the policy
capability index, since this is the only information presently available
in the policy.
Sample output with a policy created with a new capability defined
that is not known to the kernel:
SELinux: policy capability network_peer_controls=1
SELinux: policy capability open_perms=1
SELinux: policy capability extended_socket_class=1
SELinux: policy capability always_check_network=0
SELinux: policy capability cgroup_seclabel=0
SELinux: unknown policy capability 5
Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/32
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
(cherry picked from commit 4dc2fce342f8e5b165e2eda29a39446bb07b2457)
Resolved conflicts with extended_socket_class and cgroup_seclabel
policy capabilities. These are referred to as "compat1" and "compat2"
in the change to preserve compatibility with the policy binary.
Neither of these policy capabilities are appropriate for backporting
as they will break Treble backwards-compat requirements.
Change-Id: Ic1c37514b742829904e3c9536a865f29150658ce
Bug: 140252993
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Rapherion Rollerscaperers <rapherion@raphielgang.org>
Signed-off-by: Chenyang Zhong <zhongcy95@gmail.com>
Signed-off-by: Sorayukii <sorayukii69@gmail.com>
e5a7717966