| 2945 |
Garbage collector thread is created using kthread_create() since 2.6.7. |
Garbage collector thread is created using kthread_create() since 2.6.7. |
| 2946 |
Kernel threads created by kthread_create() does not need to call |
Kernel threads created by kthread_create() does not need to call |
| 2947 |
daemonize(). |
daemonize(). |
| 2948 |
|
|
| 2949 |
|
Fix 2011/09/16 |
| 2950 |
|
|
| 2951 |
|
@ Allow specifying domain transition preference. |
| 2952 |
|
|
| 2953 |
|
I got an opinion that it is difficult to use exception policy's domain |
| 2954 |
|
transition control directives because they need to match the pathname |
| 2955 |
|
specified to "file execute" directives. For example, if "file execute |
| 2956 |
|
/bin/\*\-ls\-cat" is given, corresponding domain transition control |
| 2957 |
|
directive needs to be like "no_keep_domain /bin/\*\-ls\-cat from any". |
| 2958 |
|
|
| 2959 |
|
To solve this difficulty, I introduced optional argument that supersedes |
| 2960 |
|
exception policy's domain transition control directives. |
| 2961 |
|
|
| 2962 |
|
file execute /bin/ls keep exec.realpath="/bin/ls" exec.argv[0]="ls" |
| 2963 |
|
file execute /bin/cat keep exec.realpath="/bin/cat" exec.argv[0]="cat" |
| 2964 |
|
file execute /bin/\*\-ls\-cat child |
| 2965 |
|
file execute /usr/sbin/httpd <apache> exec.realpath="/usr/sbin/httpd" exec.argv[0]="/usr/sbin/httpd" |
| 2966 |
|
|
| 2967 |
|
This argument allows transition to different domains based on conditions. |
| 2968 |
|
|
| 2969 |
|
<kernel> /usr/sbin/sshd |
| 2970 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //batch-session exec.argc=2 exec.argv[1]="-c" |
| 2971 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //root-session task.uid=0 |
| 2972 |
|
file execute /bin/bash <kernel> /usr/sbin/sshd //nonroot-session task.uid!=0 |
| 2973 |
|
|
| 2974 |
|
Fix 2011/09/25 |
| 2975 |
|
|
| 2976 |
|
@ Simplify garbage collector. |
| 2977 |
|
|
| 2978 |
|
It turned out that use of batched processing tends to choke garbage |
| 2979 |
|
collector when certain pattern of entries are queued. Thus, I replaced it |
| 2980 |
|
with sequential processing. |
| 2981 |
|
|
| 2982 |
|
Version 1.8.3 2011/XX/XX Usability enhancement release. |
TOMOYO
Parent Directory
Revision Log
Patch