tree 711aaf6c5e1d8bdd57138e8baf3a369ed832602d
parent 006ebb40d3d65338bd74abb03b945f8d60e362bd
author Stephen Smalley <sds@tycho.nsa.gov> 1211393772 -0400
committer James Morris <jmorris@namei.org> 1216011712 +1000

SELinux: enable processes with mac_admin to get the raw inode contexts

Enable processes with CAP_MAC_ADMIN + mac_admin permission in policy
to get undefined contexts on inodes.  This extends the support for
deferred mapping of security contexts in order to permit restorecon
and similar programs to see the raw file contexts unknown to the
system policy in order to check them.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>