tree c526c2ae841b0fc358d29af69cddcdb63ae72431
parent 01fa8474fba7e80f6a2ac31d0790385a993cb7ba
author Rafal Krypa <r.krypa@samsung.com> 1433237028 +0200
committer Casey Schaufler <casey@schaufler-ca.com> 1433271222 -0700

Smack: allow multiple labels in onlycap

Smack onlycap allows limiting of CAP_MAC_ADMIN and CAP_MAC_OVERRIDE to
processes running with the configured label. But having single privileged
label is not enough in some real use cases. On a complex system like Tizen,
there maybe few programs that need to configure Smack policy in run-time
and running them all with a single label is not always practical.
This patch extends onlycap feature for multiple labels. They are configured
in the same smackfs "onlycap" interface, separated by spaces.

Signed-off-by: Rafal Krypa <r.krypa@samsung.com>