tree 12041949c45c2f394d6a96041c39e07ad6df720b
parent b7e724d303b684655e4ca3dabd5a6840ad19012d
author Eric Paris <eparis@redhat.com> 1325611515 -0500
committer Eric Paris <eparis@redhat.com> 1325807574 -0500

capabilities: introduce security_capable_noaudit

Exactly like security_capable except don't audit any denials.  This is for
places where the kernel may make decisions about what to do if a task has a
given capability, but which failing that capability is not a sign of a
security policy violation.  An example is checking if a task has
CAP_SYS_ADMIN to lower it's likelyhood of being killed by the oom killer.
This check is not a security violation if it is denied.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Serge E. Hallyn <serge.hallyn@canonical.com>