tree 16308f0324846cd8c19180b6a45793268dd16f50
parent d4ee4231a3a8731576ef0e0a7e1225e4fde1e659
author Eric Paris <eparis@redhat.com> 1204221520 -0500
committer James Morris <jmorris@namei.org> 1208514366 +1000

SELinux: create new open permission

Adds a new open permission inside SELinux when 'opening' a file.  The idea
is that opening a file and reading/writing to that file are not the same
thing.  Its different if a program had its stdout redirected to /tmp/output
than if the program tried to directly open /tmp/output. This should allow
policy writers to more liberally give read/write permissions across the
policy while still blocking many design and programing flaws SELinux is so
good at catching today.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>