Kernel bump from 4.1.3-rt to 4.1.7-rt.

[kvmfornfv.git] / kernel / Documentation / ABI / testing / ima_policy

diff --git a/kernel/Documentation/ABI/testing/ima_policy b/kernel/Documentation/ABI/testing/ima_policy
index d0d0c57..0a378a8 100644 (file)
--- a/kernel/Documentation/ABI/testing/ima_policy
+++ b/kernel/Documentation/ABI/testing/ima_policy
@@ -20,17 +20,19 @@ Description:
                action: measure | dont_measure | appraise | dont_appraise | audit
                condition:= base | lsm  [option]
                        base:   [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
-                                [fowner]]
+                               [euid=] [fowner=]]
                        lsm:    [[subj_user=] [subj_role=] [subj_type=]
                                 [obj_user=] [obj_role=] [obj_type=]]
                        option: [[appraise_type=]] [permit_directio]
 
                base:   func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
                                [FIRMWARE_CHECK]
-                       mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
+                       mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
+                              [[^]MAY_EXEC]
                        fsmagic:= hex value
                        fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
                        uid:= decimal value
+                       euid:= decimal value
                        fowner:=decimal value
                lsm:    are LSM specific
                option: appraise_type:= [imasig]
@@ -49,11 +51,25 @@ Description:
                        dont_measure fsmagic=0x01021994
                        dont_appraise fsmagic=0x01021994
                        # RAMFS_MAGIC
-                       dont_measure fsmagic=0x858458f6
                        dont_appraise fsmagic=0x858458f6
+                       # DEVPTS_SUPER_MAGIC
+                       dont_measure fsmagic=0x1cd1
+                       dont_appraise fsmagic=0x1cd1
+                       # BINFMTFS_MAGIC
+                       dont_measure fsmagic=0x42494e4d
+                       dont_appraise fsmagic=0x42494e4d
                        # SECURITYFS_MAGIC
                        dont_measure fsmagic=0x73636673
                        dont_appraise fsmagic=0x73636673
+                       # SELINUX_MAGIC
+                       dont_measure fsmagic=0xf97cff8c
+                       dont_appraise fsmagic=0xf97cff8c
+                       # CGROUP_SUPER_MAGIC
+                       dont_measure fsmagic=0x27e0eb
+                       dont_appraise fsmagic=0x27e0eb
+                       # NSFS_MAGIC
+                       dont_measure fsmagic=0x6e736673
+                       dont_appraise fsmagic=0x6e736673
 
                        measure func=BPRM_CHECK
                        measure func=FILE_MMAP mask=MAY_EXEC
@@ -70,10 +86,6 @@ Description:
                Examples of LSM specific definitions:
 
                SELinux:
-                       # SELINUX_MAGIC
-                       dont_measure fsmagic=0xf97cff8c
-                       dont_appraise fsmagic=0xf97cff8c
-
                        dont_measure obj_type=var_log_t
                        dont_appraise obj_type=var_log_t
                        dont_measure obj_type=auditd_log_t