tree 637a2e206c56b1cd2be32f8ef92bea19e25a3e9c
parent 81407c84ace88368ff23abb81caaeacf050c8450
author Eric Paris <eparis@redhat.com> 1369401484 -0400
committer Eric Paris <eparis@redhat.com> 1383667693 -0500

audit: audit feature to only allow unsetting the loginuid

This is a new audit feature which only grants processes with
CAP_AUDIT_CONTROL the ability to unset their loginuid.  They cannot
directly set it from a valid uid to another valid uid.  The ability to
unset the loginuid is nice because a priviledged task, like that of
container creation, can unset the loginuid and then priv is not needed
inside the container when a login daemon needs to set the loginuid.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>