tree 07b4d852471258117f0acbfa47e9aaac84042e92
parent 888d283c30784bb61d4bd10878c85634b31da1d3
author Stephen Smalley <sds@tycho.nsa.gov> 1396529498 -0400
committer Stephen Smalley <sds@tycho.nsa.gov> 1396529498 -0400

Exclude audit-related capabilities from unconfined domains.

Require them to be explicitly granted by specific allow rules.
audit_write is required to write an audit message from userspace.
audit_control is required to configure the audit subsystem.

Change-Id: I5aa4e3228f9b0bde3570689fe7a0d68e56861a17
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>