commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541
author Michal Schmidt <mschmidt@redhat.com> Thu Aug 20 14:39:52 2009 -0700
committer James Morris <jmorris@namei.org> Mon Aug 24 11:33:40 2009 +1000
tree 0d2f864e4673df4abf994e222616651409a91c0a
parent 939a9421eb53d3ea83188ae13802779041caefdb

bsdacct: switch credentials for writing to the accounting file

When process accounting is enabled, every exiting process writes a log to
the account file.  In addition, every once in a while one of the exiting
processes checks whether there's enough free space for the log.

SELinux policy may or may not allow the exiting process to stat the fs.
So unsuspecting processes start generating AVC denials just because
someone enabled process accounting.

For these filesystem operations, the exiting process's credentials should
be temporarily switched to that of the process which enabled accounting,
because it's really that process which wanted to have the accounting
information logged.

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Morris <jmorris@namei.org>