diff options
author | Stephen Smalley <sds@tycho.nsa.gov> | 2015-05-21 13:38:09 -0400 |
---|---|---|
committer | Jason Zaman <jason@perfinion.com> | 2015-05-22 23:16:43 +0400 |
commit | 5d7e4b4d3aaaa9c10ad44b821125b050def062e8 (patch) | |
tree | 55b08ad1063660ceb7a852913c8341570b014376 /policy/flask/access_vectors | |
parent | Add "binder" security class and access vectors (diff) | |
download | hardened-refpolicy-5d7e4b4d3aaaa9c10ad44b821125b050def062e8.tar.gz hardened-refpolicy-5d7e4b4d3aaaa9c10ad44b821125b050def062e8.tar.bz2 hardened-refpolicy-5d7e4b4d3aaaa9c10ad44b821125b050def062e8.zip |
Update netlink socket classes.
Define new netlink socket security classes introduced by kernel commit
223ae516404a7a65f09e79a1c0291521c233336e.
Note that this does not remove the long-since obsolete
netlink_firewall_socket and netlink_ip6_fw_socket classes
from refpolicy in case they are still needed for legacy
distribution policies.
Add the new socket classes to socket_class_set.
Update ubac and mls constraints for the new socket classes.
Add allow rules for a few specific known cases (netutils, iptables,
netlabel, ifconfig, udev) in core policy that require access.
Further refinement for the contrib tree will be needed. Any allow
rule previously written on :netlink_socket may need to be rewritten or
duplicated for one of the more specific classes. For now, we retain the
existing :netlink_socket rules for compatibility on older kernels.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'policy/flask/access_vectors')
-rw-r--r-- | policy/flask/access_vectors | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors index 2b20aa0f..056cdd7c 100644 --- a/policy/flask/access_vectors +++ b/policy/flask/access_vectors @@ -852,6 +852,30 @@ class binder transfer } +class netlink_iscsi_socket +inherits socket + +class netlink_fib_lookup_socket +inherits socket + +class netlink_connector_socket +inherits socket + +class netlink_netfilter_socket +inherits socket + +class netlink_generic_socket +inherits socket + +class netlink_scsitransport_socket +inherits socket + +class netlink_rdma_socket +inherits socket + +class netlink_crypto_socket +inherits socket + class x_pointer inherits x_device |