diff options
| author |   Stephen Smalley <sds@tycho.nsa.gov> | 2017-05-18 16:00:39 -0400 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2020-02-15 15:26:20 +0800 |
| commit | 8c38998a0c3024ef16de5fdc1bc12cef5c521759 (patch) | |
| tree | e100cf73681e81c3679b08a654ba8f7709180af3 /policy/modules/services/rgmanager.te | |
| parent | Vagrant: allow VirtualBox provisionning to use dhclient and ip (diff) | |
| download | hardened-refpolicy-8c38998a0c3024ef16de5fdc1bc12cef5c521759.tar.gz hardened-refpolicy-8c38998a0c3024ef16de5fdc1bc12cef5c521759.tar.bz2 hardened-refpolicy-8c38998a0c3024ef16de5fdc1bc12cef5c521759.zip | |
access_vectors: Remove unused permissions
Remove unused permission definitions from SELinux.
Many of these were only ever used in pre-mainline
versions of SELinux, prior to Linux 2.6.0. Some of them
were used in the legacy network or compat_net=1 checks
that were disabled by default in Linux 2.6.18 and
fully removed in Linux 2.6.30.
The corresponding classmap declarations were removed from the
mainline kernel in:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42a9699a9fa179c0054ea3cf5ad3cc67104a6162
Permissions never used in mainline Linux:
file swapon
filesystem transition
tcp_socket { connectto newconn acceptfrom }
node enforce_dest
unix_stream_socket { newconn acceptfrom }
Legacy network checks, removed in 2.6.30:
socket { recv_msg send_msg }
node { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send }
netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send }
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
Diffstat (limited to 'policy/modules/services/rgmanager.te')
| -rw-r--r-- | policy/modules/services/rgmanager.te | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/policy/modules/services/rgmanager.te b/policy/modules/services/rgmanager.te index ef34242b..2096ddba 100644 --- a/policy/modules/services/rgmanager.te +++ b/policy/modules/services/rgmanager.te @@ -104,7 +104,6 @@ miscfiles_read_localization(rgmanager_t) tunable_policy(`rgmanager_can_network_connect',` corenet_sendrecv_all_client_packets(rgmanager_t) corenet_tcp_connect_all_ports(rgmanager_t) - corenet_tcp_sendrecv_all_ports(rgmanager_t) ') optional_policy(` |