selinux-refpolicy/policy/modules/system/netlabel.te

policy_module(netlabel, 1.3.1)

########################################
#
# Declarations
#

type netlabel_mgmt_t;
type netlabel_mgmt_exec_t;
application_domain(netlabel_mgmt_t, netlabel_mgmt_exec_t)
role system_r types netlabel_mgmt_t;

########################################
#
# NetLabel Management Tools Local policy
#

# modify the network subsystem configuration
allow netlabel_mgmt_t self:capability net_admin;
allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
allow netlabel_mgmt_t self:netlink_generic_socket create_socket_perms;

kernel_read_network_state(netlabel_mgmt_t)

files_read_etc_files(netlabel_mgmt_t)

seutil_use_newrole_fds(netlabel_mgmt_t)

userdom_use_user_terminals(netlabel_mgmt_t)
Module version bump for updated netlink sockets from Stephen Smalley 2015-05-22 12:38:53 +00:00			`policy_module(netlabel, 1.3.1)`
merge netlabel stuff from labeled-networking branch 2006-10-17 16:58:17 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type netlabel_mgmt_t;`
			`type netlabel_mgmt_exec_t;`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`application_domain(netlabel_mgmt_t, netlabel_mgmt_exec_t)`
trunk: 3 more cherry picked Fedora fixes from David Hrdeman. 2008-07-25 12:11:14 +00:00			`role system_r types netlabel_mgmt_t;`
merge netlabel stuff from labeled-networking branch 2006-10-17 16:58:17 +00:00
			`########################################`
			`#`
			`# NetLabel Management Tools Local policy`
			`#`

			`# modify the network subsystem configuration`
			`allow netlabel_mgmt_t self:capability net_admin;`
			`allow netlabel_mgmt_t self:netlink_socket create_socket_perms;`
Update netlink socket classes. Define new netlink socket security classes introduced by kernel commit 223ae516404a7a65f09e79a1c0291521c233336e. Note that this does not remove the long-since obsolete netlink_firewall_socket and netlink_ip6_fw_socket classes from refpolicy in case they are still needed for legacy distribution policies. Add the new socket classes to socket_class_set. Update ubac and mls constraints for the new socket classes. Add allow rules for a few specific known cases (netutils, iptables, netlabel, ifconfig, udev) in core policy that require access. Further refinement for the contrib tree will be needed. Any allow rule previously written on :netlink_socket may need to be rewritten or duplicated for one of the more specific classes. For now, we retain the existing :netlink_socket rules for compatibility on older kernels. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2015-05-21 17:38:09 +00:00			`allow netlabel_mgmt_t self:netlink_generic_socket create_socket_perms;`
merge netlabel stuff from labeled-networking branch 2006-10-17 16:58:17 +00:00
			`kernel_read_network_state(netlabel_mgmt_t)`

trunk: 5 patches from dan. 2007-09-04 18:57:58 +00:00			`files_read_etc_files(netlabel_mgmt_t)`

merge netlabel stuff from labeled-networking branch 2006-10-17 16:58:17 +00:00			`seutil_use_newrole_fds(netlabel_mgmt_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
			`userdom_use_user_terminals(netlabel_mgmt_t)`