RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/netlabel.te

30 lines
722 B
Plaintext
Raw Normal View History

Bump module versions for release.
2017-08-05 16:59:42 +00:00
policy_module(netlabel, 1.6.0)
merge netlabel stuff from labeled-networking branch
2006-10-17 16:58:17 +00:00
########################################
#
# Declarations
#
type netlabel_mgmt_t;
type netlabel_mgmt_exec_t;
trunk: whitespace fixes
2009-06-26 14:40:13 +00:00
application_domain(netlabel_mgmt_t, netlabel_mgmt_exec_t)
trunk: 3 more cherry picked Fedora fixes from David Hrdeman.
2008-07-25 12:11:14 +00:00
role system_r types netlabel_mgmt_t;
merge netlabel stuff from labeled-networking branch
2006-10-17 16:58:17 +00:00
########################################
#
# NetLabel Management Tools Local policy
#
# modify the network subsystem configuration
allow netlabel_mgmt_t self:capability net_admin;
allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
Update netlink socket classes. Define new netlink socket security classes introduced by kernel commit 223ae516404a7a65f09e79a1c0291521c233336e. Note that this does not remove the long-since obsolete netlink_firewall_socket and netlink_ip6_fw_socket classes from refpolicy in case they are still needed for legacy distribution policies. Add the new socket classes to socket_class_set. Update ubac and mls constraints for the new socket classes. Add allow rules for a few specific known cases (netutils, iptables, netlabel, ifconfig, udev) in core policy that require access. Further refinement for the contrib tree will be needed. Any allow rule previously written on :netlink_socket may need to be rewritten or duplicated for one of the more specific classes. For now, we retain the existing :netlink_socket rules for compatibility on older kernels. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-05-21 17:38:09 +00:00
allow netlabel_mgmt_t self:netlink_generic_socket create_socket_perms;
merge netlabel stuff from labeled-networking branch
2006-10-17 16:58:17 +00:00
kernel_read_network_state(netlabel_mgmt_t)
trunk: 5 patches from dan.
2007-09-04 18:57:58 +00:00
files_read_etc_files(netlabel_mgmt_t)
merge netlabel stuff from labeled-networking branch
2006-10-17 16:58:17 +00:00
seutil_use_newrole_fds(netlabel_mgmt_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
userdom_use_user_terminals(netlabel_mgmt_t)