diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in index f5a2563eb..b70e8436c 100644 --- a/policy/modules/kernel/corenetwork.if.in +++ b/policy/modules/kernel/corenetwork.if.in @@ -151,8 +151,23 @@ interface(`corenet_server_packet',` ## Related interface: ##

## +##

+## Example client being able to connect to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:tcp_socket create_stream_socket_perms; +## corenet_tcp_sendrecv_generic_if(myclient_t) +## corenet_tcp_sendrecv_generic_node(myclient_t) +## corenet_tcp_sendrecv_all_ports(myclient_t) +## corenet_tcp_connect_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

## ## ## @@ -256,8 +271,21 @@ interface(`corenet_dontaudit_udp_receive_generic_if',` ## Related interface: ##

## +##

+## Example client being able to send to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:udp_socket create_socket_perms; +## corenet_udp_sendrecv_generic_if(myclient_t) +## corenet_udp_sendrecv_generic_node(myclient_t) +## corenet_udp_sendrecv_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

## ## ## @@ -525,8 +553,23 @@ interface(`corenet_raw_sendrecv_all_if',` ## Related interface: ##

## +##

+## Example client being able to connect to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:tcp_socket create_stream_socket_perms; +## corenet_tcp_sendrecv_generic_if(myclient_t) +## corenet_tcp_sendrecv_generic_node(myclient_t) +## corenet_tcp_sendrecv_all_ports(myclient_t) +## corenet_tcp_connect_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

## ## ## @@ -592,8 +635,21 @@ interface(`corenet_udp_receive_generic_node',` ## Related interface: ##

##
    +##
  • corenet_all_recvfrom_unlabeled()
  • ##
  • corenet_udp_sendrecv_generic_if()
  • +##
  • corenet_udp_sendrecv_all_ports()
  • ##
+##

+## Example client being able to send to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:udp_socket create_socket_perms; +## corenet_udp_sendrecv_generic_if(myclient_t) +## corenet_udp_sendrecv_generic_node(myclient_t) +## corenet_udp_sendrecv_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

## ## ## @@ -1199,9 +1255,24 @@ interface(`corenet_tcp_connect_generic_port',` ## Related interfaces: ##

##
    +##
  • corenet_all_recvfrom_unlabeled()
  • +##
  • corenet_tcp_sendrecv_generic_if()
  • +##
  • corenet_tcp_sendrecv_generic_node()
  • ##
  • corenet_tcp_connect_all_ports()
  • ##
  • corenet_tcp_bind_all_ports()
  • ##
+##

+## Example client being able to connect to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:tcp_socket create_stream_socket_perms; +## corenet_tcp_sendrecv_generic_if(myclient_t) +## corenet_tcp_sendrecv_generic_node(myclient_t) +## corenet_tcp_sendrecv_all_ports(myclient_t) +## corenet_tcp_connect_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

## ## ## @@ -1264,8 +1335,22 @@ interface(`corenet_udp_receive_all_ports',` ## Related interfaces: ##

##
    +##
  • corenet_all_recvfrom_unlabeled()
  • +##
  • corenet_udp_sendrecv_generic_if()
  • +##
  • corenet_udp_sendrecv_generic_node()
  • ##
  • corenet_udp_bind_all_ports()
  • ##
+##

+## Example client being able to send to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:udp_socket create_socket_perms; +## corenet_udp_sendrecv_generic_if(myclient_t) +## corenet_udp_sendrecv_generic_node(myclient_t) +## corenet_udp_sendrecv_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

## ## ## @@ -1357,11 +1442,39 @@ interface(`corenet_dontaudit_udp_bind_all_ports',` ## ## Connect TCP sockets to all ports. ## +## +##

+## Connect TCP sockets to all ports +##

+##

+## Related interfaces: +##

+##
    +##
  • corenet_all_recvfrom_unlabeled()
  • +##
  • corenet_tcp_sendrecv_generic_if()
  • +##
  • corenet_tcp_sendrecv_generic_node()
  • +##
  • corenet_tcp_sendrecv_all_ports()
  • +##
  • corenet_tcp_bind_all_ports()
  • +##
+##

+## Example client being able to connect to all ports over +## generic nodes, without labeled networking: +##

+##

+## allow myclient_t self:tcp_socket create_stream_socket_perms; +## corenet_tcp_sendrecv_generic_if(myclient_t) +## corenet_tcp_sendrecv_generic_node(myclient_t) +## corenet_tcp_sendrecv_all_ports(myclient_t) +## corenet_tcp_connect_all_ports(myclient_t) +## corenet_all_recvfrom_unlabeled(myclient_t) +##

+##
## ## -## The type of the process performing this action. +## Domain allowed access. ## ## +## # interface(`corenet_tcp_connect_all_ports',` gen_require(`