Commit Graph

11 Commits

Author SHA1 Message Date
Daniel Jurgens 25a5b24274 refpolicy: Infiniband pkeys and endports
Every Infiniband network will have a default pkey, so that is labeled.
The rest of the pkey configuration is network specific. The policy allows
access to the default and unlabeled pkeys for sysadm and staff users.
kernel_t is allowed access to all pkeys, which it needs to process and
route management datagrams.

Endports are all unlabeled by default, sysadm users are allowed to
manage the subnet on unlabeled endports. kernel_t is allowed to manage
the subnet on all ibendports, which is required for configuring the HCA.

This patch requires selinux series: "SELinux user space support for
Infiniband RDMA", due to the new ipkeycon labeling mechanism.

Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
2017-05-24 19:23:18 -04:00
Chris PeBenito 332c3a5fc4 Fix corenetwork port declaration to choose either reserved or unreserved.
This changes the port declarations for cases where a type is used for
ports above and below 1024.  The old code would give both the reserved
and unreserved port attribute.  This new code only gives the reserved
port attribute.
2011-10-04 15:31:08 -04:00
Chris PeBenito a108d9db60 Enhance corenetwork network_port() macro to support ports that do not have a well defined port number, such as stunnel. 2011-09-14 12:17:22 -04:00
Chris PeBenito ec70a331ff Corenetwork policy size optimization from Dan Walsh. 2011-08-26 09:03:25 -04:00
Chris PeBenito 21fdee9dd5 Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh.
We went back and reread the bindreservport code in glibc.

Turns out the range or ports that this will reserve are 512-1024 rather
then 600-1024.

The code actually first tries to reserve a port from 600-1024 and if
they are ALL reserved will try 512-599.

So we need to change corenetwork to reflect this.
2010-07-19 14:22:44 -04:00
Chris PeBenito 3829eecb12 Clean up output of generated corenetwork.te. 2010-04-13 11:52:09 -04:00
Chris PeBenito 85e71c86da Fix network_port() in corenetwork to correctly handle port ranges. 2010-04-13 11:06:02 -04:00
Chris PeBenito 019dfaf9dc trunk: Add support for network interfaces with access controlled by a Boolean from the CLIP project. 2009-01-15 20:31:06 +00:00
Chris PeBenito 49317e6b49 fix corenetwork so the ifdef enable_mls survives to regular processing. 2006-09-29 17:37:57 +00:00
Chris PeBenito 95b8223eed cleanups 2006-09-08 17:21:28 +00:00
Chris PeBenito 17de1b790b remove extra level of directory 2006-07-12 20:32:27 +00:00