d8cb498284
remove trailing whitespaces
2016-12-06 13:45:13 +01:00
d4964ae808
Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data.
...
Example of denial:
type=AVC msg=audit(1461664028.583:784): avc: denied { relabelto } for
pid=14322 comm="yum" name="libvirt" dev="dm-0" ino=670147
scontext=root:system_r:rpm_t:s0
tcontext=system_u:object_r:virt_cache_t:s0-s15:c0.c1023 tclass=dir
2016-07-27 18:32:24 -04:00
aedd5c314d
Adds attribute mlstrustedsocket, along with the interface.
...
Sample AVC:
type=AVC msg=audit(1459979143.990:219): avc: denied { sendto } for pid=1935
comm="charon" path="/dev/log" scontext=system_u:system_r:initrc_t:s0-s3:c0.c31
tcontext=system_u:system_r:syslogd_t:s3:c0.c31 tclass=unix_dgram_socket permissive=0
This was discussed in 2010: http://oss.tresys.com/pipermail/refpolicy/2010-November/003444.html
2016-04-12 19:28:13 +03:00
3f67f722bb
trunk: whitespace fixes
2009-06-26 14:40:13 +00:00
e1a70f1dde
trunk: add MLS constrains for ingress/egress permissions from Paul Moore.
...
Add MLS constraints for several network related access controls including
the new ingress/egress controls and the older Secmark controls. Based on
the following post to the SELinux Reference Policy mailing list:
* http://oss.tresys.com/pipermail/refpolicy/2009-February/000579.html
2009-03-02 15:16:49 +00:00
ff8f0a63f4
trunk: whitespace fixes in xml blocks.
2008-12-03 19:16:20 +00:00
6073ea1e13
trunk: whitespace fix changing multiple spaces into tabs.
2008-12-03 18:33:19 +00:00
2c12b471ad
trunk: add core xselinux support.
2008-04-01 20:23:23 +00:00
936f286c16
trunk: add mls constraints to dbus.
2008-01-03 20:37:25 +00:00
d62c0881e2
Update MLS constraints from LSPP evaluated policy.
2007-08-24 14:14:29 +00:00
f8233ab7b0
trunk: Deprecate mls_file_write_down() and mls_file_read_up(), replaced with mls_write_all_levels() and mls_read_all_levels(), for consistency.
2007-08-20 18:26:08 +00:00
2d0c9cecaf
trunk: several MLS enhancements.
2007-08-20 15:15:03 +00:00
9760cbec2d
trunk: Database userspace object manager classes from KaiGai Kohei.
2007-08-09 13:15:07 +00:00
f497b8df50
Christopher J. PeBenito wrote:
...
> We could add another 'or' on the above constraint:
>
> or ( (t2 == mlsfilewrite_in_range) and (l1 dom l2) and (h1 domby h2) )
>
> I believe that would be the constraint you were looking for. I don't
> like the name of that attribute, but I couldn't come up with a better
> one off the top of my head. :)
>
Attached is a patch which I've tested against selinux-policy-2.4.2-1
that implements this additional constraint. The name is still a bit
forced, but it works.
-matt <mra at hp dot com>
2006-11-01 15:42:22 +00:00
a8671ae5b2
enhanced setransd support from darrel goeddel
2006-10-20 14:44:23 +00:00
cf7af137c0
add mls fd constraints
2006-09-15 19:05:03 +00:00
bbcd3c97dd
add main part of role-o-matic
2006-09-06 22:07:25 +00:00
17de1b790b
remove extra level of directory
2006-07-12 20:32:27 +00:00
cgzones
Lukas Vrabec
qqo
Chris PeBenito