Chris PeBenito 2b7b44d80e Remove general unlabeled packet usage. ... Back when the SECMARK implementation was new, the packet class was always checked. Because of that, unlabeled_t packet rules proliferated refpolicy since the common case was to have no SECMARK rules. Since then, the kernel has been modified to only enforce the packet class if there are SECMARK rules. Remove the unlabeled_t packet rules, since users of SECMARK will likely want no unlabeled_t packet rules, and the common case users will have no impact since the packet class isn't enforced on their systems. To have partial SECMARK confinement, the following rule applies: allow { domain -type_i_want_to_constrain_t } unlabeled_t:packet { send recv }; It seems like over-allowing, but if you have no SECMARK rules, it's the equivalent of: allow * unlabeled_t:packet { send recv }; Signed-off-by: Chris PeBenito <cpebenito@tresys.com>		2013-05-14 10:15:34 -04:00
..
corecommands.fc	Label nut drivers that are installed in /lib/nut on Debian as bin_t	2013-01-23 07:12:48 -05:00
corecommands.if	Additional rearrangement in corecommands, along with module version bump.	2010-10-27 14:09:00 -04:00
corecommands.te	Bump module versions for release.	2013-04-24 16:14:52 -04:00
corenetwork.fc	Start pulling in kernel layer pieces from Fedora.	2011-03-29 10:33:43 -04:00
corenetwork.if.in	Corenetwork policy size optimization from Dan Walsh.	2011-08-26 09:03:25 -04:00
corenetwork.if.m4	trunk: Add support for network interfaces with access controlled by a Boolean from the CLIP project.	2009-01-15 20:31:06 +00:00
corenetwork.te.in	Add trivnet1 port (8200)	2013-05-09 08:54:20 -04:00
corenetwork.te.m4	Fix corenetwork port declaration to choose either reserved or unreserved.	2011-10-04 15:31:08 -04:00
devices.fc	Rename cachefiles_dev_t to cachefiles_device_t.	2012-10-04 08:24:57 -04:00
devices.if	Rearrange devices interfaces.	2012-10-30 16:11:32 -04:00
devices.te	Bump module versions for release.	2013-04-24 16:14:52 -04:00
domain.fc	remove extra level of directory	2006-07-12 20:32:27 +00:00
domain.if	Start pulling in kernel layer pieces from Fedora.	2011-03-29 10:33:43 -04:00
domain.te	Bump module versions for release.	2012-02-15 14:32:45 -05:00
files.fc	Label /var/run/motd.dynamic as initrc_var_run_t	2013-01-23 07:08:06 -05:00
files.if	Rearrange files interfaces.	2012-10-31 11:49:23 -04:00
files.te	Bump module versions for release.	2013-04-24 16:14:52 -04:00
filesystem.fc	Label /var/run/shm as tmpfs_t for Debian	2013-01-23 07:07:28 -05:00
filesystem.if	For virtd_lxc	2012-10-30 13:58:02 -04:00
filesystem.te	Bump module versions for release.	2013-04-24 16:14:52 -04:00
kernel.fc	remove extra level of directory	2006-07-12 20:32:27 +00:00
kernel.if	Remove general unlabeled packet usage.	2013-05-14 10:15:34 -04:00
kernel.te	Remove general unlabeled packet usage.	2013-05-14 10:15:34 -04:00
mcs.fc	remove extra level of directory	2006-07-12 20:32:27 +00:00
mcs.if	Move mcs_constrained() impementation.	2012-11-28 16:26:05 -05:00
mcs.te	Bump module versions for release.	2013-04-24 16:14:52 -04:00
metadata.xml	remove extra level of directory	2006-07-12 20:32:27 +00:00
mls.fc	remove extra level of directory	2006-07-12 20:32:27 +00:00
mls.if	trunk: whitespace fixes	2009-06-26 14:40:13 +00:00
mls.te	Whitespace change: drop unnecessary blank line at the start of .te files.	2010-06-10 08:16:35 -04:00
selinux.fc	remove extra level of directory	2006-07-12 20:32:27 +00:00
selinux.if	Change secure_mode_policyload to disable only toggling of this Boolean rather than disabling all Boolean toggling permissions.	2011-09-26 10:44:27 -04:00
selinux.te	Bump module versions for release.	2012-07-25 14:33:06 -04:00
storage.fc	Mark temporary block device as fixed_disk_device_t	2012-02-22 08:32:42 -05:00
storage.if	Pull in additional changes in kernel layer from Fedora.	2011-03-31 09:49:01 -04:00
storage.te	Bump module versions for release.	2012-07-25 14:33:06 -04:00
terminal.fc	Pull in additional changes in kernel layer from Fedora.	2011-03-31 09:49:01 -04:00
terminal.if	For virtd lxc	2012-10-30 13:58:02 -04:00
terminal.te	Bump module versions for release.	2013-04-24 16:14:52 -04:00
ubac.fc	trunk: add missing ubac module.	2008-11-05 16:11:27 +00:00
ubac.if	Improve the documentation of ubac_constrained().	2010-03-02 11:28:44 -05:00
ubac.te	Whitespace change: drop unnecessary blank line at the start of .te files.	2010-06-10 08:16:35 -04:00