Stephen Smalley 09ebf2b59a refpolicy: Define extended_socket_class policy capability and socket classes ... Add a (default disabled) definition for the extended_socket_class policy capability used to enable the use of separate socket security classes for all network address families rather than the generic socket class. The capability also enables the use of separate security classes for ICMP and SCTP sockets, which were previously mapped to rawip_socket class. Add definitions for the new socket classes and access vectors enabled by this capability. Add the new socket classes to the socket_class_set macro, which also covers allowing access by unconfined domains. Allowing access by other domains to the new socket security classes is left to future commits. The kernel support will be included in Linux 4.11+. Building policy with this capability enabled will require libsepol 2.7+. This change leaves the capability disabled by default. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>		2016-12-08 18:07:42 -05:00
..
file_patterns.spt	update policy/support macros	2016-12-01 19:38:14 +01:00
ipc_patterns.spt	update policy/support macros	2016-12-01 19:38:14 +01:00
loadable_module.spt	Remove deprecated optional_policy usage.	2011-10-14 10:22:16 -04:00
misc_macros.spt	remove trailing whitespaces	2016-12-06 13:45:13 +01:00
misc_patterns.spt	update policy/support macros	2016-12-01 19:38:14 +01:00
mls_mcs_macros.spt	- Move range transitions to modules.	2006-10-04 17:25:34 +00:00
obj_perm_sets.spt	refpolicy: Define extended_socket_class policy capability and socket classes	2016-12-08 18:07:42 -05:00