RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-13 17:44:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
d7b0941eed
selinux/libsepol/include/sepol/policydb/polcaps.h

29 lines
631 B
C
Raw Normal View History

initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
#ifndef _SEPOL_POLICYDB_POLCAPS_H_
#define _SEPOL_POLICYDB_POLCAPS_H_
libsepol: do not #include <sys/cdefs.h> ratbert90 submitted this patch via https://github.com/SELinuxProject/selinux/issues/19. Apparently musl does not provide sys/cdefs.h, see http://wiki.musl-libc.org/wiki/FAQ#Q:_I.27m_trying_to_compile_something_against_musl_and_I_get_error_messages_about_sys.2Fcdefs.h. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-29 15:57:48 +00:00
#ifdef __cplusplus
extern "C" {
#endif
Allow libsepol C++ static library on device. Change-Id: I7da601767c3a4ebed7274e33304d8b589a9115fe Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-12-16 19:44:41 +00:00
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
/* Policy capabilities */
enum {
POLICYDB_CAPABILITY_NETPEER,
POLICYDB_CAPABILITY_OPENPERM,
libsepol: Define extended_socket_class policy capability Define the extended_socket_class policy capability used to enable the use of separate socket security classes for all network address families rather than the generic socket class. This also enables separate security classes for ICMP and SCTP sockets, which were previously mapped to the rawip_socket class. The legacy redhat1 policy capability that was only ever used in testing within Fedora for ptrace_child is reclaimed for this purpose; as far as I can tell, this policy capability is not enabled in any supported distro policy. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-12-01 16:08:06 +00:00
POLICYDB_CAPABILITY_EXTSOCKCLASS,
libsepol: Add always_check_network policy capability Currently the packet class in SELinux is not checked if there are no SECMARK rules in the security or mangle netfilter tables. Similarly, the peer class is not checked if there is no NetLabel or labeled IPSEC. Some systems prefer that these classes are always checked, for example, to protect the system should the netfilter rules fail to load or if the nefilter rules were maliciously flushed. Add the always_check_network policy capability which, when enabled, treats these mechanisms as enabled, even if there are no labeling rules. Signed-off-by: Chris PeBenito <cpebenito@tresys.com> Signed-off-by: Eric Paris <eparis@redhat.com>
2012-06-06 17:27:10 +00:00
POLICYDB_CAPABILITY_ALWAYSNETWORK,
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
__POLICYDB_CAPABILITY_MAX
};
#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
/* Convert a capability name to number. */
extern int sepol_polcap_getnum(const char *name);
/* Convert a capability number to name. */
extern const char *sepol_polcap_getname(int capnum);
libsepol: do not #include <sys/cdefs.h> ratbert90 submitted this patch via https://github.com/SELinuxProject/selinux/issues/19. Apparently musl does not provide sys/cdefs.h, see http://wiki.musl-libc.org/wiki/FAQ#Q:_I.27m_trying_to_compile_something_against_musl_and_I_get_error_messages_about_sys.2Fcdefs.h. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2016-11-29 15:57:48 +00:00
#ifdef __cplusplus
}
#endif
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
#endif /* _SEPOL_POLICYDB_POLCAPS_H_ */
Reference in New Issue Copy Permalink