mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-13 09:34:54 +00:00
01723ac2ce
Currently the packet class in SELinux is not checked if there are no SECMARK rules in the security or mangle netfilter tables. Similarly, the peer class is not checked if there is no NetLabel or labeled IPSEC. Some systems prefer that these classes are always checked, for example, to protect the system should the netfilter rules fail to load or if the nefilter rules were maliciously flushed. Add the always_check_network policy capability which, when enabled, treats these mechanisms as enabled, even if there are no labeling rules. Signed-off-by: Chris PeBenito <cpebenito@tresys.com> Signed-off-by: Eric Paris <eparis@redhat.com>
21 lines
603 B
C
21 lines
603 B
C
#ifndef _SEPOL_POLICYDB_POLCAPS_H_
|
|
#define _SEPOL_POLICYDB_POLCAPS_H_
|
|
|
|
/* Policy capabilities */
|
|
enum {
|
|
POLICYDB_CAPABILITY_NETPEER,
|
|
POLICYDB_CAPABILITY_OPENPERM,
|
|
POLICYDB_CAPABILITY_REDHAT1, /* reserved for RH testing of ptrace_child */
|
|
POLICYDB_CAPABILITY_ALWAYSNETWORK,
|
|
__POLICYDB_CAPABILITY_MAX
|
|
};
|
|
#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
|
|
|
|
/* Convert a capability name to number. */
|
|
extern int sepol_polcap_getnum(const char *name);
|
|
|
|
/* Convert a capability number to name. */
|
|
extern const char *sepol_polcap_getname(int capnum);
|
|
|
|
#endif /* _SEPOL_POLICYDB_POLCAPS_H_ */
|