nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

domain: unconfined access to bpf

Browse Source 
Signed-off-by: Dominick Grift <dac.override@gmail.com>
This commit is contained in:
Dominick Grift 2019-09-03 18:53:15 +02:00 committed by Chris PeBenito
parent 6b11dcef89
commit 3228c2b997
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/kernel/domain.te
View File

@ -152,6 +152,9 @@ optional_policy(`
# is handled in the interface as typeattribute cannot
# be used on an attribute.
# unconfined access to bpf
allow unconfined_domain_type domain:bpf { map_create map_read map_write prog_load prog_run };
# Use/sendto/connectto sockets created by any domain.
allow unconfined_domain_type domain:{ socket_class_set socket key_socket } { create_stream_socket_perms send_msg lock relabelto name_bind recv_msg map sendto recvfrom relabelfrom };
allow unconfined_domain_type domain:rawip_socket node_bind;