4637cd6f89
A few of the socket classes added by commit 09ebf2b59a ("refpolicy:
Define extended_socket_class policy capability and socket classes") are
never used because sockets can never be created with the associated
address family. Remove these unused socket security classes.
The removed classes are bridge_socket for PF_BRIDGE, ib_socket for PF_IB,
and mpls_socket for PF_MPLS.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
187 lines
3.6 KiB
Plaintext
187 lines
3.6 KiB
Plaintext
# FLASK
|
|
|
|
#
|
|
# Define the security object classes
|
|
#
|
|
|
|
# Classes marked as userspace are classes
|
|
# for userspace object managers
|
|
|
|
class security
|
|
class process
|
|
class system
|
|
class capability
|
|
|
|
# file-related classes
|
|
class filesystem
|
|
class file
|
|
class dir
|
|
class fd
|
|
class lnk_file
|
|
class chr_file
|
|
class blk_file
|
|
class sock_file
|
|
class fifo_file
|
|
|
|
# network-related classes
|
|
class socket
|
|
class tcp_socket
|
|
class udp_socket
|
|
class rawip_socket
|
|
class node
|
|
class netif
|
|
class netlink_socket
|
|
class packet_socket
|
|
class key_socket
|
|
class unix_stream_socket
|
|
class unix_dgram_socket
|
|
|
|
# sysv-ipc-related classes
|
|
class sem
|
|
class msg
|
|
class msgq
|
|
class shm
|
|
class ipc
|
|
|
|
#
|
|
# userspace object manager classes
|
|
#
|
|
|
|
# passwd/chfn/chsh
|
|
class passwd # userspace
|
|
|
|
# SE-X Windows stuff (more classes below)
|
|
class x_drawable # userspace
|
|
class x_screen # userspace
|
|
class x_gc # userspace
|
|
class x_font # userspace
|
|
class x_colormap # userspace
|
|
class x_property # userspace
|
|
class x_selection # userspace
|
|
class x_cursor # userspace
|
|
class x_client # userspace
|
|
class x_device # userspace
|
|
class x_server # userspace
|
|
class x_extension # userspace
|
|
|
|
# extended netlink sockets
|
|
class netlink_route_socket
|
|
class netlink_firewall_socket
|
|
class netlink_tcpdiag_socket
|
|
class netlink_nflog_socket
|
|
class netlink_xfrm_socket
|
|
class netlink_selinux_socket
|
|
class netlink_audit_socket
|
|
class netlink_ip6fw_socket
|
|
class netlink_dnrt_socket
|
|
|
|
class dbus # userspace
|
|
class nscd # userspace
|
|
|
|
# IPSec association
|
|
class association
|
|
|
|
# Updated Netlink class for KOBJECT_UEVENT family.
|
|
class netlink_kobject_uevent_socket
|
|
|
|
class appletalk_socket
|
|
|
|
class packet
|
|
|
|
# Kernel access key retention
|
|
class key
|
|
|
|
class context # userspace
|
|
|
|
class dccp_socket
|
|
|
|
class memprotect
|
|
|
|
class db_database # userspace
|
|
class db_table # userspace
|
|
class db_procedure # userspace
|
|
class db_column # userspace
|
|
class db_tuple # userspace
|
|
class db_blob # userspace
|
|
class db_exception # userspace
|
|
class db_datatype # userspace
|
|
|
|
# network peer labels
|
|
class peer
|
|
|
|
# Capabilities >= 32
|
|
class capability2
|
|
|
|
# More SE-X Windows stuff
|
|
class x_resource # userspace
|
|
class x_event # userspace
|
|
class x_synthetic_event # userspace
|
|
class x_application_data # userspace
|
|
|
|
# kernel services that need to override task security, e.g. cachefiles
|
|
class kernel_service
|
|
|
|
class tun_socket
|
|
|
|
class binder
|
|
|
|
# Updated netlink classes for more recent netlink protocols.
|
|
class netlink_iscsi_socket
|
|
class netlink_fib_lookup_socket
|
|
class netlink_connector_socket
|
|
class netlink_netfilter_socket
|
|
class netlink_generic_socket
|
|
class netlink_scsitransport_socket
|
|
class netlink_rdma_socket
|
|
class netlink_crypto_socket
|
|
|
|
# Still More SE-X Windows stuff
|
|
class x_pointer # userspace
|
|
class x_keyboard # userspace
|
|
|
|
# More Database stuff
|
|
class db_schema # userspace
|
|
class db_view # userspace
|
|
class db_sequence # userspace
|
|
class db_language # userspace
|
|
|
|
class service # userspace
|
|
|
|
# Capability checks when on a non-init user namespace
|
|
class cap_userns
|
|
class cap2_userns
|
|
|
|
# New socket classes introduced by extended_socket_class policy capability.
|
|
# These two were previously mapped to rawip_socket.
|
|
class sctp_socket
|
|
class icmp_socket
|
|
# These were previously mapped to socket.
|
|
class ax25_socket
|
|
class ipx_socket
|
|
class netrom_socket
|
|
class atmpvc_socket
|
|
class x25_socket
|
|
class rose_socket
|
|
class decnet_socket
|
|
class atmsvc_socket
|
|
class rds_socket
|
|
class irda_socket
|
|
class pppox_socket
|
|
class llc_socket
|
|
class can_socket
|
|
class tipc_socket
|
|
class bluetooth_socket
|
|
class iucv_socket
|
|
class rxrpc_socket
|
|
class isdn_socket
|
|
class phonet_socket
|
|
class ieee802154_socket
|
|
class caif_socket
|
|
class alg_socket
|
|
class nfc_socket
|
|
class vsock_socket
|
|
class kcm_socket
|
|
class qipcrtr_socket
|
|
|
|
# FLASK
|