09ebf2b59a
Add a (default disabled) definition for the extended_socket_class policy capability used to enable the use of separate socket security classes for all network address families rather than the generic socket class. The capability also enables the use of separate security classes for ICMP and SCTP sockets, which were previously mapped to rawip_socket class. Add definitions for the new socket classes and access vectors enabled by this capability. Add the new socket classes to the socket_class_set macro, which also covers allowing access by unconfined domains. Allowing access by other domains to the new socket security classes is left to future commits. The kernel support will be included in Linux 4.11+. Building policy with this capability enabled will require libsepol 2.7+. This change leaves the capability disabled by default. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
88 lines
1.6 KiB
Plaintext
88 lines
1.6 KiB
Plaintext
#
|
|
# This file contains the policy capabilites
|
|
# that are enabled in this policy, not a
|
|
# declaration of DAC capabilites such as
|
|
# dac_override.
|
|
#
|
|
# The affected object classes and their
|
|
# permissions should also be listed in
|
|
# the comments for each capability.
|
|
#
|
|
|
|
# Enable additional networking access control for
|
|
# labeled networking peers.
|
|
#
|
|
# Checks enabled:
|
|
# node: sendto recvfrom
|
|
# netif: ingress egress
|
|
# peer: recv
|
|
#
|
|
policycap network_peer_controls;
|
|
|
|
# Enable additional access controls for opening
|
|
# a file (and similar objects).
|
|
#
|
|
# Checks enabled:
|
|
# dir: open
|
|
# file: open
|
|
# fifo_file: open
|
|
# sock_file: open
|
|
# chr_file: open
|
|
# blk_file: open
|
|
#
|
|
policycap open_perms;
|
|
|
|
# Always enforce network access controls, even
|
|
# if labeling is not configured for them.
|
|
# Available in kernel 3.13+
|
|
#
|
|
# Checks enabled:
|
|
# packet: send recv
|
|
# peer: recv
|
|
#
|
|
# policycap always_check_network;
|
|
|
|
# Enable separate security classes for
|
|
# all network address families previously
|
|
# mapped to the socket class and for
|
|
# ICMP and SCTP sockets previously mapped
|
|
# to the rawip_socket class.
|
|
#
|
|
# Classes enabled:
|
|
# sctp_socket
|
|
# icmp_socket
|
|
# ax25_socket
|
|
# ipx_socket
|
|
# netrom_socket
|
|
# bridge_socket
|
|
# atmpvc_socket
|
|
# x25_socket
|
|
# rose_socket
|
|
# decnet_socket
|
|
# atmsvc_socket
|
|
# rds_socket
|
|
# irda_socket
|
|
# pppox_socket
|
|
# llc_socket
|
|
# ib_socket
|
|
# mpls_socket
|
|
# can_socket
|
|
# tipc_socket
|
|
# bluetooth_socket
|
|
# iucv_socket
|
|
# rxrpc_socket
|
|
# isdn_socket
|
|
# phonet_socket
|
|
# ieee802154_socket
|
|
# caif_socket
|
|
# alg_socket
|
|
# nfc_socket
|
|
# vsock_socket
|
|
# kcm_socket
|
|
# qipcrtr_socket
|
|
#
|
|
# Available in kernel 4.11+.
|
|
# Requires libsepol 2.7+ to build policy with this enabled.
|
|
#
|
|
#policycap extended_socket_class;
|