4637cd6f89
A few of the socket classes added by commit 09ebf2b59a ("refpolicy:
Define extended_socket_class policy capability and socket classes") are
never used because sockets can never be created with the associated
address family. Remove these unused socket security classes.
The removed classes are bridge_socket for PF_BRIDGE, ib_socket for PF_IB,
and mpls_socket for PF_MPLS.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
85 lines
1.6 KiB
Plaintext
85 lines
1.6 KiB
Plaintext
#
|
|
# This file contains the policy capabilites
|
|
# that are enabled in this policy, not a
|
|
# declaration of DAC capabilites such as
|
|
# dac_override.
|
|
#
|
|
# The affected object classes and their
|
|
# permissions should also be listed in
|
|
# the comments for each capability.
|
|
#
|
|
|
|
# Enable additional networking access control for
|
|
# labeled networking peers.
|
|
#
|
|
# Checks enabled:
|
|
# node: sendto recvfrom
|
|
# netif: ingress egress
|
|
# peer: recv
|
|
#
|
|
policycap network_peer_controls;
|
|
|
|
# Enable additional access controls for opening
|
|
# a file (and similar objects).
|
|
#
|
|
# Checks enabled:
|
|
# dir: open
|
|
# file: open
|
|
# fifo_file: open
|
|
# sock_file: open
|
|
# chr_file: open
|
|
# blk_file: open
|
|
#
|
|
policycap open_perms;
|
|
|
|
# Always enforce network access controls, even
|
|
# if labeling is not configured for them.
|
|
# Available in kernel 3.13+
|
|
#
|
|
# Checks enabled:
|
|
# packet: send recv
|
|
# peer: recv
|
|
#
|
|
# policycap always_check_network;
|
|
|
|
# Enable separate security classes for
|
|
# all network address families previously
|
|
# mapped to the socket class and for
|
|
# ICMP and SCTP sockets previously mapped
|
|
# to the rawip_socket class.
|
|
#
|
|
# Classes enabled:
|
|
# sctp_socket
|
|
# icmp_socket
|
|
# ax25_socket
|
|
# ipx_socket
|
|
# netrom_socket
|
|
# atmpvc_socket
|
|
# x25_socket
|
|
# rose_socket
|
|
# decnet_socket
|
|
# atmsvc_socket
|
|
# rds_socket
|
|
# irda_socket
|
|
# pppox_socket
|
|
# llc_socket
|
|
# can_socket
|
|
# tipc_socket
|
|
# bluetooth_socket
|
|
# iucv_socket
|
|
# rxrpc_socket
|
|
# isdn_socket
|
|
# phonet_socket
|
|
# ieee802154_socket
|
|
# caif_socket
|
|
# alg_socket
|
|
# nfc_socket
|
|
# vsock_socket
|
|
# kcm_socket
|
|
# qipcrtr_socket
|
|
#
|
|
# Available in kernel 4.11+.
|
|
# Requires libsepol 2.7+ to build policy with this enabled.
|
|
#
|
|
#policycap extended_socket_class;
|