add xml comments to generated sections, and add mls support to interfaces
and nodes
This commit is contained in:
Chris PeBenito
parent
daa0e0b01f
commit
085faa06ff
@ -1,4 +1,6 @@
|
||||
# Copyright (C) 2005 Tresys Technology, LLC
|
||||
## <module name="corenetwork" layer="kernel">
|
||||
## <summary>Policy controlling access to network objects</summary>
|
||||
|
||||
#######################################
|
||||
#
|
||||
@ -804,9 +806,17 @@ define(`devices_make_device_node',`dnl')
|
||||
########################################
|
||||
|
||||
define(`create_netif_interfaces',``
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_tcp_on_$1_interface(domain)
|
||||
|
||||
########################################
|
||||
## <interface name="corenetwork_network_tcp_on_$1_interface">
|
||||
## <description>
|
||||
## Send and receive TCP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_tcp_on_$1_interface',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -818,27 +828,48 @@ type $1_netif_t;
|
||||
class netif { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_udp_on_$1_interface(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_udp_on_$1_interface">
|
||||
## <description>
|
||||
## Send and receive UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_udp_on_$1_interface',`
|
||||
corenetwork_send_udp_on_$1_interface(dollarsone,dollarstwo)
|
||||
corenetwork_receive_udp_on_$1_interface(dollarsone,dollarstwo)
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_raw_on_$1_interface(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_raw_on_$1_interface">
|
||||
## <description>
|
||||
## Send and receive raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_raw_on_$1_interface',`
|
||||
corenetwork_send_raw_on_$1_interface(dollarsone,dollarstwo)
|
||||
corenetwork_receive_raw_on_$1_interface(dollarsone,dollarstwo)
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_send_udp_on_$1_interface(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_send_udp_on_$1_interface">
|
||||
## <description>
|
||||
## Send UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_send_udp_on_$1_interface',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -850,9 +881,16 @@ type $1_netif_t;
|
||||
class netif udp_send;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_receive_udp_on_$1_interface(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_receive_udp_on_$1_interface">
|
||||
## <description>
|
||||
## Receive UDP network traffic on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_receive_udp_on_$1_interface',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -864,9 +902,16 @@ type $1_netif_t;
|
||||
class netif udp_recv;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_send_raw_on_$1_interface(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_send_raw_on_$1_interface">
|
||||
## <description>
|
||||
## Send raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_send_raw_on_$1_interface',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -880,9 +925,16 @@ class netif rawip_send;
|
||||
class capability net_raw;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_receive_raw_on_$1_interface(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_receive_raw_on_$1_interface">
|
||||
## <description>
|
||||
## Receive raw IP packets on the $1 interface.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_receive_raw_on_$1_interface',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -902,9 +954,16 @@ class netif rawip_recv;
|
||||
########################################
|
||||
|
||||
define(`create_node_interfaces',``
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_tcp_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_tcp_on_$1_node">
|
||||
## <description>
|
||||
## Send and receive TCP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_tcp_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -916,27 +975,48 @@ type $1_node_t;
|
||||
class node { tcp_send tcp_recv };
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_udp_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_udp_on_$1_node">
|
||||
## <description>
|
||||
## Send and receive UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_udp_on_$1_node',`
|
||||
corenetwork_send_udp_on_$1_node(dollarsone)
|
||||
corenetwork_receive_udp_on_$1_node(dollarsone)
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_raw_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_raw_on_$1_node">
|
||||
## <description>
|
||||
## Send and receive raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_raw_on_$1_node',`
|
||||
corenetwork_send_raw_on_$1_node(dollarsone)
|
||||
corenetwork_receive_raw_on_$1_node(dollarsone)
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_send_udp_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_send_udp_on_$1_node">
|
||||
## <description>
|
||||
## Send and UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_send_udp_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -948,9 +1028,16 @@ type $1_node_t;
|
||||
class node udp_send;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_receive_udp_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_receive_udp_on_$1_node">
|
||||
## <description>
|
||||
## Receive UDP traffic on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_receive_udp_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -962,9 +1049,16 @@ type $1_node_t;
|
||||
class node udp_recv;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_send_raw_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_send_raw_on_$1_node">
|
||||
## <description>
|
||||
## Send raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_send_raw_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -978,9 +1072,16 @@ class node rawip_send;
|
||||
class capability net_raw;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_receive_raw_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_receive_raw_on_$1_node">
|
||||
## <description>
|
||||
## Receive raw IP packets on the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_receive_raw_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -992,9 +1093,16 @@ type $1_node_t;
|
||||
class node rawip_recv;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_bind_tcp_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_bind_tcp_on_$1_node">
|
||||
## <description>
|
||||
## Bind TCP sockets to node $1.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_bind_tcp_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1006,9 +1114,16 @@ type $1_node_t;
|
||||
class tcp_socket node_bind;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_bind_udp_on_$1_node(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_bind_udp_on_$1_node">
|
||||
## <description>
|
||||
## Bind UDP sockets to the $1 node.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_bind_udp_on_$1_node',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1028,9 +1143,16 @@ class udp_socket node_bind;
|
||||
########################################
|
||||
|
||||
define(`create_port_interfaces',``
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_tcp_on_$1_port(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_tcp_on_$1_port">
|
||||
## <description>
|
||||
## Send and receive TCP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_tcp_on_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1042,18 +1164,32 @@ type $1_port_t;
|
||||
class tcp_socket { send_msg recv_msg };
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_network_udp_on_$1_port(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_network_udp_on_$1_port">
|
||||
## <description>
|
||||
## Send and receive UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="both" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_network_udp_on_$1_port',`
|
||||
corenetwork_send_udp_on_$1_port(dollarsone,dollarstwo)
|
||||
corenetwork_receive_udp_on_$1_port(dollarsone,dollarstwo)
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_send_udp_on_$1_port(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_send_udp_on_$1_port">
|
||||
## <description>
|
||||
## Send UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="write" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_send_udp_on_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1065,9 +1201,16 @@ type $1_port_t;
|
||||
class udp_socket send_msg;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_receive_udp_on_$1_port(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_receive_udp_on_$1_port">
|
||||
## <description>
|
||||
## Receive UDP traffic on the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="read" weight="10"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_receive_udp_on_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1079,9 +1222,16 @@ type $1_port_t;
|
||||
class udp_socket recv_msg;
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_bind_tcp_on_$1_port(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_bind_tcp_on_$1_port">
|
||||
## <description>
|
||||
## Bind TCP sockets to the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_bind_tcp_on_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1095,9 +1245,16 @@ class tcp_socket name_bind;
|
||||
$3
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# corenetwork_bind_udp_on_$1_port(domain)
|
||||
########################################
|
||||
## <interface name="corenetwork_bind_udp_on_$1_port">
|
||||
## <description>
|
||||
## Bind UDP sockets to the $1 port.
|
||||
## </description>
|
||||
## <parameter name="domain">
|
||||
## The type of the process performing this action.
|
||||
## </parameter>
|
||||
## <infoflow type="none"/>
|
||||
## </interface>
|
||||
#
|
||||
define(`corenetwork_bind_udp_on_$1_port',`
|
||||
requires_block_template(`dollarszero'_depend)
|
||||
@ -1113,7 +1270,7 @@ $3
|
||||
'') dnl end create_port_interfaces
|
||||
|
||||
#
|
||||
# network_interface(linux_interfacename)
|
||||
# network_interface(linux_interfacename,mls_sensitivity)
|
||||
#
|
||||
define(`network_interface',`
|
||||
ifdef(`interface_pass',`
|
||||
@ -1121,19 +1278,19 @@ create_netif_interfaces($1)
|
||||
',`
|
||||
type $1_netif_t alias netif_$1_t, netif_type;
|
||||
requires_block_template(`type unlabeled_t')
|
||||
netifcon $1 system_u:object_r:$1_netif_t system_u:object_r:unlabeled_t
|
||||
netifcon $1 context_template(system_u:object_r:$1_netif_t,$2) context_template(system_u:object_r:unlabeled_t,$2)
|
||||
')
|
||||
')
|
||||
|
||||
#
|
||||
# network_node(node_name,address,netmask)
|
||||
# network_node(node_name,mls_sensitivity,address,netmask)
|
||||
#
|
||||
define(`network_node',`
|
||||
ifdef(`interface_pass',`
|
||||
create_node_interfaces($1)
|
||||
',`
|
||||
type $1_node_t alias node_$1_t, node_type;
|
||||
nodecon $2 $3 system_u:object_r:$1_node_t
|
||||
nodecon $3 $4 context_template(system_u:object_r:$1_node_t,$2)
|
||||
')
|
||||
')
|
||||
|
||||
@ -1166,3 +1323,5 @@ type $1_port_t, port_type;
|
||||
declare_ports($1_port_t,shift($*))
|
||||
')
|
||||
')
|
||||
|
||||
## </module>
|
||||
|
||||
@ -96,15 +96,15 @@ portcon udp 1-1023 system_u:object_r:reserved_port_t
|
||||
#
|
||||
type node_t, node_type;
|
||||
|
||||
network_node(compat_ipv4, ::, ffff:ffff:ffff:ffff:ffff:ffff::)
|
||||
network_node(inaddr_any, 0.0.0.0, 255.255.255.255)
|
||||
dnl network_node(internal, , ) # no nodecon for this in current strict policy
|
||||
network_node(link_local, fe80::, ffff:ffff:ffff:ffff::, )
|
||||
network_node(lo, 127.0.0.1, 255.255.255.255)
|
||||
network_node(mapped_ipv4, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::)
|
||||
network_node(multicast, ff00::, ff00::)
|
||||
network_node(site_local, fec0::, ffc0::)
|
||||
network_node(unspec, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
|
||||
network_node(compat_ipv4, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff::)
|
||||
network_node(inaddr_any, s0, 0.0.0.0, 255.255.255.255)
|
||||
dnl network_node(internal, s0, , ) # no nodecon for this in current strict policy
|
||||
network_node(link_local, s0, fe80::, ffff:ffff:ffff:ffff::, )
|
||||
network_node(lo, s0, 127.0.0.1, 255.255.255.255)
|
||||
network_node(mapped_ipv4, s0, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::)
|
||||
network_node(multicast, s0, ff00::, ff00::)
|
||||
network_node(site_local, s0, fec0::, ffc0::)
|
||||
network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
|
||||
|
||||
|
||||
########################################
|
||||
@ -117,11 +117,11 @@ network_node(unspec, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
|
||||
#
|
||||
type netif_t, netif_type;
|
||||
|
||||
network_interface(lo)
|
||||
network_interface(eth0)
|
||||
network_interface(eth1)
|
||||
network_interface(eth2)
|
||||
network_interface(ippp0)
|
||||
network_interface(ipsec0)
|
||||
network_interface(ipsec1)
|
||||
network_interface(ipsec2)
|
||||
network_interface(lo, s0)
|
||||
network_interface(eth0, s0)
|
||||
network_interface(eth1, s0)
|
||||
network_interface(eth2, s0)
|
||||
network_interface(ippp0, s0)
|
||||
network_interface(ipsec0, s0)
|
||||
network_interface(ipsec1, s0)
|
||||
network_interface(ipsec2, s0)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user