rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

add xml comments to generated sections, and add mls support to interfaces

Browse Source 
and nodes
This commit is contained in:
Chris PeBenito 2005-05-20 20:07:42 +00:00
parent daa0e0b01f
commit 085faa06ff
2 changed files with 246 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

299
refpolicy/policy/modules/kernel/corenetwork.if
View File

@ -1,4 +1,6 @@
# Copyright (C) 2005 Tresys Technology, LLC # Copyright (C) 2005 Tresys Technology, LLC
## <module name="corenetwork" layer="kernel">
## <summary>Policy controlling access to network objects</summary>
####################################### #######################################
# #
@ -804,9 +806,17 @@ define(`devices_make_device_node',`dnl')
######################################## ########################################
define(`create_netif_interfaces',`` define(`create_netif_interfaces',``
#######################################
# ########################################
# corenetwork_network_tcp_on_$1_interface(domain) ## <interface name="corenetwork_network_tcp_on_$1_interface">
## <description>
## Send and receive TCP network traffic on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_tcp_on_$1_interface',` define(`corenetwork_network_tcp_on_$1_interface',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -818,27 +828,48 @@ type $1_netif_t;
class netif { tcp_send tcp_recv }; class netif { tcp_send tcp_recv };
') ')
####################################### ########################################
# ## <interface name="corenetwork_network_udp_on_$1_interface">
# corenetwork_network_udp_on_$1_interface(domain) ## <description>
## Send and receive UDP network traffic on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_udp_on_$1_interface',` define(`corenetwork_network_udp_on_$1_interface',`
corenetwork_send_udp_on_$1_interface(dollarsone,dollarstwo) corenetwork_send_udp_on_$1_interface(dollarsone,dollarstwo)
corenetwork_receive_udp_on_$1_interface(dollarsone,dollarstwo) corenetwork_receive_udp_on_$1_interface(dollarsone,dollarstwo)
') ')
####################################### ########################################
# ## <interface name="corenetwork_network_raw_on_$1_interface">
# corenetwork_network_raw_on_$1_interface(domain) ## <description>
## Send and receive raw IP packets on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_raw_on_$1_interface',` define(`corenetwork_network_raw_on_$1_interface',`
corenetwork_send_raw_on_$1_interface(dollarsone,dollarstwo) corenetwork_send_raw_on_$1_interface(dollarsone,dollarstwo)
corenetwork_receive_raw_on_$1_interface(dollarsone,dollarstwo) corenetwork_receive_raw_on_$1_interface(dollarsone,dollarstwo)
') ')
####################################### ########################################
# ## <interface name="corenetwork_send_udp_on_$1_interface">
# corenetwork_send_udp_on_$1_interface(domain) ## <description>
## Send UDP network traffic on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corenetwork_send_udp_on_$1_interface',` define(`corenetwork_send_udp_on_$1_interface',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -850,9 +881,16 @@ type $1_netif_t;
class netif udp_send; class netif udp_send;
') ')
####################################### ########################################
# ## <interface name="corenetwork_receive_udp_on_$1_interface">
# corenetwork_receive_udp_on_$1_interface(domain) ## <description>
## Receive UDP network traffic on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
# #
define(`corenetwork_receive_udp_on_$1_interface',` define(`corenetwork_receive_udp_on_$1_interface',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -864,9 +902,16 @@ type $1_netif_t;
class netif udp_recv; class netif udp_recv;
') ')
####################################### ########################################
# ## <interface name="corenetwork_send_raw_on_$1_interface">
# corenetwork_send_raw_on_$1_interface(domain) ## <description>
## Send raw IP packets on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corenetwork_send_raw_on_$1_interface',` define(`corenetwork_send_raw_on_$1_interface',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -880,9 +925,16 @@ class netif rawip_send;
class capability net_raw; class capability net_raw;
') ')
####################################### ########################################
# ## <interface name="corenetwork_receive_raw_on_$1_interface">
# corenetwork_receive_raw_on_$1_interface(domain) ## <description>
## Receive raw IP packets on the $1 interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
# #
define(`corenetwork_receive_raw_on_$1_interface',` define(`corenetwork_receive_raw_on_$1_interface',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -902,9 +954,16 @@ class netif rawip_recv;
######################################## ########################################
define(`create_node_interfaces',`` define(`create_node_interfaces',``
####################################### ########################################
# ## <interface name="corenetwork_network_tcp_on_$1_node">
# corenetwork_network_tcp_on_$1_node(domain) ## <description>
## Send and receive TCP traffic on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_tcp_on_$1_node',` define(`corenetwork_network_tcp_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -916,27 +975,48 @@ type $1_node_t;
class node { tcp_send tcp_recv }; class node { tcp_send tcp_recv };
') ')
####################################### ########################################
# ## <interface name="corenetwork_network_udp_on_$1_node">
# corenetwork_network_udp_on_$1_node(domain) ## <description>
## Send and receive UDP traffic on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_udp_on_$1_node',` define(`corenetwork_network_udp_on_$1_node',`
corenetwork_send_udp_on_$1_node(dollarsone) corenetwork_send_udp_on_$1_node(dollarsone)
corenetwork_receive_udp_on_$1_node(dollarsone) corenetwork_receive_udp_on_$1_node(dollarsone)
') ')
####################################### ########################################
# ## <interface name="corenetwork_network_raw_on_$1_node">
# corenetwork_network_raw_on_$1_node(domain) ## <description>
## Send and receive raw IP packets on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_raw_on_$1_node',` define(`corenetwork_network_raw_on_$1_node',`
corenetwork_send_raw_on_$1_node(dollarsone) corenetwork_send_raw_on_$1_node(dollarsone)
corenetwork_receive_raw_on_$1_node(dollarsone) corenetwork_receive_raw_on_$1_node(dollarsone)
') ')
####################################### ########################################
# ## <interface name="corenetwork_send_udp_on_$1_node">
# corenetwork_send_udp_on_$1_node(domain) ## <description>
## Send and UDP traffic on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corenetwork_send_udp_on_$1_node',` define(`corenetwork_send_udp_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -948,9 +1028,16 @@ type $1_node_t;
class node udp_send; class node udp_send;
') ')
####################################### ########################################
# ## <interface name="corenetwork_receive_udp_on_$1_node">
# corenetwork_receive_udp_on_$1_node(domain) ## <description>
## Receive UDP traffic on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
# #
define(`corenetwork_receive_udp_on_$1_node',` define(`corenetwork_receive_udp_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -962,9 +1049,16 @@ type $1_node_t;
class node udp_recv; class node udp_recv;
') ')
####################################### ########################################
# ## <interface name="corenetwork_send_raw_on_$1_node">
# corenetwork_send_raw_on_$1_node(domain) ## <description>
## Send raw IP packets on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corenetwork_send_raw_on_$1_node',` define(`corenetwork_send_raw_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -978,9 +1072,16 @@ class node rawip_send;
class capability net_raw; class capability net_raw;
') ')
####################################### ########################################
# ## <interface name="corenetwork_receive_raw_on_$1_node">
# corenetwork_receive_raw_on_$1_node(domain) ## <description>
## Receive raw IP packets on the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corenetwork_receive_raw_on_$1_node',` define(`corenetwork_receive_raw_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -992,9 +1093,16 @@ type $1_node_t;
class node rawip_recv; class node rawip_recv;
') ')
####################################### ########################################
# ## <interface name="corenetwork_bind_tcp_on_$1_node">
# corenetwork_bind_tcp_on_$1_node(domain) ## <description>
## Bind TCP sockets to node $1.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="none"/>
## </interface>
# #
define(`corenetwork_bind_tcp_on_$1_node',` define(`corenetwork_bind_tcp_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1006,9 +1114,16 @@ type $1_node_t;
class tcp_socket node_bind; class tcp_socket node_bind;
') ')
####################################### ########################################
# ## <interface name="corenetwork_bind_udp_on_$1_node">
# corenetwork_bind_udp_on_$1_node(domain) ## <description>
## Bind UDP sockets to the $1 node.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="none"/>
## </interface>
# #
define(`corenetwork_bind_udp_on_$1_node',` define(`corenetwork_bind_udp_on_$1_node',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1028,9 +1143,16 @@ class udp_socket node_bind;
######################################## ########################################
define(`create_port_interfaces',`` define(`create_port_interfaces',``
####################################### ########################################
# ## <interface name="corenetwork_network_tcp_on_$1_port">
# corenetwork_network_tcp_on_$1_port(domain) ## <description>
## Send and receive TCP traffic on the $1 port.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_tcp_on_$1_port',` define(`corenetwork_network_tcp_on_$1_port',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1042,18 +1164,32 @@ type $1_port_t;
class tcp_socket { send_msg recv_msg }; class tcp_socket { send_msg recv_msg };
') ')
####################################### ########################################
# ## <interface name="corenetwork_network_udp_on_$1_port">
# corenetwork_network_udp_on_$1_port(domain) ## <description>
## Send and receive UDP traffic on the $1 port.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="both" weight="10"/>
## </interface>
# #
define(`corenetwork_network_udp_on_$1_port',` define(`corenetwork_network_udp_on_$1_port',`
corenetwork_send_udp_on_$1_port(dollarsone,dollarstwo) corenetwork_send_udp_on_$1_port(dollarsone,dollarstwo)
corenetwork_receive_udp_on_$1_port(dollarsone,dollarstwo) corenetwork_receive_udp_on_$1_port(dollarsone,dollarstwo)
') ')
####################################### ########################################
# ## <interface name="corenetwork_send_udp_on_$1_port">
# corenetwork_send_udp_on_$1_port(domain) ## <description>
## Send UDP traffic on the $1 port.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="write" weight="10"/>
## </interface>
# #
define(`corenetwork_send_udp_on_$1_port',` define(`corenetwork_send_udp_on_$1_port',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1065,9 +1201,16 @@ type $1_port_t;
class udp_socket send_msg; class udp_socket send_msg;
') ')
####################################### ########################################
# ## <interface name="corenetwork_receive_udp_on_$1_port">
# corenetwork_receive_udp_on_$1_port(domain) ## <description>
## Receive UDP traffic on the $1 port.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="read" weight="10"/>
## </interface>
# #
define(`corenetwork_receive_udp_on_$1_port',` define(`corenetwork_receive_udp_on_$1_port',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1079,9 +1222,16 @@ type $1_port_t;
class udp_socket recv_msg; class udp_socket recv_msg;
') ')
####################################### ########################################
# ## <interface name="corenetwork_bind_tcp_on_$1_port">
# corenetwork_bind_tcp_on_$1_port(domain) ## <description>
## Bind TCP sockets to the $1 port.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="none"/>
## </interface>
# #
define(`corenetwork_bind_tcp_on_$1_port',` define(`corenetwork_bind_tcp_on_$1_port',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1095,9 +1245,16 @@ class tcp_socket name_bind;
$3 $3
') ')
####################################### ########################################
# ## <interface name="corenetwork_bind_udp_on_$1_port">
# corenetwork_bind_udp_on_$1_port(domain) ## <description>
## Bind UDP sockets to the $1 port.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## <infoflow type="none"/>
## </interface>
# #
define(`corenetwork_bind_udp_on_$1_port',` define(`corenetwork_bind_udp_on_$1_port',`
requires_block_template(`dollarszero'_depend) requires_block_template(`dollarszero'_depend)
@ -1113,7 +1270,7 @@ $3
'') dnl end create_port_interfaces '') dnl end create_port_interfaces
# #
# network_interface(linux_interfacename) # network_interface(linux_interfacename,mls_sensitivity)
# #
define(`network_interface',` define(`network_interface',`
ifdef(`interface_pass',` ifdef(`interface_pass',`
@ -1121,19 +1278,19 @@ create_netif_interfaces($1)
',` ',`
type $1_netif_t alias netif_$1_t, netif_type; type $1_netif_t alias netif_$1_t, netif_type;
requires_block_template(`type unlabeled_t') requires_block_template(`type unlabeled_t')
netifcon $1 system_u:object_r:$1_netif_t system_u:object_r:unlabeled_t netifcon $1 context_template(system_u:object_r:$1_netif_t,$2) context_template(system_u:object_r:unlabeled_t,$2)
') ')
') ')
# #
# network_node(node_name,address,netmask) # network_node(node_name,mls_sensitivity,address,netmask)
# #
define(`network_node',` define(`network_node',`
ifdef(`interface_pass',` ifdef(`interface_pass',`
create_node_interfaces($1) create_node_interfaces($1)
',` ',`
type $1_node_t alias node_$1_t, node_type; type $1_node_t alias node_$1_t, node_type;
nodecon $2 $3 system_u:object_r:$1_node_t nodecon $3 $4 context_template(system_u:object_r:$1_node_t,$2)
') ')
') ')
@ -1166,3 +1323,5 @@ type $1_port_t, port_type;
declare_ports($1_port_t,shift($*)) declare_ports($1_port_t,shift($*))
') ')
') ')
## </module>

34
refpolicy/policy/modules/kernel/corenetwork.te
View File

@ -96,15 +96,15 @@ portcon udp 1-1023 system_u:object_r:reserved_port_t
# #
type node_t, node_type; type node_t, node_type;
network_node(compat_ipv4, ::, ffff:ffff:ffff:ffff:ffff:ffff::) network_node(compat_ipv4, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff::)
network_node(inaddr_any, 0.0.0.0, 255.255.255.255) network_node(inaddr_any, s0, 0.0.0.0, 255.255.255.255)
dnl network_node(internal, , ) # no nodecon for this in current strict policy dnl network_node(internal, s0, , ) # no nodecon for this in current strict policy
network_node(link_local, fe80::, ffff:ffff:ffff:ffff::, ) network_node(link_local, s0, fe80::, ffff:ffff:ffff:ffff::, )
network_node(lo, 127.0.0.1, 255.255.255.255) network_node(lo, s0, 127.0.0.1, 255.255.255.255)
network_node(mapped_ipv4, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::) network_node(mapped_ipv4, s0, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::)
network_node(multicast, ff00::, ff00::) network_node(multicast, s0, ff00::, ff00::)
network_node(site_local, fec0::, ffc0::) network_node(site_local, s0, fec0::, ffc0::)
network_node(unspec, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
######################################## ########################################
@ -117,11 +117,11 @@ network_node(unspec, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
# #
type netif_t, netif_type; type netif_t, netif_type;
network_interface(lo) network_interface(lo, s0)
network_interface(eth0) network_interface(eth0, s0)
network_interface(eth1) network_interface(eth1, s0)
network_interface(eth2) network_interface(eth2, s0)
network_interface(ippp0) network_interface(ippp0, s0)
network_interface(ipsec0) network_interface(ipsec0, s0)
network_interface(ipsec1) network_interface(ipsec1, s0)
network_interface(ipsec2) network_interface(ipsec2, s0)