rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

change network verb in corenetwork to sendrecv

Browse Source
This commit is contained in:
Chris PeBenito 2005-06-02 18:55:47 +00:00
parent cabfa520aa
commit d115660e3b
21 changed files with 964 additions and 791 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
refpolicy/policy/modules/admin/netutils.te
View File

@ -46,14 +46,14 @@ allow netutils_t netutils_tmp_t:dir { create read getattr lock setattr ioctl lin
allow netutils_t netutils_tmp_t:file { create ioctl read getattr lock write setattr append link unlink rename }; allow netutils_t netutils_tmp_t:file { create ioctl read getattr lock write setattr append link unlink rename };
files_create_private_tmp_data(netutils_t, netutils_tmp_t, { file dir }) files_create_private_tmp_data(netutils_t, netutils_tmp_t, { file dir })
corenetwork_network_tcp_on_all_interfaces(netutils_t) corenetwork_sendrecv_tcp_on_all_interfaces(netutils_t)
corenetwork_network_raw_on_all_interfaces(netutils_t) corenetwork_sendrecv_raw_on_all_interfaces(netutils_t)
corenetwork_network_udp_on_all_interfaces(netutils_t) corenetwork_sendrecv_udp_on_all_interfaces(netutils_t)
corenetwork_network_tcp_on_all_nodes(netutils_t) corenetwork_sendrecv_tcp_on_all_nodes(netutils_t)
corenetwork_network_raw_on_all_nodes(netutils_t) corenetwork_sendrecv_raw_on_all_nodes(netutils_t)
corenetwork_network_udp_on_all_nodes(netutils_t) corenetwork_sendrecv_udp_on_all_nodes(netutils_t)
corenetwork_network_tcp_on_all_ports(netutils_t) corenetwork_sendrecv_tcp_on_all_ports(netutils_t)
corenetwork_network_udp_on_all_ports(netutils_t) corenetwork_sendrecv_udp_on_all_ports(netutils_t)
corenetwork_bind_tcp_on_all_nodes(netutils_t) corenetwork_bind_tcp_on_all_nodes(netutils_t)
corenetwork_bind_udp_on_all_nodes(netutils_t) corenetwork_bind_udp_on_all_nodes(netutils_t)
@ -104,14 +104,14 @@ allow ping_t self:tcp_socket { create connect ioctl read getattr write setattr a
allow ping_t self:udp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown }; allow ping_t self:udp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown };
allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt }; allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt };
corenetwork_network_tcp_on_all_interfaces(ping_t) corenetwork_sendrecv_tcp_on_all_interfaces(ping_t)
corenetwork_network_udp_on_all_interfaces(ping_t) corenetwork_sendrecv_udp_on_all_interfaces(ping_t)
corenetwork_network_raw_on_all_interfaces(ping_t) corenetwork_sendrecv_raw_on_all_interfaces(ping_t)
corenetwork_network_raw_on_all_nodes(ping_t) corenetwork_sendrecv_raw_on_all_nodes(ping_t)
corenetwork_network_tcp_on_all_nodes(ping_t) corenetwork_sendrecv_tcp_on_all_nodes(ping_t)
corenetwork_network_udp_on_all_nodes(ping_t) corenetwork_sendrecv_udp_on_all_nodes(ping_t)
corenetwork_network_tcp_on_all_ports(ping_t) corenetwork_sendrecv_tcp_on_all_ports(ping_t)
corenetwork_network_udp_on_all_ports(ping_t) corenetwork_sendrecv_udp_on_all_ports(ping_t)
corenetwork_bind_udp_on_all_nodes(ping_t) corenetwork_bind_udp_on_all_nodes(ping_t)
corenetwork_bind_tcp_on_all_nodes(ping_t) corenetwork_bind_tcp_on_all_nodes(ping_t)
@ -162,14 +162,14 @@ allow traceroute_t self:netlink_route_socket { bind create getattr nlmsg_read re
kernel_read_system_state(traceroute_t) kernel_read_system_state(traceroute_t)
kernel_read_network_state(traceroute_t) kernel_read_network_state(traceroute_t)
corenetwork_network_tcp_on_all_interfaces(traceroute_t) corenetwork_sendrecv_tcp_on_all_interfaces(traceroute_t)
corenetwork_network_udp_on_all_interfaces(traceroute_t) corenetwork_sendrecv_udp_on_all_interfaces(traceroute_t)
corenetwork_network_raw_on_all_interfaces(traceroute_t) corenetwork_sendrecv_raw_on_all_interfaces(traceroute_t)
corenetwork_network_raw_on_all_nodes(traceroute_t) corenetwork_sendrecv_raw_on_all_nodes(traceroute_t)
corenetwork_network_tcp_on_all_nodes(traceroute_t) corenetwork_sendrecv_tcp_on_all_nodes(traceroute_t)
corenetwork_network_udp_on_all_nodes(traceroute_t) corenetwork_sendrecv_udp_on_all_nodes(traceroute_t)
corenetwork_network_tcp_on_all_ports(traceroute_t) corenetwork_sendrecv_tcp_on_all_ports(traceroute_t)
corenetwork_network_udp_on_all_ports(traceroute_t) corenetwork_sendrecv_udp_on_all_ports(traceroute_t)
corenetwork_bind_udp_on_all_nodes(traceroute_t) corenetwork_bind_udp_on_all_nodes(traceroute_t)
corenetwork_bind_tcp_on_all_nodes(traceroute_t) corenetwork_bind_tcp_on_all_nodes(traceroute_t)

16
refpolicy/policy/modules/admin/rpm.te
View File

@ -102,14 +102,14 @@ kernel_compute_selinux_create_context(rpm_t)
kernel_compute_selinux_relabel_context(rpm_t) kernel_compute_selinux_relabel_context(rpm_t)
kernel_compute_selinux_reachable_user_contexts(rpm_t) kernel_compute_selinux_reachable_user_contexts(rpm_t)
corenetwork_network_tcp_on_all_interfaces(rpm_t) corenetwork_sendrecv_tcp_on_all_interfaces(rpm_t)
corenetwork_network_raw_on_all_interfaces(rpm_t) corenetwork_sendrecv_raw_on_all_interfaces(rpm_t)
corenetwork_network_udp_on_all_interfaces(rpm_t) corenetwork_sendrecv_udp_on_all_interfaces(rpm_t)
corenetwork_network_tcp_on_all_nodes(rpm_t) corenetwork_sendrecv_tcp_on_all_nodes(rpm_t)
corenetwork_network_raw_on_all_nodes(rpm_t) corenetwork_sendrecv_raw_on_all_nodes(rpm_t)
corenetwork_network_udp_on_all_nodes(rpm_t) corenetwork_sendrecv_udp_on_all_nodes(rpm_t)
corenetwork_network_tcp_on_all_ports(rpm_t) corenetwork_sendrecv_tcp_on_all_ports(rpm_t)
corenetwork_network_udp_on_all_ports(rpm_t) corenetwork_sendrecv_udp_on_all_ports(rpm_t)
corenetwork_bind_tcp_on_all_nodes(rpm_t) corenetwork_bind_tcp_on_all_nodes(rpm_t)
corenetwork_bind_udp_on_all_nodes(rpm_t) corenetwork_bind_udp_on_all_nodes(rpm_t)

32
refpolicy/policy/modules/apps/gpg.if
View File

@ -62,14 +62,14 @@ allow $1_gpg_t $1_gpg_secret_t:dir { read getattr lock search ioctl add_name rem
allow $1_gpg_t $1_gpg_secret_t:file { create ioctl read getattr lock write setattr append link unlink rename }; allow $1_gpg_t $1_gpg_secret_t:file { create ioctl read getattr lock write setattr append link unlink rename };
allow $1_gpg_t $1_gpg_secret_t:lnk_file { create read getattr setattr link unlink rename }; allow $1_gpg_t $1_gpg_secret_t:lnk_file { create read getattr setattr link unlink rename };
corenetwork_network_tcp_on_all_interfaces($1_gpg_t) corenetwork_sendrecv_tcp_on_all_interfaces($1_gpg_t)
corenetwork_network_raw_on_all_interfaces($1_gpg_t) corenetwork_sendrecv_raw_on_all_interfaces($1_gpg_t)
corenetwork_network_udp_on_all_interfaces($1_gpg_t) corenetwork_sendrecv_udp_on_all_interfaces($1_gpg_t)
corenetwork_network_tcp_on_all_nodes($1_gpg_t) corenetwork_sendrecv_tcp_on_all_nodes($1_gpg_t)
corenetwork_network_raw_on_all_nodes($1_gpg_t) corenetwork_sendrecv_raw_on_all_nodes($1_gpg_t)
corenetwork_network_udp_on_all_nodes($1_gpg_t) corenetwork_sendrecv_udp_on_all_nodes($1_gpg_t)
corenetwork_network_tcp_on_all_ports($1_gpg_t) corenetwork_sendrecv_tcp_on_all_ports($1_gpg_t)
corenetwork_network_udp_on_all_ports($1_gpg_t) corenetwork_sendrecv_udp_on_all_ports($1_gpg_t)
corenetwork_bind_tcp_on_all_nodes($1_gpg_t) corenetwork_bind_tcp_on_all_nodes($1_gpg_t)
corenetwork_bind_udp_on_all_nodes($1_gpg_t) corenetwork_bind_udp_on_all_nodes($1_gpg_t)
@ -169,14 +169,14 @@ allow $1_gpg_helper_t self:udp_socket { create connect ioctl read getattr write
dontaudit $1_gpg_helper_t $1_gpg_secret_t:file read; dontaudit $1_gpg_helper_t $1_gpg_secret_t:file read;
corenetwork_network_tcp_on_all_interfaces($1_gpg_helper_t) corenetwork_sendrecv_tcp_on_all_interfaces($1_gpg_helper_t)
corenetwork_network_raw_on_all_interfaces($1_gpg_helper_t) corenetwork_sendrecv_raw_on_all_interfaces($1_gpg_helper_t)
corenetwork_network_udp_on_all_interfaces($1_gpg_helper_t) corenetwork_sendrecv_udp_on_all_interfaces($1_gpg_helper_t)
corenetwork_network_tcp_on_all_nodes($1_gpg_helper_t) corenetwork_sendrecv_tcp_on_all_nodes($1_gpg_helper_t)
corenetwork_network_udp_on_all_nodes($1_gpg_helper_t) corenetwork_sendrecv_udp_on_all_nodes($1_gpg_helper_t)
corenetwork_network_raw_on_all_nodes($1_gpg_helper_t) corenetwork_sendrecv_raw_on_all_nodes($1_gpg_helper_t)
corenetwork_network_tcp_on_all_ports($1_gpg_helper_t) corenetwork_sendrecv_tcp_on_all_ports($1_gpg_helper_t)
corenetwork_network_udp_on_all_ports($1_gpg_helper_t) corenetwork_sendrecv_udp_on_all_ports($1_gpg_helper_t)
corenetwork_bind_tcp_on_all_nodes($1_gpg_helper_t) corenetwork_bind_tcp_on_all_nodes($1_gpg_helper_t)
corenetwork_bind_udp_on_all_nodes($1_gpg_helper_t) corenetwork_bind_udp_on_all_nodes($1_gpg_helper_t)

49
refpolicy/policy/modules/kernel/bootloader.if
View File

@ -14,10 +14,12 @@
# #
define(`bootloader_transition',` define(`bootloader_transition',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 bootloader_exec_t:file { getattr read execute }; allow $1 bootloader_exec_t:file { getattr read execute };
allow $1 bootloader_t:process transition; allow $1 bootloader_t:process transition;
type_transition $1 bootloader_exec_t:process bootloader_t; type_transition $1 bootloader_exec_t:process bootloader_t;
dontaudit $1 bootloader_t:process { noatsecure siginh rlimitinh }; dontaudit $1 bootloader_t:process { noatsecure siginh rlimitinh };
allow $1 bootloader_t:fd use; allow $1 bootloader_t:fd use;
allow bootloader_t $1:fd use; allow bootloader_t $1:fd use;
allow bootloader_t $1:fifo_file rw_file_perms; allow bootloader_t $1:fifo_file rw_file_perms;
@ -26,6 +28,7 @@ allow bootloader_t $1:process sigchld;
define(`bootloader_transition_depend',` define(`bootloader_transition_depend',`
type bootloader_t; type bootloader_t;
class file { getattr read execute }; class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh sigchld }; class process { transition noatsecure siginh rlimitinh sigchld };
class fd use; class fd use;
@ -53,7 +56,9 @@ class fifo_file rw_file_perms;
# #
define(`bootloader_transition_add_role_use_terminal',` define(`bootloader_transition_add_role_use_terminal',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
bootloader_transition($1) bootloader_transition($1)
role $2 types bootloader_t; role $2 types bootloader_t;
allow bootloader_t $3:chr_file { getattr read write ioctl }; allow bootloader_t $3:chr_file { getattr read write ioctl };
') ')
@ -69,11 +74,13 @@ class chr_file { getattr read write ioctl };
# #
define(`bootloader_search_bootloader_data_directory',` define(`bootloader_search_bootloader_data_directory',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir search; allow $1 boot_t:dir search;
') ')
define(`bootloader_search_bootloader_data_directory_depend',` define(`bootloader_search_bootloader_data_directory_depend',`
type boot_t; type boot_t;
class dir search; class dir search;
') ')
@ -83,11 +90,13 @@ class dir search;
# #
define(`bootloader_ignore_search_bootloader_data_directory',` define(`bootloader_ignore_search_bootloader_data_directory',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
dontaudit $1 boot_t:dir search; dontaudit $1 boot_t:dir search;
') ')
define(`bootloader_ignore_search_bootloader_data_directory_depend',` define(`bootloader_ignore_search_bootloader_data_directory_depend',`
type boot_t; type boot_t;
class dir search; class dir search;
') ')
@ -97,12 +106,14 @@ class dir search;
# #
define(`bootloader_modify_bootloader_data_directory_symbolic_links',` define(`bootloader_modify_bootloader_data_directory_symbolic_links',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read }; allow $1 boot_t:dir { getattr search read };
allow $1 boot_t:lnk_file { getattr read write }; allow $1 boot_t:lnk_file { getattr read write };
') ')
define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',` define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',`
type boot_t; type boot_t;
class dir { getattr search read }; class dir { getattr search read };
') ')
@ -112,6 +123,7 @@ class dir { getattr search read };
# #
define(`bootloader_install_kernel',` define(`bootloader_install_kernel',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name }; allow $1 boot_t:dir { getattr search read write add_name };
allow $1 boot_t:file { getattr read write create }; allow $1 boot_t:file { getattr read write create };
allow $1 boot_t:lnk_file { getattr read create unlink }; allow $1 boot_t:lnk_file { getattr read create unlink };
@ -119,6 +131,7 @@ allow $1 boot_t:lnk_file { getattr read create unlink };
define(`bootloader_install_kernel_depend',` define(`bootloader_install_kernel_depend',`
type boot_t; type boot_t;
class dir { getattr search read write add_name }; class dir { getattr search read write add_name };
class file { getattr read write create }; class file { getattr read write create };
class lnk_file { getattr read create unlink }; class lnk_file { getattr read create unlink };
@ -130,6 +143,7 @@ class lnk_file { getattr read create unlink };
# #
define(`bootloader_install_initrd',` define(`bootloader_install_initrd',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name }; allow $1 boot_t:dir { getattr search read write add_name };
allow $1 boot_t:file { getattr read write create }; allow $1 boot_t:file { getattr read write create };
allow $1 boot_t:lnk_file { getattr read create unlink }; allow $1 boot_t:lnk_file { getattr read create unlink };
@ -137,6 +151,7 @@ allow $1 boot_t:lnk_file { getattr read create unlink };
define(`bootloader_install_initrd_depend',` define(`bootloader_install_initrd_depend',`
type boot_t; type boot_t;
class dir { getattr search read write add_name }; class dir { getattr search read write add_name };
class file { getattr read write create }; class file { getattr read write create };
class lnk_file { getattr read create unlink }; class lnk_file { getattr read create unlink };
@ -148,12 +163,14 @@ class lnk_file { getattr read create unlink };
# #
define(`bootloader_install_kernel_symbol_table',` define(`bootloader_install_kernel_symbol_table',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name }; allow $1 boot_t:dir { getattr search read write add_name };
allow $1 system_map_t:file { getattr read write create }; allow $1 system_map_t:file { getattr read write create };
') ')
define(`bootloader_install_kernel_symbol_table_depend',` define(`bootloader_install_kernel_symbol_table_depend',`
type boot_t, system_map_t; type boot_t, system_map_t;
class dir { getattr search read write add_name }; class dir { getattr search read write add_name };
class file { getattr read write create }; class file { getattr read write create };
') ')
@ -164,12 +181,14 @@ class file { getattr read write create };
# #
define(`bootloader_read_kernel_symbol_table',` define(`bootloader_read_kernel_symbol_table',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read }; allow $1 boot_t:dir { getattr search read };
allow $1 system_map_t:file { getattr read }; allow $1 system_map_t:file { getattr read };
') ')
define(`bootloader_read_kernel_symbol_table_depend',` define(`bootloader_read_kernel_symbol_table_depend',`
type boot_t, system_map_t; type boot_t, system_map_t;
class dir { getattr search read }; class dir { getattr search read };
class file { getattr read }; class file { getattr read };
') ')
@ -180,12 +199,14 @@ class file { getattr read };
# #
define(`bootloader_remove_kernel',` define(`bootloader_remove_kernel',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write remove_name }; allow $1 boot_t:dir { getattr search read write remove_name };
allow $1 boot_t:file { getattr unlink }; allow $1 boot_t:file { getattr unlink };
') ')
define(`bootloader_remove_kernel_depend',` define(`bootloader_remove_kernel_depend',`
type boot_t; type boot_t;
class dir { getattr search read write remove_name }; class dir { getattr search read write remove_name };
class file { getattr unlink }; class file { getattr unlink };
') ')
@ -196,12 +217,14 @@ class file { getattr unlink };
# #
define(`bootloader_remove_kernel_symbol_table',` define(`bootloader_remove_kernel_symbol_table',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write remove_name }; allow $1 boot_t:dir { getattr search read write remove_name };
allow $1 system_map_t:file { getattr unlink }; allow $1 system_map_t:file { getattr unlink };
') ')
define(`bootloader_remove_kernel_symbol_table_depend',` define(`bootloader_remove_kernel_symbol_table_depend',`
type boot_t, system_map_t; type boot_t, system_map_t;
class dir { getattr search read write remove_name }; class dir { getattr search read write remove_name };
class file { getattr unlink }; class file { getattr unlink };
') ')
@ -212,11 +235,13 @@ class file { getattr unlink };
# #
define(`bootloader_read_config',` define(`bootloader_read_config',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file { getattr read }; allow $1 bootloader_etc_t:file { getattr read };
') ')
define(`bootloader_read_config_depend',` define(`bootloader_read_config_depend',`
type bootloader_etc_t; type bootloader_etc_t;
class file { getattr read }; class file { getattr read };
') ')
@ -226,11 +251,13 @@ class file { getattr read };
# #
define(`bootloader_modify_bootloader_config',` define(`bootloader_modify_bootloader_config',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file { getattr read write append }; allow $1 bootloader_etc_t:file { getattr read write append };
') ')
define(`bootloader_modify_bootloader_config_depend',` define(`bootloader_modify_bootloader_config_depend',`
type bootloader_etc_t; type bootloader_etc_t;
class file { getattr read write append }; class file { getattr read write append };
') ')
@ -240,12 +267,14 @@ class file { getattr read write append };
# #
define(`bootloader_modify_temporary_data',` define(`bootloader_modify_temporary_data',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
# FIXME: read tmp_t # FIXME: read tmp_t
allow $1 bootloader_tmp_t:file { getattr read write }; allow $1 bootloader_tmp_t:file { getattr read write };
') ')
define(`bootloader_modify_temporary_data_depend',` define(`bootloader_modify_temporary_data_depend',`
type bootloader_tmp_t; type bootloader_tmp_t;
class file { getattr read write setattr }; class file { getattr read write setattr };
') ')
@ -255,6 +284,7 @@ class file { getattr read write setattr };
# #
define(`bootloader_create_runtime_data',` define(`bootloader_create_runtime_data',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name remove_name }; allow $1 boot_t:dir { getattr search read write add_name remove_name };
allow $1 boot_runtime_t:file { getattr create read write append unlink }; allow $1 boot_runtime_t:file { getattr create read write append unlink };
type_transition $1 boot_t:file boot_runtime_t; type_transition $1 boot_t:file boot_runtime_t;
@ -262,6 +292,7 @@ type_transition $1 boot_t:file boot_runtime_t;
define(`bootloader_create_runtime_data_depend',` define(`bootloader_create_runtime_data_depend',`
type boot_t, boot_runtime_t; type boot_t, boot_runtime_t;
class dir { getattr search read write add_name remove_name }; class dir { getattr search read write add_name remove_name };
class file { getattr create read write append unlink }; class file { getattr create read write append unlink };
') ')
@ -272,11 +303,13 @@ class file { getattr create read write append unlink };
# #
define(`bootloader_list_kernel_modules',` define(`bootloader_list_kernel_modules',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read }; allow $1 modules_object_t:dir { getattr search read };
') ')
define(`bootloader_list_kernel_modules_depend',` define(`bootloader_list_kernel_modules_depend',`
type modules_object_t; type modules_object_t;
class dir { getattr search read }; class dir { getattr search read };
') ')
@ -286,6 +319,7 @@ class dir { getattr search read };
# #
define(`bootloader_read_kernel_modules',` define(`bootloader_read_kernel_modules',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read }; allow $1 modules_object_t:dir { getattr search read };
allow $1 modules_object_t:lnk_file { getattr read }; allow $1 modules_object_t:lnk_file { getattr read };
allow $1 modules_object_t:file { getattr read lock }; allow $1 modules_object_t:file { getattr read lock };
@ -293,6 +327,7 @@ allow $1 modules_object_t:file { getattr read lock };
define(`bootloader_read_kernel_modules_depend',` define(`bootloader_read_kernel_modules_depend',`
type modules_object_t; type modules_object_t;
class dir { getattr search read }; class dir { getattr search read };
class lnk_file { getattr read }; class lnk_file { getattr read };
class file { getattr read lock }; class file { getattr read lock };
@ -304,14 +339,18 @@ class file { getattr read lock };
# #
define(`bootloader_write_kernel_modules',` define(`bootloader_write_kernel_modules',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read }; allow $1 modules_object_t:dir { getattr search read };
allow $1 modules_object_t:file write; allow $1 modules_object_t:file write;
typeattribute $1 can_modify_kernel_modules; typeattribute $1 can_modify_kernel_modules;
') ')
define(`bootloader_write_kernel_modules_depend',` define(`bootloader_write_kernel_modules_depend',`
attribute can_modify_kernel_modules; attribute can_modify_kernel_modules;
type modules_object_t; type modules_object_t;
class dir { getattr search read }; class dir { getattr search read };
class file write; class file write;
') ')
@ -322,14 +361,18 @@ class file write;
# #
define(`bootloader_manage_kernel_modules',` define(`bootloader_manage_kernel_modules',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 modules_object_t:file { getattr create read write setattr unlink }; allow $1 modules_object_t:file { getattr create read write setattr unlink };
allow $1 modules_object_t:dir { getattr search read write add_name remove_name }; allow $1 modules_object_t:dir { getattr search read write add_name remove_name };
typeattribute $1 can_modify_kernel_modules; typeattribute $1 can_modify_kernel_modules;
') ')
define(`bootloader_manage_kernel_modules_depend',` define(`bootloader_manage_kernel_modules_depend',`
attribute can_modify_kernel_modules; attribute can_modify_kernel_modules;
type modules_object_t; type modules_object_t;
class file { getattr create read write setattr unlink }; class file { getattr create read write setattr unlink };
class dir { getattr search read write add_name remove_name }; class dir { getattr search read write add_name remove_name };
') ')
@ -340,16 +383,20 @@ class dir { getattr search read write add_name remove_name };
# #
define(`bootloader_create_private_module_dir_entry',` define(`bootloader_create_private_module_dir_entry',`
requires_block_template(`$0'_depend) requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read write add_name remove_name }; allow $1 modules_object_t:dir { getattr search read write add_name remove_name };
# if a class is specified use it, else use file as default
ifelse(`$3',`',` ifelse(`$3',`',`
type_transition $1 modules_object_t:file $2; type_transition $1 modules_object_t:file $2;
',` ',`
type_transition $1 modules_object_t:$3 $2; type_transition $1 modules_object_t:$3 $2;
') dnl end ifelse ')
') ')
define(`bootloader_create_private_module_dir_entry_depend',` define(`bootloader_create_private_module_dir_entry_depend',`
type modules_object_t; type modules_object_t;
class dir { getattr search read write add_name remove_name }; class dir { getattr search read write add_name remove_name };
') ')

632
refpolicy/policy/modules/kernel/corenetwork.if
View File

File diff suppressed because it is too large Load Diff

8
refpolicy/policy/modules/kernel/kernel.te
View File

@ -217,12 +217,12 @@ corecommands_execute_general_programs(kernel_t)
logging_send_system_log_message(kernel_t) logging_send_system_log_message(kernel_t)
# Kernel-generated traffic, e.g. ICMP replies. # Kernel-generated traffic, e.g. ICMP replies.
corenetwork_network_raw_on_all_interfaces(kernel_t) corenetwork_sendrecv_raw_on_all_interfaces(kernel_t)
corenetwork_network_raw_on_all_nodes(kernel_t) corenetwork_sendrecv_raw_on_all_nodes(kernel_t)
# Kernel-generated traffic, e.g. TCP resets. # Kernel-generated traffic, e.g. TCP resets.
corenetwork_network_tcp_on_all_interfaces(kernel_t) corenetwork_sendrecv_tcp_on_all_interfaces(kernel_t)
corenetwork_network_tcp_on_all_nodes(kernel_t) corenetwork_sendrecv_tcp_on_all_nodes(kernel_t)
neverallow ~can_load_policy security_t:security load_policy; neverallow ~can_load_policy security_t:security load_policy;
neverallow ~can_setenforce security_t:security setenforce; neverallow ~can_setenforce security_t:security setenforce;

16
refpolicy/policy/modules/services/cron.if
View File

@ -57,14 +57,14 @@ kernel_read_kernel_sysctl($1_crond_t)
# ps does not need to access /boot when run from cron # ps does not need to access /boot when run from cron
bootloader_ignore_search_bootloader_data_directory($1_crond_t) bootloader_ignore_search_bootloader_data_directory($1_crond_t)
corenetwork_network_tcp_on_all_interfaces($1_crond_t) corenetwork_sendrecv_tcp_on_all_interfaces($1_crond_t)
corenetwork_network_raw_on_all_interfaces($1_crond_t) corenetwork_sendrecv_raw_on_all_interfaces($1_crond_t)
corenetwork_network_udp_on_all_interfaces($1_crond_t) corenetwork_sendrecv_udp_on_all_interfaces($1_crond_t)
corenetwork_network_tcp_on_all_nodes($1_crond_t) corenetwork_sendrecv_tcp_on_all_nodes($1_crond_t)
corenetwork_network_raw_on_all_nodes($1_crond_t) corenetwork_sendrecv_raw_on_all_nodes($1_crond_t)
corenetwork_network_udp_on_all_nodes($1_crond_t) corenetwork_sendrecv_udp_on_all_nodes($1_crond_t)
corenetwork_network_tcp_on_all_ports($1_crond_t) corenetwork_sendrecv_tcp_on_all_ports($1_crond_t)
corenetwork_network_udp_on_all_ports($1_crond_t) corenetwork_sendrecv_udp_on_all_ports($1_crond_t)
corenetwork_bind_tcp_on_all_nodes($1_crond_t) corenetwork_bind_tcp_on_all_nodes($1_crond_t)
corenetwork_bind_udp_on_all_nodes($1_crond_t) corenetwork_bind_udp_on_all_nodes($1_crond_t)

16
refpolicy/policy/modules/services/cron.te
View File

@ -237,14 +237,14 @@ kernel_read_software_raid_state(system_crond_t)
# ps does not need to access /boot when run from cron # ps does not need to access /boot when run from cron
bootloader_ignore_search_bootloader_data_directory(system_crond_t) bootloader_ignore_search_bootloader_data_directory(system_crond_t)
corenetwork_network_tcp_on_all_interfaces(system_crond_t) corenetwork_sendrecv_tcp_on_all_interfaces(system_crond_t)
corenetwork_network_raw_on_all_interfaces(system_crond_t) corenetwork_sendrecv_raw_on_all_interfaces(system_crond_t)
corenetwork_network_udp_on_all_interfaces(system_crond_t) corenetwork_sendrecv_udp_on_all_interfaces(system_crond_t)
corenetwork_network_tcp_on_all_nodes(system_crond_t) corenetwork_sendrecv_tcp_on_all_nodes(system_crond_t)
corenetwork_network_raw_on_all_nodes(system_crond_t) corenetwork_sendrecv_raw_on_all_nodes(system_crond_t)
corenetwork_network_udp_on_all_nodes(system_crond_t) corenetwork_sendrecv_udp_on_all_nodes(system_crond_t)
corenetwork_network_tcp_on_all_ports(system_crond_t) corenetwork_sendrecv_tcp_on_all_ports(system_crond_t)
corenetwork_network_udp_on_all_ports(system_crond_t) corenetwork_sendrecv_udp_on_all_ports(system_crond_t)
corenetwork_bind_tcp_on_all_nodes(system_crond_t) corenetwork_bind_tcp_on_all_nodes(system_crond_t)
corenetwork_bind_udp_on_all_nodes(system_crond_t) corenetwork_bind_udp_on_all_nodes(system_crond_t)

16
refpolicy/policy/modules/services/mta.if
View File

@ -44,11 +44,11 @@ allow $1_mail_t $1_t:process sigchld;
kernel_read_kernel_sysctl($1_mail_t) kernel_read_kernel_sysctl($1_mail_t)
corenetwork_network_tcp_on_all_interfaces($1_mail_t) corenetwork_sendrecv_tcp_on_all_interfaces($1_mail_t)
corenetwork_network_raw_on_all_interfaces($1_mail_t) corenetwork_sendrecv_raw_on_all_interfaces($1_mail_t)
corenetwork_network_tcp_on_all_nodes($1_mail_t) corenetwork_sendrecv_tcp_on_all_nodes($1_mail_t)
corenetwork_network_raw_on_all_nodes($1_mail_t) corenetwork_sendrecv_raw_on_all_nodes($1_mail_t)
corenetwork_network_tcp_on_all_ports($1_mail_t) corenetwork_sendrecv_tcp_on_all_ports($1_mail_t)
corenetwork_bind_tcp_on_all_nodes($1_mail_t) corenetwork_bind_tcp_on_all_nodes($1_mail_t)
domain_use_widely_inheritable_file_descriptors($1_mail_t) domain_use_widely_inheritable_file_descriptors($1_mail_t)
@ -68,10 +68,10 @@ sysnetwork_read_network_config($1_mail_t)
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow $1_mail_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow $1_mail_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces($1_mail_t) corenetwork_sendrecv_udp_on_all_interfaces($1_mail_t)
corenetwork_network_udp_on_all_nodes($1_mail_t) corenetwork_sendrecv_udp_on_all_nodes($1_mail_t)
corenetwork_bind_udp_on_all_nodes($1_mail_t) corenetwork_bind_udp_on_all_nodes($1_mail_t)
corenetwork_network_udp_on_dns_port($1_mail_t) corenetwork_sendrecv_udp_on_dns_port($1_mail_t)
') ')
optional_policy(`procmail.te',` optional_policy(`procmail.te',`

16
refpolicy/policy/modules/services/mta.te
View File

@ -53,12 +53,12 @@ kernel_read_kernel_sysctl(system_mail_t)
kernel_read_system_state(system_mail_t) kernel_read_system_state(system_mail_t)
kernel_read_network_state(system_mail_t) kernel_read_network_state(system_mail_t)
corenetwork_network_tcp_on_all_interfaces(system_mail_t) corenetwork_sendrecv_tcp_on_all_interfaces(system_mail_t)
corenetwork_network_raw_on_all_interfaces(system_mail_t) corenetwork_sendrecv_raw_on_all_interfaces(system_mail_t)
corenetwork_network_tcp_on_all_nodes(system_mail_t) corenetwork_sendrecv_tcp_on_all_nodes(system_mail_t)
corenetwork_network_raw_on_all_nodes(system_mail_t) corenetwork_sendrecv_raw_on_all_nodes(system_mail_t)
corenetwork_bind_tcp_on_all_nodes(system_mail_t) corenetwork_bind_tcp_on_all_nodes(system_mail_t)
corenetwork_network_tcp_on_all_ports(system_mail_t) corenetwork_sendrecv_tcp_on_all_ports(system_mail_t)
devices_get_pseudorandom_data(system_mail_t) devices_get_pseudorandom_data(system_mail_t)
@ -84,10 +84,10 @@ sysnetwork_read_network_config(system_mail_t)
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow system_mail_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow system_mail_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(system_mail_t) corenetwork_sendrecv_udp_on_all_interfaces(system_mail_t)
corenetwork_network_udp_on_all_nodes(system_mail_t) corenetwork_sendrecv_udp_on_all_nodes(system_mail_t)
corenetwork_bind_udp_on_all_nodes(system_mail_t) corenetwork_bind_udp_on_all_nodes(system_mail_t)
corenetwork_network_udp_on_dns_port(system_mail_t) corenetwork_sendrecv_udp_on_dns_port(system_mail_t)
') ')
optional_policy(`procmail.te',` optional_policy(`procmail.te',`

16
refpolicy/policy/modules/services/sendmail.te
View File

@ -42,14 +42,14 @@ files_create_daemon_runtime_data(sendmail_t,sendmail_var_run_t)
kernel_read_kernel_sysctl(sendmail_t) kernel_read_kernel_sysctl(sendmail_t)
kernel_read_hardware_state(sendmail_t) kernel_read_hardware_state(sendmail_t)
corenetwork_network_tcp_on_all_interfaces(sendmail_t) corenetwork_sendrecv_tcp_on_all_interfaces(sendmail_t)
corenetwork_network_raw_on_all_interfaces(sendmail_t) corenetwork_sendrecv_raw_on_all_interfaces(sendmail_t)
corenetwork_network_udp_on_all_interfaces(sendmail_t) corenetwork_sendrecv_udp_on_all_interfaces(sendmail_t)
corenetwork_network_tcp_on_all_nodes(sendmail_t) corenetwork_sendrecv_tcp_on_all_nodes(sendmail_t)
corenetwork_network_raw_on_all_nodes(sendmail_t) corenetwork_sendrecv_raw_on_all_nodes(sendmail_t)
corenetwork_network_udp_on_all_nodes(sendmail_t) corenetwork_sendrecv_udp_on_all_nodes(sendmail_t)
corenetwork_network_tcp_on_all_ports(sendmail_t) corenetwork_sendrecv_tcp_on_all_ports(sendmail_t)
corenetwork_network_udp_on_all_ports(sendmail_t) corenetwork_sendrecv_udp_on_all_ports(sendmail_t)
corenetwork_bind_tcp_on_all_nodes(sendmail_t) corenetwork_bind_tcp_on_all_nodes(sendmail_t)
corenetwork_bind_udp_on_all_nodes(sendmail_t) corenetwork_bind_udp_on_all_nodes(sendmail_t)
corenetwork_bind_tcp_on_smtp_port(sendmail_t) corenetwork_bind_tcp_on_smtp_port(sendmail_t)

20
refpolicy/policy/modules/system/authlogin.if
View File

@ -64,12 +64,12 @@ allow $1_chkpwd_t $1_t:process sigchld;
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow $1_chkpwd_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow $1_chkpwd_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces($1_chkpwd_t) corenetwork_sendrecv_udp_on_all_interfaces($1_chkpwd_t)
corenetwork_network_raw_on_all_interfaces($1_chkpwd_t) corenetwork_sendrecv_raw_on_all_interfaces($1_chkpwd_t)
corenetwork_network_udp_on_all_nodes($1_chkpwd_t) corenetwork_sendrecv_udp_on_all_nodes($1_chkpwd_t)
corenetwork_network_raw_on_all_nodes($1_chkpwd_t) corenetwork_sendrecv_raw_on_all_nodes($1_chkpwd_t)
corenetwork_bind_udp_on_all_nodes($1_chkpwd_t) corenetwork_bind_udp_on_all_nodes($1_chkpwd_t)
corenetwork_network_udp_on_dns_port($1_chkpwd_t) corenetwork_sendrecv_udp_on_dns_port($1_chkpwd_t)
sysnetwork_read_network_config($1_chkpwd_t) sysnetwork_read_network_config($1_chkpwd_t)
') ')
@ -162,12 +162,12 @@ dontaudit $1 shadow_t:file { getattr read };
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces($1) corenetwork_sendrecv_udp_on_all_interfaces($1)
corenetwork_network_raw_on_all_interfaces($1) corenetwork_sendrecv_raw_on_all_interfaces($1)
corenetwork_network_udp_on_all_nodes($1) corenetwork_sendrecv_udp_on_all_nodes($1)
corenetwork_network_raw_on_all_nodes($1) corenetwork_sendrecv_raw_on_all_nodes($1)
corenetwork_bind_udp_on_all_nodes($1) corenetwork_bind_udp_on_all_nodes($1)
corenetwork_network_udp_on_dns_port($1) corenetwork_sendrecv_udp_on_dns_port($1)
sysnetwork_read_network_config($1) sysnetwork_read_network_config($1)
') dnl end use_dns ') dnl end use_dns

10
refpolicy/policy/modules/system/authlogin.te
View File

@ -255,12 +255,12 @@ selinux_read_config(system_chkpwd_t)
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow system_chkpwd_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow system_chkpwd_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(system_chkpwd_t) corenetwork_sendrecv_udp_on_all_interfaces(system_chkpwd_t)
corenetwork_network_raw_on_all_interfaces(system_chkpwd_t) corenetwork_sendrecv_raw_on_all_interfaces(system_chkpwd_t)
corenetwork_network_udp_on_all_nodes(system_chkpwd_t) corenetwork_sendrecv_udp_on_all_nodes(system_chkpwd_t)
corenetwork_network_raw_on_all_nodes(system_chkpwd_t) corenetwork_sendrecv_raw_on_all_nodes(system_chkpwd_t)
corenetwork_bind_udp_on_all_nodes(system_chkpwd_t) corenetwork_bind_udp_on_all_nodes(system_chkpwd_t)
corenetwork_network_udp_on_dns_port(system_chkpwd_t) corenetwork_sendrecv_udp_on_dns_port(system_chkpwd_t)
sysnetwork_read_network_config(system_chkpwd_t) sysnetwork_read_network_config(system_chkpwd_t)
') ')

10
refpolicy/policy/modules/system/hostname.te
View File

@ -66,12 +66,12 @@ files_ignore_read_rootfs_file(hostname_t)
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow hostname_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow hostname_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(hostname_t) corenetwork_sendrecv_udp_on_all_interfaces(hostname_t)
corenetwork_network_raw_on_all_interfaces(hostname_t) corenetwork_sendrecv_raw_on_all_interfaces(hostname_t)
corenetwork_network_udp_on_all_nodes(hostname_t) corenetwork_sendrecv_udp_on_all_nodes(hostname_t)
corenetwork_network_raw_on_all_nodes(hostname_t) corenetwork_sendrecv_raw_on_all_nodes(hostname_t)
corenetwork_bind_udp_on_all_nodes(hostname_t) corenetwork_bind_udp_on_all_nodes(hostname_t)
corenetwork_network_udp_on_dns_port(hostname_t) corenetwork_sendrecv_udp_on_dns_port(hostname_t)
sysnetwork_read_network_config(hostname_t) sysnetwork_read_network_config(hostname_t)
') ')

10
refpolicy/policy/modules/system/hotplug.te
View File

@ -51,11 +51,11 @@ kernel_read_usb_hardware_state(hotplug_t)
bootloader_read_kernel_modules(hotplug_t) bootloader_read_kernel_modules(hotplug_t)
corenetwork_network_tcp_on_all_interfaces(hotplug_t) corenetwork_sendrecv_tcp_on_all_interfaces(hotplug_t)
corenetwork_network_raw_on_all_interfaces(hotplug_t) corenetwork_sendrecv_raw_on_all_interfaces(hotplug_t)
corenetwork_network_tcp_on_all_nodes(hotplug_t) corenetwork_sendrecv_tcp_on_all_nodes(hotplug_t)
corenetwork_network_raw_on_all_nodes(hotplug_t) corenetwork_sendrecv_raw_on_all_nodes(hotplug_t)
corenetwork_network_tcp_on_all_ports(hotplug_t) corenetwork_sendrecv_tcp_on_all_ports(hotplug_t)
corenetwork_bind_tcp_on_all_nodes(hotplug_t) corenetwork_bind_tcp_on_all_nodes(hotplug_t)
# for SSP # for SSP

16
refpolicy/policy/modules/system/init.te
View File

@ -203,14 +203,14 @@ kernel_ignore_get_message_interface_attributes(initrc_t)
bootloader_read_kernel_symbol_table(initrc_t) bootloader_read_kernel_symbol_table(initrc_t)
corenetwork_network_tcp_on_all_interfaces(initrc_t) corenetwork_sendrecv_tcp_on_all_interfaces(initrc_t)
corenetwork_network_raw_on_all_interfaces(initrc_t) corenetwork_sendrecv_raw_on_all_interfaces(initrc_t)
corenetwork_network_udp_on_all_interfaces(initrc_t) corenetwork_sendrecv_udp_on_all_interfaces(initrc_t)
corenetwork_network_tcp_on_all_nodes(initrc_t) corenetwork_sendrecv_tcp_on_all_nodes(initrc_t)
corenetwork_network_raw_on_all_nodes(initrc_t) corenetwork_sendrecv_raw_on_all_nodes(initrc_t)
corenetwork_network_udp_on_all_nodes(initrc_t) corenetwork_sendrecv_udp_on_all_nodes(initrc_t)
corenetwork_network_tcp_on_all_ports(initrc_t) corenetwork_sendrecv_tcp_on_all_ports(initrc_t)
corenetwork_network_udp_on_all_ports(initrc_t) corenetwork_sendrecv_udp_on_all_ports(initrc_t)
corenetwork_bind_tcp_on_all_nodes(initrc_t) corenetwork_bind_tcp_on_all_nodes(initrc_t)
corenetwork_bind_udp_on_all_nodes(initrc_t) corenetwork_bind_udp_on_all_nodes(initrc_t)

10
refpolicy/policy/modules/system/iptables.te
View File

@ -73,12 +73,12 @@ userdomain_use_all_users_file_descriptors(iptables_t)
tunable_policy(`use_dns',` tunable_policy(`use_dns',`
allow iptables_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect }; allow iptables_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(iptables_t) corenetwork_sendrecv_udp_on_all_interfaces(iptables_t)
corenetwork_network_raw_on_all_interfaces(iptables_t) corenetwork_sendrecv_raw_on_all_interfaces(iptables_t)
corenetwork_network_udp_on_all_nodes(iptables_t) corenetwork_sendrecv_udp_on_all_nodes(iptables_t)
corenetwork_network_raw_on_all_nodes(iptables_t) corenetwork_sendrecv_raw_on_all_nodes(iptables_t)
corenetwork_bind_udp_on_all_nodes(iptables_t) corenetwork_bind_udp_on_all_nodes(iptables_t)
corenetwork_network_udp_on_dns_port(iptables_t) corenetwork_sendrecv_udp_on_dns_port(iptables_t)
sysnetwork_read_network_config(iptables_t) sysnetwork_read_network_config(iptables_t)
') ')

10
refpolicy/policy/modules/system/logging.te
View File

@ -120,11 +120,11 @@ init_script_read_runtime_data(syslogd_t)
init_script_ignore_write_runtime_data(syslogd_t) init_script_ignore_write_runtime_data(syslogd_t)
terminal_write_all_private_physical_terminals(syslogd_t) terminal_write_all_private_physical_terminals(syslogd_t)
corenetwork_network_raw_on_all_interfaces(syslogd_t) corenetwork_sendrecv_raw_on_all_interfaces(syslogd_t)
corenetwork_network_udp_on_all_interfaces(syslogd_t) corenetwork_sendrecv_udp_on_all_interfaces(syslogd_t)
corenetwork_network_raw_on_all_nodes(syslogd_t) corenetwork_sendrecv_raw_on_all_nodes(syslogd_t)
corenetwork_network_udp_on_all_nodes(syslogd_t) corenetwork_sendrecv_udp_on_all_nodes(syslogd_t)
corenetwork_network_udp_on_all_ports(syslogd_t) corenetwork_sendrecv_udp_on_all_ports(syslogd_t)
corenetwork_bind_udp_on_all_nodes(syslogd_t) corenetwork_bind_udp_on_all_nodes(syslogd_t)
corenetwork_bind_udp_on_syslogd_port(syslogd_t) corenetwork_bind_udp_on_syslogd_port(syslogd_t)

16
refpolicy/policy/modules/system/mount.te
View File

@ -86,14 +86,14 @@ optional_policy(`portmap.te', `
#allow portmap_t mount_t:udp_socket { sendto recvfrom }; #allow portmap_t mount_t:udp_socket { sendto recvfrom };
#allow mount_t portmap_t:udp_socket { sendto recvfrom }; #allow mount_t portmap_t:udp_socket { sendto recvfrom };
#allow mount_t rpc_pipefs_t:dir search; #allow mount_t rpc_pipefs_t:dir search;
corenetwork_network_tcp_on_all_interfaces(mount_t) corenetwork_sendrecv_tcp_on_all_interfaces(mount_t)
corenetwork_network_raw_on_all_interfaces(mount_t) corenetwork_sendrecv_raw_on_all_interfaces(mount_t)
corenetwork_network_udp_on_all_interfaces(mount_t) corenetwork_sendrecv_udp_on_all_interfaces(mount_t)
corenetwork_network_tcp_on_all_nodes(mount_t) corenetwork_sendrecv_tcp_on_all_nodes(mount_t)
corenetwork_network_raw_on_all_nodes(mount_t) corenetwork_sendrecv_raw_on_all_nodes(mount_t)
corenetwork_network_udp_on_all_nodes(mount_t) corenetwork_sendrecv_udp_on_all_nodes(mount_t)
corenetwork_network_tcp_on_all_ports(mount_t) corenetwork_sendrecv_tcp_on_all_ports(mount_t)
corenetwork_network_udp_on_all_ports(mount_t) corenetwork_sendrecv_udp_on_all_ports(mount_t)
corenetwork_bind_tcp_on_all_nodes(mount_t) corenetwork_bind_tcp_on_all_nodes(mount_t)
corenetwork_bind_udp_on_all_nodes(mount_t) corenetwork_bind_udp_on_all_nodes(mount_t)
corenetwork_bind_tcp_on_general_port(mount_t) corenetwork_bind_tcp_on_general_port(mount_t)

16
refpolicy/policy/modules/system/sysnetwork.te
View File

@ -92,14 +92,14 @@ kernel_read_kernel_sysctl(dhcpc_t)
kernel_read_hardware_state(dhcpc_t) kernel_read_hardware_state(dhcpc_t)
kernel_use_file_descriptors(dhcpc_t) kernel_use_file_descriptors(dhcpc_t)
corenetwork_network_tcp_on_all_interfaces(dhcpc_t) corenetwork_sendrecv_tcp_on_all_interfaces(dhcpc_t)
corenetwork_network_raw_on_all_interfaces(dhcpc_t) corenetwork_sendrecv_raw_on_all_interfaces(dhcpc_t)
corenetwork_network_udp_on_all_interfaces(dhcpc_t) corenetwork_sendrecv_udp_on_all_interfaces(dhcpc_t)
corenetwork_network_tcp_on_all_nodes(dhcpc_t) corenetwork_sendrecv_tcp_on_all_nodes(dhcpc_t)
corenetwork_network_raw_on_all_nodes(dhcpc_t) corenetwork_sendrecv_raw_on_all_nodes(dhcpc_t)
corenetwork_network_udp_on_all_nodes(dhcpc_t) corenetwork_sendrecv_udp_on_all_nodes(dhcpc_t)
corenetwork_network_tcp_on_all_ports(dhcpc_t) corenetwork_sendrecv_tcp_on_all_ports(dhcpc_t)
corenetwork_network_udp_on_all_ports(dhcpc_t) corenetwork_sendrecv_udp_on_all_ports(dhcpc_t)
corenetwork_bind_tcp_on_all_nodes(dhcpc_t) corenetwork_bind_tcp_on_all_nodes(dhcpc_t)
corenetwork_bind_udp_on_all_nodes(dhcpc_t) corenetwork_bind_udp_on_all_nodes(dhcpc_t)
corenetwork_bind_udp_on_dhcpc_port(dhcpc_t) corenetwork_bind_udp_on_dhcpc_port(dhcpc_t)

16
refpolicy/policy/modules/system/userdomain.if
View File

@ -110,14 +110,14 @@ kernel_read_device_sysctl($1_t)
# GNOME checks for usb and other devices: # GNOME checks for usb and other devices:
kernel_modify_usb_hardware_config_option($1_t) kernel_modify_usb_hardware_config_option($1_t)
corenetwork_network_tcp_on_all_interfaces($1_t) corenetwork_sendrecv_tcp_on_all_interfaces($1_t)
corenetwork_network_raw_on_all_interfaces($1_t) corenetwork_sendrecv_raw_on_all_interfaces($1_t)
corenetwork_network_udp_on_all_interfaces($1_t) corenetwork_sendrecv_udp_on_all_interfaces($1_t)
corenetwork_network_tcp_on_all_nodes($1_t) corenetwork_sendrecv_tcp_on_all_nodes($1_t)
corenetwork_network_raw_on_all_nodes($1_t) corenetwork_sendrecv_raw_on_all_nodes($1_t)
corenetwork_network_udp_on_all_nodes($1_t) corenetwork_sendrecv_udp_on_all_nodes($1_t)
corenetwork_network_tcp_on_all_ports($1_t) corenetwork_sendrecv_tcp_on_all_ports($1_t)
corenetwork_network_udp_on_all_ports($1_t) corenetwork_sendrecv_udp_on_all_ports($1_t)
corenetwork_bind_tcp_on_all_nodes($1_t) corenetwork_bind_tcp_on_all_nodes($1_t)
corenetwork_bind_udp_on_all_nodes($1_t) corenetwork_bind_udp_on_all_nodes($1_t)
# allow port_t name binding for UDP because it is not very usable otherwise # allow port_t name binding for UDP because it is not very usable otherwise