rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

change network verb in corenetwork to sendrecv

Browse Source
This commit is contained in:
Chris PeBenito 2005-06-02 18:55:47 +00:00
parent cabfa520aa
commit d115660e3b
21 changed files with 964 additions and 791 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
refpolicy/policy/modules/admin/netutils.te
View File

@ -46,14 +46,14 @@ allow netutils_t netutils_tmp_t:dir { create read getattr lock setattr ioctl lin
allow netutils_t netutils_tmp_t:file { create ioctl read getattr lock write setattr append link unlink rename };
files_create_private_tmp_data(netutils_t, netutils_tmp_t, { file dir })
corenetwork_network_tcp_on_all_interfaces(netutils_t)
corenetwork_network_raw_on_all_interfaces(netutils_t)
corenetwork_network_udp_on_all_interfaces(netutils_t)
corenetwork_network_tcp_on_all_nodes(netutils_t)
corenetwork_network_raw_on_all_nodes(netutils_t)
corenetwork_network_udp_on_all_nodes(netutils_t)
corenetwork_network_tcp_on_all_ports(netutils_t)
corenetwork_network_udp_on_all_ports(netutils_t)
corenetwork_sendrecv_tcp_on_all_interfaces(netutils_t)
corenetwork_sendrecv_raw_on_all_interfaces(netutils_t)
corenetwork_sendrecv_udp_on_all_interfaces(netutils_t)
corenetwork_sendrecv_tcp_on_all_nodes(netutils_t)
corenetwork_sendrecv_raw_on_all_nodes(netutils_t)
corenetwork_sendrecv_udp_on_all_nodes(netutils_t)
corenetwork_sendrecv_tcp_on_all_ports(netutils_t)
corenetwork_sendrecv_udp_on_all_ports(netutils_t)
corenetwork_bind_tcp_on_all_nodes(netutils_t)
corenetwork_bind_udp_on_all_nodes(netutils_t)
@ -104,14 +104,14 @@ allow ping_t self:tcp_socket { create connect ioctl read getattr write setattr a
allow ping_t self:udp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown };
allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt };
corenetwork_network_tcp_on_all_interfaces(ping_t)
corenetwork_network_udp_on_all_interfaces(ping_t)
corenetwork_network_raw_on_all_interfaces(ping_t)
corenetwork_network_raw_on_all_nodes(ping_t)
corenetwork_network_tcp_on_all_nodes(ping_t)
corenetwork_network_udp_on_all_nodes(ping_t)
corenetwork_network_tcp_on_all_ports(ping_t)
corenetwork_network_udp_on_all_ports(ping_t)
corenetwork_sendrecv_tcp_on_all_interfaces(ping_t)
corenetwork_sendrecv_udp_on_all_interfaces(ping_t)
corenetwork_sendrecv_raw_on_all_interfaces(ping_t)
corenetwork_sendrecv_raw_on_all_nodes(ping_t)
corenetwork_sendrecv_tcp_on_all_nodes(ping_t)
corenetwork_sendrecv_udp_on_all_nodes(ping_t)
corenetwork_sendrecv_tcp_on_all_ports(ping_t)
corenetwork_sendrecv_udp_on_all_ports(ping_t)
corenetwork_bind_udp_on_all_nodes(ping_t)
corenetwork_bind_tcp_on_all_nodes(ping_t)
@ -162,14 +162,14 @@ allow traceroute_t self:netlink_route_socket { bind create getattr nlmsg_read re
kernel_read_system_state(traceroute_t)
kernel_read_network_state(traceroute_t)
corenetwork_network_tcp_on_all_interfaces(traceroute_t)
corenetwork_network_udp_on_all_interfaces(traceroute_t)
corenetwork_network_raw_on_all_interfaces(traceroute_t)
corenetwork_network_raw_on_all_nodes(traceroute_t)
corenetwork_network_tcp_on_all_nodes(traceroute_t)
corenetwork_network_udp_on_all_nodes(traceroute_t)
corenetwork_network_tcp_on_all_ports(traceroute_t)
corenetwork_network_udp_on_all_ports(traceroute_t)
corenetwork_sendrecv_tcp_on_all_interfaces(traceroute_t)
corenetwork_sendrecv_udp_on_all_interfaces(traceroute_t)
corenetwork_sendrecv_raw_on_all_interfaces(traceroute_t)
corenetwork_sendrecv_raw_on_all_nodes(traceroute_t)
corenetwork_sendrecv_tcp_on_all_nodes(traceroute_t)
corenetwork_sendrecv_udp_on_all_nodes(traceroute_t)
corenetwork_sendrecv_tcp_on_all_ports(traceroute_t)
corenetwork_sendrecv_udp_on_all_ports(traceroute_t)
corenetwork_bind_udp_on_all_nodes(traceroute_t)
corenetwork_bind_tcp_on_all_nodes(traceroute_t)

16
refpolicy/policy/modules/admin/rpm.te
View File

@ -102,14 +102,14 @@ kernel_compute_selinux_create_context(rpm_t)
kernel_compute_selinux_relabel_context(rpm_t)
kernel_compute_selinux_reachable_user_contexts(rpm_t)
corenetwork_network_tcp_on_all_interfaces(rpm_t)
corenetwork_network_raw_on_all_interfaces(rpm_t)
corenetwork_network_udp_on_all_interfaces(rpm_t)
corenetwork_network_tcp_on_all_nodes(rpm_t)
corenetwork_network_raw_on_all_nodes(rpm_t)
corenetwork_network_udp_on_all_nodes(rpm_t)
corenetwork_network_tcp_on_all_ports(rpm_t)
corenetwork_network_udp_on_all_ports(rpm_t)
corenetwork_sendrecv_tcp_on_all_interfaces(rpm_t)
corenetwork_sendrecv_raw_on_all_interfaces(rpm_t)
corenetwork_sendrecv_udp_on_all_interfaces(rpm_t)
corenetwork_sendrecv_tcp_on_all_nodes(rpm_t)
corenetwork_sendrecv_raw_on_all_nodes(rpm_t)
corenetwork_sendrecv_udp_on_all_nodes(rpm_t)
corenetwork_sendrecv_tcp_on_all_ports(rpm_t)
corenetwork_sendrecv_udp_on_all_ports(rpm_t)
corenetwork_bind_tcp_on_all_nodes(rpm_t)
corenetwork_bind_udp_on_all_nodes(rpm_t)

32
refpolicy/policy/modules/apps/gpg.if
View File

@ -62,14 +62,14 @@ allow $1_gpg_t $1_gpg_secret_t:dir { read getattr lock search ioctl add_name rem
allow $1_gpg_t $1_gpg_secret_t:file { create ioctl read getattr lock write setattr append link unlink rename };
allow $1_gpg_t $1_gpg_secret_t:lnk_file { create read getattr setattr link unlink rename };
corenetwork_network_tcp_on_all_interfaces($1_gpg_t)
corenetwork_network_raw_on_all_interfaces($1_gpg_t)
corenetwork_network_udp_on_all_interfaces($1_gpg_t)
corenetwork_network_tcp_on_all_nodes($1_gpg_t)
corenetwork_network_raw_on_all_nodes($1_gpg_t)
corenetwork_network_udp_on_all_nodes($1_gpg_t)
corenetwork_network_tcp_on_all_ports($1_gpg_t)
corenetwork_network_udp_on_all_ports($1_gpg_t)
corenetwork_sendrecv_tcp_on_all_interfaces($1_gpg_t)
corenetwork_sendrecv_raw_on_all_interfaces($1_gpg_t)
corenetwork_sendrecv_udp_on_all_interfaces($1_gpg_t)
corenetwork_sendrecv_tcp_on_all_nodes($1_gpg_t)
corenetwork_sendrecv_raw_on_all_nodes($1_gpg_t)
corenetwork_sendrecv_udp_on_all_nodes($1_gpg_t)
corenetwork_sendrecv_tcp_on_all_ports($1_gpg_t)
corenetwork_sendrecv_udp_on_all_ports($1_gpg_t)
corenetwork_bind_tcp_on_all_nodes($1_gpg_t)
corenetwork_bind_udp_on_all_nodes($1_gpg_t)
@ -169,14 +169,14 @@ allow $1_gpg_helper_t self:udp_socket { create connect ioctl read getattr write
dontaudit $1_gpg_helper_t $1_gpg_secret_t:file read;
corenetwork_network_tcp_on_all_interfaces($1_gpg_helper_t)
corenetwork_network_raw_on_all_interfaces($1_gpg_helper_t)
corenetwork_network_udp_on_all_interfaces($1_gpg_helper_t)
corenetwork_network_tcp_on_all_nodes($1_gpg_helper_t)
corenetwork_network_udp_on_all_nodes($1_gpg_helper_t)
corenetwork_network_raw_on_all_nodes($1_gpg_helper_t)
corenetwork_network_tcp_on_all_ports($1_gpg_helper_t)
corenetwork_network_udp_on_all_ports($1_gpg_helper_t)
corenetwork_sendrecv_tcp_on_all_interfaces($1_gpg_helper_t)
corenetwork_sendrecv_raw_on_all_interfaces($1_gpg_helper_t)
corenetwork_sendrecv_udp_on_all_interfaces($1_gpg_helper_t)
corenetwork_sendrecv_tcp_on_all_nodes($1_gpg_helper_t)
corenetwork_sendrecv_udp_on_all_nodes($1_gpg_helper_t)
corenetwork_sendrecv_raw_on_all_nodes($1_gpg_helper_t)
corenetwork_sendrecv_tcp_on_all_ports($1_gpg_helper_t)
corenetwork_sendrecv_udp_on_all_ports($1_gpg_helper_t)
corenetwork_bind_tcp_on_all_nodes($1_gpg_helper_t)
corenetwork_bind_udp_on_all_nodes($1_gpg_helper_t)

307
refpolicy/policy/modules/kernel/bootloader.if
View File

@ -13,23 +13,26 @@
## </interface>
#
define(`bootloader_transition',`
requires_block_template(`$0'_depend)
allow $1 bootloader_exec_t:file { getattr read execute };
allow $1 bootloader_t:process transition;
type_transition $1 bootloader_exec_t:process bootloader_t;
dontaudit $1 bootloader_t:process { noatsecure siginh rlimitinh };
allow $1 bootloader_t:fd use;
allow bootloader_t $1:fd use;
allow bootloader_t $1:fifo_file rw_file_perms;
allow bootloader_t $1:process sigchld;
requires_block_template(`$0'_depend)
allow $1 bootloader_exec_t:file { getattr read execute };
allow $1 bootloader_t:process transition;
type_transition $1 bootloader_exec_t:process bootloader_t;
dontaudit $1 bootloader_t:process { noatsecure siginh rlimitinh };
allow $1 bootloader_t:fd use;
allow bootloader_t $1:fd use;
allow bootloader_t $1:fifo_file rw_file_perms;
allow bootloader_t $1:process sigchld;
')
define(`bootloader_transition_depend',`
type bootloader_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh sigchld };
class fd use;
class fifo_file rw_file_perms;
type bootloader_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh sigchld };
class fd use;
class fifo_file rw_file_perms;
')
########################################
@ -52,15 +55,17 @@ class fifo_file rw_file_perms;
## </interface>
#
define(`bootloader_transition_add_role_use_terminal',`
requires_block_template(`$0'_depend)
bootloader_transition($1)
role $2 types bootloader_t;
allow bootloader_t $3:chr_file { getattr read write ioctl };
requires_block_template(`$0'_depend)
bootloader_transition($1)
role $2 types bootloader_t;
allow bootloader_t $3:chr_file { getattr read write ioctl };
')
define(`bootloader_transition_add_role_use_terminal_depend',`
type bootloader_t;
class chr_file { getattr read write ioctl };
type bootloader_t;
class chr_file { getattr read write ioctl };
')
########################################
@ -68,13 +73,15 @@ class chr_file { getattr read write ioctl };
# bootloader_search_bootloader_data_directory(domain)
#
define(`bootloader_search_bootloader_data_directory',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir search;
requires_block_template(`$0'_depend)
allow $1 boot_t:dir search;
')
define(`bootloader_search_bootloader_data_directory_depend',`
type boot_t;
class dir search;
type boot_t;
class dir search;
')
########################################
@ -82,13 +89,15 @@ class dir search;
# bootloader_ignore_search_bootloader_data_directory(domain)
#
define(`bootloader_ignore_search_bootloader_data_directory',`
requires_block_template(`$0'_depend)
dontaudit $1 boot_t:dir search;
requires_block_template(`$0'_depend)
dontaudit $1 boot_t:dir search;
')
define(`bootloader_ignore_search_bootloader_data_directory_depend',`
type boot_t;
class dir search;
type boot_t;
class dir search;
')
########################################
@ -96,14 +105,16 @@ class dir search;
# bootloader_modify_bootloader_data_directory_symbolic_links(domain)
#
define(`bootloader_modify_bootloader_data_directory_symbolic_links',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read };
allow $1 boot_t:lnk_file { getattr read write };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read };
allow $1 boot_t:lnk_file { getattr read write };
')
define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',`
type boot_t;
class dir { getattr search read };
type boot_t;
class dir { getattr search read };
')
########################################
@ -111,17 +122,19 @@ class dir { getattr search read };
# bootloader_install_kernel(domain)
#
define(`bootloader_install_kernel',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name };
allow $1 boot_t:file { getattr read write create };
allow $1 boot_t:lnk_file { getattr read create unlink };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name };
allow $1 boot_t:file { getattr read write create };
allow $1 boot_t:lnk_file { getattr read create unlink };
')
define(`bootloader_install_kernel_depend',`
type boot_t;
class dir { getattr search read write add_name };
class file { getattr read write create };
class lnk_file { getattr read create unlink };
type boot_t;
class dir { getattr search read write add_name };
class file { getattr read write create };
class lnk_file { getattr read create unlink };
')
########################################
@ -129,17 +142,19 @@ class lnk_file { getattr read create unlink };
# bootloader_install_initrd(domain)
#
define(`bootloader_install_initrd',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name };
allow $1 boot_t:file { getattr read write create };
allow $1 boot_t:lnk_file { getattr read create unlink };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name };
allow $1 boot_t:file { getattr read write create };
allow $1 boot_t:lnk_file { getattr read create unlink };
')
define(`bootloader_install_initrd_depend',`
type boot_t;
class dir { getattr search read write add_name };
class file { getattr read write create };
class lnk_file { getattr read create unlink };
type boot_t;
class dir { getattr search read write add_name };
class file { getattr read write create };
class lnk_file { getattr read create unlink };
')
########################################
@ -147,15 +162,17 @@ class lnk_file { getattr read create unlink };
# bootloader_install_kernel_symbol_table(domain)
#
define(`bootloader_install_kernel_symbol_table',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name };
allow $1 system_map_t:file { getattr read write create };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name };
allow $1 system_map_t:file { getattr read write create };
')
define(`bootloader_install_kernel_symbol_table_depend',`
type boot_t, system_map_t;
class dir { getattr search read write add_name };
class file { getattr read write create };
type boot_t, system_map_t;
class dir { getattr search read write add_name };
class file { getattr read write create };
')
########################################
@ -163,15 +180,17 @@ class file { getattr read write create };
# bootloader_read_kernel_symbol_table(domain)
#
define(`bootloader_read_kernel_symbol_table',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read };
allow $1 system_map_t:file { getattr read };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read };
allow $1 system_map_t:file { getattr read };
')
define(`bootloader_read_kernel_symbol_table_depend',`
type boot_t, system_map_t;
class dir { getattr search read };
class file { getattr read };
type boot_t, system_map_t;
class dir { getattr search read };
class file { getattr read };
')
########################################
@ -179,15 +198,17 @@ class file { getattr read };
# bootloader_remove_kernel(domain)
#
define(`bootloader_remove_kernel',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write remove_name };
allow $1 boot_t:file { getattr unlink };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write remove_name };
allow $1 boot_t:file { getattr unlink };
')
define(`bootloader_remove_kernel_depend',`
type boot_t;
class dir { getattr search read write remove_name };
class file { getattr unlink };
type boot_t;
class dir { getattr search read write remove_name };
class file { getattr unlink };
')
########################################
@ -195,15 +216,17 @@ class file { getattr unlink };
# bootloader_remove_kernel_symbol_table(domain)
#
define(`bootloader_remove_kernel_symbol_table',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write remove_name };
allow $1 system_map_t:file { getattr unlink };
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write remove_name };
allow $1 system_map_t:file { getattr unlink };
')
define(`bootloader_remove_kernel_symbol_table_depend',`
type boot_t, system_map_t;
class dir { getattr search read write remove_name };
class file { getattr unlink };
type boot_t, system_map_t;
class dir { getattr search read write remove_name };
class file { getattr unlink };
')
########################################
@ -211,13 +234,15 @@ class file { getattr unlink };
# bootloader_read_config(domain)
#
define(`bootloader_read_config',`
requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file { getattr read };
requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file { getattr read };
')
define(`bootloader_read_config_depend',`
type bootloader_etc_t;
class file { getattr read };
type bootloader_etc_t;
class file { getattr read };
')
########################################
@ -225,13 +250,15 @@ class file { getattr read };
# bootloader_modify_config(domain)
#
define(`bootloader_modify_bootloader_config',`
requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file { getattr read write append };
requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file { getattr read write append };
')
define(`bootloader_modify_bootloader_config_depend',`
type bootloader_etc_t;
class file { getattr read write append };
type bootloader_etc_t;
class file { getattr read write append };
')
########################################
@ -239,14 +266,16 @@ class file { getattr read write append };
# bootloader_modify_temporary_data(domain)
#
define(`bootloader_modify_temporary_data',`
requires_block_template(`$0'_depend)
# FIXME: read tmp_t
allow $1 bootloader_tmp_t:file { getattr read write };
requires_block_template(`$0'_depend)
# FIXME: read tmp_t
allow $1 bootloader_tmp_t:file { getattr read write };
')
define(`bootloader_modify_temporary_data_depend',`
type bootloader_tmp_t;
class file { getattr read write setattr };
type bootloader_tmp_t;
class file { getattr read write setattr };
')
########################################
@ -254,16 +283,18 @@ class file { getattr read write setattr };
# bootloader_create_runtime_data(domain)
#
define(`bootloader_create_runtime_data',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name remove_name };
allow $1 boot_runtime_t:file { getattr create read write append unlink };
type_transition $1 boot_t:file boot_runtime_t;
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { getattr search read write add_name remove_name };
allow $1 boot_runtime_t:file { getattr create read write append unlink };
type_transition $1 boot_t:file boot_runtime_t;
')
define(`bootloader_create_runtime_data_depend',`
type boot_t, boot_runtime_t;
class dir { getattr search read write add_name remove_name };
class file { getattr create read write append unlink };
type boot_t, boot_runtime_t;
class dir { getattr search read write add_name remove_name };
class file { getattr create read write append unlink };
')
########################################
@ -271,13 +302,15 @@ class file { getattr create read write append unlink };
# bootloader_list_kernel_modules(domain)
#
define(`bootloader_list_kernel_modules',`
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read };
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read };
')
define(`bootloader_list_kernel_modules_depend',`
type modules_object_t;
class dir { getattr search read };
type modules_object_t;
class dir { getattr search read };
')
########################################
@ -285,17 +318,19 @@ class dir { getattr search read };
# bootloader_read_kernel_modules(domain)
#
define(`bootloader_read_kernel_modules',`
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read };
allow $1 modules_object_t:lnk_file { getattr read };
allow $1 modules_object_t:file { getattr read lock };
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read };
allow $1 modules_object_t:lnk_file { getattr read };
allow $1 modules_object_t:file { getattr read lock };
')
define(`bootloader_read_kernel_modules_depend',`
type modules_object_t;
class dir { getattr search read };
class lnk_file { getattr read };
class file { getattr read lock };
type modules_object_t;
class dir { getattr search read };
class lnk_file { getattr read };
class file { getattr read lock };
')
########################################
@ -303,17 +338,21 @@ class file { getattr read lock };
# bootloader_write_kernel_modules(domain)
#
define(`bootloader_write_kernel_modules',`
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read };
allow $1 modules_object_t:file write;
typeattribute $1 can_modify_kernel_modules;
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read };
allow $1 modules_object_t:file write;
typeattribute $1 can_modify_kernel_modules;
')
define(`bootloader_write_kernel_modules_depend',`
attribute can_modify_kernel_modules;
type modules_object_t;
class dir { getattr search read };
class file write;
attribute can_modify_kernel_modules;
type modules_object_t;
class dir { getattr search read };
class file write;
')
########################################
@ -321,17 +360,21 @@ class file write;
# bootloader_manage_kernel_modules(domain)
#
define(`bootloader_manage_kernel_modules',`
requires_block_template(`$0'_depend)
allow $1 modules_object_t:file { getattr create read write setattr unlink };
allow $1 modules_object_t:dir { getattr search read write add_name remove_name };
typeattribute $1 can_modify_kernel_modules;
requires_block_template(`$0'_depend)
allow $1 modules_object_t:file { getattr create read write setattr unlink };
allow $1 modules_object_t:dir { getattr search read write add_name remove_name };
typeattribute $1 can_modify_kernel_modules;
')
define(`bootloader_manage_kernel_modules_depend',`
attribute can_modify_kernel_modules;
type modules_object_t;
class file { getattr create read write setattr unlink };
class dir { getattr search read write add_name remove_name };
attribute can_modify_kernel_modules;
type modules_object_t;
class file { getattr create read write setattr unlink };
class dir { getattr search read write add_name remove_name };
')
########################################
@ -339,18 +382,22 @@ class dir { getattr search read write add_name remove_name };
# bootloader_create_private_module_dir_entry(domain,privatetype,[class(es)])
#
define(`bootloader_create_private_module_dir_entry',`
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read write add_name remove_name };
ifelse(`$3',`',`
type_transition $1 modules_object_t:file $2;
',`
type_transition $1 modules_object_t:$3 $2;
') dnl end ifelse
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir { getattr search read write add_name remove_name };
# if a class is specified use it, else use file as default
ifelse(`$3',`',`
type_transition $1 modules_object_t:file $2;
',`
type_transition $1 modules_object_t:$3 $2;
')
')
define(`bootloader_create_private_module_dir_entry_depend',`
type modules_object_t;
class dir { getattr search read write add_name remove_name };
type modules_object_t;
class dir { getattr search read write add_name remove_name };
')
## </module>

1130
refpolicy/policy/modules/kernel/corenetwork.if
View File

File diff suppressed because it is too large Load Diff

8
refpolicy/policy/modules/kernel/kernel.te
View File

@ -217,12 +217,12 @@ corecommands_execute_general_programs(kernel_t)
logging_send_system_log_message(kernel_t)
# Kernel-generated traffic, e.g. ICMP replies.
corenetwork_network_raw_on_all_interfaces(kernel_t)
corenetwork_network_raw_on_all_nodes(kernel_t)
corenetwork_sendrecv_raw_on_all_interfaces(kernel_t)
corenetwork_sendrecv_raw_on_all_nodes(kernel_t)
# Kernel-generated traffic, e.g. TCP resets.
corenetwork_network_tcp_on_all_interfaces(kernel_t)
corenetwork_network_tcp_on_all_nodes(kernel_t)
corenetwork_sendrecv_tcp_on_all_interfaces(kernel_t)
corenetwork_sendrecv_tcp_on_all_nodes(kernel_t)
neverallow ~can_load_policy security_t:security load_policy;
neverallow ~can_setenforce security_t:security setenforce;

16
refpolicy/policy/modules/services/cron.if
View File

@ -57,14 +57,14 @@ kernel_read_kernel_sysctl($1_crond_t)
# ps does not need to access /boot when run from cron
bootloader_ignore_search_bootloader_data_directory($1_crond_t)
corenetwork_network_tcp_on_all_interfaces($1_crond_t)
corenetwork_network_raw_on_all_interfaces($1_crond_t)
corenetwork_network_udp_on_all_interfaces($1_crond_t)
corenetwork_network_tcp_on_all_nodes($1_crond_t)
corenetwork_network_raw_on_all_nodes($1_crond_t)
corenetwork_network_udp_on_all_nodes($1_crond_t)
corenetwork_network_tcp_on_all_ports($1_crond_t)
corenetwork_network_udp_on_all_ports($1_crond_t)
corenetwork_sendrecv_tcp_on_all_interfaces($1_crond_t)
corenetwork_sendrecv_raw_on_all_interfaces($1_crond_t)
corenetwork_sendrecv_udp_on_all_interfaces($1_crond_t)
corenetwork_sendrecv_tcp_on_all_nodes($1_crond_t)
corenetwork_sendrecv_raw_on_all_nodes($1_crond_t)
corenetwork_sendrecv_udp_on_all_nodes($1_crond_t)
corenetwork_sendrecv_tcp_on_all_ports($1_crond_t)
corenetwork_sendrecv_udp_on_all_ports($1_crond_t)
corenetwork_bind_tcp_on_all_nodes($1_crond_t)
corenetwork_bind_udp_on_all_nodes($1_crond_t)

16
refpolicy/policy/modules/services/cron.te
View File

@ -237,14 +237,14 @@ kernel_read_software_raid_state(system_crond_t)
# ps does not need to access /boot when run from cron
bootloader_ignore_search_bootloader_data_directory(system_crond_t)
corenetwork_network_tcp_on_all_interfaces(system_crond_t)
corenetwork_network_raw_on_all_interfaces(system_crond_t)
corenetwork_network_udp_on_all_interfaces(system_crond_t)
corenetwork_network_tcp_on_all_nodes(system_crond_t)
corenetwork_network_raw_on_all_nodes(system_crond_t)
corenetwork_network_udp_on_all_nodes(system_crond_t)
corenetwork_network_tcp_on_all_ports(system_crond_t)
corenetwork_network_udp_on_all_ports(system_crond_t)
corenetwork_sendrecv_tcp_on_all_interfaces(system_crond_t)
corenetwork_sendrecv_raw_on_all_interfaces(system_crond_t)
corenetwork_sendrecv_udp_on_all_interfaces(system_crond_t)
corenetwork_sendrecv_tcp_on_all_nodes(system_crond_t)
corenetwork_sendrecv_raw_on_all_nodes(system_crond_t)
corenetwork_sendrecv_udp_on_all_nodes(system_crond_t)
corenetwork_sendrecv_tcp_on_all_ports(system_crond_t)
corenetwork_sendrecv_udp_on_all_ports(system_crond_t)
corenetwork_bind_tcp_on_all_nodes(system_crond_t)
corenetwork_bind_udp_on_all_nodes(system_crond_t)

16
refpolicy/policy/modules/services/mta.if
View File

@ -44,11 +44,11 @@ allow $1_mail_t $1_t:process sigchld;
kernel_read_kernel_sysctl($1_mail_t)
corenetwork_network_tcp_on_all_interfaces($1_mail_t)
corenetwork_network_raw_on_all_interfaces($1_mail_t)
corenetwork_network_tcp_on_all_nodes($1_mail_t)
corenetwork_network_raw_on_all_nodes($1_mail_t)
corenetwork_network_tcp_on_all_ports($1_mail_t)
corenetwork_sendrecv_tcp_on_all_interfaces($1_mail_t)
corenetwork_sendrecv_raw_on_all_interfaces($1_mail_t)
corenetwork_sendrecv_tcp_on_all_nodes($1_mail_t)
corenetwork_sendrecv_raw_on_all_nodes($1_mail_t)
corenetwork_sendrecv_tcp_on_all_ports($1_mail_t)
corenetwork_bind_tcp_on_all_nodes($1_mail_t)
domain_use_widely_inheritable_file_descriptors($1_mail_t)
@ -68,10 +68,10 @@ sysnetwork_read_network_config($1_mail_t)
tunable_policy(`use_dns',`
allow $1_mail_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces($1_mail_t)
corenetwork_network_udp_on_all_nodes($1_mail_t)
corenetwork_sendrecv_udp_on_all_interfaces($1_mail_t)
corenetwork_sendrecv_udp_on_all_nodes($1_mail_t)
corenetwork_bind_udp_on_all_nodes($1_mail_t)
corenetwork_network_udp_on_dns_port($1_mail_t)
corenetwork_sendrecv_udp_on_dns_port($1_mail_t)
')
optional_policy(`procmail.te',`

16
refpolicy/policy/modules/services/mta.te
View File

@ -53,12 +53,12 @@ kernel_read_kernel_sysctl(system_mail_t)
kernel_read_system_state(system_mail_t)
kernel_read_network_state(system_mail_t)
corenetwork_network_tcp_on_all_interfaces(system_mail_t)
corenetwork_network_raw_on_all_interfaces(system_mail_t)
corenetwork_network_tcp_on_all_nodes(system_mail_t)
corenetwork_network_raw_on_all_nodes(system_mail_t)
corenetwork_sendrecv_tcp_on_all_interfaces(system_mail_t)
corenetwork_sendrecv_raw_on_all_interfaces(system_mail_t)
corenetwork_sendrecv_tcp_on_all_nodes(system_mail_t)
corenetwork_sendrecv_raw_on_all_nodes(system_mail_t)
corenetwork_bind_tcp_on_all_nodes(system_mail_t)
corenetwork_network_tcp_on_all_ports(system_mail_t)
corenetwork_sendrecv_tcp_on_all_ports(system_mail_t)
devices_get_pseudorandom_data(system_mail_t)
@ -84,10 +84,10 @@ sysnetwork_read_network_config(system_mail_t)
tunable_policy(`use_dns',`
allow system_mail_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(system_mail_t)
corenetwork_network_udp_on_all_nodes(system_mail_t)
corenetwork_sendrecv_udp_on_all_interfaces(system_mail_t)
corenetwork_sendrecv_udp_on_all_nodes(system_mail_t)
corenetwork_bind_udp_on_all_nodes(system_mail_t)
corenetwork_network_udp_on_dns_port(system_mail_t)
corenetwork_sendrecv_udp_on_dns_port(system_mail_t)
')
optional_policy(`procmail.te',`

16
refpolicy/policy/modules/services/sendmail.te
View File

@ -42,14 +42,14 @@ files_create_daemon_runtime_data(sendmail_t,sendmail_var_run_t)
kernel_read_kernel_sysctl(sendmail_t)
kernel_read_hardware_state(sendmail_t)
corenetwork_network_tcp_on_all_interfaces(sendmail_t)
corenetwork_network_raw_on_all_interfaces(sendmail_t)
corenetwork_network_udp_on_all_interfaces(sendmail_t)
corenetwork_network_tcp_on_all_nodes(sendmail_t)
corenetwork_network_raw_on_all_nodes(sendmail_t)
corenetwork_network_udp_on_all_nodes(sendmail_t)
corenetwork_network_tcp_on_all_ports(sendmail_t)
corenetwork_network_udp_on_all_ports(sendmail_t)
corenetwork_sendrecv_tcp_on_all_interfaces(sendmail_t)
corenetwork_sendrecv_raw_on_all_interfaces(sendmail_t)
corenetwork_sendrecv_udp_on_all_interfaces(sendmail_t)
corenetwork_sendrecv_tcp_on_all_nodes(sendmail_t)
corenetwork_sendrecv_raw_on_all_nodes(sendmail_t)
corenetwork_sendrecv_udp_on_all_nodes(sendmail_t)
corenetwork_sendrecv_tcp_on_all_ports(sendmail_t)
corenetwork_sendrecv_udp_on_all_ports(sendmail_t)
corenetwork_bind_tcp_on_all_nodes(sendmail_t)
corenetwork_bind_udp_on_all_nodes(sendmail_t)
corenetwork_bind_tcp_on_smtp_port(sendmail_t)

20
refpolicy/policy/modules/system/authlogin.if
View File

@ -64,12 +64,12 @@ allow $1_chkpwd_t $1_t:process sigchld;
tunable_policy(`use_dns',`
allow $1_chkpwd_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces($1_chkpwd_t)
corenetwork_network_raw_on_all_interfaces($1_chkpwd_t)
corenetwork_network_udp_on_all_nodes($1_chkpwd_t)
corenetwork_network_raw_on_all_nodes($1_chkpwd_t)
corenetwork_sendrecv_udp_on_all_interfaces($1_chkpwd_t)
corenetwork_sendrecv_raw_on_all_interfaces($1_chkpwd_t)
corenetwork_sendrecv_udp_on_all_nodes($1_chkpwd_t)
corenetwork_sendrecv_raw_on_all_nodes($1_chkpwd_t)
corenetwork_bind_udp_on_all_nodes($1_chkpwd_t)
corenetwork_network_udp_on_dns_port($1_chkpwd_t)
corenetwork_sendrecv_udp_on_dns_port($1_chkpwd_t)
sysnetwork_read_network_config($1_chkpwd_t)
')
@ -162,12 +162,12 @@ dontaudit $1 shadow_t:file { getattr read };
tunable_policy(`use_dns',`
allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces($1)
corenetwork_network_raw_on_all_interfaces($1)
corenetwork_network_udp_on_all_nodes($1)
corenetwork_network_raw_on_all_nodes($1)
corenetwork_sendrecv_udp_on_all_interfaces($1)
corenetwork_sendrecv_raw_on_all_interfaces($1)
corenetwork_sendrecv_udp_on_all_nodes($1)
corenetwork_sendrecv_raw_on_all_nodes($1)
corenetwork_bind_udp_on_all_nodes($1)
corenetwork_network_udp_on_dns_port($1)
corenetwork_sendrecv_udp_on_dns_port($1)
sysnetwork_read_network_config($1)
') dnl end use_dns

10
refpolicy/policy/modules/system/authlogin.te
View File

@ -255,12 +255,12 @@ selinux_read_config(system_chkpwd_t)
tunable_policy(`use_dns',`
allow system_chkpwd_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(system_chkpwd_t)
corenetwork_network_raw_on_all_interfaces(system_chkpwd_t)
corenetwork_network_udp_on_all_nodes(system_chkpwd_t)
corenetwork_network_raw_on_all_nodes(system_chkpwd_t)
corenetwork_sendrecv_udp_on_all_interfaces(system_chkpwd_t)
corenetwork_sendrecv_raw_on_all_interfaces(system_chkpwd_t)
corenetwork_sendrecv_udp_on_all_nodes(system_chkpwd_t)
corenetwork_sendrecv_raw_on_all_nodes(system_chkpwd_t)
corenetwork_bind_udp_on_all_nodes(system_chkpwd_t)
corenetwork_network_udp_on_dns_port(system_chkpwd_t)
corenetwork_sendrecv_udp_on_dns_port(system_chkpwd_t)
sysnetwork_read_network_config(system_chkpwd_t)
')

10
refpolicy/policy/modules/system/hostname.te
View File

@ -66,12 +66,12 @@ files_ignore_read_rootfs_file(hostname_t)
tunable_policy(`use_dns',`
allow hostname_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(hostname_t)
corenetwork_network_raw_on_all_interfaces(hostname_t)
corenetwork_network_udp_on_all_nodes(hostname_t)
corenetwork_network_raw_on_all_nodes(hostname_t)
corenetwork_sendrecv_udp_on_all_interfaces(hostname_t)
corenetwork_sendrecv_raw_on_all_interfaces(hostname_t)
corenetwork_sendrecv_udp_on_all_nodes(hostname_t)
corenetwork_sendrecv_raw_on_all_nodes(hostname_t)
corenetwork_bind_udp_on_all_nodes(hostname_t)
corenetwork_network_udp_on_dns_port(hostname_t)
corenetwork_sendrecv_udp_on_dns_port(hostname_t)
sysnetwork_read_network_config(hostname_t)
')

10
refpolicy/policy/modules/system/hotplug.te
View File

@ -51,11 +51,11 @@ kernel_read_usb_hardware_state(hotplug_t)
bootloader_read_kernel_modules(hotplug_t)
corenetwork_network_tcp_on_all_interfaces(hotplug_t)
corenetwork_network_raw_on_all_interfaces(hotplug_t)
corenetwork_network_tcp_on_all_nodes(hotplug_t)
corenetwork_network_raw_on_all_nodes(hotplug_t)
corenetwork_network_tcp_on_all_ports(hotplug_t)
corenetwork_sendrecv_tcp_on_all_interfaces(hotplug_t)
corenetwork_sendrecv_raw_on_all_interfaces(hotplug_t)
corenetwork_sendrecv_tcp_on_all_nodes(hotplug_t)
corenetwork_sendrecv_raw_on_all_nodes(hotplug_t)
corenetwork_sendrecv_tcp_on_all_ports(hotplug_t)
corenetwork_bind_tcp_on_all_nodes(hotplug_t)
# for SSP

16
refpolicy/policy/modules/system/init.te
View File

@ -203,14 +203,14 @@ kernel_ignore_get_message_interface_attributes(initrc_t)
bootloader_read_kernel_symbol_table(initrc_t)
corenetwork_network_tcp_on_all_interfaces(initrc_t)
corenetwork_network_raw_on_all_interfaces(initrc_t)
corenetwork_network_udp_on_all_interfaces(initrc_t)
corenetwork_network_tcp_on_all_nodes(initrc_t)
corenetwork_network_raw_on_all_nodes(initrc_t)
corenetwork_network_udp_on_all_nodes(initrc_t)
corenetwork_network_tcp_on_all_ports(initrc_t)
corenetwork_network_udp_on_all_ports(initrc_t)
corenetwork_sendrecv_tcp_on_all_interfaces(initrc_t)
corenetwork_sendrecv_raw_on_all_interfaces(initrc_t)
corenetwork_sendrecv_udp_on_all_interfaces(initrc_t)
corenetwork_sendrecv_tcp_on_all_nodes(initrc_t)
corenetwork_sendrecv_raw_on_all_nodes(initrc_t)
corenetwork_sendrecv_udp_on_all_nodes(initrc_t)
corenetwork_sendrecv_tcp_on_all_ports(initrc_t)
corenetwork_sendrecv_udp_on_all_ports(initrc_t)
corenetwork_bind_tcp_on_all_nodes(initrc_t)
corenetwork_bind_udp_on_all_nodes(initrc_t)

10
refpolicy/policy/modules/system/iptables.te
View File

@ -73,12 +73,12 @@ userdomain_use_all_users_file_descriptors(iptables_t)
tunable_policy(`use_dns',`
allow iptables_t self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
corenetwork_network_udp_on_all_interfaces(iptables_t)
corenetwork_network_raw_on_all_interfaces(iptables_t)
corenetwork_network_udp_on_all_nodes(iptables_t)
corenetwork_network_raw_on_all_nodes(iptables_t)
corenetwork_sendrecv_udp_on_all_interfaces(iptables_t)
corenetwork_sendrecv_raw_on_all_interfaces(iptables_t)
corenetwork_sendrecv_udp_on_all_nodes(iptables_t)
corenetwork_sendrecv_raw_on_all_nodes(iptables_t)
corenetwork_bind_udp_on_all_nodes(iptables_t)
corenetwork_network_udp_on_dns_port(iptables_t)
corenetwork_sendrecv_udp_on_dns_port(iptables_t)
sysnetwork_read_network_config(iptables_t)
')

10
refpolicy/policy/modules/system/logging.te
View File

@ -120,11 +120,11 @@ init_script_read_runtime_data(syslogd_t)
init_script_ignore_write_runtime_data(syslogd_t)
terminal_write_all_private_physical_terminals(syslogd_t)
corenetwork_network_raw_on_all_interfaces(syslogd_t)
corenetwork_network_udp_on_all_interfaces(syslogd_t)
corenetwork_network_raw_on_all_nodes(syslogd_t)
corenetwork_network_udp_on_all_nodes(syslogd_t)
corenetwork_network_udp_on_all_ports(syslogd_t)
corenetwork_sendrecv_raw_on_all_interfaces(syslogd_t)
corenetwork_sendrecv_udp_on_all_interfaces(syslogd_t)
corenetwork_sendrecv_raw_on_all_nodes(syslogd_t)
corenetwork_sendrecv_udp_on_all_nodes(syslogd_t)
corenetwork_sendrecv_udp_on_all_ports(syslogd_t)
corenetwork_bind_udp_on_all_nodes(syslogd_t)
corenetwork_bind_udp_on_syslogd_port(syslogd_t)

16
refpolicy/policy/modules/system/mount.te
View File

@ -86,14 +86,14 @@ optional_policy(`portmap.te', `
#allow portmap_t mount_t:udp_socket { sendto recvfrom };
#allow mount_t portmap_t:udp_socket { sendto recvfrom };
#allow mount_t rpc_pipefs_t:dir search;
corenetwork_network_tcp_on_all_interfaces(mount_t)
corenetwork_network_raw_on_all_interfaces(mount_t)
corenetwork_network_udp_on_all_interfaces(mount_t)
corenetwork_network_tcp_on_all_nodes(mount_t)
corenetwork_network_raw_on_all_nodes(mount_t)
corenetwork_network_udp_on_all_nodes(mount_t)
corenetwork_network_tcp_on_all_ports(mount_t)
corenetwork_network_udp_on_all_ports(mount_t)
corenetwork_sendrecv_tcp_on_all_interfaces(mount_t)
corenetwork_sendrecv_raw_on_all_interfaces(mount_t)
corenetwork_sendrecv_udp_on_all_interfaces(mount_t)
corenetwork_sendrecv_tcp_on_all_nodes(mount_t)
corenetwork_sendrecv_raw_on_all_nodes(mount_t)
corenetwork_sendrecv_udp_on_all_nodes(mount_t)
corenetwork_sendrecv_tcp_on_all_ports(mount_t)
corenetwork_sendrecv_udp_on_all_ports(mount_t)
corenetwork_bind_tcp_on_all_nodes(mount_t)
corenetwork_bind_udp_on_all_nodes(mount_t)
corenetwork_bind_tcp_on_general_port(mount_t)

16
refpolicy/policy/modules/system/sysnetwork.te
View File

@ -92,14 +92,14 @@ kernel_read_kernel_sysctl(dhcpc_t)
kernel_read_hardware_state(dhcpc_t)
kernel_use_file_descriptors(dhcpc_t)
corenetwork_network_tcp_on_all_interfaces(dhcpc_t)
corenetwork_network_raw_on_all_interfaces(dhcpc_t)
corenetwork_network_udp_on_all_interfaces(dhcpc_t)
corenetwork_network_tcp_on_all_nodes(dhcpc_t)
corenetwork_network_raw_on_all_nodes(dhcpc_t)
corenetwork_network_udp_on_all_nodes(dhcpc_t)
corenetwork_network_tcp_on_all_ports(dhcpc_t)
corenetwork_network_udp_on_all_ports(dhcpc_t)
corenetwork_sendrecv_tcp_on_all_interfaces(dhcpc_t)
corenetwork_sendrecv_raw_on_all_interfaces(dhcpc_t)
corenetwork_sendrecv_udp_on_all_interfaces(dhcpc_t)
corenetwork_sendrecv_tcp_on_all_nodes(dhcpc_t)
corenetwork_sendrecv_raw_on_all_nodes(dhcpc_t)
corenetwork_sendrecv_udp_on_all_nodes(dhcpc_t)
corenetwork_sendrecv_tcp_on_all_ports(dhcpc_t)
corenetwork_sendrecv_udp_on_all_ports(dhcpc_t)
corenetwork_bind_tcp_on_all_nodes(dhcpc_t)
corenetwork_bind_udp_on_all_nodes(dhcpc_t)
corenetwork_bind_udp_on_dhcpc_port(dhcpc_t)

16
refpolicy/policy/modules/system/userdomain.if
View File

@ -110,14 +110,14 @@ kernel_read_device_sysctl($1_t)
# GNOME checks for usb and other devices:
kernel_modify_usb_hardware_config_option($1_t)
corenetwork_network_tcp_on_all_interfaces($1_t)
corenetwork_network_raw_on_all_interfaces($1_t)
corenetwork_network_udp_on_all_interfaces($1_t)
corenetwork_network_tcp_on_all_nodes($1_t)
corenetwork_network_raw_on_all_nodes($1_t)
corenetwork_network_udp_on_all_nodes($1_t)
corenetwork_network_tcp_on_all_ports($1_t)
corenetwork_network_udp_on_all_ports($1_t)
corenetwork_sendrecv_tcp_on_all_interfaces($1_t)
corenetwork_sendrecv_raw_on_all_interfaces($1_t)
corenetwork_sendrecv_udp_on_all_interfaces($1_t)
corenetwork_sendrecv_tcp_on_all_nodes($1_t)
corenetwork_sendrecv_raw_on_all_nodes($1_t)
corenetwork_sendrecv_udp_on_all_nodes($1_t)
corenetwork_sendrecv_tcp_on_all_ports($1_t)
corenetwork_sendrecv_udp_on_all_ports($1_t)
corenetwork_bind_tcp_on_all_nodes($1_t)
corenetwork_bind_udp_on_all_nodes($1_t)
# allow port_t name binding for UDP because it is not very usable otherwise