Re: [RFC PATCH v9 12/18] SELinux: Add a new peer class and permissions to the Flask definitions

On Friday 21 December 2007 12:36:15 pm Stephen Smalley wrote:
> On Fri, 2007-12-21 at 12:09 -0500, Paul Moore wrote:
> > Add additional Flask definitions to support the new "peer" object class
> > and additional permissions to the netif and node object classes.
> >
> > Signed-off-by: Paul Moore <paul.moore@hp.com>
>
> Not an obstacle to merging, but need to get this reserved in policy too.

Yep, I'm working on some policy patches now, although I'm not sure when I'll have those done. I'll post the FLASK definition changes today either way, that way they are at least there even if the policy rules aren't ready yet.

> > ---
> >
> > security/selinux/include/av_perm_to_string.h | 5 +++++
> > security/selinux/include/av_permissions.h | 5 +++++
> > security/selinux/include/class_to_string.h | 7 +++++++
> > security/selinux/include/flask.h | 1 +
> > 4 files changed, 18 insertions(+), 0 deletions(-)
> >
> > diff --git a/security/selinux/include/av_perm_to_string.h
> > b/security/selinux/include/av_perm_to_string.h index 049bf69..caa0634
> > 100644
> > --- a/security/selinux/include/av_perm_to_string.h
> > +++ b/security/selinux/include/av_perm_to_string.h
> > @@ -37,6 +37,8 @@
> > S_(SECCLASS_NODE, NODE__ENFORCE_DEST, "enforce_dest")
> > S_(SECCLASS_NODE, NODE__DCCP_RECV, "dccp_recv")
> > S_(SECCLASS_NODE, NODE__DCCP_SEND, "dccp_send")
> > + S_(SECCLASS_NODE, NODE__RECVFROM, "recvfrom")
> > + S_(SECCLASS_NODE, NODE__SENDTO, "sendto")
> > S_(SECCLASS_NETIF, NETIF__TCP_RECV, "tcp_recv")
> > S_(SECCLASS_NETIF, NETIF__TCP_SEND, "tcp_send")
> > S_(SECCLASS_NETIF, NETIF__UDP_RECV, "udp_recv")
> > @@ -45,6 +47,8 @@
> > S_(SECCLASS_NETIF, NETIF__RAWIP_SEND, "rawip_send")
> > S_(SECCLASS_NETIF, NETIF__DCCP_RECV, "dccp_recv")
> > S_(SECCLASS_NETIF, NETIF__DCCP_SEND, "dccp_send")
> > + S_(SECCLASS_NETIF, NETIF__INGRESS, "ingress")
> > + S_(SECCLASS_NETIF, NETIF__EGRESS, "egress")
> > S_(SECCLASS_UNIX_STREAM_SOCKET, UNIX_STREAM_SOCKET__CONNECTTO,
> > "connectto") S_(SECCLASS_UNIX_STREAM_SOCKET, UNIX_STREAM_SOCKET__NEWCONN,
> > "newconn") S_(SECCLASS_UNIX_STREAM_SOCKET,
> > UNIX_STREAM_SOCKET__ACCEPTFROM, "acceptfrom") @@ -159,3 +163,4 @@
> > S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NODE_BIND, "node_bind")
> > S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
> > S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")
> > + S_(SECCLASS_PEER, PEER__RECV, "recv")
> > diff --git a/security/selinux/include/av_permissions.h
> > b/security/selinux/include/av_permissions.h index eda89a2..c2b5bb2 100644
> > --- a/security/selinux/include/av_permissions.h
> > +++ b/security/selinux/include/av_permissions.h
> > @@ -292,6 +292,8 @@
> > #define NODE__ENFORCE_DEST 0x00000040UL
> > #define NODE__DCCP_RECV 0x00000080UL
> > #define NODE__DCCP_SEND 0x00000100UL
> > +#define NODE__RECVFROM 0x00000200UL
> > +#define NODE__SENDTO 0x00000400UL
> > #define NETIF__TCP_RECV 0x00000001UL
> > #define NETIF__TCP_SEND 0x00000002UL
> > #define NETIF__UDP_RECV 0x00000004UL
> > @@ -300,6 +302,8 @@
> > #define NETIF__RAWIP_SEND 0x00000020UL
> > #define NETIF__DCCP_RECV 0x00000040UL
> > #define NETIF__DCCP_SEND 0x00000080UL
> > +#define NETIF__INGRESS 0x00000100UL
> > +#define NETIF__EGRESS 0x00000200UL
> > #define NETLINK_SOCKET__IOCTL 0x00000001UL
> > #define NETLINK_SOCKET__READ 0x00000002UL
> > #define NETLINK_SOCKET__WRITE 0x00000004UL
> > @@ -824,3 +828,4 @@
> > #define DCCP_SOCKET__NODE_BIND 0x00400000UL
> > #define DCCP_SOCKET__NAME_CONNECT 0x00800000UL
> > #define MEMPROTECT__MMAP_ZERO 0x00000001UL
> > +#define PEER__RECV 0x00000001UL
> > diff --git a/security/selinux/include/class_to_string.h
> > b/security/selinux/include/class_to_string.h index e77de0e..b1b0d1d
> > 100644
> > --- a/security/selinux/include/class_to_string.h
> > +++ b/security/selinux/include/class_to_string.h
> > @@ -64,3 +64,10 @@
> > S_(NULL)
> > S_("dccp_socket")
> > S_("memprotect")
> > + S_(NULL)
> > + S_(NULL)
> > + S_(NULL)
> > + S_(NULL)
> > + S_(NULL)
> > + S_(NULL)
> > + S_("peer")
> > diff --git a/security/selinux/include/flask.h
> > b/security/selinux/include/flask.h index a9c2b20..09e9dd2 100644
> > --- a/security/selinux/include/flask.h
> > +++ b/security/selinux/include/flask.h
> > @@ -50,6 +50,7 @@
> > #define SECCLASS_KEY 58
> > #define SECCLASS_DCCP_SOCKET 60
> > #define SECCLASS_MEMPROTECT 61
> > +#define SECCLASS_PEER 68
> >
> > /*
> > * Security identifier indices for initial entities
> >
> >
> > --
> > This message was distributed to subscribers of the selinux mailing list.
> > If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
> > with the words "unsubscribe selinux" without quotes as the message.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.