Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to socket_class_set #1580

Open
wants to merge 3 commits into
base: rawhide
Choose a base branch
from
Open

Update to socket_class_set #1580

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
083314c
Include key_socket in socket_class_set
zpytela Jan 30, 2023
672b12c
Remove socket from socket_class_set
zpytela Jan 30, 2023
fd7c18f
Remove the lockdown class from the policy
zpytela Oct 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions policy/flask/access_vectors
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1090,12 +1090,6 @@ class perf_event
write
}

class lockdown
{
integrity
confidentiality
}

class io_uring
{
override_creds
Expand Down
10 changes: 0 additions & 10 deletions policy/flask/flask_documentation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1906,16 +1906,6 @@ Used to manage access while attaching BPF programs to tracepoints, perf profilin

---

## class lockdown

*deprecated*

**integrity**

**confidentiality**

---

## class io\_uring

Used to control the ability to use special io\_uring features by the process. See also [the original kernel commit](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=740b03414b20e7f1879cd99aae27d8c401bbcbf9) for more details.
Expand Down
2 changes: 0 additions & 2 deletions policy/flask/security_classes
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,8 +201,6 @@ class mctp_socket

class perf_event

class lockdown

class io_uring

class user_namespace
Expand Down
2 changes: 1 addition & 1 deletion policy/modules/kernel/domain.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,7 +282,7 @@ allow unconfined_domain_type self:lnk_file setattr;

# Use/sendto/connectto sockets created by any domain.
allow unconfined_domain_type self:cap_userns all_cap_userns_perms;
allow unconfined_domain_type domain:{ socket_class_set socket key_socket } *;
allow unconfined_domain_type domain:socket_class_set *;

allow unconfined_domain_type domain:system all_system_perms;
# Use descriptors and pipes created by any domain.
Expand Down
2 changes: 1 addition & 1 deletion policy/support/obj_perm_sets.spt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ define(`devfile_class_set', `{ chr_file blk_file }')
#
# All socket classes.
#
define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket dccp_socket xdp_socket mctp_socket}')
define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket dccp_socket xdp_socket mctp_socket key_socket}')

#
# Datagram socket classes.
Expand Down