From 11dc03e5a2c65c4f3ca9a5b6fd0eb688447433bd Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Mon, 21 Nov 2016 14:38:17 -0800
Subject: [PATCH] access_vectors: Remove unused permission definitions
Description stolen from
https://github.com/torvalds/linux/commit/42a9699a9fa179c0054ea3cf5ad3cc67104a6162
Remove unused permission definitions from SELinux.
Many of these were only ever used in pre-mainline
versions of SELinux, prior to Linux 2.6.0. Some of them
were used in the legacy network or compat_net=1 checks
that were disabled by default in Linux 2.6.18 and
fully removed in Linux 2.6.30.
Permissions never used in mainline Linux:
file swapon
filesystem transition
tcp_socket { connectto newconn acceptfrom }
node enforce_dest
unix_stream_socket { newconn acceptfrom }
Legacy network checks, removed in 2.6.30:
socket { recv_msg send_msg }
node { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send }
netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send }
Test: policy compiles and no boot errors (marlin)
Change-Id: Idaef2567666f80db39c3e3cee70e760e1dac73ec
---
private/access_vectors | 26 --------------------------
public/te_macros | 2 +-
2 files changed, 1 insertion(+), 27 deletions(-)
diff --git a/private/access_vectors b/private/access_vectors
index 26286b238..6393c166d 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -24,7 +24,6 @@ common file
link
rename
execute
- swapon
quotaon
mounton
}
@@ -57,8 +56,6 @@ common socket
shutdown
recvfrom
sendto
- recv_msg
- send_msg
name_bind
}
@@ -97,7 +94,6 @@ class filesystem
getattr
relabelfrom
relabelto
- transition
associate
quotamod
quotaget
@@ -184,9 +180,6 @@ inherits socket
class tcp_socket
inherits socket
{
- connectto
- newconn
- acceptfrom
node_bind
name_connect
}
@@ -205,29 +198,12 @@ inherits socket
class node
{
- tcp_recv
- tcp_send
- udp_recv
- udp_send
- rawip_recv
- rawip_send
- enforce_dest
- dccp_recv
- dccp_send
recvfrom
sendto
}
class netif
{
- tcp_recv
- tcp_send
- udp_recv
- udp_send
- rawip_recv
- rawip_send
- dccp_recv
- dccp_send
ingress
egress
}
@@ -245,8 +221,6 @@ class unix_stream_socket
inherits socket
{
connectto
- newconn
- acceptfrom
}
class unix_dgram_socket
diff --git a/public/te_macros b/public/te_macros
index a826e9683..df171f010 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -237,7 +237,7 @@ define(`selinux_check_access', `
r_dir_file($1, selinuxfs)
allow $1 selinuxfs:file w_file_perms;
allow $1 kernel:security compute_av;
-allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto recv_msg send_msg name_bind };
+allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind };
')
#####################################
--
GitLab