From ea1775dcb5eac51fc8ded9623a009570ce59ef48 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Thu, 1 Nov 2018 19:39:44 -0700
Subject: [PATCH] Update access_vectors
Update access_vectors to support newer kernel functionality.
This change does not grant any new access.
Inspired by the following refpolicy commits:
* https://github.com/SELinuxProject/refpolicy/commit/25a5b2427447eb14edb07ce302217d37528813bc
* https://github.com/SELinuxProject/refpolicy/commit/109ab3296bce27281c453617d3629a238f5e4dbf
* https://github.com/SELinuxProject/refpolicy/commit/437e48ac53307e1e2e13e49d349c0a09b12eb187
Bug: 118843234
Test: policy compiles
Change-Id: I7c5a8dcf288dc2321adcf368bd0c0573c5257202
---
private/access_vectors | 15 +++++++++++++++
private/security_classes | 9 ++++++++-
public/global_macros | 4 ++--
3 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/private/access_vectors b/private/access_vectors
index 59e6d3213..b77dcc1f7 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -547,6 +547,16 @@ inherits socket
class netlink_crypto_socket
inherits socket
+class infiniband_pkey
+{
+ access
+}
+
+class infiniband_endport
+{
+ manage_subnet
+}
+
#
# Define the access vector interpretation for controlling capabilities
# in user namespaces
@@ -573,6 +583,8 @@ class sctp_socket
inherits socket
{
node_bind
+ name_connect
+ association
}
class icmp_socket
@@ -729,3 +741,6 @@ class drmservice {
finalizeDecryptUnit
pread
}
+
+class xdp_socket
+inherits socket
diff --git a/private/security_classes b/private/security_classes
index e0007d19c..25b4cbaf5 100644
--- a/private/security_classes
+++ b/private/security_classes
@@ -35,7 +35,6 @@ class packet_socket
class key_socket
class unix_stream_socket
class unix_dgram_socket
-class bpf
# sysv-ipc-related classes
class sem
@@ -93,6 +92,10 @@ class netlink_scsitransport_socket
class netlink_rdma_socket
class netlink_crypto_socket
+# Infiniband
+class infiniband_pkey
+class infiniband_endport
+
# Capability checks when on a non-init user namespace
class cap_userns
class cap2_userns
@@ -132,6 +135,10 @@ class smc_socket
class process2
+class bpf
+
+class xdp_socket
+
# Property service
class property_service # userspace
diff --git a/public/global_macros b/public/global_macros
index b2fe6ae86..00f9fb310 100644
--- a/public/global_macros
+++ b/public/global_macros
@@ -12,8 +12,8 @@ define(`dir_file_class_set', `{ dir file_class_set }')
define(`socket_class_set', `{ socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket }')
define(`dgram_socket_class_set', `{ udp_socket unix_dgram_socket }')
-define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket }')
-define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket }')
+define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket sctp_socket }')
+define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket sctp_socket }')
define(`ipc_class_set', `{ sem msgq shm ipc }')
--
GitLab