[refpolicy] [PATCH] Update socket_class_set according to flask/access_vectors

Nicolas Iooss nicolas.iooss at m4x.org
Fri Aug 29 16:25:37 EDT 2014


File policy/flask/access_vectors defines access vectors for several
socket classes which all inherit from socket class.  All of these
classes belong to socket_class_set but three: socket, dccp_socket and
key_socket.

socket class is a fallback the kernel uses for sockets with no defined
SELinux object class and should not be used in the policy without a good
reason.

dccp_socket is not fully implemented in the policy (e.g. it is not
present in constraints in policy/mls where all other socket classes are)
but there is no reason not to add it to socket_class_set.

For key_socket, I do not know whether it should belong to
socket_class_set or not.  Therefore I document this lack without giving
any argument.

Add dccp_socket to socket_class_set and add a comment about socket and
key_socket.

While at it, rearrange the socket classes to have the same order as in
policy/flask/access_vectors (appletalk_socket moves).

Initial discussion about socket class:
http://oss.tresys.com/pipermail/refpolicy/2014-August/007374.html
---
 policy/support/obj_perm_sets.spt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt
index 27294ea220e8..e61591b58639 100644
--- a/policy/support/obj_perm_sets.spt
+++ b/policy/support/obj_perm_sets.spt
@@ -26,10 +26,10 @@ define(`notdevfile_class_set', `{ file lnk_file sock_file fifo_file }')
 define(`devfile_class_set', `{ chr_file blk_file }')
 
 #
-# All socket classes.
+# All socket classes but "socket" and "key_socket".
+# "socket" is the fallback the kernel uses for socket with no defined SELinux object class.
 #
-define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket }')
-
+define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket appletalk_socket dccp_socket tun_socket }')
 
 #
 # Datagram socket classes.
-- 
2.0.4



More information about the refpolicy mailing list