]>
Commit | Line | Data |
---|---|---|
c6d3aaa4 SS |
1 | #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \ |
2 | "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append" | |
3 | ||
4 | #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ | |
42a9699a | 5 | "rename", "execute", "quotaon", "mounton", "audit_access", \ |
b424485a | 6 | "open", "execmod" |
c6d3aaa4 SS |
7 | |
8 | #define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \ | |
9 | "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \ | |
42a9699a | 10 | "sendto", "name_bind" |
c6d3aaa4 SS |
11 | |
12 | #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ | |
13 | "write", "associate", "unix_read", "unix_write" | |
14 | ||
8e4ff6f2 SS |
15 | #define COMMON_CAP_PERMS "chown", "dac_override", "dac_read_search", \ |
16 | "fowner", "fsetid", "kill", "setgid", "setuid", "setpcap", \ | |
17 | "linux_immutable", "net_bind_service", "net_broadcast", \ | |
18 | "net_admin", "net_raw", "ipc_lock", "ipc_owner", "sys_module", \ | |
19 | "sys_rawio", "sys_chroot", "sys_ptrace", "sys_pacct", "sys_admin", \ | |
20 | "sys_boot", "sys_nice", "sys_resource", "sys_time", \ | |
21 | "sys_tty_config", "mknod", "lease", "audit_write", \ | |
22 | "audit_control", "setfcap" | |
23 | ||
24 | #define COMMON_CAP2_PERMS "mac_override", "mac_admin", "syslog", \ | |
25 | "wake_alarm", "block_suspend", "audit_read" | |
26 | ||
4bc6c2d5 HC |
27 | /* |
28 | * Note: The name for any socket class should be suffixed by "socket", | |
29 | * and doesn't contain more than one substr of "socket". | |
30 | */ | |
c6d3aaa4 SS |
31 | struct security_class_mapping secclass_map[] = { |
32 | { "security", | |
33 | { "compute_av", "compute_create", "compute_member", | |
34 | "check_context", "load_policy", "compute_relabel", | |
35 | "compute_user", "setenforce", "setbool", "setsecparam", | |
f9df6458 | 36 | "setcheckreqprot", "read_policy", "validate_trans", NULL } }, |
c6d3aaa4 SS |
37 | { "process", |
38 | { "fork", "transition", "sigchld", "sigkill", | |
39 | "sigstop", "signull", "signal", "ptrace", "getsched", "setsched", | |
40 | "getsession", "getpgid", "setpgid", "getcap", "setcap", "share", | |
41 | "getattr", "setexec", "setfscreate", "noatsecure", "siginh", | |
42 | "setrlimit", "rlimitinh", "dyntransition", "setcurrent", | |
43 | "execmem", "execstack", "execheap", "setkeycreate", | |
44 | "setsockcreate", NULL } }, | |
45 | { "system", | |
46 | { "ipc_info", "syslog_read", "syslog_mod", | |
61d612ea | 47 | "syslog_console", "module_request", "module_load", NULL } }, |
c6d3aaa4 | 48 | { "capability", |
8e4ff6f2 | 49 | { COMMON_CAP_PERMS, NULL } }, |
c6d3aaa4 SS |
50 | { "filesystem", |
51 | { "mount", "remount", "unmount", "getattr", | |
42a9699a | 52 | "relabelfrom", "relabelto", "associate", "quotamod", |
c6d3aaa4 SS |
53 | "quotaget", NULL } }, |
54 | { "file", | |
55 | { COMMON_FILE_PERMS, | |
b424485a | 56 | "execute_no_trans", "entrypoint", NULL } }, |
c6d3aaa4 SS |
57 | { "dir", |
58 | { COMMON_FILE_PERMS, "add_name", "remove_name", | |
49b7b8de | 59 | "reparent", "search", "rmdir", NULL } }, |
c6d3aaa4 SS |
60 | { "fd", { "use", NULL } }, |
61 | { "lnk_file", | |
62 | { COMMON_FILE_PERMS, NULL } }, | |
63 | { "chr_file", | |
b424485a | 64 | { COMMON_FILE_PERMS, NULL } }, |
c6d3aaa4 | 65 | { "blk_file", |
49b7b8de | 66 | { COMMON_FILE_PERMS, NULL } }, |
c6d3aaa4 | 67 | { "sock_file", |
49b7b8de | 68 | { COMMON_FILE_PERMS, NULL } }, |
c6d3aaa4 | 69 | { "fifo_file", |
49b7b8de | 70 | { COMMON_FILE_PERMS, NULL } }, |
c6d3aaa4 SS |
71 | { "socket", |
72 | { COMMON_SOCK_PERMS, NULL } }, | |
73 | { "tcp_socket", | |
74 | { COMMON_SOCK_PERMS, | |
42a9699a | 75 | "node_bind", "name_connect", |
c6d3aaa4 SS |
76 | NULL } }, |
77 | { "udp_socket", | |
78 | { COMMON_SOCK_PERMS, | |
79 | "node_bind", NULL } }, | |
80 | { "rawip_socket", | |
81 | { COMMON_SOCK_PERMS, | |
82 | "node_bind", NULL } }, | |
83 | { "node", | |
42a9699a | 84 | { "recvfrom", "sendto", NULL } }, |
c6d3aaa4 | 85 | { "netif", |
42a9699a | 86 | { "ingress", "egress", NULL } }, |
c6d3aaa4 SS |
87 | { "netlink_socket", |
88 | { COMMON_SOCK_PERMS, NULL } }, | |
89 | { "packet_socket", | |
90 | { COMMON_SOCK_PERMS, NULL } }, | |
91 | { "key_socket", | |
92 | { COMMON_SOCK_PERMS, NULL } }, | |
93 | { "unix_stream_socket", | |
42a9699a | 94 | { COMMON_SOCK_PERMS, "connectto", NULL } }, |
c6d3aaa4 | 95 | { "unix_dgram_socket", |
42a9699a | 96 | { COMMON_SOCK_PERMS, NULL } }, |
c6d3aaa4 SS |
97 | { "sem", |
98 | { COMMON_IPC_PERMS, NULL } }, | |
99 | { "msg", { "send", "receive", NULL } }, | |
100 | { "msgq", | |
101 | { COMMON_IPC_PERMS, "enqueue", NULL } }, | |
102 | { "shm", | |
103 | { COMMON_IPC_PERMS, "lock", NULL } }, | |
104 | { "ipc", | |
105 | { COMMON_IPC_PERMS, NULL } }, | |
106 | { "netlink_route_socket", | |
107 | { COMMON_SOCK_PERMS, | |
108 | "nlmsg_read", "nlmsg_write", NULL } }, | |
c6d3aaa4 SS |
109 | { "netlink_tcpdiag_socket", |
110 | { COMMON_SOCK_PERMS, | |
111 | "nlmsg_read", "nlmsg_write", NULL } }, | |
112 | { "netlink_nflog_socket", | |
113 | { COMMON_SOCK_PERMS, NULL } }, | |
114 | { "netlink_xfrm_socket", | |
115 | { COMMON_SOCK_PERMS, | |
116 | "nlmsg_read", "nlmsg_write", NULL } }, | |
117 | { "netlink_selinux_socket", | |
118 | { COMMON_SOCK_PERMS, NULL } }, | |
6c6d2e9b SS |
119 | { "netlink_iscsi_socket", |
120 | { COMMON_SOCK_PERMS, NULL } }, | |
c6d3aaa4 SS |
121 | { "netlink_audit_socket", |
122 | { COMMON_SOCK_PERMS, | |
123 | "nlmsg_read", "nlmsg_write", "nlmsg_relay", "nlmsg_readpriv", | |
124 | "nlmsg_tty_audit", NULL } }, | |
6c6d2e9b SS |
125 | { "netlink_fib_lookup_socket", |
126 | { COMMON_SOCK_PERMS, NULL } }, | |
127 | { "netlink_connector_socket", | |
128 | { COMMON_SOCK_PERMS, NULL } }, | |
129 | { "netlink_netfilter_socket", | |
130 | { COMMON_SOCK_PERMS, NULL } }, | |
c6d3aaa4 SS |
131 | { "netlink_dnrt_socket", |
132 | { COMMON_SOCK_PERMS, NULL } }, | |
133 | { "association", | |
134 | { "sendto", "recvfrom", "setcontext", "polmatch", NULL } }, | |
135 | { "netlink_kobject_uevent_socket", | |
136 | { COMMON_SOCK_PERMS, NULL } }, | |
6c6d2e9b SS |
137 | { "netlink_generic_socket", |
138 | { COMMON_SOCK_PERMS, NULL } }, | |
139 | { "netlink_scsitransport_socket", | |
140 | { COMMON_SOCK_PERMS, NULL } }, | |
141 | { "netlink_rdma_socket", | |
142 | { COMMON_SOCK_PERMS, NULL } }, | |
143 | { "netlink_crypto_socket", | |
144 | { COMMON_SOCK_PERMS, NULL } }, | |
c6d3aaa4 SS |
145 | { "appletalk_socket", |
146 | { COMMON_SOCK_PERMS, NULL } }, | |
147 | { "packet", | |
47ac19ea | 148 | { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } }, |
c6d3aaa4 SS |
149 | { "key", |
150 | { "view", "read", "write", "search", "link", "setattr", "create", | |
151 | NULL } }, | |
152 | { "dccp_socket", | |
153 | { COMMON_SOCK_PERMS, | |
154 | "node_bind", "name_connect", NULL } }, | |
155 | { "memprotect", { "mmap_zero", NULL } }, | |
156 | { "peer", { "recv", NULL } }, | |
64919e60 | 157 | { "capability2", |
8e4ff6f2 | 158 | { COMMON_CAP2_PERMS, NULL } }, |
c6d3aaa4 SS |
159 | { "kernel_service", { "use_as_override", "create_files_as", NULL } }, |
160 | { "tun_socket", | |
6f96c142 | 161 | { COMMON_SOCK_PERMS, "attach_queue", NULL } }, |
79af7307 SS |
162 | { "binder", { "impersonate", "call", "set_context_mgr", "transfer", |
163 | NULL } }, | |
8e4ff6f2 SS |
164 | { "cap_userns", |
165 | { COMMON_CAP_PERMS, NULL } }, | |
166 | { "cap2_userns", | |
167 | { COMMON_CAP2_PERMS, NULL } }, | |
c6d3aaa4 SS |
168 | { NULL } |
169 | }; |