Greg Kroah-Hartman | b244131 | 2017-11-01 15:07:57 +0100 | [diff] [blame] | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
Paul Moore | bfc5e3a | 2016-12-21 10:39:25 -0500 | [diff] [blame] | 2 | #include <linux/capability.h> |
| 3 | |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 4 | #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \ |
Stephen Smalley | 3ba4bf5 | 2017-05-05 09:14:48 -0400 | [diff] [blame] | 5 | "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append", "map" |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 6 | |
| 7 | #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 8 | "rename", "execute", "quotaon", "mounton", "audit_access", \ |
Eric Paris | b424485 | 2010-07-23 11:44:15 -0400 | [diff] [blame] | 9 | "open", "execmod" |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 10 | |
| 11 | #define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \ |
| 12 | "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \ |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 13 | "sendto", "name_bind" |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 14 | |
| 15 | #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ |
| 16 | "write", "associate", "unix_read", "unix_write" |
| 17 | |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 18 | #define COMMON_CAP_PERMS "chown", "dac_override", "dac_read_search", \ |
| 19 | "fowner", "fsetid", "kill", "setgid", "setuid", "setpcap", \ |
| 20 | "linux_immutable", "net_bind_service", "net_broadcast", \ |
| 21 | "net_admin", "net_raw", "ipc_lock", "ipc_owner", "sys_module", \ |
| 22 | "sys_rawio", "sys_chroot", "sys_ptrace", "sys_pacct", "sys_admin", \ |
| 23 | "sys_boot", "sys_nice", "sys_resource", "sys_time", \ |
| 24 | "sys_tty_config", "mknod", "lease", "audit_write", \ |
| 25 | "audit_control", "setfcap" |
| 26 | |
| 27 | #define COMMON_CAP2_PERMS "mac_override", "mac_admin", "syslog", \ |
| 28 | "wake_alarm", "block_suspend", "audit_read" |
| 29 | |
Stephen Smalley | 3322d0d | 2016-11-18 10:23:09 -0500 | [diff] [blame] | 30 | #if CAP_LAST_CAP > CAP_AUDIT_READ |
| 31 | #error New capability defined, please update COMMON_CAP2_PERMS. |
| 32 | #endif |
| 33 | |
Harry Ciao | 4bc6c2d | 2011-03-02 13:46:08 +0800 | [diff] [blame] | 34 | /* |
| 35 | * Note: The name for any socket class should be suffixed by "socket", |
| 36 | * and doesn't contain more than one substr of "socket". |
| 37 | */ |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 38 | struct security_class_mapping secclass_map[] = { |
| 39 | { "security", |
| 40 | { "compute_av", "compute_create", "compute_member", |
| 41 | "check_context", "load_policy", "compute_relabel", |
| 42 | "compute_user", "setenforce", "setbool", "setsecparam", |
Andrew Perepechko | f9df645 | 2015-12-24 11:09:41 -0500 | [diff] [blame] | 43 | "setcheckreqprot", "read_policy", "validate_trans", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 44 | { "process", |
| 45 | { "fork", "transition", "sigchld", "sigkill", |
| 46 | "sigstop", "signull", "signal", "ptrace", "getsched", "setsched", |
| 47 | "getsession", "getpgid", "setpgid", "getcap", "setcap", "share", |
| 48 | "getattr", "setexec", "setfscreate", "noatsecure", "siginh", |
| 49 | "setrlimit", "rlimitinh", "dyntransition", "setcurrent", |
| 50 | "execmem", "execstack", "execheap", "setkeycreate", |
Stephen Smalley | 791ec49 | 2017-02-17 07:57:00 -0500 | [diff] [blame] | 51 | "setsockcreate", "getrlimit", NULL } }, |
Stephen Smalley | af63f41 | 2017-07-31 10:12:46 -0400 | [diff] [blame] | 52 | { "process2", |
| 53 | { "nnp_transition", "nosuid_transition", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 54 | { "system", |
| 55 | { "ipc_info", "syslog_read", "syslog_mod", |
Jeff Vander Stoep | 61d612e | 2016-04-05 13:06:27 -0700 | [diff] [blame] | 56 | "syslog_console", "module_request", "module_load", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 57 | { "capability", |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 58 | { COMMON_CAP_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 59 | { "filesystem", |
| 60 | { "mount", "remount", "unmount", "getattr", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 61 | "relabelfrom", "relabelto", "associate", "quotamod", |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 62 | "quotaget", NULL } }, |
| 63 | { "file", |
| 64 | { COMMON_FILE_PERMS, |
Eric Paris | b424485 | 2010-07-23 11:44:15 -0400 | [diff] [blame] | 65 | "execute_no_trans", "entrypoint", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 66 | { "dir", |
| 67 | { COMMON_FILE_PERMS, "add_name", "remove_name", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 68 | "reparent", "search", "rmdir", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 69 | { "fd", { "use", NULL } }, |
| 70 | { "lnk_file", |
| 71 | { COMMON_FILE_PERMS, NULL } }, |
| 72 | { "chr_file", |
Eric Paris | b424485 | 2010-07-23 11:44:15 -0400 | [diff] [blame] | 73 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 74 | { "blk_file", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 75 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 76 | { "sock_file", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 77 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 78 | { "fifo_file", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 79 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 80 | { "socket", |
| 81 | { COMMON_SOCK_PERMS, NULL } }, |
| 82 | { "tcp_socket", |
| 83 | { COMMON_SOCK_PERMS, |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 84 | "node_bind", "name_connect", |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 85 | NULL } }, |
| 86 | { "udp_socket", |
| 87 | { COMMON_SOCK_PERMS, |
| 88 | "node_bind", NULL } }, |
| 89 | { "rawip_socket", |
| 90 | { COMMON_SOCK_PERMS, |
| 91 | "node_bind", NULL } }, |
| 92 | { "node", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 93 | { "recvfrom", "sendto", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 94 | { "netif", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 95 | { "ingress", "egress", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 96 | { "netlink_socket", |
| 97 | { COMMON_SOCK_PERMS, NULL } }, |
| 98 | { "packet_socket", |
| 99 | { COMMON_SOCK_PERMS, NULL } }, |
| 100 | { "key_socket", |
| 101 | { COMMON_SOCK_PERMS, NULL } }, |
| 102 | { "unix_stream_socket", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 103 | { COMMON_SOCK_PERMS, "connectto", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 104 | { "unix_dgram_socket", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 105 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 106 | { "sem", |
| 107 | { COMMON_IPC_PERMS, NULL } }, |
| 108 | { "msg", { "send", "receive", NULL } }, |
| 109 | { "msgq", |
| 110 | { COMMON_IPC_PERMS, "enqueue", NULL } }, |
| 111 | { "shm", |
| 112 | { COMMON_IPC_PERMS, "lock", NULL } }, |
| 113 | { "ipc", |
| 114 | { COMMON_IPC_PERMS, NULL } }, |
| 115 | { "netlink_route_socket", |
| 116 | { COMMON_SOCK_PERMS, |
| 117 | "nlmsg_read", "nlmsg_write", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 118 | { "netlink_tcpdiag_socket", |
| 119 | { COMMON_SOCK_PERMS, |
| 120 | "nlmsg_read", "nlmsg_write", NULL } }, |
| 121 | { "netlink_nflog_socket", |
| 122 | { COMMON_SOCK_PERMS, NULL } }, |
| 123 | { "netlink_xfrm_socket", |
| 124 | { COMMON_SOCK_PERMS, |
| 125 | "nlmsg_read", "nlmsg_write", NULL } }, |
| 126 | { "netlink_selinux_socket", |
| 127 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | 6c6d2e9 | 2015-06-04 16:22:16 -0400 | [diff] [blame] | 128 | { "netlink_iscsi_socket", |
| 129 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 130 | { "netlink_audit_socket", |
| 131 | { COMMON_SOCK_PERMS, |
| 132 | "nlmsg_read", "nlmsg_write", "nlmsg_relay", "nlmsg_readpriv", |
| 133 | "nlmsg_tty_audit", NULL } }, |
Stephen Smalley | 6c6d2e9 | 2015-06-04 16:22:16 -0400 | [diff] [blame] | 134 | { "netlink_fib_lookup_socket", |
| 135 | { COMMON_SOCK_PERMS, NULL } }, |
| 136 | { "netlink_connector_socket", |
| 137 | { COMMON_SOCK_PERMS, NULL } }, |
| 138 | { "netlink_netfilter_socket", |
| 139 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 140 | { "netlink_dnrt_socket", |
| 141 | { COMMON_SOCK_PERMS, NULL } }, |
| 142 | { "association", |
| 143 | { "sendto", "recvfrom", "setcontext", "polmatch", NULL } }, |
| 144 | { "netlink_kobject_uevent_socket", |
| 145 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | 6c6d2e9 | 2015-06-04 16:22:16 -0400 | [diff] [blame] | 146 | { "netlink_generic_socket", |
| 147 | { COMMON_SOCK_PERMS, NULL } }, |
| 148 | { "netlink_scsitransport_socket", |
| 149 | { COMMON_SOCK_PERMS, NULL } }, |
| 150 | { "netlink_rdma_socket", |
| 151 | { COMMON_SOCK_PERMS, NULL } }, |
| 152 | { "netlink_crypto_socket", |
| 153 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 154 | { "appletalk_socket", |
| 155 | { COMMON_SOCK_PERMS, NULL } }, |
| 156 | { "packet", |
Eric Paris | 47ac19e | 2011-02-25 15:39:20 -0500 | [diff] [blame] | 157 | { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 158 | { "key", |
| 159 | { "view", "read", "write", "search", "link", "setattr", "create", |
| 160 | NULL } }, |
| 161 | { "dccp_socket", |
| 162 | { COMMON_SOCK_PERMS, |
| 163 | "node_bind", "name_connect", NULL } }, |
| 164 | { "memprotect", { "mmap_zero", NULL } }, |
| 165 | { "peer", { "recv", NULL } }, |
Eric Paris | 64919e6 | 2012-07-06 14:13:29 -0400 | [diff] [blame] | 166 | { "capability2", |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 167 | { COMMON_CAP2_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 168 | { "kernel_service", { "use_as_override", "create_files_as", NULL } }, |
| 169 | { "tun_socket", |
Paul Moore | 6f96c14 | 2013-01-14 07:12:13 +0000 | [diff] [blame] | 170 | { COMMON_SOCK_PERMS, "attach_queue", NULL } }, |
Stephen Smalley | 79af730 | 2015-01-21 10:54:10 -0500 | [diff] [blame] | 171 | { "binder", { "impersonate", "call", "set_context_mgr", "transfer", |
| 172 | NULL } }, |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 173 | { "cap_userns", |
| 174 | { COMMON_CAP_PERMS, NULL } }, |
| 175 | { "cap2_userns", |
| 176 | { COMMON_CAP2_PERMS, NULL } }, |
Stephen Smalley | da69a53 | 2017-01-09 10:07:30 -0500 | [diff] [blame] | 177 | { "sctp_socket", |
| 178 | { COMMON_SOCK_PERMS, |
Richard Haines | d452930 | 2018-02-13 20:57:18 +0000 | [diff] [blame] | 179 | "node_bind", "name_connect", "association", NULL } }, |
Stephen Smalley | da69a53 | 2017-01-09 10:07:30 -0500 | [diff] [blame] | 180 | { "icmp_socket", |
| 181 | { COMMON_SOCK_PERMS, |
| 182 | "node_bind", NULL } }, |
| 183 | { "ax25_socket", |
| 184 | { COMMON_SOCK_PERMS, NULL } }, |
| 185 | { "ipx_socket", |
| 186 | { COMMON_SOCK_PERMS, NULL } }, |
| 187 | { "netrom_socket", |
| 188 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | da69a53 | 2017-01-09 10:07:30 -0500 | [diff] [blame] | 189 | { "atmpvc_socket", |
| 190 | { COMMON_SOCK_PERMS, NULL } }, |
| 191 | { "x25_socket", |
| 192 | { COMMON_SOCK_PERMS, NULL } }, |
| 193 | { "rose_socket", |
| 194 | { COMMON_SOCK_PERMS, NULL } }, |
| 195 | { "decnet_socket", |
| 196 | { COMMON_SOCK_PERMS, NULL } }, |
| 197 | { "atmsvc_socket", |
| 198 | { COMMON_SOCK_PERMS, NULL } }, |
| 199 | { "rds_socket", |
| 200 | { COMMON_SOCK_PERMS, NULL } }, |
| 201 | { "irda_socket", |
| 202 | { COMMON_SOCK_PERMS, NULL } }, |
| 203 | { "pppox_socket", |
| 204 | { COMMON_SOCK_PERMS, NULL } }, |
| 205 | { "llc_socket", |
| 206 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | da69a53 | 2017-01-09 10:07:30 -0500 | [diff] [blame] | 207 | { "can_socket", |
| 208 | { COMMON_SOCK_PERMS, NULL } }, |
| 209 | { "tipc_socket", |
| 210 | { COMMON_SOCK_PERMS, NULL } }, |
| 211 | { "bluetooth_socket", |
| 212 | { COMMON_SOCK_PERMS, NULL } }, |
| 213 | { "iucv_socket", |
| 214 | { COMMON_SOCK_PERMS, NULL } }, |
| 215 | { "rxrpc_socket", |
| 216 | { COMMON_SOCK_PERMS, NULL } }, |
| 217 | { "isdn_socket", |
| 218 | { COMMON_SOCK_PERMS, NULL } }, |
| 219 | { "phonet_socket", |
| 220 | { COMMON_SOCK_PERMS, NULL } }, |
| 221 | { "ieee802154_socket", |
| 222 | { COMMON_SOCK_PERMS, NULL } }, |
| 223 | { "caif_socket", |
| 224 | { COMMON_SOCK_PERMS, NULL } }, |
| 225 | { "alg_socket", |
| 226 | { COMMON_SOCK_PERMS, NULL } }, |
| 227 | { "nfc_socket", |
| 228 | { COMMON_SOCK_PERMS, NULL } }, |
| 229 | { "vsock_socket", |
| 230 | { COMMON_SOCK_PERMS, NULL } }, |
| 231 | { "kcm_socket", |
| 232 | { COMMON_SOCK_PERMS, NULL } }, |
| 233 | { "qipcrtr_socket", |
| 234 | { COMMON_SOCK_PERMS, NULL } }, |
Linus Torvalds | 3051bf3 | 2017-02-22 10:15:09 -0800 | [diff] [blame] | 235 | { "smc_socket", |
| 236 | { COMMON_SOCK_PERMS, NULL } }, |
Daniel Jurgens | cfc4d88 | 2017-05-19 15:48:57 +0300 | [diff] [blame] | 237 | { "infiniband_pkey", |
| 238 | { "access", NULL } }, |
Daniel Jurgens | ab861df | 2017-05-19 15:48:58 +0300 | [diff] [blame] | 239 | { "infiniband_endport", |
| 240 | { "manage_subnet", NULL } }, |
Chenbo Feng | ec27c35 | 2017-10-18 13:00:25 -0700 | [diff] [blame] | 241 | { "bpf", |
| 242 | {"map_create", "map_read", "map_write", "prog_load", "prog_run"} }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 243 | { NULL } |
| 244 | }; |
Stephen Smalley | da69a53 | 2017-01-09 10:07:30 -0500 | [diff] [blame] | 245 | |
Linus Torvalds | 3051bf3 | 2017-02-22 10:15:09 -0800 | [diff] [blame] | 246 | #if PF_MAX > 44 |
Stephen Smalley | da69a53 | 2017-01-09 10:07:30 -0500 | [diff] [blame] | 247 | #error New address family defined, please update secclass_map. |
| 248 | #endif |