Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 1 | #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \ |
| 2 | "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append" |
| 3 | |
| 4 | #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 5 | "rename", "execute", "quotaon", "mounton", "audit_access", \ |
Eric Paris | b424485 | 2010-07-23 11:44:15 -0400 | [diff] [blame] | 6 | "open", "execmod" |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 7 | |
| 8 | #define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \ |
| 9 | "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \ |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 10 | "sendto", "name_bind" |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 11 | |
| 12 | #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ |
| 13 | "write", "associate", "unix_read", "unix_write" |
| 14 | |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 15 | #define COMMON_CAP_PERMS "chown", "dac_override", "dac_read_search", \ |
| 16 | "fowner", "fsetid", "kill", "setgid", "setuid", "setpcap", \ |
| 17 | "linux_immutable", "net_bind_service", "net_broadcast", \ |
| 18 | "net_admin", "net_raw", "ipc_lock", "ipc_owner", "sys_module", \ |
| 19 | "sys_rawio", "sys_chroot", "sys_ptrace", "sys_pacct", "sys_admin", \ |
| 20 | "sys_boot", "sys_nice", "sys_resource", "sys_time", \ |
| 21 | "sys_tty_config", "mknod", "lease", "audit_write", \ |
| 22 | "audit_control", "setfcap" |
| 23 | |
| 24 | #define COMMON_CAP2_PERMS "mac_override", "mac_admin", "syslog", \ |
| 25 | "wake_alarm", "block_suspend", "audit_read" |
| 26 | |
Harry Ciao | 4bc6c2d | 2011-03-02 13:46:08 +0800 | [diff] [blame] | 27 | /* |
| 28 | * Note: The name for any socket class should be suffixed by "socket", |
| 29 | * and doesn't contain more than one substr of "socket". |
| 30 | */ |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 31 | struct security_class_mapping secclass_map[] = { |
| 32 | { "security", |
| 33 | { "compute_av", "compute_create", "compute_member", |
| 34 | "check_context", "load_policy", "compute_relabel", |
| 35 | "compute_user", "setenforce", "setbool", "setsecparam", |
Andrew Perepechko | f9df645 | 2015-12-24 11:09:41 -0500 | [diff] [blame] | 36 | "setcheckreqprot", "read_policy", "validate_trans", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 37 | { "process", |
| 38 | { "fork", "transition", "sigchld", "sigkill", |
| 39 | "sigstop", "signull", "signal", "ptrace", "getsched", "setsched", |
| 40 | "getsession", "getpgid", "setpgid", "getcap", "setcap", "share", |
| 41 | "getattr", "setexec", "setfscreate", "noatsecure", "siginh", |
| 42 | "setrlimit", "rlimitinh", "dyntransition", "setcurrent", |
| 43 | "execmem", "execstack", "execheap", "setkeycreate", |
| 44 | "setsockcreate", NULL } }, |
| 45 | { "system", |
| 46 | { "ipc_info", "syslog_read", "syslog_mod", |
Jeff Vander Stoep | 61d612e | 2016-04-05 13:06:27 -0700 | [diff] [blame] | 47 | "syslog_console", "module_request", "module_load", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 48 | { "capability", |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 49 | { COMMON_CAP_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 50 | { "filesystem", |
| 51 | { "mount", "remount", "unmount", "getattr", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 52 | "relabelfrom", "relabelto", "associate", "quotamod", |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 53 | "quotaget", NULL } }, |
| 54 | { "file", |
| 55 | { COMMON_FILE_PERMS, |
Eric Paris | b424485 | 2010-07-23 11:44:15 -0400 | [diff] [blame] | 56 | "execute_no_trans", "entrypoint", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 57 | { "dir", |
| 58 | { COMMON_FILE_PERMS, "add_name", "remove_name", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 59 | "reparent", "search", "rmdir", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 60 | { "fd", { "use", NULL } }, |
| 61 | { "lnk_file", |
| 62 | { COMMON_FILE_PERMS, NULL } }, |
| 63 | { "chr_file", |
Eric Paris | b424485 | 2010-07-23 11:44:15 -0400 | [diff] [blame] | 64 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 65 | { "blk_file", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 66 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 67 | { "sock_file", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 68 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 69 | { "fifo_file", |
Eric Paris | 49b7b8d | 2010-07-23 11:44:09 -0400 | [diff] [blame] | 70 | { COMMON_FILE_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 71 | { "socket", |
| 72 | { COMMON_SOCK_PERMS, NULL } }, |
| 73 | { "tcp_socket", |
| 74 | { COMMON_SOCK_PERMS, |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 75 | "node_bind", "name_connect", |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 76 | NULL } }, |
| 77 | { "udp_socket", |
| 78 | { COMMON_SOCK_PERMS, |
| 79 | "node_bind", NULL } }, |
| 80 | { "rawip_socket", |
| 81 | { COMMON_SOCK_PERMS, |
| 82 | "node_bind", NULL } }, |
| 83 | { "node", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 84 | { "recvfrom", "sendto", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 85 | { "netif", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 86 | { "ingress", "egress", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 87 | { "netlink_socket", |
| 88 | { COMMON_SOCK_PERMS, NULL } }, |
| 89 | { "packet_socket", |
| 90 | { COMMON_SOCK_PERMS, NULL } }, |
| 91 | { "key_socket", |
| 92 | { COMMON_SOCK_PERMS, NULL } }, |
| 93 | { "unix_stream_socket", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 94 | { COMMON_SOCK_PERMS, "connectto", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 95 | { "unix_dgram_socket", |
Stephen Smalley | 42a9699 | 2015-06-04 16:22:17 -0400 | [diff] [blame] | 96 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 97 | { "sem", |
| 98 | { COMMON_IPC_PERMS, NULL } }, |
| 99 | { "msg", { "send", "receive", NULL } }, |
| 100 | { "msgq", |
| 101 | { COMMON_IPC_PERMS, "enqueue", NULL } }, |
| 102 | { "shm", |
| 103 | { COMMON_IPC_PERMS, "lock", NULL } }, |
| 104 | { "ipc", |
| 105 | { COMMON_IPC_PERMS, NULL } }, |
| 106 | { "netlink_route_socket", |
| 107 | { COMMON_SOCK_PERMS, |
| 108 | "nlmsg_read", "nlmsg_write", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 109 | { "netlink_tcpdiag_socket", |
| 110 | { COMMON_SOCK_PERMS, |
| 111 | "nlmsg_read", "nlmsg_write", NULL } }, |
| 112 | { "netlink_nflog_socket", |
| 113 | { COMMON_SOCK_PERMS, NULL } }, |
| 114 | { "netlink_xfrm_socket", |
| 115 | { COMMON_SOCK_PERMS, |
| 116 | "nlmsg_read", "nlmsg_write", NULL } }, |
| 117 | { "netlink_selinux_socket", |
| 118 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | 6c6d2e9 | 2015-06-04 16:22:16 -0400 | [diff] [blame] | 119 | { "netlink_iscsi_socket", |
| 120 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 121 | { "netlink_audit_socket", |
| 122 | { COMMON_SOCK_PERMS, |
| 123 | "nlmsg_read", "nlmsg_write", "nlmsg_relay", "nlmsg_readpriv", |
| 124 | "nlmsg_tty_audit", NULL } }, |
Stephen Smalley | 6c6d2e9 | 2015-06-04 16:22:16 -0400 | [diff] [blame] | 125 | { "netlink_fib_lookup_socket", |
| 126 | { COMMON_SOCK_PERMS, NULL } }, |
| 127 | { "netlink_connector_socket", |
| 128 | { COMMON_SOCK_PERMS, NULL } }, |
| 129 | { "netlink_netfilter_socket", |
| 130 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 131 | { "netlink_dnrt_socket", |
| 132 | { COMMON_SOCK_PERMS, NULL } }, |
| 133 | { "association", |
| 134 | { "sendto", "recvfrom", "setcontext", "polmatch", NULL } }, |
| 135 | { "netlink_kobject_uevent_socket", |
| 136 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | 6c6d2e9 | 2015-06-04 16:22:16 -0400 | [diff] [blame] | 137 | { "netlink_generic_socket", |
| 138 | { COMMON_SOCK_PERMS, NULL } }, |
| 139 | { "netlink_scsitransport_socket", |
| 140 | { COMMON_SOCK_PERMS, NULL } }, |
| 141 | { "netlink_rdma_socket", |
| 142 | { COMMON_SOCK_PERMS, NULL } }, |
| 143 | { "netlink_crypto_socket", |
| 144 | { COMMON_SOCK_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 145 | { "appletalk_socket", |
| 146 | { COMMON_SOCK_PERMS, NULL } }, |
| 147 | { "packet", |
Eric Paris | 47ac19e | 2011-02-25 15:39:20 -0500 | [diff] [blame] | 148 | { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 149 | { "key", |
| 150 | { "view", "read", "write", "search", "link", "setattr", "create", |
| 151 | NULL } }, |
| 152 | { "dccp_socket", |
| 153 | { COMMON_SOCK_PERMS, |
| 154 | "node_bind", "name_connect", NULL } }, |
| 155 | { "memprotect", { "mmap_zero", NULL } }, |
| 156 | { "peer", { "recv", NULL } }, |
Eric Paris | 64919e6 | 2012-07-06 14:13:29 -0400 | [diff] [blame] | 157 | { "capability2", |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 158 | { COMMON_CAP2_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 159 | { "kernel_service", { "use_as_override", "create_files_as", NULL } }, |
| 160 | { "tun_socket", |
Paul Moore | 6f96c14 | 2013-01-14 07:12:13 +0000 | [diff] [blame] | 161 | { COMMON_SOCK_PERMS, "attach_queue", NULL } }, |
Stephen Smalley | 79af730 | 2015-01-21 10:54:10 -0500 | [diff] [blame] | 162 | { "binder", { "impersonate", "call", "set_context_mgr", "transfer", |
| 163 | NULL } }, |
Stephen Smalley | 8e4ff6f | 2016-04-08 13:52:00 -0400 | [diff] [blame] | 164 | { "cap_userns", |
| 165 | { COMMON_CAP_PERMS, NULL } }, |
| 166 | { "cap2_userns", |
| 167 | { COMMON_CAP2_PERMS, NULL } }, |
Stephen Smalley | c6d3aaa | 2009-09-30 13:37:50 -0400 | [diff] [blame] | 168 | { NULL } |
| 169 | }; |