diff options
author | 2022-06-20 14:50:20 -0400 | |
---|---|---|
committer | 2022-09-03 11:41:55 -0700 | |
commit | 712733031648611660a45cf614edc3c5e1253c0a (patch) | |
tree | 0dd84f14883ff3ad5fc8b4ca6691c01c11fe70a9 | |
parent | mcs: Collapse constraints. (diff) | |
download | hardened-refpolicy-712733031648611660a45cf614edc3c5e1253c0a.tar.gz hardened-refpolicy-712733031648611660a45cf614edc3c5e1253c0a.tar.bz2 hardened-refpolicy-712733031648611660a45cf614edc3c5e1253c0a.zip |
mcs: Add additional socket constraints.
Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
-rw-r--r-- | policy/mcs | 12 |
1 files changed, 12 insertions, 0 deletions
@@ -86,9 +86,21 @@ mlsconstrain { file lnk_file fifo_file } { create relabelto } mlsconstrain process { transition dyntransition ptrace sigkill sigstop signal } (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); +mlsconstrain socket_class_set { create ioctl read write setattr append bind connect getopt setopt shutdown } + (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); + +mlsconstrain stream_socket_class_set { listen accept } + (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); + mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } node_bind (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); +mlsconstrain unix_stream_socket connectto + (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); + +mlsconstrain unix_dgram_socket sendto + (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); + mlsconstrain key { create link read search setattr view write } (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); |