From: "Christopher J. PeBenito" <cpebenito@tresys.com>
To: Stephen Smalley <sds@epoch.ncsc.mil>, James Morris <jmorris@redhat.com>
Cc: SELinux Mail List <selinux@tycho.nsa.gov>
Subject: appletalk sockets
Date: Wed, 03 May 2006 13:23:14 -0400 [thread overview]
Message-ID: <1146676995.20331.113.camel@sgc> (raw)
[-- Attachment #1: Type: text/plain, Size: 687 bytes --]
On Tue, 02 May 2006 at 13:57 -0400, Christopher J. PeBenito wrote:
> On Tue, 2006-05-02 at 13:30 -0400, Daniel J Walsh wrote:
> > Christopher J. PeBenito wrote:
> > > On Tue, 2006-05-02 at 10:08 -0400, Daniel J Walsh wrote:
> > >> cups needs to be able to create socket to itself.
> > >
> > > This needs more investigation; we need to find out more about this
> > > generic socket so we can add a specific class for it.
> > >
> > >
> >
> http://www.redhat.com/archives/fedora-selinux-list/2006-April/msg00216.html
>
> So it appears that a class for appletalk sockets needs to be added.
How about the attached patches?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
[-- Attachment #2: appletalk-kernel.diff --]
[-- Type: text/x-patch, Size: 4119 bytes --]
diff -urNp linux-2.6.16.13.orig/security/selinux/hooks.c linux-2.6.16.13/security/selinux/hooks.c
--- linux-2.6.16.13.orig/security/selinux/hooks.c 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/hooks.c 2006-05-03 12:45:42.910285500 -0400
@@ -665,6 +665,8 @@ static inline u16 socket_type_to_securit
return SECCLASS_PACKET_SOCKET;
case PF_KEY:
return SECCLASS_KEY_SOCKET;
+ case PF_APPLETALK:
+ return SECCLASS_APPLETALK_SOCKET;
}
return SECCLASS_SOCKET;
diff -urNp linux-2.6.16.13.orig/security/selinux/include/av_inherit.h linux-2.6.16.13/security/selinux/include/av_inherit.h
--- linux-2.6.16.13.orig/security/selinux/include/av_inherit.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/av_inherit.h 2006-05-03 12:44:35.666083000 -0400
@@ -29,3 +29,4 @@
S_(SECCLASS_NETLINK_IP6FW_SOCKET, socket, 0x00400000UL)
S_(SECCLASS_NETLINK_DNRT_SOCKET, socket, 0x00400000UL)
S_(SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET, socket, 0x00400000UL)
+ S_(SECCLASS_APPLETALK_SOCKET, socket, 0x00400000UL)
diff -urNp linux-2.6.16.13.orig/security/selinux/include/av_permissions.h linux-2.6.16.13/security/selinux/include/av_permissions.h
--- linux-2.6.16.13.orig/security/selinux/include/av_permissions.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/av_permissions.h 2006-05-03 12:44:35.666083000 -0400
@@ -933,3 +933,26 @@
#define NETLINK_KOBJECT_UEVENT_SOCKET__SEND_MSG 0x00100000UL
#define NETLINK_KOBJECT_UEVENT_SOCKET__NAME_BIND 0x00200000UL
+#define APPLETALK_SOCKET__IOCTL 0x00000001UL
+#define APPLETALK_SOCKET__READ 0x00000002UL
+#define APPLETALK_SOCKET__WRITE 0x00000004UL
+#define APPLETALK_SOCKET__CREATE 0x00000008UL
+#define APPLETALK_SOCKET__GETATTR 0x00000010UL
+#define APPLETALK_SOCKET__SETATTR 0x00000020UL
+#define APPLETALK_SOCKET__LOCK 0x00000040UL
+#define APPLETALK_SOCKET__RELABELFROM 0x00000080UL
+#define APPLETALK_SOCKET__RELABELTO 0x00000100UL
+#define APPLETALK_SOCKET__APPEND 0x00000200UL
+#define APPLETALK_SOCKET__BIND 0x00000400UL
+#define APPLETALK_SOCKET__CONNECT 0x00000800UL
+#define APPLETALK_SOCKET__LISTEN 0x00001000UL
+#define APPLETALK_SOCKET__ACCEPT 0x00002000UL
+#define APPLETALK_SOCKET__GETOPT 0x00004000UL
+#define APPLETALK_SOCKET__SETOPT 0x00008000UL
+#define APPLETALK_SOCKET__SHUTDOWN 0x00010000UL
+#define APPLETALK_SOCKET__RECVFROM 0x00020000UL
+#define APPLETALK_SOCKET__SENDTO 0x00040000UL
+#define APPLETALK_SOCKET__RECV_MSG 0x00080000UL
+#define APPLETALK_SOCKET__SEND_MSG 0x00100000UL
+#define APPLETALK_SOCKET__NAME_BIND 0x00200000UL
+
diff -urNp linux-2.6.16.13.orig/security/selinux/include/class_to_string.h linux-2.6.16.13/security/selinux/include/class_to_string.h
--- linux-2.6.16.13.orig/security/selinux/include/class_to_string.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/class_to_string.h 2006-05-03 12:44:35.514073000 -0400
@@ -58,3 +58,4 @@
S_("nscd")
S_("association")
S_("netlink_kobject_uevent_socket")
+ S_("appletalk_socket")
diff -urNp linux-2.6.16.13.orig/security/selinux/include/flask.h linux-2.6.16.13/security/selinux/include/flask.h
--- linux-2.6.16.13.orig/security/selinux/include/flask.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/flask.h 2006-05-03 12:44:35.514073000 -0400
@@ -60,6 +60,7 @@
#define SECCLASS_NSCD 53
#define SECCLASS_ASSOCIATION 54
#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
+#define SECCLASS_APPLETALK_SOCKET 56
/*
* Security identifier indices for initial entities
[-- Attachment #3: appletalk-refpolicy.diff --]
[-- Type: text/x-patch, Size: 2503 bytes --]
Index: policy/flask/security_classes
===================================================================
--- policy/flask/security_classes (revision 1764)
+++ policy/flask/security_classes (working copy)
@@ -86,4 +86,6 @@
# Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket
+class appletalk_socket
+
# FLASK
Index: policy/flask/access_vectors
===================================================================
--- policy/flask/access_vectors (revision 1764)
+++ policy/flask/access_vectors (working copy)
@@ -607,3 +607,6 @@
# Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket
inherits socket
+
+class appletalk_socket
+inherits socket
Index: policy/modules/services/cups.te
===================================================================
--- policy/modules/services/cups.te (revision 1764)
+++ policy/modules/services/cups.te (working copy)
@@ -84,6 +84,9 @@
allow cupsd_t self:netlink_route_socket { r_netlink_socket_perms };
allow cupsd_t self:tcp_socket { create_stream_socket_perms connectto acceptfrom recvfrom };
allow cupsd_t self:udp_socket create_socket_perms;
+allow cupsd_t self:appletalk_socket create_socket_perms;
+# generic socket here until appletalk socket is available in kernels
+allow cupsd_t self:socket create_socket_perms;
allow cupsd_t cupsd_etc_t:file { r_file_perms setattr };
allow cupsd_t cupsd_etc_t:dir { rw_dir_perms setattr };
Index: policy/support/obj_perm_sets.spt
===================================================================
--- policy/support/obj_perm_sets.spt (revision 1764)
+++ policy/support/obj_perm_sets.spt (working copy)
@@ -28,7 +28,7 @@
#
# All socket classes.
#
-define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket }')
+define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket }')
#
next reply other threads:[~2006-05-03 17:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-05-03 17:23 Christopher J. PeBenito [this message]
2006-05-03 18:25 ` appletalk sockets Christopher J. PeBenito
2006-05-03 18:39 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1146676995.20331.113.camel@sgc \
--to=cpebenito@tresys.com \
--cc=jmorris@redhat.com \
--cc=sds@epoch.ncsc.mil \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.