* appletalk sockets
@ 2006-05-03 17:23 Christopher J. PeBenito
2006-05-03 18:25 ` Christopher J. PeBenito
0 siblings, 1 reply; 3+ messages in thread
From: Christopher J. PeBenito @ 2006-05-03 17:23 UTC (permalink / raw)
To: Stephen Smalley, James Morris; +Cc: SELinux Mail List
[-- Attachment #1: Type: text/plain, Size: 687 bytes --]
On Tue, 02 May 2006 at 13:57 -0400, Christopher J. PeBenito wrote:
> On Tue, 2006-05-02 at 13:30 -0400, Daniel J Walsh wrote:
> > Christopher J. PeBenito wrote:
> > > On Tue, 2006-05-02 at 10:08 -0400, Daniel J Walsh wrote:
> > >> cups needs to be able to create socket to itself.
> > >
> > > This needs more investigation; we need to find out more about this
> > > generic socket so we can add a specific class for it.
> > >
> > >
> >
> http://www.redhat.com/archives/fedora-selinux-list/2006-April/msg00216.html
>
> So it appears that a class for appletalk sockets needs to be added.
How about the attached patches?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
[-- Attachment #2: appletalk-kernel.diff --]
[-- Type: text/x-patch, Size: 4119 bytes --]
diff -urNp linux-2.6.16.13.orig/security/selinux/hooks.c linux-2.6.16.13/security/selinux/hooks.c
--- linux-2.6.16.13.orig/security/selinux/hooks.c 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/hooks.c 2006-05-03 12:45:42.910285500 -0400
@@ -665,6 +665,8 @@ static inline u16 socket_type_to_securit
return SECCLASS_PACKET_SOCKET;
case PF_KEY:
return SECCLASS_KEY_SOCKET;
+ case PF_APPLETALK:
+ return SECCLASS_APPLETALK_SOCKET;
}
return SECCLASS_SOCKET;
diff -urNp linux-2.6.16.13.orig/security/selinux/include/av_inherit.h linux-2.6.16.13/security/selinux/include/av_inherit.h
--- linux-2.6.16.13.orig/security/selinux/include/av_inherit.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/av_inherit.h 2006-05-03 12:44:35.666083000 -0400
@@ -29,3 +29,4 @@
S_(SECCLASS_NETLINK_IP6FW_SOCKET, socket, 0x00400000UL)
S_(SECCLASS_NETLINK_DNRT_SOCKET, socket, 0x00400000UL)
S_(SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET, socket, 0x00400000UL)
+ S_(SECCLASS_APPLETALK_SOCKET, socket, 0x00400000UL)
diff -urNp linux-2.6.16.13.orig/security/selinux/include/av_permissions.h linux-2.6.16.13/security/selinux/include/av_permissions.h
--- linux-2.6.16.13.orig/security/selinux/include/av_permissions.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/av_permissions.h 2006-05-03 12:44:35.666083000 -0400
@@ -933,3 +933,26 @@
#define NETLINK_KOBJECT_UEVENT_SOCKET__SEND_MSG 0x00100000UL
#define NETLINK_KOBJECT_UEVENT_SOCKET__NAME_BIND 0x00200000UL
+#define APPLETALK_SOCKET__IOCTL 0x00000001UL
+#define APPLETALK_SOCKET__READ 0x00000002UL
+#define APPLETALK_SOCKET__WRITE 0x00000004UL
+#define APPLETALK_SOCKET__CREATE 0x00000008UL
+#define APPLETALK_SOCKET__GETATTR 0x00000010UL
+#define APPLETALK_SOCKET__SETATTR 0x00000020UL
+#define APPLETALK_SOCKET__LOCK 0x00000040UL
+#define APPLETALK_SOCKET__RELABELFROM 0x00000080UL
+#define APPLETALK_SOCKET__RELABELTO 0x00000100UL
+#define APPLETALK_SOCKET__APPEND 0x00000200UL
+#define APPLETALK_SOCKET__BIND 0x00000400UL
+#define APPLETALK_SOCKET__CONNECT 0x00000800UL
+#define APPLETALK_SOCKET__LISTEN 0x00001000UL
+#define APPLETALK_SOCKET__ACCEPT 0x00002000UL
+#define APPLETALK_SOCKET__GETOPT 0x00004000UL
+#define APPLETALK_SOCKET__SETOPT 0x00008000UL
+#define APPLETALK_SOCKET__SHUTDOWN 0x00010000UL
+#define APPLETALK_SOCKET__RECVFROM 0x00020000UL
+#define APPLETALK_SOCKET__SENDTO 0x00040000UL
+#define APPLETALK_SOCKET__RECV_MSG 0x00080000UL
+#define APPLETALK_SOCKET__SEND_MSG 0x00100000UL
+#define APPLETALK_SOCKET__NAME_BIND 0x00200000UL
+
diff -urNp linux-2.6.16.13.orig/security/selinux/include/class_to_string.h linux-2.6.16.13/security/selinux/include/class_to_string.h
--- linux-2.6.16.13.orig/security/selinux/include/class_to_string.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/class_to_string.h 2006-05-03 12:44:35.514073000 -0400
@@ -58,3 +58,4 @@
S_("nscd")
S_("association")
S_("netlink_kobject_uevent_socket")
+ S_("appletalk_socket")
diff -urNp linux-2.6.16.13.orig/security/selinux/include/flask.h linux-2.6.16.13/security/selinux/include/flask.h
--- linux-2.6.16.13.orig/security/selinux/include/flask.h 2006-05-02 17:38:44.000000000 -0400
+++ linux-2.6.16.13/security/selinux/include/flask.h 2006-05-03 12:44:35.514073000 -0400
@@ -60,6 +60,7 @@
#define SECCLASS_NSCD 53
#define SECCLASS_ASSOCIATION 54
#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
+#define SECCLASS_APPLETALK_SOCKET 56
/*
* Security identifier indices for initial entities
[-- Attachment #3: appletalk-refpolicy.diff --]
[-- Type: text/x-patch, Size: 2503 bytes --]
Index: policy/flask/security_classes
===================================================================
--- policy/flask/security_classes (revision 1764)
+++ policy/flask/security_classes (working copy)
@@ -86,4 +86,6 @@
# Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket
+class appletalk_socket
+
# FLASK
Index: policy/flask/access_vectors
===================================================================
--- policy/flask/access_vectors (revision 1764)
+++ policy/flask/access_vectors (working copy)
@@ -607,3 +607,6 @@
# Updated Netlink class for KOBJECT_UEVENT family.
class netlink_kobject_uevent_socket
inherits socket
+
+class appletalk_socket
+inherits socket
Index: policy/modules/services/cups.te
===================================================================
--- policy/modules/services/cups.te (revision 1764)
+++ policy/modules/services/cups.te (working copy)
@@ -84,6 +84,9 @@
allow cupsd_t self:netlink_route_socket { r_netlink_socket_perms };
allow cupsd_t self:tcp_socket { create_stream_socket_perms connectto acceptfrom recvfrom };
allow cupsd_t self:udp_socket create_socket_perms;
+allow cupsd_t self:appletalk_socket create_socket_perms;
+# generic socket here until appletalk socket is available in kernels
+allow cupsd_t self:socket create_socket_perms;
allow cupsd_t cupsd_etc_t:file { r_file_perms setattr };
allow cupsd_t cupsd_etc_t:dir { rw_dir_perms setattr };
Index: policy/support/obj_perm_sets.spt
===================================================================
--- policy/support/obj_perm_sets.spt (revision 1764)
+++ policy/support/obj_perm_sets.spt (working copy)
@@ -28,7 +28,7 @@
#
# All socket classes.
#
-define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket }')
+define(`socket_class_set', `{ tcp_socket udp_socket rawip_socket netlink_socket packet_socket unix_stream_socket unix_dgram_socket appletalk_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_kobject_uevent_socket }')
#
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: appletalk sockets
2006-05-03 17:23 appletalk sockets Christopher J. PeBenito
@ 2006-05-03 18:25 ` Christopher J. PeBenito
2006-05-03 18:39 ` Stephen Smalley
0 siblings, 1 reply; 3+ messages in thread
From: Christopher J. PeBenito @ 2006-05-03 18:25 UTC (permalink / raw)
To: Stephen Smalley; +Cc: James Morris, SELinux Mail List
On Wed, 2006-05-03 at 13:23 -0400, Christopher J. PeBenito wrote:
> On Tue, 02 May 2006 at 13:57 -0400, Christopher J. PeBenito wrote:
> > On Tue, 2006-05-02 at 13:30 -0400, Daniel J Walsh wrote:
> > > Christopher J. PeBenito wrote:
> > > > On Tue, 2006-05-02 at 10:08 -0400, Daniel J Walsh wrote:
> > > >> cups needs to be able to create socket to itself.
> > > >
> > > > This needs more investigation; we need to find out more about this
> > > > generic socket so we can add a specific class for it.
> > > >
> > > >
> > >
> > http://www.redhat.com/archives/fedora-selinux-list/2006-April/msg00216.html
> >
> > So it appears that a class for appletalk sockets needs to be added.
>
> How about the attached patches?
Perhaps permissions should be added to netif for appletalk send/receive
too, so it doesn't fall through to rawip send/receive?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: appletalk sockets
2006-05-03 18:25 ` Christopher J. PeBenito
@ 2006-05-03 18:39 ` Stephen Smalley
0 siblings, 0 replies; 3+ messages in thread
From: Stephen Smalley @ 2006-05-03 18:39 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: James Morris, SELinux Mail List
On Wed, 2006-05-03 at 14:25 -0400, Christopher J. PeBenito wrote:
> On Wed, 2006-05-03 at 13:23 -0400, Christopher J. PeBenito wrote:
> > On Tue, 02 May 2006 at 13:57 -0400, Christopher J. PeBenito wrote:
> > > On Tue, 2006-05-02 at 13:30 -0400, Daniel J Walsh wrote:
> > > > Christopher J. PeBenito wrote:
> > > > > On Tue, 2006-05-02 at 10:08 -0400, Daniel J Walsh wrote:
> > > > >> cups needs to be able to create socket to itself.
> > > > >
> > > > > This needs more investigation; we need to find out more about this
> > > > > generic socket so we can add a specific class for it.
> > > > >
> > > > >
> > > >
> > > http://www.redhat.com/archives/fedora-selinux-list/2006-April/msg00216.html
> > >
> > > So it appears that a class for appletalk sockets needs to be added.
> >
> > How about the attached patches?
>
> Perhaps permissions should be added to netif for appletalk send/receive
> too, so it doesn't fall through to rawip send/receive?
netif checks are going away altogether.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2006-05-03 18:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-05-03 17:23 appletalk sockets Christopher J. PeBenito
2006-05-03 18:25 ` Christopher J. PeBenito
2006-05-03 18:39 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.