| 1 |
|
| 2 |
|
| 3 | #define COMMON_FILE_SOCK_PERMS \
|
| 4 | "ioctl", "read", "write", "create", "getattr", "setattr", "lock", \
|
| 5 | "relabelfrom", "relabelto", "append", "map"
|
| 6 |
|
| 7 | #define COMMON_FILE_PERMS \
|
| 8 | COMMON_FILE_SOCK_PERMS, "unlink", "link", "rename", "execute", \
|
| 9 | "quotaon", "mounton", "audit_access", "open", "execmod", \
|
| 10 | "watch", "watch_mount", "watch_sb", "watch_with_perm", \
|
| 11 | "watch_reads", "watch_mountns"
|
| 12 |
|
| 13 | #define COMMON_SOCK_PERMS \
|
| 14 | COMMON_FILE_SOCK_PERMS, "bind", "connect", "listen", "accept", \
|
| 15 | "getopt", "setopt", "shutdown", "recvfrom", "sendto", \
|
| 16 | "name_bind"
|
| 17 |
|
| 18 | #define COMMON_IPC_PERMS \
|
| 19 | "create", "destroy", "getattr", "setattr", "read", "write", \
|
| 20 | "associate", "unix_read", "unix_write"
|
| 21 |
|
| 22 | #define COMMON_CAP_PERMS \
|
| 23 | "chown", "dac_override", "dac_read_search", "fowner", "fsetid", \
|
| 24 | "kill", "setgid", "setuid", "setpcap", "linux_immutable", \
|
| 25 | "net_bind_service", "net_broadcast", "net_admin", "net_raw", \
|
| 26 | "ipc_lock", "ipc_owner", "sys_module", "sys_rawio", \
|
| 27 | "sys_chroot", "sys_ptrace", "sys_pacct", "sys_admin", \
|
| 28 | "sys_boot", "sys_nice", "sys_resource", "sys_time", \
|
| 29 | "sys_tty_config", "mknod", "lease", "audit_write", \
|
| 30 | "audit_control", "setfcap"
|
| 31 |
|
| 32 | #define COMMON_CAP2_PERMS \
|
| 33 | "mac_override", "mac_admin", "syslog", "wake_alarm", "block_suspend", \
|
| 34 | "audit_read", "perfmon", "bpf", "checkpoint_restore"
|
| 35 |
|
| 36 | #ifdef __KERNEL__
|
| 37 | #include <linux/capability.h>
|
| 38 |
|
| 39 | #if CAP_LAST_CAP > CAP_CHECKPOINT_RESTORE
|
| 40 | #error New capability defined, please update COMMON_CAP2_PERMS.
|
| 41 | #endif
|
| 42 | #endif
|
| 43 |
|
| 44 | |
| 45 | * Note: The name for any socket class should be suffixed by "socket",
|
| 46 | * and doesn't contain more than one substr of "socket".
|
| 47 |
|
| 48 | const struct security_class_mapping secclass_map[] = {
|
| 49 | { "security",
|
| 50 | { "compute_av", "compute_create", "compute_member", "check_context",
|
| 51 | "load_policy", "compute_relabel", "compute_user", "setenforce",
|
| 52 | "setbool", "setsecparam", "setcheckreqprot", "read_policy",
|
| 53 | "validate_trans", NULL } },
|
| 54 | { "process",
|
| 55 | { "fork", "transition", "sigchld", "sigkill",
|
| 56 | "sigstop", "signull", "signal", "ptrace",
|
| 57 | "getsched", "setsched", "getsession", "getpgid",
|
| 58 | "setpgid", "getcap", "setcap", "share",
|
| 59 | "getattr", "setexec", "setfscreate", "noatsecure",
|
| 60 | "siginh", "setrlimit", "rlimitinh", "dyntransition",
|
| 61 | "setcurrent", "execmem", "execstack", "execheap",
|
| 62 | "setkeycreate", "setsockcreate", "getrlimit", NULL } },
|
| 63 | { "process2", { "nnp_transition", "nosuid_transition", NULL } },
|
| 64 | { "system",
|
| 65 | { "ipc_info", "syslog_read", "syslog_mod", "syslog_console",
|
| 66 | "module_request", "module_load", "firmware_load",
|
| 67 | "kexec_image_load", "kexec_initramfs_load", "policy_load",
|
| 68 | "x509_certificate_load", NULL } },
|
| 69 | { "capability", { COMMON_CAP_PERMS, NULL } },
|
| 70 | { "filesystem",
|
| 71 | { "mount", "remount", "unmount", "getattr", "relabelfrom",
|
| 72 | "relabelto", "associate", "quotamod", "quotaget", "watch", NULL } },
|
| 73 | { "file",
|
| 74 | { COMMON_FILE_PERMS, "execute_no_trans", "entrypoint", NULL } },
|
| 75 | { "dir",
|
| 76 | { COMMON_FILE_PERMS, "add_name", "remove_name", "reparent", "search",
|
| 77 | "rmdir", NULL } },
|
| 78 | { "fd", { "use", NULL } },
|
| 79 | { "lnk_file", { COMMON_FILE_PERMS, NULL } },
|
| 80 | { "chr_file", { COMMON_FILE_PERMS, NULL } },
|
| 81 | { "blk_file", { COMMON_FILE_PERMS, NULL } },
|
| 82 | { "sock_file", { COMMON_FILE_PERMS, NULL } },
|
| 83 | { "fifo_file", { COMMON_FILE_PERMS, NULL } },
|
| 84 | { "socket", { COMMON_SOCK_PERMS, NULL } },
|
| 85 | { "tcp_socket",
|
| 86 | { COMMON_SOCK_PERMS, "node_bind", "name_connect", NULL } },
|
| 87 | { "udp_socket", { COMMON_SOCK_PERMS, "node_bind", NULL } },
|
| 88 | { "rawip_socket", { COMMON_SOCK_PERMS, "node_bind", NULL } },
|
| 89 | { "node", { "recvfrom", "sendto", NULL } },
|
| 90 | { "netif", { "ingress", "egress", NULL } },
|
| 91 | { "netlink_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 92 | { "packet_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 93 | { "key_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 94 | { "unix_stream_socket", { COMMON_SOCK_PERMS, "connectto", NULL } },
|
| 95 | { "unix_dgram_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 96 | { "sem", { COMMON_IPC_PERMS, NULL } },
|
| 97 | { "msg", { "send", "receive", NULL } },
|
| 98 | { "msgq", { COMMON_IPC_PERMS, "enqueue", NULL } },
|
| 99 | { "shm", { COMMON_IPC_PERMS, "lock", NULL } },
|
| 100 | { "ipc", { COMMON_IPC_PERMS, NULL } },
|
| 101 | { "netlink_route_socket",
|
| 102 | { COMMON_SOCK_PERMS, "nlmsg_read", "nlmsg_write", "nlmsg", NULL } },
|
| 103 | { "netlink_tcpdiag_socket",
|
| 104 | { COMMON_SOCK_PERMS, "nlmsg_read", "nlmsg_write", "nlmsg", NULL } },
|
| 105 | { "netlink_nflog_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 106 | { "netlink_xfrm_socket",
|
| 107 | { COMMON_SOCK_PERMS, "nlmsg_read", "nlmsg_write", "nlmsg", NULL } },
|
| 108 | { "netlink_selinux_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 109 | { "netlink_iscsi_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 110 | { "netlink_audit_socket",
|
| 111 | { COMMON_SOCK_PERMS, "nlmsg_read", "nlmsg_write", "nlmsg_relay",
|
| 112 | "nlmsg_readpriv", "nlmsg_tty_audit", "nlmsg", NULL } },
|
| 113 | { "netlink_fib_lookup_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 114 | { "netlink_connector_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 115 | { "netlink_netfilter_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 116 | { "netlink_dnrt_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 117 | { "association",
|
| 118 | { "sendto", "recvfrom", "setcontext", "polmatch", NULL } },
|
| 119 | { "netlink_kobject_uevent_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 120 | { "netlink_generic_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 121 | { "netlink_scsitransport_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 122 | { "netlink_rdma_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 123 | { "netlink_crypto_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 124 | { "appletalk_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 125 | { "packet",
|
| 126 | { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
|
| 127 | { "key",
|
| 128 | { "view", "read", "write", "search", "link", "setattr", "create",
|
| 129 | NULL } },
|
| 130 | { "memprotect", { "mmap_zero", NULL } },
|
| 131 | { "peer", { "recv", NULL } },
|
| 132 | { "capability2", { COMMON_CAP2_PERMS, NULL } },
|
| 133 | { "kernel_service", { "use_as_override", "create_files_as", NULL } },
|
| 134 | { "tun_socket", { COMMON_SOCK_PERMS, "attach_queue", NULL } },
|
| 135 | { "binder",
|
| 136 | { "impersonate", "call", "set_context_mgr", "transfer", NULL } },
|
| 137 | { "cap_userns", { COMMON_CAP_PERMS, NULL } },
|
| 138 | { "cap2_userns", { COMMON_CAP2_PERMS, NULL } },
|
| 139 | { "sctp_socket",
|
| 140 | { COMMON_SOCK_PERMS, "node_bind", "name_connect", "association",
|
| 141 | NULL } },
|
| 142 | { "icmp_socket", { COMMON_SOCK_PERMS, "node_bind", NULL } },
|
| 143 | { "ax25_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 144 | { "ipx_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 145 | { "netrom_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 146 | { "atmpvc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 147 | { "x25_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 148 | { "rose_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 149 | { "decnet_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 150 | { "atmsvc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 151 | { "rds_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 152 | { "irda_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 153 | { "pppox_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 154 | { "llc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 155 | { "can_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 156 | { "tipc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 157 | { "bluetooth_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 158 | { "iucv_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 159 | { "rxrpc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 160 | { "isdn_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 161 | { "phonet_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 162 | { "ieee802154_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 163 | { "caif_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 164 | { "alg_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 165 | { "nfc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 166 | { "vsock_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 167 | { "kcm_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 168 | { "qipcrtr_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 169 | { "smc_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 170 | { "infiniband_pkey", { "access", NULL } },
|
| 171 | { "infiniband_endport", { "manage_subnet", NULL } },
|
| 172 | { "bpf",
|
| 173 | { "map_create", "map_read", "map_write", "prog_load", "prog_run",
|
| 174 | "map_create_as", "prog_load_as", NULL } },
|
| 175 | { "xdp_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 176 | { "mctp_socket", { COMMON_SOCK_PERMS, NULL } },
|
| 177 | { "perf_event",
|
| 178 | { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } },
|
| 179 | { "anon_inode", { COMMON_FILE_PERMS, NULL } },
|
| 180 | { "io_uring", { "override_creds", "sqpoll", "cmd", "allowed", NULL } },
|
| 181 | { "user_namespace", { "create", NULL } },
|
| 182 | { "memfd_file",
|
| 183 | { COMMON_FILE_PERMS, "execute_no_trans", "entrypoint", NULL } },
|
| 184 | { NULL, {} }
|
| 185 | };
|
| 186 |
|
| 187 | #ifdef __KERNEL__
|
| 188 | #include <linux/socket.h>
|
| 189 |
|
| 190 | #if PF_MAX > 46
|
| 191 | #error New address family defined, please update secclass_map.
|
| 192 | #endif
|
| 193 | #endif
|