From: Russell Coker <russell@coker.com.au>
To: selinux-refpolicy@vger.kernel.org
Subject: connected_stream_socket_perms
Date: Thu, 10 Jan 2019 21:51:20 +1100 [thread overview]
Message-ID: <1657648.nfkMHCI95s@liv> (raw)
define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind
connect getopt setopt shutdown }')
define(`connected_socket_perms', `{ create ioctl read getattr write setattr
append bind getopt setopt shutdown }')
The difference between these 2 is that connected_socket_perms includes create
while rw_socket_perms has connect. Why doesn't rw_socket_perms have create?
Or if we are saying "rw_socket_perms only means reading and writing" then why
does it have connect?
Does this all make sense?
I expect that a lot of policy has been written based on using whichever of
those macros seems to match an audit2allow rule and vaguely match the concept
of what someone imagines the program in question is doing.
Would it make sense to have another macro defined to { ioctl read getattr write
setattr append bind getopt setopt shutdown } so that there can be a more
obvious progression of which macro is a superset of which other macro?
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
next reply other threads:[~2019-01-10 10:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-10 10:51 Russell Coker [this message]
2019-01-11 1:23 ` connected_stream_socket_perms Chris PeBenito
2019-01-11 3:22 ` connected_stream_socket_perms Russell Coker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1657648.nfkMHCI95s@liv \
--to=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).