* [PATCH] domain: unconfined access to bpf
@ 2019-09-03 16:53 Dominick Grift
2019-09-03 23:52 ` Chris PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Dominick Grift @ 2019-09-03 16:53 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Dominick Grift
Signed-off-by: Dominick Grift <dac.override@gmail.com>
---
policy/modules/kernel/domain.te | 3 +++
1 file changed, 3 insertions(+)
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index 1a55e3d2..a4c78af9 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -152,6 +152,9 @@ optional_policy(`
# is handled in the interface as typeattribute cannot
# be used on an attribute.
+# unconfined access to bpf
+allow unconfined_domain_type domain:bpf { map_create map_read map_write prog_load prog_run };
+
# Use/sendto/connectto sockets created by any domain.
allow unconfined_domain_type domain:{ socket_class_set socket key_socket } { create_stream_socket_perms send_msg lock relabelto name_bind recv_msg map sendto recvfrom relabelfrom };
allow unconfined_domain_type domain:rawip_socket node_bind;
--
2.23.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] domain: unconfined access to bpf
2019-09-03 16:53 [PATCH] domain: unconfined access to bpf Dominick Grift
@ 2019-09-03 23:52 ` Chris PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Chris PeBenito @ 2019-09-03 23:52 UTC (permalink / raw)
To: Dominick Grift, selinux-refpolicy
On 9/3/19 12:53 PM, Dominick Grift wrote:
> Signed-off-by: Dominick Grift <dac.override@gmail.com>
> ---
> policy/modules/kernel/domain.te | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
> index 1a55e3d2..a4c78af9 100644
> --- a/policy/modules/kernel/domain.te
> +++ b/policy/modules/kernel/domain.te
> @@ -152,6 +152,9 @@ optional_policy(`
> # is handled in the interface as typeattribute cannot
> # be used on an attribute.
>
> +# unconfined access to bpf
> +allow unconfined_domain_type domain:bpf { map_create map_read map_write prog_load prog_run };
> +
> # Use/sendto/connectto sockets created by any domain.
> allow unconfined_domain_type domain:{ socket_class_set socket key_socket } { create_stream_socket_perms send_msg lock relabelto name_bind recv_msg map sendto recvfrom relabelfrom };
> allow unconfined_domain_type domain:rawip_socket node_bind;
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-09-03 23:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-03 16:53 [PATCH] domain: unconfined access to bpf Dominick Grift
2019-09-03 23:52 ` Chris PeBenito
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).