* [PATCH 0/7] mcs, various: pull in changes from Fedora policy
@ 2021-10-29 21:04 Kenton Groombridge
2021-10-29 21:04 ` [PATCH 1/7] mcs: deprecate mcs overrides Kenton Groombridge
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Pull in some changes from the Fedora policy's MCS constraints.
Most notably, the MCS override attributes were deprecated in favor of
mcs_constrained_type. This means that domains will have unchecked
access to objects with categories UNLESS the domain is
mcs_constrained_type. This alleviates confusion between the MCS
overrides and mcs_constrained_type to imply that a domain must be
MCS-constrained to have MCS checks at all.
Other changes include additional constraints to miscellaneous IPC
objects, node "write" operations, and netif egress/ingress operations.
Kenton Groombridge (7):
mcs: deprecate mcs overrides
mcs: restrict create, relabelto on mcs files
mcs: add additional constraints to databases
mcs: constrain misc IPC objects
mcs: combine single-level object creation constraints
various: deprecate mcs override interfaces
corenet: make netlabel_peer_t mcs constrained
policy/mcs | 61 ++++++++++++++++---------
policy/modules/admin/rpm.te | 2 -
policy/modules/admin/tmpreaper.te | 2 -
policy/modules/kernel/corenetwork.te.in | 1 +
policy/modules/kernel/mcs.if | 24 ++--------
policy/modules/services/policykit.te | 2 -
policy/modules/services/postfix.te | 10 ----
policy/modules/services/watchdog.te | 2 -
policy/modules/system/init.te | 6 ---
policy/modules/system/systemd.te | 1 -
policy/modules/system/udev.te | 2 -
policy/modules/system/unconfined.te | 3 --
12 files changed, 45 insertions(+), 71 deletions(-)
--
2.33.1
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH 1/7] mcs: deprecate mcs overrides
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
2021-10-29 21:04 ` [PATCH 2/7] mcs: restrict create, relabelto on mcs files Kenton Groombridge
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Deprecate mcs overrides in favor of using mcs_constrained_type.
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/mcs | 34 ++++++++++++++--------------------
1 file changed, 14 insertions(+), 20 deletions(-)
diff --git a/policy/mcs b/policy/mcs
index c0d424a97..44b57e594 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -69,53 +69,47 @@ gen_levels(1,mcs_num_cats)
# - /proc/pid operations are not constrained.
mlsconstrain file { read ioctl lock execute execute_no_trans }
- (( h1 dom h2 ) or ( t1 == mcsreadall ) or
- (( t1 != mcs_constrained_type ) and (t2 == domain)));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain file { write setattr append unlink link rename }
- (( h1 dom h2 ) or ( t1 == mcswriteall ) or
- (( t1 != mcs_constrained_type ) and (t2 == domain)));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain dir { search read ioctl lock }
- (( h1 dom h2 ) or ( t1 == mcsreadall ) or
- (( t1 != mcs_constrained_type ) and (t2 == domain)));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
- (( h1 dom h2 ) or ( t1 == mcswriteall ) or
- (( t1 != mcs_constrained_type ) and (t2 == domain)));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain fifo_file { open }
- (( h1 dom h2 ) or ( t1 == mcsreadall ) or
- (( t1 != mcs_constrained_type ) and ( t2 == domain )));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
- (( h1 dom h2 ) or ( t1 == mcsreadall ) or
- (( t1 != mcs_constrained_type ) and (t2 == domain)));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
- (( h1 dom h2 ) or ( t1 == mcswriteall ) or
- (( t1 != mcs_constrained_type ) and (t2 == domain)));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
mlsconstrain file { create relabelto }
- (( h1 dom h2 ) and ( l2 eq h2 ));
+ ((( h1 dom h2 ) and ( l2 eq h2 )) or
+ ( t1 != mcs_constrained_type ));
# new file labels must be dominated by the relabeling subject clearance
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
- ( h1 dom h2 );
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
- (( h1 dom h2 ) and ( l2 eq h2 ));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain process { transition dyntransition }
- (( h1 dom h2 ) or ( t1 == mcssetcats ));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain process { ptrace }
- (( h1 dom h2) or ( t1 == mcsptraceall ));
+ (( h1 dom h2) or ( t1 != mcs_constrained_type ));
mlsconstrain process { sigkill sigstop }
- (( h1 dom h2 ) or ( t1 == mcskillall ));
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain process { signal }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 2/7] mcs: restrict create, relabelto on mcs files
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
2021-10-29 21:04 ` [PATCH 1/7] mcs: deprecate mcs overrides Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
2021-10-29 21:04 ` [PATCH 3/7] mcs: add additional constraints to databases Kenton Groombridge
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/mcs | 3 +++
1 file changed, 3 insertions(+)
diff --git a/policy/mcs b/policy/mcs
index 44b57e594..d4d984e47 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -99,6 +99,9 @@ mlsconstrain file { create relabelto }
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+mlsconstrain { file lnk_file fifo_file } { create relabelto }
+ (( l2 eq h2 ) or ( t1 != mcs_constrained_type ));
+
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 3/7] mcs: add additional constraints to databases
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
2021-10-29 21:04 ` [PATCH 1/7] mcs: deprecate mcs overrides Kenton Groombridge
2021-10-29 21:04 ` [PATCH 2/7] mcs: restrict create, relabelto on mcs files Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
2021-10-29 21:04 ` [PATCH 4/7] mcs: constrain misc IPC objects Kenton Groombridge
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/mcs | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/policy/mcs b/policy/mcs
index d4d984e47..8db3838f5 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -135,6 +135,9 @@ mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure d
mlsconstrain { db_tuple } { insert relabelto }
(( h1 dom h2 ) and ( l2 eq h2 ));
+mlsconstrain context contains
+ (( h1 dom h2 ) and ( l1 domby l2 ));
+
# Access control for any database objects based on MCS rules.
mlsconstrain db_database { drop getattr setattr relabelfrom access install_module load_module get_param set_param }
( h1 dom h2 );
@@ -166,4 +169,23 @@ mlsconstrain db_language { drop getattr setattr relabelfrom execute }
mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
( h1 dom h2 );
+mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
+# The node recvfrom/sendto ops, the recvfrom permission is a "write" operation
+# because the subject in this particular case is the remote domain which is
+# writing data out the network node which is acting as the object
+mlsconstrain { node } { recvfrom sendto }
+ (( l1 dom l2 ) or ( t1 != msc_constrained_type ));
+
+mlsconstrain { packet peer } { recv }
+ (( l1 dom l2 ) or
+ (( t1 != mcs_constrained_type ) and ( t2 != mcs_constrained_type )));
+
+# The netif ingress/egress ops, the ingress permission is a "write" operation
+# because the subject in this particular case is the remote domain which is
+# writing data out the network interface which is acting as the object
+mlsconstrain { netif } { egress ingress }
+ (( l1 dom l2 ) or ( t1 != mcs_constrained_type ));
+
') dnl end enable_mcs
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 4/7] mcs: constrain misc IPC objects
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
` (2 preceding siblings ...)
2021-10-29 21:04 ` [PATCH 3/7] mcs: add additional constraints to databases Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
2021-10-29 21:04 ` [PATCH 5/7] mcs: combine single-level object creation constraints Kenton Groombridge
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/mcs | 3 +++
1 file changed, 3 insertions(+)
diff --git a/policy/mcs b/policy/mcs
index 8db3838f5..6207b2734 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } node_bind
mlsconstrain key { create link read search setattr view write }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+mlsconstrain { ipc sem msgq shm } { create destroy setattr write unix_write }
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
#
# MCS policy for SELinux-enabled databases
#
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 5/7] mcs: combine single-level object creation constraints
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
` (3 preceding siblings ...)
2021-10-29 21:04 ` [PATCH 4/7] mcs: constrain misc IPC objects Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
2021-10-29 21:04 ` [PATCH 6/7] various: deprecate mcs override interfaces Kenton Groombridge
2021-10-29 21:04 ` [PATCH 7/7] corenet: make netlabel_peer_t mcs constrained Kenton Groombridge
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/mcs | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/policy/mcs b/policy/mcs
index 6207b2734..54d06f292 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -91,7 +91,7 @@ mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
-mlsconstrain file { create relabelto }
+mlsconstrain { file lnk_file fifo_file } { create relabelto }
((( h1 dom h2 ) and ( l2 eq h2 )) or
( t1 != mcs_constrained_type ));
@@ -99,9 +99,6 @@ mlsconstrain file { create relabelto }
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
-mlsconstrain { file lnk_file fifo_file } { create relabelto }
- (( l2 eq h2 ) or ( t1 != mcs_constrained_type ));
-
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 6/7] various: deprecate mcs override interfaces
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
` (4 preceding siblings ...)
2021-10-29 21:04 ` [PATCH 5/7] mcs: combine single-level object creation constraints Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
2021-10-29 21:04 ` [PATCH 7/7] corenet: make netlabel_peer_t mcs constrained Kenton Groombridge
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/mcs | 2 +-
policy/modules/admin/rpm.te | 2 --
policy/modules/admin/tmpreaper.te | 2 --
policy/modules/kernel/mcs.if | 24 ++++--------------------
policy/modules/services/policykit.te | 2 --
policy/modules/services/postfix.te | 10 ----------
policy/modules/services/watchdog.te | 2 --
policy/modules/system/init.te | 6 ------
policy/modules/system/systemd.te | 1 -
policy/modules/system/udev.te | 2 --
policy/modules/system/unconfined.te | 3 ---
11 files changed, 5 insertions(+), 51 deletions(-)
diff --git a/policy/mcs b/policy/mcs
index 54d06f292..860c8fcc1 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -176,7 +176,7 @@ mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
# because the subject in this particular case is the remote domain which is
# writing data out the network node which is acting as the object
mlsconstrain { node } { recvfrom sendto }
- (( l1 dom l2 ) or ( t1 != msc_constrained_type ));
+ (( l1 dom l2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { packet peer } { recv }
(( l1 dom l2 ) or
diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
index f82fd21f2..274052958 100644
--- a/policy/modules/admin/rpm.te
+++ b/policy/modules/admin/rpm.te
@@ -313,8 +313,6 @@ fs_mount_xattr_fs(rpm_script_t)
fs_unmount_xattr_fs(rpm_script_t)
fs_search_auto_mountpoints(rpm_script_t)
-mcs_killall(rpm_script_t)
-
mls_file_read_all_levels(rpm_script_t)
mls_file_write_all_levels(rpm_script_t)
diff --git a/policy/modules/admin/tmpreaper.te b/policy/modules/admin/tmpreaper.te
index f4ce8dba9..1acefd7fe 100644
--- a/policy/modules/admin/tmpreaper.te
+++ b/policy/modules/admin/tmpreaper.te
@@ -34,8 +34,6 @@ files_read_var_lib_files(tmpreaper_t)
files_purge_tmp(tmpreaper_t)
files_setattr_all_tmp_dirs(tmpreaper_t)
-mcs_file_read_all(tmpreaper_t)
-mcs_file_write_all(tmpreaper_t)
mls_file_read_all_levels(tmpreaper_t)
mls_file_write_all_levels(tmpreaper_t)
diff --git a/policy/modules/kernel/mcs.if b/policy/modules/kernel/mcs.if
index eb4bcfcbe..55b5a7fe1 100644
--- a/policy/modules/kernel/mcs.if
+++ b/policy/modules/kernel/mcs.if
@@ -44,11 +44,7 @@ interface(`mcs_constrained',`
## <rolecap/>
#
interface(`mcs_file_read_all',`
- gen_require(`
- attribute mcsreadall;
- ')
-
- typeattribute $1 mcsreadall;
+ refpolicywarn(`$0() has been deprecated, please remove mcs_constrained() instead.')
')
########################################
@@ -64,11 +60,7 @@ interface(`mcs_file_read_all',`
## <rolecap/>
#
interface(`mcs_file_write_all',`
- gen_require(`
- attribute mcswriteall;
- ')
-
- typeattribute $1 mcswriteall;
+ refpolicywarn(`$0() has been deprecated, please remove mcs_constrained() instead.')
')
########################################
@@ -84,11 +76,7 @@ interface(`mcs_file_write_all',`
## <rolecap/>
#
interface(`mcs_killall',`
- gen_require(`
- attribute mcskillall;
- ')
-
- typeattribute $1 mcskillall;
+ refpolicywarn(`$0() has been deprecated, please remove mcs_constrained() instead.')
')
########################################
@@ -104,11 +92,7 @@ interface(`mcs_killall',`
## </param>
#
interface(`mcs_ptrace_all',`
- gen_require(`
- attribute mcsptraceall;
- ')
-
- typeattribute $1 mcsptraceall;
+ refpolicywarn(`$0() has been deprecated, please remove mcs_constrained() instead.')
')
########################################
diff --git a/policy/modules/services/policykit.te b/policy/modules/services/policykit.te
index 721534a0b..7ba8dbb13 100644
--- a/policy/modules/services/policykit.te
+++ b/policy/modules/services/policykit.te
@@ -265,8 +265,6 @@ can_exec(policykit_resolve_t, policykit_resolve_exec_t)
domtrans_pattern(policykit_resolve_t, policykit_auth_exec_t, policykit_auth_t)
-mcs_ptrace_all(policykit_resolve_t)
-
auth_use_nsswitch(policykit_resolve_t)
userdom_read_all_users_state(policykit_resolve_t)
diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 067d42f08..23c8c0ef1 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -292,8 +292,6 @@ domain_use_interactive_fds(postfix_master_t)
files_search_tmp(postfix_master_t)
-mcs_file_read_all(postfix_master_t)
-
term_dontaudit_search_ptys(postfix_master_t)
hostname_exec(postfix_master_t)
@@ -564,9 +562,6 @@ allow postfix_pickup_t postfix_spool_maildrop_t:dir list_dir_perms;
read_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
delete_files_pattern(postfix_pickup_t, postfix_spool_maildrop_t, postfix_spool_maildrop_t)
-mcs_file_read_all(postfix_pickup_t)
-mcs_file_write_all(postfix_pickup_t)
-
optional_policy(`
dbus_system_bus_client(postfix_pickup_t)
init_dbus_chat(postfix_pickup_t)
@@ -635,9 +630,6 @@ allow postfix_postdrop_t postfix_local_t:unix_stream_socket { read write };
# for /var/spool/postfix/public/pickup
stream_connect_pattern(postfix_postdrop_t, postfix_public_t, postfix_public_t, postfix_master_t)
-mcs_file_read_all(postfix_postdrop_t)
-mcs_file_write_all(postfix_postdrop_t)
-
term_dontaudit_use_all_ptys(postfix_postdrop_t)
term_dontaudit_use_all_ttys(postfix_postdrop_t)
@@ -743,8 +735,6 @@ allow postfix_showq_t postfix_spool_maildrop_t:lnk_file read_lnk_file_perms;
allow postfix_showq_t postfix_spool_t:file read_file_perms;
-mcs_file_read_all(postfix_showq_t)
-
term_use_all_ptys(postfix_showq_t)
term_use_all_ttys(postfix_showq_t)
diff --git a/policy/modules/services/watchdog.te b/policy/modules/services/watchdog.te
index 6ad408584..ab9d94585 100644
--- a/policy/modules/services/watchdog.te
+++ b/policy/modules/services/watchdog.te
@@ -76,8 +76,6 @@ auth_append_login_records(watchdog_t)
logging_send_syslog_msg(watchdog_t)
-mcs_killall(watchdog_t)
-
miscfiles_read_localization(watchdog_t)
sysnet_dns_name_resolve(watchdog_t)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 649f431dc..6093de7f5 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -212,7 +212,6 @@ fs_list_inotifyfs(init_t)
fs_write_ramfs_sockets(init_t)
mcs_process_set_categories(init_t)
-mcs_killall(init_t)
mls_file_read_all_levels(init_t)
mls_file_write_all_levels(init_t)
@@ -790,11 +789,6 @@ fs_getattr_all_fs(initrc_t)
fs_search_all(initrc_t)
fs_getattr_nfsd_files(initrc_t)
-# initrc_t needs to do a pidof which requires ptrace
-mcs_ptrace_all(initrc_t)
-mcs_file_read_all(initrc_t)
-mcs_file_write_all(initrc_t)
-mcs_killall(initrc_t)
mcs_process_set_categories(initrc_t)
mls_file_read_all_levels(initrc_t)
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 30d23c3fe..fe493277b 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -193,7 +193,6 @@ init_daemon_domain(systemd_notify_t, systemd_notify_exec_t)
type systemd_nspawn_t;
type systemd_nspawn_exec_t;
init_system_domain(systemd_nspawn_t, systemd_nspawn_exec_t)
-mcs_killall(systemd_nspawn_t)
type systemd_nspawn_runtime_t alias systemd_nspawn_var_run_t;
files_runtime_file(systemd_nspawn_runtime_t)
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 4463f086b..81b0dd1fe 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -141,8 +141,6 @@ fs_read_cgroup_files(udev_t)
fs_rw_anon_inodefs_files(udev_t)
fs_search_tracefs(udev_t)
-mcs_ptrace_all(udev_t)
-
mls_file_read_all_levels(udev_t)
mls_file_write_all_levels(udev_t)
mls_file_upgrade(udev_t)
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 385c88695..9df73ac76 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -30,9 +30,6 @@ domtrans_pattern(unconfined_t, unconfined_execmem_exec_t, unconfined_execmem_t)
files_create_boot_flag(unconfined_t)
-mcs_killall(unconfined_t)
-mcs_ptrace_all(unconfined_t)
-
libs_run_ldconfig(unconfined_t, unconfined_r)
logging_send_syslog_msg(unconfined_t)
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 7/7] corenet: make netlabel_peer_t mcs constrained
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
` (5 preceding siblings ...)
2021-10-29 21:04 ` [PATCH 6/7] various: deprecate mcs override interfaces Kenton Groombridge
@ 2021-10-29 21:04 ` Kenton Groombridge
6 siblings, 0 replies; 8+ messages in thread
From: Kenton Groombridge @ 2021-10-29 21:04 UTC (permalink / raw)
To: selinux-refpolicy; +Cc: Kenton Groombridge
Signed-off-by: Kenton Groombridge <me@concord.sh>
---
policy/modules/kernel/corenetwork.te.in | 1 +
1 file changed, 1 insertion(+)
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index 010fc808e..42bbfc8df 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -53,6 +53,7 @@ network_packet_simple(icmp)
#
type netlabel_peer_t;
sid netmsg gen_context(system_u:object_r:netlabel_peer_t,mls_systemhigh)
+mcs_constrained(netlabel_peer_t)
#
# port_t is the default type of INET port numbers.
--
2.33.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-10-29 21:13 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-29 21:04 [PATCH 0/7] mcs, various: pull in changes from Fedora policy Kenton Groombridge
2021-10-29 21:04 ` [PATCH 1/7] mcs: deprecate mcs overrides Kenton Groombridge
2021-10-29 21:04 ` [PATCH 2/7] mcs: restrict create, relabelto on mcs files Kenton Groombridge
2021-10-29 21:04 ` [PATCH 3/7] mcs: add additional constraints to databases Kenton Groombridge
2021-10-29 21:04 ` [PATCH 4/7] mcs: constrain misc IPC objects Kenton Groombridge
2021-10-29 21:04 ` [PATCH 5/7] mcs: combine single-level object creation constraints Kenton Groombridge
2021-10-29 21:04 ` [PATCH 6/7] various: deprecate mcs override interfaces Kenton Groombridge
2021-10-29 21:04 ` [PATCH 7/7] corenet: make netlabel_peer_t mcs constrained Kenton Groombridge
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).