* [SELinux-notebook PATCH] lsm_selinux: document genfs_seclabel_symlinks policy capability
@ 2020-07-20 14:50 Dominick Grift
2020-07-21 19:38 ` Stephen Smalley
0 siblings, 1 reply; 5+ messages in thread
From: Dominick Grift @ 2020-07-20 14:50 UTC (permalink / raw)
To: selinux; +Cc: Dominick Grift
This was added with Linux 5.7 and SELinux 3.1
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
src/lsm_selinux.md | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/lsm_selinux.md b/src/lsm_selinux.md
index a400c36..8e6f3ad 100644
--- a/src/lsm_selinux.md
+++ b/src/lsm_selinux.md
@@ -676,6 +676,11 @@ interface, it is not recommended - use the **libselinux** or **libsepol** librar
<td>Enables the use of separate socket security classes for all network address families rather than the generic socket class.</td>
</tr>
<tr>
+<td>genfs_seclabel_symlinks</td>
+<td>-r--r--r--</td>
+<td>Symlinks on kernel filesystems will receive contexts based on genfscon statements like directories and files.</td>
+</tr>
+<tr>
<td>network_peer_controls</td>
<td>-r--r--r--</td>
<td><p>If true the following network_peer_controls are enabled:</p>
--
2.27.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [SELinux-notebook PATCH] lsm_selinux: document genfs_seclabel_symlinks policy capability
2020-07-20 14:50 [SELinux-notebook PATCH] lsm_selinux: document genfs_seclabel_symlinks policy capability Dominick Grift
@ 2020-07-21 19:38 ` Stephen Smalley
2020-07-21 19:57 ` [SELinux-notebook PATCH v2] " Dominick Grift
0 siblings, 1 reply; 5+ messages in thread
From: Stephen Smalley @ 2020-07-21 19:38 UTC (permalink / raw)
To: Dominick Grift; +Cc: SElinux list
On Mon, Jul 20, 2020 at 10:53 AM Dominick Grift
<dominick.grift@defensec.nl> wrote:
>
> This was added with Linux 5.7 and SELinux 3.1
>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
> ---
> src/lsm_selinux.md | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/src/lsm_selinux.md b/src/lsm_selinux.md
> index a400c36..8e6f3ad 100644
> --- a/src/lsm_selinux.md
> +++ b/src/lsm_selinux.md
> @@ -676,6 +676,11 @@ interface, it is not recommended - use the **libselinux** or **libsepol** librar
> <td>Enables the use of separate socket security classes for all network address families rather than the generic socket class.</td>
> </tr>
> <tr>
> +<td>genfs_seclabel_symlinks</td>
> +<td>-r--r--r--</td>
> +<td>Symlinks on kernel filesystems will receive contexts based on genfscon statements like directories and files.</td>
> +</tr>
> +<tr>
Maybe "Enables fine-grained labeling of symlinks in pseudo filesystems
based on genfscon rules."
^ permalink raw reply [flat|nested] 5+ messages in thread
* [SELinux-notebook PATCH v2] lsm_selinux: document genfs_seclabel_symlinks policy capability
2020-07-21 19:38 ` Stephen Smalley
@ 2020-07-21 19:57 ` Dominick Grift
2020-07-22 15:04 ` Stephen Smalley
2020-07-23 1:54 ` Paul Moore
0 siblings, 2 replies; 5+ messages in thread
From: Dominick Grift @ 2020-07-21 19:57 UTC (permalink / raw)
To: selinux; +Cc: Dominick Grift
This was added with Linux 5.7 and SELinux 3.1
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
v2: copied and pasted feedback from Stephen Smalley
src/lsm_selinux.md | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/lsm_selinux.md b/src/lsm_selinux.md
index a400c36..f762614 100644
--- a/src/lsm_selinux.md
+++ b/src/lsm_selinux.md
@@ -676,6 +676,11 @@ interface, it is not recommended - use the **libselinux** or **libsepol** librar
<td>Enables the use of separate socket security classes for all network address families rather than the generic socket class.</td>
</tr>
<tr>
+<td>genfs_seclabel_symlinks</td>
+<td>-r--r--r--</td>
+<td>Enables fine-grained labeling of symlinks in pseudo filesystems based on genfscon rules.</td>
+</tr>
+<tr>
<td>network_peer_controls</td>
<td>-r--r--r--</td>
<td><p>If true the following network_peer_controls are enabled:</p>
--
2.27.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [SELinux-notebook PATCH v2] lsm_selinux: document genfs_seclabel_symlinks policy capability
2020-07-21 19:57 ` [SELinux-notebook PATCH v2] " Dominick Grift
@ 2020-07-22 15:04 ` Stephen Smalley
2020-07-23 1:54 ` Paul Moore
1 sibling, 0 replies; 5+ messages in thread
From: Stephen Smalley @ 2020-07-22 15:04 UTC (permalink / raw)
To: Dominick Grift; +Cc: SElinux list
On Tue, Jul 21, 2020 at 3:58 PM Dominick Grift
<dominick.grift@defensec.nl> wrote:
>
> This was added with Linux 5.7 and SELinux 3.1
>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [SELinux-notebook PATCH v2] lsm_selinux: document genfs_seclabel_symlinks policy capability
2020-07-21 19:57 ` [SELinux-notebook PATCH v2] " Dominick Grift
2020-07-22 15:04 ` Stephen Smalley
@ 2020-07-23 1:54 ` Paul Moore
1 sibling, 0 replies; 5+ messages in thread
From: Paul Moore @ 2020-07-23 1:54 UTC (permalink / raw)
To: Dominick Grift; +Cc: selinux
On Tue, Jul 21, 2020 at 3:57 PM Dominick Grift
<dominick.grift@defensec.nl> wrote:
>
> This was added with Linux 5.7 and SELinux 3.1
>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
> ---
> v2: copied and pasted feedback from Stephen Smalley
>
> src/lsm_selinux.md | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/src/lsm_selinux.md b/src/lsm_selinux.md
> index a400c36..f762614 100644
> --- a/src/lsm_selinux.md
> +++ b/src/lsm_selinux.md
> @@ -676,6 +676,11 @@ interface, it is not recommended - use the **libselinux** or **libsepol** librar
> <td>Enables the use of separate socket security classes for all network address families rather than the generic socket class.</td>
> </tr>
> <tr>
> +<td>genfs_seclabel_symlinks</td>
> +<td>-r--r--r--</td>
> +<td>Enables fine-grained labeling of symlinks in pseudo filesystems based on genfscon rules.</td>
> +</tr>
> +<tr>
> <td>network_peer_controls</td>
> <td>-r--r--r--</td>
> <td><p>If true the following network_peer_controls are enabled:</p>
> --
> 2.27.0
Merged into main, thanks!
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-07-23 1:55 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-20 14:50 [SELinux-notebook PATCH] lsm_selinux: document genfs_seclabel_symlinks policy capability Dominick Grift
2020-07-21 19:38 ` Stephen Smalley
2020-07-21 19:57 ` [SELinux-notebook PATCH v2] " Dominick Grift
2020-07-22 15:04 ` Stephen Smalley
2020-07-23 1:54 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).