* [SELinux-notebook PATCH] object_classes_permissions: describe bpf and perfmon capabilities
@ 2020-07-20 7:45 Dominick Grift
2020-07-21 17:59 ` Stephen Smalley
0 siblings, 1 reply; 3+ messages in thread
From: Dominick Grift @ 2020-07-20 7:45 UTC (permalink / raw)
To: selinux; +Cc: Dominick Grift
These capabilities were introduced with Linux 5.8
The ipc security class is deprecated (kind of at least)
Fix a typo in net_broadcast
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
src/object_classes_permissions.md | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/src/object_classes_permissions.md b/src/object_classes_permissions.md
index 1b183bb..498d872 100644
--- a/src/object_classes_permissions.md
+++ b/src/object_classes_permissions.md
@@ -421,7 +421,7 @@ inherited by a number of object classes.
<td>Allows opening of raw sockets and packet sockets.</td>
</tr>
<tr>
-<td>netbroadcast</td>
+<td>net_broadcast</td>
<td>Grant network broadcasting and listening to incoming multicasts.</td>
</tr>
<tr>
@@ -496,13 +496,18 @@ inherited by a number of object classes.
<tbody>
<tr>
<td style="background-color:#F2F2F2;"><strong>Permissions</strong></td>
-<td style="background-color:#F2F2F2;">Description (6 permissions)</td>
+<td style="background-color:#F2F2F2;">Description (8 permissions)</td>
</tr>
<tr>
<td>audit_read</td>
<td>Allow reading audits logs.</td>
</tr>
<tr>
+<td>bpf</td>
+<td><p>Create maps, do other <em>sys_bpf()</em> commands and load 'SK_REUSEPORT' progs.</p>
+<p>Note that loading tracing programs also requires 'CAP_PERFMON' and that loading networking programs also requires 'CAP_NET_ADMIN'.</p></td>
+</tr>
+<tr>
<td>block_suspend</td>
<td>Prevent system suspends (was <em>epollwakeup</em>)</td>
</tr>
@@ -516,6 +521,11 @@ inherited by a number of object classes.
<td>Allow MAC policy to be overridden. (not used)</td>
</tr>
<tr>
+<tr>
+<td>perfmon</td>
+<td>Allow system performance monitoring and observability operations.</td>
+</tr>
+<tr>
<td>syslog</td>
<td>Allow configuration of kernel <em>syslog</em> (<em>printk</em> behaviour).</td>
</tr>
@@ -2015,7 +2025,7 @@ implementation.
## IPC Object Classes
-### `ipc`
+### `ipc` (Deprecated)
<table>
<tbody>
@@ -2600,11 +2610,11 @@ Note that while this is defined as a kernel object class, the userspace
</tr>
<tr>
<td style="background-color:#F2F2F2;"><strong>Permissions</strong></td>
-<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 6 permissions)</td>
+<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 8 permissions)</td>
</tr>
<tr>
<td style="background-color:#F2F2F2;"><a href="#common-capability2-permissions"><strong>Common Capability2 Permissions<strong></td>
-<td style="background-color:#F2F2F2;">audit_read, block_suspend, mac_admin, mac_override, syslog, wake_alarm</td>
+<td style="background-color:#F2F2F2;">audit_read, bpf, block_suspend, mac_admin, mac_override, perfmon, syslog, wake_alarm</td>
</tr>
</tbody>
</table>
@@ -2638,11 +2648,11 @@ Note that while this is defined as a kernel object class, the userspace
</tr>
<tr>
<td style="background-color:#F2F2F2;"><strong>Permissions</strong></td>
-<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 6 permissions)</td>
+<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 8 permissions)</td>
</tr>
<tr>
<td style="background-color:#F2F2F2;"><a href="#common-capability2-permissions"><strong>Common Capability2 Permissions<strong></td>
-<td style="background-color:#F2F2F2;">audit_read, block_suspend, mac_admin, mac_override, syslog, wake_alarm</td>
+<td style="background-color:#F2F2F2;">audit_read, bpf, block_suspend, mac_admin, mac_override, perfmon, syslog, wake_alarm</td>
</tr>
</tbody>
</table>
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [SELinux-notebook PATCH] object_classes_permissions: describe bpf and perfmon capabilities
2020-07-20 7:45 [SELinux-notebook PATCH] object_classes_permissions: describe bpf and perfmon capabilities Dominick Grift
@ 2020-07-21 17:59 ` Stephen Smalley
2020-07-21 21:04 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Stephen Smalley @ 2020-07-21 17:59 UTC (permalink / raw)
To: Dominick Grift; +Cc: SElinux list
On Mon, Jul 20, 2020 at 3:47 AM Dominick Grift
<dominick.grift@defensec.nl> wrote:
>
> These capabilities were introduced with Linux 5.8
> The ipc security class is deprecated (kind of at least)
Trying to remember the final resolution on the ipc class. I think I
looked at it as part of
https://github.com/SELinuxProject/selinux/issues/57 but couldn't
cleanly remove it altogether. We are no longer assigning SECCLASS_IPC
to anything but we are using the IPC__UNIX_READ/WRITE permissions in
selinux_ipc_permission().
> Fix a typo in net_broadcast
>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> src/object_classes_permissions.md | 24 +++++++++++++++++-------
> 1 file changed, 17 insertions(+), 7 deletions(-)
>
> diff --git a/src/object_classes_permissions.md b/src/object_classes_permissions.md
> index 1b183bb..498d872 100644
> --- a/src/object_classes_permissions.md
> +++ b/src/object_classes_permissions.md
> @@ -421,7 +421,7 @@ inherited by a number of object classes.
> <td>Allows opening of raw sockets and packet sockets.</td>
> </tr>
> <tr>
> -<td>netbroadcast</td>
> +<td>net_broadcast</td>
> <td>Grant network broadcasting and listening to incoming multicasts.</td>
> </tr>
> <tr>
> @@ -496,13 +496,18 @@ inherited by a number of object classes.
> <tbody>
> <tr>
> <td style="background-color:#F2F2F2;"><strong>Permissions</strong></td>
> -<td style="background-color:#F2F2F2;">Description (6 permissions)</td>
> +<td style="background-color:#F2F2F2;">Description (8 permissions)</td>
> </tr>
> <tr>
> <td>audit_read</td>
> <td>Allow reading audits logs.</td>
> </tr>
> <tr>
> +<td>bpf</td>
> +<td><p>Create maps, do other <em>sys_bpf()</em> commands and load 'SK_REUSEPORT' progs.</p>
> +<p>Note that loading tracing programs also requires 'CAP_PERFMON' and that loading networking programs also requires 'CAP_NET_ADMIN'.</p></td>
> +</tr>
> +<tr>
> <td>block_suspend</td>
> <td>Prevent system suspends (was <em>epollwakeup</em>)</td>
> </tr>
> @@ -516,6 +521,11 @@ inherited by a number of object classes.
> <td>Allow MAC policy to be overridden. (not used)</td>
> </tr>
> <tr>
> +<tr>
> +<td>perfmon</td>
> +<td>Allow system performance monitoring and observability operations.</td>
> +</tr>
> +<tr>
> <td>syslog</td>
> <td>Allow configuration of kernel <em>syslog</em> (<em>printk</em> behaviour).</td>
> </tr>
> @@ -2015,7 +2025,7 @@ implementation.
>
> ## IPC Object Classes
>
> -### `ipc`
> +### `ipc` (Deprecated)
>
> <table>
> <tbody>
> @@ -2600,11 +2610,11 @@ Note that while this is defined as a kernel object class, the userspace
> </tr>
> <tr>
> <td style="background-color:#F2F2F2;"><strong>Permissions</strong></td>
> -<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 6 permissions)</td>
> +<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 8 permissions)</td>
> </tr>
> <tr>
> <td style="background-color:#F2F2F2;"><a href="#common-capability2-permissions"><strong>Common Capability2 Permissions<strong></td>
> -<td style="background-color:#F2F2F2;">audit_read, block_suspend, mac_admin, mac_override, syslog, wake_alarm</td>
> +<td style="background-color:#F2F2F2;">audit_read, bpf, block_suspend, mac_admin, mac_override, perfmon, syslog, wake_alarm</td>
> </tr>
> </tbody>
> </table>
> @@ -2638,11 +2648,11 @@ Note that while this is defined as a kernel object class, the userspace
> </tr>
> <tr>
> <td style="background-color:#F2F2F2;"><strong>Permissions</strong></td>
> -<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 6 permissions)</td>
> +<td style="background-color:#F2F2F2;"><strong>Description</strong> (Inherit 8 permissions)</td>
> </tr>
> <tr>
> <td style="background-color:#F2F2F2;"><a href="#common-capability2-permissions"><strong>Common Capability2 Permissions<strong></td>
> -<td style="background-color:#F2F2F2;">audit_read, block_suspend, mac_admin, mac_override, syslog, wake_alarm</td>
> +<td style="background-color:#F2F2F2;">audit_read, bpf, block_suspend, mac_admin, mac_override, perfmon, syslog, wake_alarm</td>
> </tr>
> </tbody>
> </table>
> --
> 2.27.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [SELinux-notebook PATCH] object_classes_permissions: describe bpf and perfmon capabilities
2020-07-21 17:59 ` Stephen Smalley
@ 2020-07-21 21:04 ` Paul Moore
0 siblings, 0 replies; 3+ messages in thread
From: Paul Moore @ 2020-07-21 21:04 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Dominick Grift, SElinux list
On Tue, Jul 21, 2020 at 2:00 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
> On Mon, Jul 20, 2020 at 3:47 AM Dominick Grift
> <dominick.grift@defensec.nl> wrote:
> >
> > These capabilities were introduced with Linux 5.8
> > The ipc security class is deprecated (kind of at least)
>
> Trying to remember the final resolution on the ipc class. I think I
> looked at it as part of
> https://github.com/SELinuxProject/selinux/issues/57 but couldn't
> cleanly remove it altogether. We are no longer assigning SECCLASS_IPC
> to anything but we are using the IPC__UNIX_READ/WRITE permissions in
> selinux_ipc_permission().
>
> > Fix a typo in net_broadcast
> >
> > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Merged into main, thanks!
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-07-21 21:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-20 7:45 [SELinux-notebook PATCH] object_classes_permissions: describe bpf and perfmon capabilities Dominick Grift
2020-07-21 17:59 ` Stephen Smalley
2020-07-21 21:04 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).