diff options
| author | John Turner <jturner.usa@gmail.com> | 2025-08-16 14:43:06 -0400 |
|---|---|---|
| committer | John Turner <jturner.usa@gmail.com> | 2025-08-16 14:43:06 -0400 |
| commit | 58ffeaf9b49e662e49d24a2d71dcdc9fac2949f8 (patch) | |
| tree | 84c645e32aac8eb468f41df33fbac7b0a8584887 /src/misc/av | |
| parent | cfd55472db08f37b2123c350ce76fb3d916d25f6 (diff) | |
| download | selinux-policy-58ffeaf9b49e662e49d24a2d71dcdc9fac2949f8.tar.gz | |
auto format all files
Diffstat (limited to 'src/misc/av')
| -rw-r--r-- | src/misc/av/binderav.cil | 18 | ||||
| -rw-r--r-- | src/misc/av/bpfav.cil | 18 | ||||
| -rw-r--r-- | src/misc/av/capabilityav.cil | 18 | ||||
| -rw-r--r-- | src/misc/av/fdav.cil | 68 | ||||
| -rw-r--r-- | src/misc/av/iouringav.cil | 18 | ||||
| -rw-r--r-- | src/misc/av/ipcav.cil | 66 | ||||
| -rw-r--r-- | src/misc/av/kernelserviceav.cil | 20 | ||||
| -rw-r--r-- | src/misc/av/keyav.cil | 36 | ||||
| -rw-r--r-- | src/misc/av/memprotectav.cil | 14 | ||||
| -rw-r--r-- | src/misc/av/msgav.cil | 18 | ||||
| -rw-r--r-- | src/misc/av/perfeventav.cil | 18 | ||||
| -rw-r--r-- | src/misc/av/socketav.cil | 968 | ||||
| -rw-r--r-- | src/misc/av/systemav.cil | 52 | ||||
| -rw-r--r-- | src/misc/av/usernamespaceav.cil | 2 |
14 files changed, 667 insertions, 667 deletions
diff --git a/src/misc/av/binderav.cil b/src/misc/av/binderav.cil index 592d066..23827f1 100644 --- a/src/misc/av/binderav.cil +++ b/src/misc/av/binderav.cil @@ -1,14 +1,14 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class binder (call impersonate set_context_mgr transfer)) (classorder (unordered binder)) (macro call_invalid_binders ((type ARG1)) - (allow ARG1 .invalid (binder (call)))) + (allow ARG1 .invalid (binder (call)))) (macro transfer_invalid_binders ((type ARG1)) - (allow ARG1 .invalid (binder (transfer)))) + (allow ARG1 .invalid (binder (transfer)))) (in invalid.unconfined @@ -17,24 +17,24 @@ (in subj (macro call_all_binders ((type ARG1)) - (allow ARG1 typeattr (binder (call)))) + (allow ARG1 typeattr (binder (call)))) (macro impersonate_all_binders ((type ARG1)) - (allow ARG1 typeattr (binder (impersonate)))) + (allow ARG1 typeattr (binder (impersonate)))) (macro transfer_all_binders ((type ARG1)) - (allow ARG1 typeattr (binder (transfer))))) + (allow ARG1 typeattr (binder (transfer))))) (in subj.macro_template (macro call_subj_binders ((type ARG1)) - (allow ARG1 subj (binder (call)))) + (allow ARG1 subj (binder (call)))) (macro impersonate_subj_binders ((type ARG1)) - (allow ARG1 subj (binder (impersonate)))) + (allow ARG1 subj (binder (impersonate)))) (macro transfer_subj_binders ((type ARG1)) - (allow ARG1 subj (binder (transfer))))) + (allow ARG1 subj (binder (transfer))))) (in subj.unconfined diff --git a/src/misc/av/bpfav.cil b/src/misc/av/bpfav.cil index 286b656..0dcc5e8 100644 --- a/src/misc/av/bpfav.cil +++ b/src/misc/av/bpfav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class bpf (map_create map_read map_write prog_load prog_run)) @@ -11,18 +11,18 @@ (in mcs (mlsconstrain (bpf (map_read map_write prog_run)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in rbacsep (constrain (bpf (map_read map_write prog_run)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in subj.unconfined diff --git a/src/misc/av/capabilityav.cil b/src/misc/av/capabilityav.cil index fa0635a..6b079f5 100644 --- a/src/misc/av/capabilityav.cil +++ b/src/misc/av/capabilityav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class cap_userns ()) @@ -19,16 +19,16 @@ (classcommon capability2 common_capability2) (common common_capability - (audit_control audit_write chown dac_read_search dac_override fowner - fsetid ipc_lock ipc_owner kill linux_immutable lease - mknod net_admin net_bind_service net_broadcast net_raw - setfcap setgid setpcap setuid sys_admin sys_boot - sys_chroot sys_module sys_nice sys_pacct sys_ptrace - sys_rawio sys_resource sys_time sys_tty_config)) + (audit_control audit_write chown dac_read_search dac_override fowner + fsetid ipc_lock ipc_owner kill linux_immutable lease + mknod net_admin net_bind_service net_broadcast net_raw + setfcap setgid setpcap setuid sys_admin sys_boot + sys_chroot sys_module sys_nice sys_pacct sys_ptrace + sys_rawio sys_resource sys_time sys_tty_config)) (common common_capability2 - (audit_read block_suspend bpf checkpoint_restore mac_admin mac_override - perfmon syslog wake_alarm)) + (audit_read block_suspend bpf checkpoint_restore mac_admin mac_override + perfmon syslog wake_alarm)) (in subj.unconfined diff --git a/src/misc/av/fdav.cil b/src/misc/av/fdav.cil index 9ded93b..b625ceb 100644 --- a/src/misc/av/fdav.cil +++ b/src/misc/av/fdav.cil @@ -1,11 +1,11 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class fd (use)) (classorder (unordered fd)) (macro use_invalid_fds ((type ARG1)) - (allow ARG1 invalid (fd (use)))) + (allow ARG1 invalid (fd (use)))) (in invalid.unconfined @@ -14,78 +14,78 @@ (in mcs (mlsconstrain (fd (use)) - (or (or (dom h1 h2) - (neq t1 constrained.typeattr)) - (and (eq t1 usefdsource.typeattr) - (eq t2 usefdtarget.typeattr)))) + (or (or (dom h1 h2) + (neq t1 constrained.typeattr)) + (and (eq t1 usefdsource.typeattr) + (eq t2 usefdtarget.typeattr)))) (block usefdsource - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr)) + (typeattribute typeattr)) (block usefdtarget - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr))) + (typeattribute typeattr))) (in rbacsep (constrain (fd (use)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 usefdsource.typeattr) - (eq t2 usefdtarget.typeattr)))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 usefdsource.typeattr) + (eq t2 usefdtarget.typeattr)))) (block usefdsource - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr)) + (typeattribute typeattr)) (block usefdtarget - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr))) + (typeattribute typeattr))) (in subj (block interactivefd - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr) + (typeattribute typeattr) - (call .mcs.usefdtarget.type (typeattr))) + (call .mcs.usefdtarget.type (typeattr))) (block useinteractivefd - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr) + (typeattribute typeattr) - (allow typeattr interactivefd.typeattr (fd (use))))) + (allow typeattr interactivefd.typeattr (fd (use))))) (in subj.all_macro_template (macro use_all_fds ((type ARG1)) - (allow ARG1 typeattr (fd (use))))) + (allow ARG1 typeattr (fd (use))))) (in subj.macro_template (macro use_subj_fds ((type ARG1)) - (allow ARG1 subj (fd (use))))) + (allow ARG1 subj (fd (use))))) (in subj.unconfined diff --git a/src/misc/av/iouringav.cil b/src/misc/av/iouringav.cil index 2e1c3aa..9476784 100644 --- a/src/misc/av/iouringav.cil +++ b/src/misc/av/iouringav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class io_uring (cmd override_creds sqpoll)) @@ -35,8 +35,8 @@ (in mcs (mlsconstrain (io_uring (override_creds)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in nodedev.unconfined @@ -57,12 +57,12 @@ (in rbacsep (constrain (io_uring (override_creds)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in securityfile.unconfined diff --git a/src/misc/av/ipcav.cil b/src/misc/av/ipcav.cil index 938daa9..a0041ac 100644 --- a/src/misc/av/ipcav.cil +++ b/src/misc/av/ipcav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class ipc ()) @@ -19,8 +19,8 @@ (classcommon shm common_ipc) (common common_ipc - (associate create destroy getattr read setattr unix_read unix_write - write)) + (associate create destroy getattr read setattr unix_read unix_write + write)) (classpermission create_ipc) (classpermission create_msgq) @@ -38,17 +38,17 @@ (classpermission readwrite_shm) (classpermissionset create_ipc - (ipc (associate create destroy getattr read setattr - unix_read unix_write write))) + (ipc (associate create destroy getattr read setattr + unix_read unix_write write))) (classpermissionset create_msgq - (msgq (associate create destroy enqueue getattr read setattr - unix_read unix_write write))) + (msgq (associate create destroy enqueue getattr read setattr + unix_read unix_write write))) (classpermissionset create_sem - (sem (associate create destroy getattr read setattr - unix_read unix_write write))) + (sem (associate create destroy getattr read setattr + unix_read unix_write write))) (classpermissionset create_shm - (shm (associate create destroy getattr read setattr - unix_read unix_write write))) + (shm (associate create destroy getattr read setattr + unix_read unix_write write))) (classpermissionset read_ipc (ipc (associate getattr read unix_read))) (classpermissionset read_msgq (msgq (associate getattr read unix_read))) @@ -56,14 +56,14 @@ (classpermissionset read_shm (shm (associate getattr read unix_read))) (classpermissionset readwrite_ipc - (ipc (associate getattr read unix_read unix_write write))) + (ipc (associate getattr read unix_read unix_write write))) (classpermissionset readwrite_msgq - (msgq (associate enqueue getattr read unix_read unix_write - write))) + (msgq (associate enqueue getattr read unix_read unix_write + write))) (classpermissionset readwrite_sem - (sem (associate getattr read unix_read unix_write write))) + (sem (associate getattr read unix_read unix_write write))) (classpermissionset readwrite_shm - (shm (associate getattr read unix_read unix_write write))) + (shm (associate getattr read unix_read unix_write write))) (classmap constrainipcsubject (create getattr read setattr write)) @@ -95,10 +95,10 @@ (in ibac (constrain (constrainipcsubject (create)) - (or (or (or (eq u1 u2) - (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) - (eq t1 subjchange.typeattr)) - (eq t1 exempt.typeattr)))) + (or (or (or (eq u1 u2) + (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) (in invalid.unconfined @@ -110,27 +110,27 @@ (in mcs (mlsconstrain (constrainipcsubject (create getattr read setattr write)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in rbac (constrain (constrainipcsubject (create)) - (or (or (or (eq r1 r2) - (and (eq t1 subjchangesys.typeattr) - (eq r2 .sys.role))) - (eq t1 subjchange.typeattr)) - (eq t1 exempt.typeattr)))) + (or (or (or (eq r1 r2) + (and (eq t1 subjchangesys.typeattr) + (eq r2 .sys.role))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) (in rbacsep (constrain (constrainipcsubject (getattr read setattr write)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in subj.unconfined diff --git a/src/misc/av/kernelserviceav.cil b/src/misc/av/kernelserviceav.cil index 7ab098a..e99cb67 100644 --- a/src/misc/av/kernelserviceav.cil +++ b/src/misc/av/kernelserviceav.cil @@ -1,17 +1,17 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class kernel_service (create_files_as use_as_override)) (classorder (unordered kernel_service)) (macro createfilesas_invalid_kernel_services ((type ARG1)) - (allow ARG1 invalid (kernel_service (create_files_as)))) + (allow ARG1 invalid (kernel_service (create_files_as)))) (macro createfilesas_unlabeled_kernel_services ((type ARG1)) - (allow ARG1 unlabeled (kernel_service (create_files_as)))) + (allow ARG1 unlabeled (kernel_service (create_files_as)))) (macro useasoverride_invalid_kernel_services ((type ARG1)) - (allow ARG1 invalid (kernel_service (use_as_override)))) + (allow ARG1 invalid (kernel_service (use_as_override)))) (in file @@ -19,17 +19,17 @@ (block all_macro_template_kernel_services - (blockabstract all_macro_template_kernel_services) + (blockabstract all_macro_template_kernel_services) - (macro createfileas_all_kernel_services ((type ARG1)) - (allow ARG1 typeattr (kernel_service (create_files_as))))) + (macro createfileas_all_kernel_services ((type ARG1)) + (allow ARG1 typeattr (kernel_service (create_files_as))))) (block macro_template_kernel_services - (blockabstract macro_template_kernel_services) + (blockabstract macro_template_kernel_services) - (macro createfileas_file_kernel_services ((type ARG1)) - (allow ARG1 file (kernel_service (create_files_as)))))) + (macro createfileas_file_kernel_services ((type ARG1)) + (allow ARG1 file (kernel_service (create_files_as)))))) (in file.unconfined diff --git a/src/misc/av/keyav.cil b/src/misc/av/keyav.cil index 508ea64..3a5ebaf 100644 --- a/src/misc/av/keyav.cil +++ b/src/misc/av/keyav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class key (create link read search setattr view write)) @@ -7,10 +7,10 @@ (in ibac (constrain (key (create)) - (or (or (or (eq u1 u2) - (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) - (eq t1 subjchange.typeattr)) - (eq t1 exempt.typeattr)))) + (or (or (or (eq u1 u2) + (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) (in invalid.unconfined @@ -19,27 +19,27 @@ (in mcs (mlsconstrain (key (create read setattr view write)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in rbac (constrain (key (create)) - (or (or (or (eq r1 r2) - (and (eq t1 subjchangesys.typeattr) - (eq r2 .sys.role))) - (eq t1 subjchange.typeattr)) - (eq t1 exempt.typeattr)))) + (or (or (or (eq r1 r2) + (and (eq t1 subjchangesys.typeattr) + (eq r2 .sys.role))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) (in rbacsep (constrain (key (read setattr view write)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in subj.unconfined diff --git a/src/misc/av/memprotectav.cil b/src/misc/av/memprotectav.cil index b43db24..1e89e53 100644 --- a/src/misc/av/memprotectav.cil +++ b/src/misc/av/memprotectav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class memprotect (mmap_zero)) @@ -8,15 +8,15 @@ (block mmapzero - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute not_typeattr) - (typeattribute typeattr) + (typeattribute not_typeattr) + (typeattribute typeattr) - (typeattributeset not_typeattr (not typeattr)) + (typeattributeset not_typeattr (not typeattr)) - (neverallow not_typeattr self (memprotect (mmap_zero))))) + (neverallow not_typeattr self (memprotect (mmap_zero))))) (in subj.unconfined diff --git a/src/misc/av/msgav.cil b/src/misc/av/msgav.cil index 44cd39f..7a16449 100644 --- a/src/misc/av/msgav.cil +++ b/src/misc/av/msgav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class msg (receive send)) @@ -13,18 +13,18 @@ (in mcs (mlsconstrain (msg (send)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in rbacsep (constrain (msg (send)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in subj.unconfined diff --git a/src/misc/av/perfeventav.cil b/src/misc/av/perfeventav.cil index 5b685bc..9547108 100644 --- a/src/misc/av/perfeventav.cil +++ b/src/misc/av/perfeventav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class perf_event (cpu kernel open read tracepoint write)) @@ -11,18 +11,18 @@ (in mcs (mlsconstrain (perf_event (read write)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in rbacsep (constrain (perf_event (read write)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in subj.unconfined diff --git a/src/misc/av/socketav.cil b/src/misc/av/socketav.cil index 42f70ff..88b2b2f 100644 --- a/src/misc/av/socketav.cil +++ b/src/misc/av/socketav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class alg_socket ()) @@ -62,7 +62,7 @@ (classorder (unordered mctp_socket)) (class netlink_audit_socket - (nlmsg_read nlmsg_readpriv nlmsg_relay nlmsg_tty_audit nlmsg_write)) + (nlmsg_read nlmsg_readpriv nlmsg_relay nlmsg_tty_audit nlmsg_write)) (classorder (unordered netlink_audit_socket)) (class netlink_connector_socket ()) @@ -240,9 +240,9 @@ (classcommon xdp_socket common_socket) (common common_socket - (accept append bind connect create getattr getopt ioctl listen lock map - name_bind read recvfrom relabelfrom relabelto sendto setattr - setopt shutdown write)) + (accept append bind connect create getattr getopt ioctl listen lock map + name_bind read recvfrom relabelfrom relabelto sendto setattr + setopt shutdown write)) (classpermission create_alg_socket) (classpermission create_alg_stream_socket) @@ -333,325 +333,325 @@ (classpermission write_vsock_socket) (classpermissionset create_alg_socket - (alg_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (alg_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_alg_stream_socket - (alg_socket (accept append bind connect create getattr - getopt ioctl listen read setattr setopt - shutdown write))) + (alg_socket (accept append bind connect create getattr + getopt ioctl listen read setattr setopt + shutdown write))) (classpermissionset create_appletalk_socket - (appletalk_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (appletalk_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_atmpvc_socket - (atmpvc_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (atmpvc_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_atmsvc_socket - (atmsvc_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (atmsvc_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_ax25_socket - (ax25_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (ax25_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_bluetooth_socket - (bluetooth_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (bluetooth_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_bluetooth_stream_socket - (bluetooth_socket (accept append bind connect create getattr - getopt ioctl listen read setattr - setopt shutdown write))) + (bluetooth_socket (accept append bind connect create getattr + getopt ioctl listen read setattr + setopt shutdown write))) (classpermissionset create_caif_socket - (caif_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (caif_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_can_socket - (can_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (can_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_dccp_socket - (dccp_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (dccp_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_dccp_stream_socket - (dccp_socket (accept append bind connect create getattr - getopt ioctl listen read setattr setopt - shutdown write))) + (dccp_socket (accept append bind connect create getattr + getopt ioctl listen read setattr setopt + shutdown write))) (classpermissionset create_decnet_socket - (decnet_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (decnet_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_icmp_socket - (icmp_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (icmp_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_ieee802154_socket - (ieee802154_socket (append bind connect create getattr - getopt ioctl read setattr setopt - shutdown write))) + (ieee802154_socket (append bind connect create getattr + getopt ioctl read setattr setopt + shutdown write))) (classpermissionset create_ipx_socket - (ipx_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (ipx_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_irda_socket - (irda_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (irda_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_isdn_socket - (isdn_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (isdn_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_iucv_socket - (iucv_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (iucv_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_kcm_socket - (kcm_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (kcm_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_key_socket - (key_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (key_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_llc_socket - (llc_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (llc_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_mctp_socket - (mctp_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (mctp_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_netlink_audit_socket - (netlink_audit_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_audit_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_connector_socket - (netlink_connector_socket (append bind connect create - getattr getopt ioctl read - setattr setopt shutdown - write))) + (netlink_connector_socket (append bind connect create + getattr getopt ioctl read + setattr setopt shutdown + write))) (classpermissionset create_netlink_crypto_socket - (netlink_crypto_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_crypto_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_dnrt_socket - (netlink_dnrt_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_dnrt_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_fib_lookup_socket - (netlink_fib_lookup_socket (append bind connect create - getattr getopt ioctl - read setattr setopt - shutdown write))) + (netlink_fib_lookup_socket (append bind connect create + getattr getopt ioctl + read setattr setopt + shutdown write))) (classpermissionset create_netlink_generic_socket - (netlink_generic_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_generic_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_iscsi_socket - (netlink_iscsi_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_iscsi_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_kobject_uevent_socket - (netlink_kobject_uevent_socket (append bind connect create - getattr getopt ioctl - read setattr setopt - shutdown write))) + (netlink_kobject_uevent_socket (append bind connect create + getattr getopt ioctl + read setattr setopt + shutdown write))) (classpermissionset create_netlink_netfilter_socket - (netlink_netfilter_socket (append bind connect create - getattr getopt ioctl read - setattr setopt shutdown - write))) + (netlink_netfilter_socket (append bind connect create + getattr getopt ioctl read + setattr setopt shutdown + write))) (classpermissionset create_netlink_nflog_socket - (netlink_nflog_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_nflog_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_rdma_socket - (netlink_rdma_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_rdma_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_route_socket - (netlink_route_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_route_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_scsitransport_socket - (netlink_scsitransport_socket (append bind connect create - getattr getopt ioctl - read setattr setopt - shutdown write))) + (netlink_scsitransport_socket (append bind connect create + getattr getopt ioctl + read setattr setopt + shutdown write))) (classpermissionset create_netlink_selinux_socket - (netlink_selinux_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_selinux_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_socket - (netlink_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (netlink_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_netlink_tcpdiag_socket - (netlink_tcpdiag_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_tcpdiag_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netlink_xfrm_socket - (netlink_xfrm_socket (append bind connect create getattr - getopt ioctl read setattr - setopt shutdown write))) + (netlink_xfrm_socket (append bind connect create getattr + getopt ioctl read setattr + setopt shutdown write))) (classpermissionset create_netrom_socket - (netrom_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (netrom_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_nfc_socket - (nfc_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (nfc_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_packet_socket - (packet_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (packet_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_phonet_socket - (phonet_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (phonet_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_pppox_socket - (pppox_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (pppox_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_qipcrtr_socket - (qipcrtr_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (qipcrtr_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_rawip_socket - (rawip_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (rawip_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_rds_socket - (rds_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (rds_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_rose_socket - (rose_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (rose_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_rxrpc_socket - (rxrpc_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (rxrpc_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_sctp_socket - (sctp_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (sctp_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_sctp_stream_socket - (sctp_socket (accept append bind connect create getattr - getopt ioctl listen read setattr setopt - shutdown write))) + (sctp_socket (accept append bind connect create getattr + getopt ioctl listen read setattr setopt + shutdown write))) (classpermissionset create_smc_socket - (smc_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (smc_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_socket - (socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_tcp_socket - (tcp_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (tcp_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_tcp_stream_socket - (tcp_socket (accept append bind connect create getattr - getopt ioctl listen read setattr setopt - shutdown write))) + (tcp_socket (accept append bind connect create getattr + getopt ioctl listen read setattr setopt + shutdown write))) (classpermissionset create_tipc_socket - (tipc_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (tipc_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_tun_socket - (tun_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (tun_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_udp_socket - (udp_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (udp_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_unix_dgram_socket - (unix_dgram_socket (append bind connect create getattr - getopt ioctl read setattr setopt - shutdown write))) + (unix_dgram_socket (append bind connect create getattr + getopt ioctl read setattr setopt + shutdown write))) (classpermissionset create_unix_stream_socket - (unix_stream_socket (append bind connect create getattr - getopt ioctl read setattr setopt - shutdown write))) + (unix_stream_socket (append bind connect create getattr + getopt ioctl read setattr setopt + shutdown write))) (classpermissionset create_unix_stream_stream_socket - (unix_stream_socket (accept append bind connect create - getattr getopt ioctl listen read - setattr setopt shutdown write))) + (unix_stream_socket (accept append bind connect create + getattr getopt ioctl listen read + setattr setopt shutdown write))) (classpermissionset create_vsock_socket - (vsock_socket (append bind connect create getattr getopt - ioctl read setattr setopt shutdown - write))) + (vsock_socket (append bind connect create getattr getopt + ioctl read setattr setopt shutdown + write))) (classpermissionset create_vsock_stream_socket - (vsock_socket (accept append bind connect create getattr - getopt ioctl listen read setattr - setopt shutdown write))) + (vsock_socket (accept append bind connect create getattr + getopt ioctl listen read setattr + setopt shutdown write))) (classpermissionset create_x25_socket - (x25_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (x25_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset create_xdp_socket - (xdp_socket (append bind connect create getattr getopt ioctl - read setattr setopt shutdown write))) + (xdp_socket (append bind connect create getattr getopt ioctl + read setattr setopt shutdown write))) (classpermissionset readwrite_alg_socket - (alg_socket (append bind connect getattr getopt ioctl read - setopt shutdown write))) + (alg_socket (append bind connect getattr getopt ioctl read + setopt shutdown write))) (classpermissionset readwrite_bluetooth_socket - (bluetooth_socket (append bind connect getattr getopt ioctl - read setopt shutdown write))) + (bluetooth_socket (append bind connect getattr getopt ioctl + read setopt shutdown write))) (classpermissionset readwrite_dccp_socket - (dccp_socket (append bind connect getattr getopt ioctl read - setopt shutdown write))) + (dccp_socket (append bind connect getattr getopt ioctl read + setopt shutdown write))) (classpermissionset readwrite_netlink_audit_socket - (netlink_audit_socket (append bind connect getattr getopt - ioctl read setopt shutdown - write))) + (netlink_audit_socket (append bind connect getattr getopt + ioctl read setopt shutdown + write))) (classpermissionset readwrite_sctp_socket - (sctp_socket (append bind connect getattr getopt ioctl read - setopt shutdown write))) + (sctp_socket (append bind connect getattr getopt ioctl read + setopt shutdown write))) (classpermissionset readwrite_tcp_socket - (tcp_socket (append bind connect getattr getopt ioctl read - setopt shutdown write))) + (tcp_socket (append bind connect getattr getopt ioctl read + setopt shutdown write))) (classpermissionset readwrite_tun_socket - (tun_socket (append bind connect getattr getopt ioctl read - setopt shutdown write))) + (tun_socket (append bind connect getattr getopt ioctl read + setopt shutdown write))) (classpermissionset readwrite_unix_dgram_socket - (unix_dgram_socket (append bind connect getattr getopt ioctl - read setopt shutdown write))) + (unix_dgram_socket (append bind connect getattr getopt ioctl + read setopt shutdown write))) (classpermissionset readwrite_unix_stream_socket - (unix_stream_socket (append bind connect getattr getopt - ioctl read setopt shutdown - write))) + (unix_stream_socket (append bind connect getattr getopt + ioctl read setopt shutdown + write))) (classpermissionset readwrite_vsock_socket - (vsock_socket (append bind connect getattr getopt ioctl - read setopt shutdown write))) + (vsock_socket (append bind connect getattr getopt ioctl + read setopt shutdown write))) (classpermissionset write_alg_socket - (alg_socket (append bind connect getattr getopt ioctl setopt - shutdown write))) + (alg_socket (append bind connect getattr getopt ioctl setopt + shutdown write))) (classpermissionset write_bluetooth_socket - (bluetooth_socket (append bind connect getattr getopt ioctl - setopt shutdown write))) + (bluetooth_socket (append bind connect getattr getopt ioctl + setopt shutdown write))) (classpermissionset write_dccp_socket - (dccp_socket (append bind connect getattr getopt ioctl - setopt shutdown write))) + (dccp_socket (append bind connect getattr getopt ioctl + setopt shutdown write))) (classpermissionset write_sctp_socket - (sctp_socket (append bind connect getattr getopt ioctl - setopt shutdown write))) + (sctp_socket (append bind connect getattr getopt ioctl + setopt shutdown write))) (classpermissionset write_tcp_socket - (tcp_socket (append bind connect getattr getopt ioctl setopt - shutdown write))) + (tcp_socket (append bind connect getattr getopt ioctl setopt + shutdown write))) (classpermissionset write_tun_socket - (tun_socket (append bind connect getattr getopt ioctl setopt - shutdown write))) + (tun_socket (append bind connect getattr getopt ioctl setopt + shutdown write))) (classpermissionset write_unix_dgram_socket - (unix_dgram_socket (append bind connect getattr getopt ioctl - setopt shutdown write))) + (unix_dgram_socket (append bind connect getattr getopt ioctl + setopt shutdown write))) (classpermissionset write_unix_stream_socket - (unix_stream_socket (append bind connect getattr getopt - ioctl setopt shutdown write))) + (unix_stream_socket (append bind connect getattr getopt + ioctl setopt shutdown write))) (classpermissionset write_vsock_socket - (vsock_socket (append bind connect getattr getopt ioctl - setopt shutdown write))) + (vsock_socket (append bind connect getattr getopt ioctl + setopt shutdown write))) (classmap constrainsocketobject (nameconnect nodebind)) (classmap constrainsocketsubject - (append association attachqueue connectto create getattr read - relabelto sendto setattr write)) + (append association attachqueue connectto create getattr read + relabelto sendto setattr write)) (classmap sockets (common getattr)) @@ -691,17 +691,17 @@ (classmapping constrainsocketsubject append (netlink_crypto_socket (append))) (classmapping constrainsocketsubject append (netlink_dnrt_socket (append))) (classmapping constrainsocketsubject append - (netlink_fib_lookup_socket (append))) + (netlink_fib_lookup_socket (append))) (classmapping constrainsocketsubject append (netlink_generic_socket (append))) (classmapping constrainsocketsubject append (netlink_iscsi_socket (append))) (classmapping constrainsocketsubject append - (netlink_kobject_uevent_socket (append))) + (netlink_kobject_uevent_socket (append))) (classmapping constrainsocketsubject append (netlink_netfilter_socket (append))) (classmapping constrainsocketsubject append (netlink_nflog_socket (append))) (classmapping constrainsocketsubject append (netlink_rdma_socket (append))) (classmapping constrainsocketsubject append (netlink_route_socket (append))) (classmapping constrainsocketsubject append - (netlink_scsitransport_socket (append))) + (netlink_scsitransport_socket (append))) (classmapping constrainsocketsubject append (netlink_selinux_socket (append))) (classmapping constrainsocketsubject append (netlink_socket (append))) (classmapping constrainsocketsubject append (netlink_tcpdiag_socket (append))) @@ -730,13 +730,13 @@ (classmapping constrainsocketsubject append (xdp_socket (append))) (classmapping constrainsocketsubject - association (sctp_socket (association))) + association (sctp_socket (association))) (classmapping constrainsocketsubject - attachqueue (tun_socket (attach_queue))) + attachqueue (tun_socket (attach_queue))) (classmapping constrainsocketsubject - connectto (unix_stream_socket (connectto))) + connectto (unix_stream_socket (connectto))) (classmapping constrainsocketsubject create (alg_socket (create))) (classmapping constrainsocketsubject create (appletalk_socket (create))) @@ -763,17 +763,17 @@ (classmapping constrainsocketsubject create (netlink_crypto_socket (create))) (classmapping constrainsocketsubject create (netlink_dnrt_socket (create))) (classmapping constrainsocketsubject create - (netlink_fib_lookup_socket (create))) + (netlink_fib_lookup_socket (create))) (classmapping constrainsocketsubject create (netlink_generic_socket (create))) (classmapping constrainsocketsubject create (netlink_iscsi_socket (create))) (classmapping constrainsocketsubject create - (netlink_kobject_uevent_socket (create))) + (netlink_kobject_uevent_socket (create))) (classmapping constrainsocketsubject create (netlink_netfilter_socket (create))) (classmapping constrainsocketsubject create (netlink_nflog_socket (create))) (classmapping constrainsocketsubject create (netlink_rdma_socket (create))) (classmapping constrainsocketsubject create (netlink_route_socket (create))) (classmapping constrainsocketsubject create - (netlink_scsitransport_socket (create))) + (netlink_scsitransport_socket (create))) (classmapping constrainsocketsubject create (netlink_selinux_socket (create))) (classmapping constrainsocketsubject create (netlink_socket (create))) (classmapping constrainsocketsubject create (netlink_tcpdiag_socket (create))) @@ -823,22 +823,22 @@ (classmapping constrainsocketsubject getattr (mctp_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_audit_socket (getattr))) (classmapping constrainsocketsubject getattr - (netlink_connector_socket (getattr))) + (netlink_connector_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_crypto_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_dnrt_socket (getattr))) (classmapping constrainsocketsubject getattr - (netlink_fib_lookup_socket (getattr))) + (netlink_fib_lookup_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_generic_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_iscsi_socket (getattr))) (classmapping constrainsocketsubject getattr - (netlink_kobject_uevent_socket (getattr))) + (netlink_kobject_uevent_socket (getattr))) (classmapping constrainsocketsubject getattr - (netlink_netfilter_socket (getattr))) + (netlink_netfilter_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_nflog_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_rdma_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_route_socket (getattr))) (classmapping constrainsocketsubject getattr - (netlink_scsitransport_socket (getattr))) + (netlink_scsitransport_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_selinux_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_socket (getattr))) (classmapping constrainsocketsubject getattr (netlink_tcpdiag_socket (getattr))) @@ -895,7 +895,7 @@ (classmapping constrainsocketsubject read (netlink_generic_socket (read))) (classmapping constrainsocketsubject read (netlink_iscsi_socket (read))) (classmapping constrainsocketsubject read - (netlink_kobject_uevent_socket (read))) + (netlink_kobject_uevent_socket (read))) (classmapping constrainsocketsubject read (netlink_netfilter_socket (read))) (classmapping constrainsocketsubject read (netlink_nflog_socket (read))) (classmapping constrainsocketsubject read (netlink_rdma_socket (read))) @@ -949,38 +949,38 @@ (classmapping constrainsocketsubject relabelto (llc_socket (relabelto))) (classmapping constrainsocketsubject relabelto (mctp_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_audit_socket (relabelto))) + (netlink_audit_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_connector_socket (relabelto))) + (netlink_connector_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_crypto_socket (relabelto))) + (netlink_crypto_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_dnrt_socket (relabelto))) + (netlink_dnrt_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_fib_lookup_socket (relabelto))) + (netlink_fib_lookup_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_generic_socket (relabelto))) + (netlink_generic_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_iscsi_socket (relabelto))) + (netlink_iscsi_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_kobject_uevent_socket (relabelto))) + (netlink_kobject_uevent_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_netfilter_socket (relabelto))) + (netlink_netfilter_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_nflog_socket (relabelto))) + (netlink_nflog_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_rdma_socket (relabelto))) + (netlink_rdma_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_route_socket (relabelto))) + (netlink_route_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_scsitransport_socket (relabelto))) + (netlink_scsitransport_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_selinux_socket (relabelto))) + (netlink_selinux_socket (relabelto))) (classmapping constrainsocketsubject relabelto (netlink_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_tcpdiag_socket (relabelto))) + (netlink_tcpdiag_socket (relabelto))) (classmapping constrainsocketsubject relabelto - (netlink_xfrm_socket (relabelto))) + (netlink_xfrm_socket (relabelto))) (classmapping constrainsocketsubject relabelto (netrom_socket (relabelto))) (classmapping constrainsocketsubject relabelto (nfc_socket (relabelto))) (classmapping constrainsocketsubject relabelto (packet_socket (relabelto))) @@ -1028,22 +1028,22 @@ (classmapping constrainsocketsubject setattr (mctp_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_audit_socket (setattr))) (classmapping constrainsocketsubject setattr - (netlink_connector_socket (setattr))) + (netlink_connector_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_crypto_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_dnrt_socket (setattr))) (classmapping constrainsocketsubject setattr - (netlink_fib_lookup_socket (setattr))) + (netlink_fib_lookup_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_generic_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_iscsi_socket (setattr))) (classmapping constrainsocketsubject setattr - (netlink_kobject_uevent_socket (setattr))) + (netlink_kobject_uevent_socket (setattr))) (classmapping constrainsocketsubject setattr - (netlink_netfilter_socket (setattr))) + (netlink_netfilter_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_nflog_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_rdma_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_route_socket (setattr))) (classmapping constrainsocketsubject setattr - (netlink_scsitransport_socket (setattr))) + (netlink_scsitransport_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_selinux_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_socket (setattr))) (classmapping constrainsocketsubject setattr (netlink_tcpdiag_socket (setattr))) @@ -1099,13 +1099,13 @@ (classmapping constrainsocketsubject write (netlink_generic_socket (write))) (classmapping constrainsocketsubject write (netlink_iscsi_socket (write))) (classmapping constrainsocketsubject write - (netlink_kobject_uevent_socket (write))) + (netlink_kobject_uevent_socket (write))) (classmapping constrainsocketsubject write (netlink_netfilter_socket (write))) (classmapping constrainsocketsubject write (netlink_nflog_socket (write))) (classmapping constrainsocketsubject write (netlink_rdma_socket (write))) (classmapping constrainsocketsubject write (netlink_route_socket (write))) (classmapping constrainsocketsubject write - (netlink_scsitransport_socket (write))) + (netlink_scsitransport_socket (write))) (classmapping constrainsocketsubject write (netlink_selinux_socket (write))) (classmapping constrainsocketsubject write (netlink_socket (write))) (classmapping constrainsocketsubject write (netlink_tcpdiag_socket (write))) @@ -1134,207 +1134,207 @@ (classmapping constrainsocketsubject write (xdp_socket (write))) (classmapping sockets common - (alg_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (alg_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (appletalk_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (appletalk_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (atmpvc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (atmpvc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (atmsvc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (atmsvc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (ax25_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (ax25_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (bluetooth_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (bluetooth_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (caif_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (caif_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (can_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (can_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (dccp_socket (not (accept listen map name_connect name_bind - node_bind relabelfrom relabelto recvfrom - sendto)))) + (dccp_socket (not (accept listen map name_connect name_bind + node_bind relabelfrom relabelto recvfrom + sendto)))) (classmapping sockets common - (decnet_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (decnet_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (icmp_socket (not (accept listen map name_bind node_bind - relabelfrom relabelto recvfrom - sendto)))) + (icmp_socket (not (accept listen map name_bind node_bind + relabelfrom relabelto recvfrom + sendto)))) (classmapping sockets common - (ieee802154_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (ieee802154_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (ipx_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (ipx_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (irda_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (irda_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (isdn_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (isdn_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (iucv_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (iucv_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (kcm_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (kcm_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (key_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (key_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (llc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (llc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (mctp_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (mctp_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (netlink_audit_socket (not (accept listen map name_bind nlmsg_read - nlmsg_readpriv nlmsg_relay - nlmsg_tty_audit nlmsg_write - relabelfrom relabelto recvfrom - sendto)))) + (netlink_audit_socket (not (accept listen map name_bind nlmsg_read + nlmsg_readpriv nlmsg_relay + nlmsg_tty_audit nlmsg_write + relabelfrom relabelto recvfrom + sendto)))) (classmapping sockets common - (netlink_connector_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_connector_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_crypto_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_crypto_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_dnrt_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_dnrt_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_fib_lookup_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_fib_lookup_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_generic_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_generic_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_iscsi_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_iscsi_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_kobject_uevent_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_kobject_uevent_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_netfilter_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_netfilter_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_nflog_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_nflog_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_rdma_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_rdma_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_route_socket (not (accept listen map name_bind nlmsg_read - nlmsg_write relabelfrom - relabelto recvfrom sendto)))) + (netlink_route_socket (not (accept listen map name_bind nlmsg_read + nlmsg_write relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (netlink_scsitransport_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_scsitransport_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_selinux_socket (not (accept listen map name_bind - relabelfrom relabelto - recvfrom sendto)))) + (netlink_selinux_socket (not (accept listen map name_bind + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (netlink_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (netlink_tcpdiag_socket (not (accept listen map name_bind - nlmsg_read nlmsg_write - relabelfrom relabelto - recvfrom sendto)))) + (netlink_tcpdiag_socket (not (accept listen map name_bind + nlmsg_read nlmsg_write + relabelfrom relabelto + recvfrom sendto)))) (classmapping sockets common - (netlink_xfrm_socket (not (accept listen map name_bind nlmsg_read - nlmsg_write relabelfrom - relabelto recvfrom sendto)))) + (netlink_xfrm_socket (not (accept listen map name_bind nlmsg_read + nlmsg_write relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (netrom_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (netrom_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (nfc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (nfc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (packet_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (packet_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (phonet_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (phonet_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (pppox_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (pppox_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (qipcrtr_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (qipcrtr_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (rawip_socket (not (accept listen map name_bind node_bind - relabelfrom relabelto recvfrom - sendto)))) + (rawip_socket (not (accept listen map name_bind node_bind + relabelfrom relabelto recvfrom + sendto)))) (classmapping sockets common - (rds_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (rds_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (rose_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (rose_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (rxrpc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (rxrpc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (sctp_socket (not (accept association listen map name_connect - name_bind node_bind relabelfrom - relabelto recvfrom sendto)))) + (sctp_socket (not (accept association listen map name_connect + name_bind node_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (smc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (smc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (tcp_socket (not (accept listen map name_connect name_bind - node_bind relabelfrom relabelto recvfrom - sendto)))) + (tcp_socket (not (accept listen map name_connect name_bind + node_bind relabelfrom relabelto recvfrom + sendto)))) (classmapping sockets common - (tipc_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (tipc_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (tun_socket (not (accept attach_queue listen map name_bind - relabelfrom relabelto recvfrom sendto)))) + (tun_socket (not (accept attach_queue listen map name_bind + relabelfrom relabelto recvfrom sendto)))) (classmapping sockets common - (udp_socket (not (accept listen map name_bind node_bind - relabelfrom relabelto recvfrom sendto)))) + (udp_socket (not (accept listen map name_bind node_bind + relabelfrom relabelto recvfrom sendto)))) (classmapping sockets common - (unix_dgram_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (unix_dgram_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (unix_stream_socket (not (accept connectto listen map name_bind - relabelfrom relabelto recvfrom - sendto)))) + (unix_stream_socket (not (accept connectto listen map name_bind + relabelfrom relabelto recvfrom + sendto)))) (classmapping sockets common - (vsock_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (vsock_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (x25_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (x25_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets common - (xdp_socket (not (accept listen map name_bind relabelfrom - relabelto recvfrom sendto)))) + (xdp_socket (not (accept listen map name_bind relabelfrom + relabelto recvfrom sendto)))) (classmapping sockets getattr (ax25_socket (getattr))) (classmapping sockets getattr (alg_socket (getattr))) @@ -1397,81 +1397,81 @@ (classmapping sockets getattr (xdp_socket (getattr))) (macro association_invalid_sctp_sockets ((type ARG1)) - (allow ARG1 invalid (sctp_socket (association)))) + (allow ARG1 invalid (sctp_socket (association)))) (macro connectto_invalid_unix_stream_sockets ((type ARG1)) - (allow ARG1 invalid (unix_stream_socket (connectto)))) + (allow ARG1 invalid (unix_stream_socket (connectto)))) (macro getattr_invalid_sockets ((type ARG1)) - (allow ARG1 invalid (sockets (getattr)))) + (allow ARG1 invalid (sockets (getattr)))) (macro namebind_invalid_dccp_sockets ((type ARG1)) - (allow ARG1 invalid (dccp_socket (name_bind)))) + (allow ARG1 invalid (dccp_socket (name_bind)))) (macro namebind_invalid_icmp_sockets ((type ARG1)) - (allow ARG1 invalid (icmp_socket (name_bind)))) + (allow ARG1 invalid (icmp_socket (name_bind)))) (macro namebind_invalid_rawip_sockets ((type ARG1)) - (allow ARG1 invalid (rawip_socket (name_bind)))) + (allow ARG1 invalid (rawip_socket (name_bind)))) (macro namebind_invalid_sctp_sockets ((type ARG1)) - (allow ARG1 invalid (sctp_socket (name_bind)))) + (allow ARG1 invalid (sctp_socket (name_bind)))) (macro namebind_invalid_tcp_sockets ((type ARG1)) - (allow ARG1 invalid (tcp_socket (name_bind)))) + (allow ARG1 invalid (tcp_socket (name_bind)))) (macro namebind_invalid_udp_sockets ((type ARG1)) - (allow ARG1 invalid (udp_socket (name_bind)))) + (allow ARG1 invalid (udp_socket (name_bind)))) (macro nameconnect_invalid_dccp_sockets ((type ARG1)) - (allow ARG1 invalid (dccp_socket (name_connect)))) + (allow ARG1 invalid (dccp_socket (name_connect)))) (macro nameconnect_invalid_sctp_sockets ((type ARG1)) - (allow ARG1 invalid (sctp_socket (name_connect)))) + (allow ARG1 invalid (sctp_socket (name_connect)))) (macro nameconnect_invalid_tcp_sockets ((type ARG1)) - (allow ARG1 invalid (tcp_socket (name_connect)))) + (allow ARG1 invalid (tcp_socket (name_connect)))) (macro nodebind_invalid_dccp_sockets ((type ARG1)) - (allow ARG1 invalid (dccp_socket (node_bind)))) + (allow ARG1 invalid (dccp_socket (node_bind)))) (macro nodebind_invalid_icmp_sockets ((type ARG1)) - (allow ARG1 invalid (icmp_socket (node_bind)))) + (allow ARG1 invalid (icmp_socket (node_bind)))) (macro nodebind_invalid_rawip_sockets ((type ARG1)) - (allow ARG1 invalid (rawip_socket (node_bind)))) + (allow ARG1 invalid (rawip_socket (node_bind)))) (macro nodebind_invalid_sctp_sockets ((type ARG1)) - (allow ARG1 invalid (sctp_socket (node_bind)))) + (allow ARG1 invalid (sctp_socket (node_bind)))) (macro nodebind_invalid_tcp_sockets ((type ARG1)) - (allow ARG1 invalid (tcp_socket (node_bind)))) + (allow ARG1 invalid (tcp_socket (node_bind)))) (macro nodebind_invalid_udp_sockets ((type ARG1)) - (allow ARG1 invalid (udp_socket (node_bind)))) + (allow ARG1 invalid (udp_socket (node_bind)))) (macro readwrite_invalid_unix_dgram_sockets ((type ARG1)) - (allow ARG1 invalid readwrite_unix_dgram_socket)) + (allow ARG1 invalid readwrite_unix_dgram_socket)) (macro readwrite_invalid_unix_stream_sockets ((type ARG1)) - (allow ARG1 invalid readwrite_unix_stream_socket)) + (allow ARG1 invalid readwrite_unix_stream_socket)) (macro sendto_invalid_unix_dgram_sockets ((type ARG1)) - (allow ARG1 invalid (unix_dgram_socket (sendto)))) + (allow ARG1 invalid (unix_dgram_socket (sendto)))) (macro write_invalid_unix_dgram_sockets ((type ARG1)) - (allow ARG1 invalid write_unix_dgram_socket)) + (allow ARG1 invalid write_unix_dgram_socket)) (macro write_invalid_unix_stream_sockets ((type ARG1)) - (allow ARG1 invalid write_unix_stream_socket)) + (allow ARG1 invalid write_unix_stream_socket)) (in ibac (constrain (constrainsocketsubject (create relabelto)) - (or (or (or (eq u1 u2) - (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) - (eq t1 subjchange.typeattr)) - (eq t1 exempt.typeattr)))) + (or (or (or (eq u1 u2) + (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) (in invalid.unconfined @@ -1479,15 +1479,15 @@ (allow typeattr .invalid (alg_socket (accept listen))) (allow typeattr .invalid (bluetooth_socket (accept listen))) (allow typeattr .invalid - (dccp_socket (accept listen name_bind name_connect node_bind))) + (dccp_socket (accept listen name_bind name_connect node_bind))) (allow typeattr .invalid (icmp_socket (name_bind node_bind))) (allow typeattr .invalid (rawip_socket (name_bind node_bind))) (allow typeattr .invalid - (sctp_socket (association accept listen name_bind name_connect - node_bind))) + (sctp_socket (association accept listen name_bind name_connect + node_bind))) (allow typeattr .invalid (udp_socket (name_bind node_bind))) (allow typeattr .invalid - (tcp_socket (accept listen name_bind name_connect node_bind))) + (tcp_socket (accept listen name_bind name_connect node_bind))) (allow typeattr .invalid (tun_socket (attach_queue))) (allow typeattr .invalid (unix_dgram_socket (sendto))) (allow typeattr .invalid (unix_stream_socket (accept connectto listen))) @@ -1496,92 +1496,92 @@ (in mcs (mlsconstrain (constrainsocketobject (nameconnect nodebind)) - (or (dom h1 h2) - (neq t1 constrained.typeattr))) + (or (dom h1 h2) + (neq t1 constrained.typeattr))) (mlsconstrain - (constrainsocketsubject (append association attachqueue connectto create - getattr read relabelto sendto setattr - write)) - (or (dom h1 h2) - (neq t1 constrained.typeattr)))) + (constrainsocketsubject (append association attachqueue connectto create + getattr read relabelto sendto setattr + write)) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) (in rbac (constrain (constrainsocketsubject (create relabelto)) - (or (or (or (eq r1 r2) - (and (eq t1 subjchangesys.typeattr) - (eq r2 .sys.role))) - (eq t1 subjchange.typeattr)) - (eq t1 exempt.typeattr)))) + (or (or (or (eq r1 r2) + (and (eq t1 subjchangesys.typeattr) + (eq r2 .sys.role))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) (in rbacsep (constrain (constrainsocketsubject (append getattr read setattr write)) - (or (or (or (eq r1 r2) - (and (eq r1 exempt.roleattr) - (neq t1 constrained.typeattr))) - (eq t1 exempt.subj.typeattr)) - (and (eq t1 exemptsource.typeattr) - (eq t2 exempttarget.typeattr))))) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) (in subj.all_macro_template (macro association_all_sctp_sockets ((type ARG1)) - (allow ARG1 typeattr (sctp_socket (association)))) + (allow ARG1 typeattr (sctp_socket (association)))) (macro connectto_all_unix_stream_sockets ((type ARG1)) - (allow ARG1 typeattr (unix_stream_socket (connectto)))) + (allow ARG1 typeattr (unix_stream_socket (connectto)))) (macro getattr_all_sockets ((type ARG1)) - (allow ARG1 typeattr (sockets (getattr)))) + (allow ARG1 typeattr (sockets (getattr)))) (macro readwrite_all_unix_dgram_sockets ((type ARG1)) - (allow ARG1 typeattr readwrite_unix_dgram_socket)) + (allow ARG1 typeattr readwrite_unix_dgram_socket)) (macro readwrite_all_unix_stream_sockets ((type ARG1)) - (allow ARG1 typeattr readwrite_unix_stream_socket)) + (allow ARG1 typeattr readwrite_unix_stream_socket)) (macro sendto_all_unix_dgram_sockets ((type ARG1)) - (allow ARG1 typeattr (unix_dgram_socket (sendto)))) + (allow ARG1 typeattr (unix_dgram_socket (sendto)))) (macro write_all_unix_dgram_sockets ((type ARG1)) - (allow ARG1 typeattr write_unix_dgram_socket)) + (allow ARG1 typeattr write_unix_dgram_socket)) (macro write_all_unix_stream_sockets ((type ARG1)) - (allow ARG1 typeattr write_unix_stream_socket))) + (allow ARG1 typeattr write_unix_stream_socket))) (in subj.macro_template (macro association_subj_sctp_sockets ((type ARG1)) - (allow ARG1 subj (sctp_socket (association)))) + (allow ARG1 subj (sctp_socket (association)))) (macro connectto_subj_unix_stream_sockets ((type ARG1)) - (allow ARG1 subj (unix_stream_socket (connectto)))) + (allow ARG1 subj (unix_stream_socket (connectto)))) (macro getattr_subj_sockets ((type ARG1)) - (allow ARG1 subj (sockets (getattr)))) + (allow ARG1 subj (sockets (getattr)))) (macro readwrite_subj_unix_dgram_sockets ((type ARG1)) - (allow ARG1 subj readwrite_unix_dgram_socket)) + (allow ARG1 subj readwrite_unix_dgram_socket)) (macro readwrite_subj_unix_stream_sockets ((type ARG1)) - (allow ARG1 subj readwrite_unix_stream_socket)) + (allow ARG1 subj readwrite_unix_stream_socket)) (macro sendto_subj_unix_dgram_sockets ((type ARG1)) - (allow ARG1 subj (unix_dgram_socket (sendto)))) + (allow ARG1 subj (unix_dgram_socket (sendto)))) (macro write_subj_unix_dgram_sockets ((type ARG1)) - (allow ARG1 subj write_unix_dgram_socket)) + (allow ARG1 subj write_unix_dgram_socket)) (macro write_subj_unix_stream_sockets ((type ARG1)) - (allow ARG1 subj write_unix_stream_socket))) + (allow ARG1 subj write_unix_stream_socket))) (in subj.unconfined (allow typeattr self - (netlink_audit_socket (nlmsg_read nlmsg_readpriv nlmsg_relay - nlmsg_tty_audit nlmsg_write))) + (netlink_audit_socket (nlmsg_read nlmsg_readpriv nlmsg_relay + nlmsg_tty_audit nlmsg_write))) (allow typeattr self (netlink_route_socket (nlmsg_read nlmsg_write))) (allow typeattr self (netlink_tcpdiag_socket (nlmsg_read nlmsg_write))) (allow typeattr self (netlink_xfrm_socket (nlmsg_read nlmsg_write))) @@ -1597,5 +1597,5 @@ (allow typeattr subj.typeattr (tun_socket (attach_queue relabelfrom))) (allow typeattr subj.typeattr (unix_dgram_socket (sendto))) (allow typeattr subj.typeattr - (unix_stream_socket (accept connectto listen))) + (unix_stream_socket (accept connectto listen))) (allow typeattr subj.typeattr (vsock_socket (accept listen)))) diff --git a/src/misc/av/systemav.cil b/src/misc/av/systemav.cil index be9cb11..61d8f8a 100644 --- a/src/misc/av/systemav.cil +++ b/src/misc/av/systemav.cil @@ -1,59 +1,59 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class system - (halt ipc_info module_load module_request reboot reload start status - stop syslog_console syslog_mod syslog_read)) + (halt ipc_info module_load module_request reboot reload start status + stop syslog_console syslog_mod syslog_read)) (classorder (unordered system)) (in sys (macro ipcinfo_system ((type ARG1)) - (allow ARG1 subj (system (ipc_info)))) + (allow ARG1 subj (system (ipc_info)))) (macro modulerequest_system ((type ARG1)) - (allow ARG1 subj (system (module_request)))) + (allow ARG1 subj (system (module_request)))) (macro syslogconsole_system ((type ARG1)) - (allow ARG1 subj (system (syslog_console)))) + (allow ARG1 subj (system (syslog_console)))) (macro syslogmod_system ((type ARG1)) - (allow ARG1 subj (system (syslog_mod)))) + (allow ARG1 subj (system (syslog_mod)))) (macro syslogread_system ((type ARG1)) - (allow ARG1 subj (system (syslog_read)))) + (allow ARG1 subj (system (syslog_read)))) (block moduleload - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute not_typeattr) - (typeattribute typeattr) + (typeattribute not_typeattr) + (typeattribute typeattr) - (typeattributeset not_typeattr (not typeattr)) + (typeattributeset not_typeattr (not typeattr)) - (neverallow not_typeattr self (system (module_load)))) + (neverallow not_typeattr self (system (module_load)))) (block unconfined - (macro type ((type ARG1)) - (typeattributeset typeattr ARG1)) + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) - (typeattribute typeattr) + (typeattribute typeattr) - (allow typeattr self (system (module_load))) - (allow typeattr subj - (system (ipc_info module_request syslog_console syslog_mod - syslog_read))) + (allow typeattr self (system (module_load))) + (allow typeattr subj + (system (ipc_info module_request syslog_console syslog_mod + syslog_read))) - ;; potentially happens in autorelabel.target on policy model change - (allow typeattr .invalid (system (module_load))) + ;; potentially happens in autorelabel.target on policy model change + (allow typeattr .invalid (system (module_load))) - ;; potentially happens in autorelabel.target on fresh install - (allow typeattr .unlabeled (system (module_load))) + ;; potentially happens in autorelabel.target on fresh install + (allow typeattr .unlabeled (system (module_load))) - (call moduleload.type (typeattr)))) + (call moduleload.type (typeattr)))) (in unconfined diff --git a/src/misc/av/usernamespaceav.cil b/src/misc/av/usernamespaceav.cil index fe73e30..f5012f5 100644 --- a/src/misc/av/usernamespaceav.cil +++ b/src/misc/av/usernamespaceav.cil @@ -1,4 +1,4 @@ -;; SPDX-FileCopyrightText: © 2025 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-FileCopyrightText: M-BM-) 2025 Dominick Grift <dominick.grift@defensec.nl> ;; SPDX-License-Identifier: Unlicense (class user_namespace (create)) |