lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[SELinux]: Add support for DCCP

Browse Source 
This patch implements SELinux kernel support for DCCP
(http://linux-net.osdl.org/index.php/DCCP), which is similar in
operation to TCP in terms of connected state between peers.

The SELinux support for DCCP is thus modeled on existing handling of
TCP.

A new DCCP socket class is introduced, to allow protocol
differentation.  The permissions for this class inherit all of the
socket permissions, as well as the current TCP permissions (node_bind,
name_bind etc). IPv4 and IPv6 are supported, although labeled
networking is not, at this stage.

Patches for SELinux userspace are at:
http://people.redhat.com/jmorris/selinux/dccp/user/

I've performed some basic testing, and it seems to be working as
expected.  Adding policy support is similar to TCP, the only real
difference being that it's a different protocol.

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
James Morris
2006-11-13 16:09:01 -08:00
committed by David S. Miller
parent 90833aa4f4
commit 2ee92d46c6
6 changed files with 103 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
security/selinux/include/av_permissions.h
View File

@@ -312,6 +312,8 @@
#define NODE__RAWIP_RECV 0x00000010UL
#define NODE__RAWIP_SEND 0x00000020UL
#define NODE__ENFORCE_DEST 0x00000040UL
#define NODE__DCCP_RECV 0x00000080UL
#define NODE__DCCP_SEND 0x00000100UL
#define NETIF__TCP_RECV 0x00000001UL
#define NETIF__TCP_SEND 0x00000002UL
@@ -319,6 +321,8 @@
#define NETIF__UDP_SEND 0x00000008UL
#define NETIF__RAWIP_RECV 0x00000010UL
#define NETIF__RAWIP_SEND 0x00000020UL
#define NETIF__DCCP_RECV 0x00000040UL
#define NETIF__DCCP_SEND 0x00000080UL
#define NETLINK_SOCKET__IOCTL 0x00000001UL
#define NETLINK_SOCKET__READ 0x00000002UL
@@ -970,3 +974,31 @@
#define KEY__LINK 0x00000010UL
#define KEY__SETATTR 0x00000020UL
#define KEY__CREATE 0x00000040UL
#define CONTEXT__TRANSLATE 0x00000001UL
#define CONTEXT__CONTAINS 0x00000002UL
#define DCCP_SOCKET__IOCTL 0x00000001UL
#define DCCP_SOCKET__READ 0x00000002UL
#define DCCP_SOCKET__WRITE 0x00000004UL
#define DCCP_SOCKET__CREATE 0x00000008UL
#define DCCP_SOCKET__GETATTR 0x00000010UL
#define DCCP_SOCKET__SETATTR 0x00000020UL
#define DCCP_SOCKET__LOCK 0x00000040UL
#define DCCP_SOCKET__RELABELFROM 0x00000080UL
#define DCCP_SOCKET__RELABELTO 0x00000100UL
#define DCCP_SOCKET__APPEND 0x00000200UL
#define DCCP_SOCKET__BIND 0x00000400UL
#define DCCP_SOCKET__CONNECT 0x00000800UL
#define DCCP_SOCKET__LISTEN 0x00001000UL
#define DCCP_SOCKET__ACCEPT 0x00002000UL
#define DCCP_SOCKET__GETOPT 0x00004000UL
#define DCCP_SOCKET__SETOPT 0x00008000UL
#define DCCP_SOCKET__SHUTDOWN 0x00010000UL
#define DCCP_SOCKET__RECVFROM 0x00020000UL
#define DCCP_SOCKET__SENDTO 0x00040000UL
#define DCCP_SOCKET__RECV_MSG 0x00080000UL
#define DCCP_SOCKET__SEND_MSG 0x00100000UL
#define DCCP_SOCKET__NAME_BIND 0x00200000UL
#define DCCP_SOCKET__NODE_BIND 0x00400000UL
#define DCCP_SOCKET__NAME_CONNECT 0x00800000UL