1 |
commit: 9ae0383e041bfa3c531eb028f38a7444cf1cbfaa |
2 |
Author: Richard Haines <richard_c_haines <AT> btinternet <DOT> com> |
3 |
AuthorDate: Mon Mar 19 09:59:54 2018 +0000 |
4 |
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Mar 25 10:27:39 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9ae0383e |
7 |
|
8 |
refpolicy: Update for kernel sctp support |
9 |
|
10 |
Add additional entries to support the kernel SCTP implementation |
11 |
introduced in kernel 4.16 |
12 |
|
13 |
Signed-off-by: Richard Haines <richard_c_haines <AT> btinternet.com> |
14 |
|
15 |
policy/constraints | 1 + |
16 |
policy/flask/access_vectors | 2 + |
17 |
policy/mcs | 2 +- |
18 |
policy/mls | 18 +- |
19 |
policy/modules/kernel/corenetwork.if.in | 419 ++++++++++++++++++++++++++++++++ |
20 |
policy/modules/kernel/corenetwork.te.in | 8 +- |
21 |
policy/support/obj_perm_sets.spt | 4 +- |
22 |
7 files changed, 440 insertions(+), 14 deletions(-) |
23 |
|
24 |
diff --git a/policy/constraints b/policy/constraints |
25 |
index 90a794b3..e9e05f06 100644 |
26 |
--- a/policy/constraints |
27 |
+++ b/policy/constraints |
28 |
@@ -130,6 +130,7 @@ exempted_ubac_constraint(fd, ubacfd) |
29 |
|
30 |
exempted_ubac_constraint(socket, ubacsock) |
31 |
exempted_ubac_constraint(tcp_socket, ubacsock) |
32 |
+exempted_ubac_constraint(sctp_socket, ubacsock) |
33 |
exempted_ubac_constraint(udp_socket, ubacsock) |
34 |
exempted_ubac_constraint(rawip_socket, ubacsock) |
35 |
exempted_ubac_constraint(netlink_socket, ubacsock) |
36 |
|
37 |
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors |
38 |
index 9c9db71b..4f57fb40 100644 |
39 |
--- a/policy/flask/access_vectors |
40 |
+++ b/policy/flask/access_vectors |
41 |
@@ -985,6 +985,8 @@ class sctp_socket |
42 |
inherits socket |
43 |
{ |
44 |
node_bind |
45 |
+ name_connect |
46 |
+ association |
47 |
} |
48 |
|
49 |
class icmp_socket |
50 |
|
51 |
diff --git a/policy/mcs b/policy/mcs |
52 |
index 94319570..c0d424a9 100644 |
53 |
--- a/policy/mcs |
54 |
+++ b/policy/mcs |
55 |
@@ -120,7 +120,7 @@ mlsconstrain process { sigkill sigstop } |
56 |
mlsconstrain process { signal } |
57 |
(( h1 dom h2 ) or ( t1 != mcs_constrained_type )); |
58 |
|
59 |
-mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind |
60 |
+mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } node_bind |
61 |
(( h1 dom h2 ) or ( t1 != mcs_constrained_type )); |
62 |
|
63 |
mlsconstrain key { create link read search setattr view write } |
64 |
|
65 |
diff --git a/policy/mls b/policy/mls |
66 |
index 73ff301b..eeca15a8 100644 |
67 |
--- a/policy/mls |
68 |
+++ b/policy/mls |
69 |
@@ -166,13 +166,13 @@ mlsconstrain filesystem { mount remount unmount relabelfrom quotamod } |
70 |
# |
71 |
|
72 |
# new socket labels must be dominated by the relabeling subjects clearance |
73 |
-mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket } relabelto |
74 |
+mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket } relabelto |
75 |
( h1 dom h2 ); |
76 |
|
77 |
# the socket "read+write" ops |
78 |
# (Socket FDs are generally bidirectional, equivalent to open(..., O_RDWR), |
79 |
# require equal levels for unprivileged subjects, or read *and* write overrides) |
80 |
-mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { accept connect } |
81 |
+mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket sctp_socket } { accept connect } |
82 |
(( l1 eq l2 ) or |
83 |
(((( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or |
84 |
( t1 == mlsnetread )) and |
85 |
@@ -182,7 +182,7 @@ mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_s |
86 |
|
87 |
|
88 |
# the socket "read" ops (note the check is dominance of the low level) |
89 |
-mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket } { read getattr listen accept getopt recv_msg } |
90 |
+mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket } { read getattr listen accept getopt recv_msg } |
91 |
(( l1 dom l2 ) or |
92 |
(( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or |
93 |
( t1 == mlsnetread )); |
94 |
@@ -193,14 +193,14 @@ mlsconstrain { netlink_route_socket netlink_firewall_socket netlink_tcpdiag_sock |
95 |
( t1 == mlsnetread )); |
96 |
|
97 |
# the socket "write" ops |
98 |
-mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket } { write setattr relabelfrom connect setopt shutdown } |
99 |
+mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket sctp_socket } { write setattr relabelfrom connect setopt shutdown } |
100 |
(( l1 eq l2 ) or |
101 |
(( t1 == mlsnetwriteranged ) and ( l1 dom l2 ) and ( l1 domby h2 )) or |
102 |
(( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or |
103 |
( t1 == mlsnetwrite )); |
104 |
|
105 |
# used by netlabel to restrict normal domains to same level connections |
106 |
-mlsconstrain { tcp_socket udp_socket rawip_socket } recvfrom |
107 |
+mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } recvfrom |
108 |
(( l1 eq l2 ) or |
109 |
(( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or |
110 |
( t1 == mlsnetread )); |
111 |
@@ -223,13 +223,13 @@ mlsconstrain unix_dgram_socket sendto |
112 |
( t2 == mlstrustedsocket )); |
113 |
|
114 |
# these access vectors have no MLS restrictions |
115 |
-# { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { ioctl create lock append bind sendto send_msg name_bind } |
116 |
+# { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket sctp_socket } { ioctl create lock append bind sendto send_msg name_bind } |
117 |
# |
118 |
-# { tcp_socket udp_socket rawip_socket } node_bind |
119 |
+# { tcp_socket udp_socket rawip_socket sctp_socket } node_bind |
120 |
# |
121 |
-# { tcp_socket unix_stream_socket } { connectto newconn acceptfrom } |
122 |
+# { tcp_socket unix_stream_socket sctp_socket } { connectto newconn acceptfrom } |
123 |
# |
124 |
-# tcp_socket name_connect |
125 |
+# { tcp_socket sctp_socket } name_connect |
126 |
# |
127 |
# { netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_xfrm_socket netlink_audit_socket netlink_ip6fw_socket } nlmsg_write |
128 |
# |
129 |
|
130 |
diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in |
131 |
index 3671fa8e..64e98632 100644 |
132 |
--- a/policy/modules/kernel/corenetwork.if.in |
133 |
+++ b/policy/modules/kernel/corenetwork.if.in |
134 |
@@ -634,6 +634,24 @@ interface(`corenet_raw_send_all_if',` |
135 |
allow $1 netif_type:netif { rawip_send egress }; |
136 |
') |
137 |
|
138 |
+######################################## |
139 |
+## <summary> |
140 |
+## Send and receive SCTP network traffic on generic nodes. |
141 |
+## </summary> |
142 |
+## <param name="domain"> |
143 |
+## <summary> |
144 |
+## Domain allowed access. |
145 |
+## </summary> |
146 |
+## </param> |
147 |
+# |
148 |
+interface(`corenet_sctp_sendrecv_generic_node',` |
149 |
+ gen_require(` |
150 |
+ type node_t; |
151 |
+ ') |
152 |
+ |
153 |
+ allow $1 node_t:node { sendto recvfrom }; |
154 |
+') |
155 |
+ |
156 |
######################################## |
157 |
## <summary> |
158 |
## Receive raw IP packets on all interfaces. |
159 |
@@ -841,6 +859,24 @@ interface(`corenet_raw_sendrecv_generic_node',` |
160 |
corenet_raw_receive_generic_node($1) |
161 |
') |
162 |
|
163 |
+######################################## |
164 |
+## <summary> |
165 |
+## Bind SCTP sockets to generic nodes. |
166 |
+## </summary> |
167 |
+## <param name="domain"> |
168 |
+## <summary> |
169 |
+## Domain allowed access. |
170 |
+## </summary> |
171 |
+## </param> |
172 |
+# |
173 |
+interface(`corenet_sctp_bind_generic_node',` |
174 |
+ gen_require(` |
175 |
+ type node_t; |
176 |
+ ') |
177 |
+ |
178 |
+ allow $1 node_t:sctp_socket node_bind; |
179 |
+') |
180 |
+ |
181 |
######################################## |
182 |
## <summary> |
183 |
## Bind TCP sockets to generic nodes. |
184 |
@@ -1035,6 +1071,24 @@ interface(`corenet_dontaudit_udp_send_all_nodes',` |
185 |
dontaudit $1 node_type:node { udp_send sendto }; |
186 |
') |
187 |
|
188 |
+######################################## |
189 |
+## <summary> |
190 |
+## Send and receive SCTP network traffic on all nodes. |
191 |
+## </summary> |
192 |
+## <param name="domain"> |
193 |
+## <summary> |
194 |
+## Domain allowed access. |
195 |
+## </summary> |
196 |
+## </param> |
197 |
+# |
198 |
+interface(`corenet_sctp_sendrecv_all_nodes',` |
199 |
+ gen_require(` |
200 |
+ attribute node_type; |
201 |
+ ') |
202 |
+ |
203 |
+ allow $1 node_type:node { sendto recvfrom }; |
204 |
+') |
205 |
+ |
206 |
######################################## |
207 |
## <summary> |
208 |
## Receive UDP network traffic on all nodes. |
209 |
@@ -1227,6 +1281,25 @@ interface(`corenet_tcp_sendrecv_generic_port',` |
210 |
allow $1 port_t:tcp_socket { send_msg recv_msg }; |
211 |
') |
212 |
|
213 |
+######################################## |
214 |
+## <summary> |
215 |
+## Bind SCTP sockets to all nodes. |
216 |
+## </summary> |
217 |
+## <param name="domain"> |
218 |
+## <summary> |
219 |
+## Domain allowed access. |
220 |
+## </summary> |
221 |
+## </param> |
222 |
+# |
223 |
+interface(`corenet_sctp_bind_all_nodes',` |
224 |
+ gen_require(` |
225 |
+ attribute node_type; |
226 |
+ ') |
227 |
+ |
228 |
+ allow $1 node_type:sctp_socket node_bind; |
229 |
+') |
230 |
+ |
231 |
+ |
232 |
######################################## |
233 |
## <summary> |
234 |
## Do not audit send and receive TCP network traffic on generic ports. |
235 |
@@ -1434,6 +1507,26 @@ interface(`corenet_udp_send_all_ports',` |
236 |
allow $1 port_type:udp_socket send_msg; |
237 |
') |
238 |
|
239 |
+######################################## |
240 |
+## <summary> |
241 |
+## Bind SCTP sockets to generic ports. |
242 |
+## </summary> |
243 |
+## <param name="domain"> |
244 |
+## <summary> |
245 |
+## Domain allowed access. |
246 |
+## </summary> |
247 |
+## </param> |
248 |
+# |
249 |
+interface(`corenet_sctp_bind_generic_port',` |
250 |
+ gen_require(` |
251 |
+ type port_t, unreserved_port_t, ephemeral_port_t; |
252 |
+ attribute defined_port_type; |
253 |
+ ') |
254 |
+ |
255 |
+ allow $1 { port_t unreserved_port_t ephemeral_port_t }:sctp_socket name_bind; |
256 |
+ dontaudit $1 defined_port_type:sctp_socket name_bind; |
257 |
+') |
258 |
+ |
259 |
######################################## |
260 |
## <summary> |
261 |
## Receive UDP network traffic on all ports. |
262 |
@@ -1491,6 +1584,25 @@ interface(`corenet_udp_sendrecv_all_ports',` |
263 |
corenet_udp_receive_all_ports($1) |
264 |
') |
265 |
|
266 |
+######################################## |
267 |
+## <summary> |
268 |
+## Do not audit attempts to bind SCTP |
269 |
+## sockets to generic ports. |
270 |
+## </summary> |
271 |
+## <param name="domain"> |
272 |
+## <summary> |
273 |
+## Domain to not audit. |
274 |
+## </summary> |
275 |
+## </param> |
276 |
+# |
277 |
+interface(`corenet_dontaudit_sctp_bind_generic_port',` |
278 |
+ gen_require(` |
279 |
+ type port_t, unreserved_port_t, ephemeral_port_t; |
280 |
+ ') |
281 |
+ |
282 |
+ dontaudit $1 { port_t unreserved_port_t ephemeral_port_t }:sctp_socket name_bind; |
283 |
+') |
284 |
+ |
285 |
######################################## |
286 |
## <summary> |
287 |
## Bind TCP sockets to all ports. |
288 |
@@ -1547,6 +1659,24 @@ interface(`corenet_udp_bind_all_ports',` |
289 |
allow $1 self:capability net_bind_service; |
290 |
') |
291 |
|
292 |
+######################################## |
293 |
+## <summary> |
294 |
+## Connect SCTP sockets to generic ports. |
295 |
+## </summary> |
296 |
+## <param name="domain"> |
297 |
+## <summary> |
298 |
+## Domain allowed access. |
299 |
+## </summary> |
300 |
+## </param> |
301 |
+# |
302 |
+interface(`corenet_sctp_connect_generic_port',` |
303 |
+ gen_require(` |
304 |
+ type port_t, unreserved_port_t,ephemeral_port_t; |
305 |
+ ') |
306 |
+ |
307 |
+ allow $1 { port_t unreserved_port_t ephemeral_port_t }:sctp_socket name_connect; |
308 |
+') |
309 |
+ |
310 |
######################################## |
311 |
## <summary> |
312 |
## Do not audit attepts to bind UDP sockets to any ports. |
313 |
@@ -1718,6 +1848,25 @@ interface(`corenet_tcp_bind_reserved_port',` |
314 |
allow $1 self:capability net_bind_service; |
315 |
') |
316 |
|
317 |
+######################################## |
318 |
+## <summary> |
319 |
+## Bind SCTP sockets to all ports. |
320 |
+## </summary> |
321 |
+## <param name="domain"> |
322 |
+## <summary> |
323 |
+## Domain allowed access. |
324 |
+## </summary> |
325 |
+## </param> |
326 |
+# |
327 |
+interface(`corenet_sctp_bind_all_ports',` |
328 |
+ gen_require(` |
329 |
+ attribute port_type; |
330 |
+ ') |
331 |
+ |
332 |
+ allow $1 port_type:sctp_socket name_bind; |
333 |
+ allow $1 self:capability net_bind_service; |
334 |
+') |
335 |
+ |
336 |
######################################## |
337 |
## <summary> |
338 |
## Bind UDP sockets to generic reserved ports. |
339 |
@@ -1755,6 +1904,24 @@ interface(`corenet_tcp_connect_reserved_port',` |
340 |
allow $1 reserved_port_t:tcp_socket name_connect; |
341 |
') |
342 |
|
343 |
+######################################## |
344 |
+## <summary> |
345 |
+## Do not audit attempts to bind SCTP sockets to any ports. |
346 |
+## </summary> |
347 |
+## <param name="domain"> |
348 |
+## <summary> |
349 |
+## Domain to not audit. |
350 |
+## </summary> |
351 |
+## </param> |
352 |
+# |
353 |
+interface(`corenet_dontaudit_sctp_bind_all_ports',` |
354 |
+ gen_require(` |
355 |
+ attribute port_type; |
356 |
+ ') |
357 |
+ |
358 |
+ dontaudit $1 port_type:sctp_socket name_bind; |
359 |
+') |
360 |
+ |
361 |
######################################## |
362 |
## <summary> |
363 |
## Send and receive TCP network traffic on all reserved ports. |
364 |
@@ -1824,6 +1991,24 @@ interface(`corenet_udp_sendrecv_all_reserved_ports',` |
365 |
corenet_udp_receive_all_reserved_ports($1) |
366 |
') |
367 |
|
368 |
+######################################## |
369 |
+## <summary> |
370 |
+## Connect SCTP sockets to all ports. |
371 |
+## </summary> |
372 |
+## <param name="domain"> |
373 |
+## <summary> |
374 |
+## Domain allowed access. |
375 |
+## </summary> |
376 |
+## </param> |
377 |
+# |
378 |
+interface(`corenet_sctp_connect_all_ports',` |
379 |
+ gen_require(` |
380 |
+ attribute port_type; |
381 |
+ ') |
382 |
+ |
383 |
+ allow $1 port_type:sctp_socket name_connect; |
384 |
+') |
385 |
+ |
386 |
######################################## |
387 |
## <summary> |
388 |
## Bind TCP sockets to all reserved ports. |
389 |
@@ -1898,6 +2083,25 @@ interface(`corenet_dontaudit_udp_bind_all_reserved_ports',` |
390 |
dontaudit $1 reserved_port_type:udp_socket name_bind; |
391 |
') |
392 |
|
393 |
+######################################## |
394 |
+## <summary> |
395 |
+## Do not audit attempts to connect SCTP sockets |
396 |
+## to all ports. |
397 |
+## </summary> |
398 |
+## <param name="domain"> |
399 |
+## <summary> |
400 |
+## Domain to not audit. |
401 |
+## </summary> |
402 |
+## </param> |
403 |
+# |
404 |
+interface(`corenet_dontaudit_sctp_connect_all_ports',` |
405 |
+ gen_require(` |
406 |
+ attribute port_type; |
407 |
+ ') |
408 |
+ |
409 |
+ dontaudit $1 port_type:sctp_socket name_connect; |
410 |
+') |
411 |
+ |
412 |
######################################## |
413 |
## <summary> |
414 |
## Bind TCP sockets to all ports > 1024. |
415 |
@@ -1952,6 +2156,24 @@ interface(`corenet_tcp_connect_all_reserved_ports',` |
416 |
allow $1 reserved_port_type:tcp_socket name_connect; |
417 |
') |
418 |
|
419 |
+######################################## |
420 |
+## <summary> |
421 |
+## Connect SCTP sockets to all ports > 1024. |
422 |
+## </summary> |
423 |
+## <param name="domain"> |
424 |
+## <summary> |
425 |
+## Domain allowed access. |
426 |
+## </summary> |
427 |
+## </param> |
428 |
+# |
429 |
+interface(`corenet_sctp_connect_all_unreserved_ports',` |
430 |
+ gen_require(` |
431 |
+ attribute unreserved_port_type; |
432 |
+ ') |
433 |
+ |
434 |
+ allow $1 unreserved_port_type:sctp_socket name_connect; |
435 |
+') |
436 |
+ |
437 |
######################################## |
438 |
## <summary> |
439 |
## Do not audit connect attempts to TCP sockets on |
440 |
@@ -2045,6 +2267,25 @@ interface(`corenet_dontaudit_tcp_connect_all_rpc_ports',` |
441 |
dontaudit $1 rpc_port_type:tcp_socket name_connect; |
442 |
') |
443 |
|
444 |
+######################################## |
445 |
+## <summary> |
446 |
+## Bind SCTP sockets to generic reserved ports. |
447 |
+## </summary> |
448 |
+## <param name="domain"> |
449 |
+## <summary> |
450 |
+## Domain allowed access. |
451 |
+## </summary> |
452 |
+## </param> |
453 |
+# |
454 |
+interface(`corenet_sctp_bind_reserved_port',` |
455 |
+ gen_require(` |
456 |
+ type reserved_port_t; |
457 |
+ ') |
458 |
+ |
459 |
+ allow $1 reserved_port_t:sctp_socket name_bind; |
460 |
+ allow $1 self:capability net_bind_service; |
461 |
+') |
462 |
+ |
463 |
######################################## |
464 |
## <summary> |
465 |
## Read the TUN/TAP virtual network device. |
466 |
@@ -2102,6 +2343,24 @@ interface(`corenet_rw_tun_tap_dev',` |
467 |
allow $1 tun_tap_device_t:chr_file rw_chr_file_perms; |
468 |
') |
469 |
|
470 |
+######################################## |
471 |
+## <summary> |
472 |
+## Connect SCTP sockets to generic reserved ports. |
473 |
+## </summary> |
474 |
+## <param name="domain"> |
475 |
+## <summary> |
476 |
+## Domain allowed access. |
477 |
+## </summary> |
478 |
+## </param> |
479 |
+# |
480 |
+interface(`corenet_sctp_connect_reserved_port',` |
481 |
+ gen_require(` |
482 |
+ type reserved_port_t; |
483 |
+ ') |
484 |
+ |
485 |
+ allow $1 reserved_port_t:sctp_socket name_connect; |
486 |
+') |
487 |
+ |
488 |
######################################## |
489 |
## <summary> |
490 |
## Do not audit attempts to read or write the TUN/TAP |
491 |
@@ -2232,6 +2491,25 @@ interface(`corenet_dontaudit_udp_bind_all_rpc_ports',` |
492 |
dontaudit $1 rpc_port_type:udp_socket name_bind; |
493 |
') |
494 |
|
495 |
+######################################## |
496 |
+## <summary> |
497 |
+## Bind SCTP sockets to all reserved ports. |
498 |
+## </summary> |
499 |
+## <param name="domain"> |
500 |
+## <summary> |
501 |
+## Domain allowed access. |
502 |
+## </summary> |
503 |
+## </param> |
504 |
+# |
505 |
+interface(`corenet_sctp_bind_all_reserved_ports',` |
506 |
+ gen_require(` |
507 |
+ attribute reserved_port_type; |
508 |
+ ') |
509 |
+ |
510 |
+ allow $1 reserved_port_type:sctp_socket name_bind; |
511 |
+ allow $1 self:capability net_bind_service; |
512 |
+') |
513 |
+ |
514 |
######################################## |
515 |
## <summary> |
516 |
## Receive TCP packets from a NetLabel connection. |
517 |
@@ -2271,6 +2549,24 @@ interface(`corenet_tcp_recvfrom_unlabeled',` |
518 |
kernel_sendrecv_unlabeled_association($1) |
519 |
') |
520 |
|
521 |
+######################################## |
522 |
+## <summary> |
523 |
+## Do not audit attempts to bind SCTP sockets to all reserved ports. |
524 |
+## </summary> |
525 |
+## <param name="domain"> |
526 |
+## <summary> |
527 |
+## Domain to not audit. |
528 |
+## </summary> |
529 |
+## </param> |
530 |
+# |
531 |
+interface(`corenet_dontaudit_sctp_bind_all_reserved_ports',` |
532 |
+ gen_require(` |
533 |
+ attribute reserved_port_type; |
534 |
+ ') |
535 |
+ |
536 |
+ dontaudit $1 reserved_port_type:sctp_socket name_bind; |
537 |
+') |
538 |
+ |
539 |
######################################## |
540 |
## <summary> |
541 |
## Do not audit attempts to receive TCP packets from a NetLabel |
542 |
@@ -2351,6 +2647,24 @@ interface(`corenet_udp_recvfrom_unlabeled',` |
543 |
kernel_sendrecv_unlabeled_association($1) |
544 |
') |
545 |
|
546 |
+######################################## |
547 |
+## <summary> |
548 |
+## Bind SCTP sockets to all ports > 1024. |
549 |
+## </summary> |
550 |
+## <param name="domain"> |
551 |
+## <summary> |
552 |
+## Domain allowed access. |
553 |
+## </summary> |
554 |
+## </param> |
555 |
+# |
556 |
+interface(`corenet_sctp_bind_all_unreserved_ports',` |
557 |
+ gen_require(` |
558 |
+ attribute unreserved_port_type; |
559 |
+ ') |
560 |
+ |
561 |
+ allow $1 unreserved_port_type:sctp_socket name_bind; |
562 |
+') |
563 |
+ |
564 |
######################################## |
565 |
## <summary> |
566 |
## Do not audit attempts to receive UDP packets from a NetLabel |
567 |
@@ -2451,6 +2765,24 @@ interface(`corenet_dontaudit_raw_recvfrom_netlabel',` |
568 |
dontaudit $1 netlabel_peer_t:rawip_socket recvfrom; |
569 |
') |
570 |
|
571 |
+######################################## |
572 |
+## <summary> |
573 |
+## Connect SCTP sockets to reserved ports. |
574 |
+## </summary> |
575 |
+## <param name="domain"> |
576 |
+## <summary> |
577 |
+## Domain allowed access. |
578 |
+## </summary> |
579 |
+## </param> |
580 |
+# |
581 |
+interface(`corenet_sctp_connect_all_reserved_ports',` |
582 |
+ gen_require(` |
583 |
+ attribute reserved_port_type; |
584 |
+ ') |
585 |
+ |
586 |
+ allow $1 reserved_port_type:sctp_socket name_connect; |
587 |
+') |
588 |
+ |
589 |
######################################## |
590 |
## <summary> |
591 |
## Do not audit attempts to receive Raw IP packets from an unlabeled |
592 |
@@ -2558,6 +2890,25 @@ interface(`corenet_dontaudit_all_recvfrom_unlabeled',` |
593 |
kernel_dontaudit_sendrecv_unlabeled_association($1) |
594 |
') |
595 |
|
596 |
+######################################## |
597 |
+## <summary> |
598 |
+## Do not audit attempts to connect SCTP sockets |
599 |
+## all reserved ports. |
600 |
+## </summary> |
601 |
+## <param name="domain"> |
602 |
+## <summary> |
603 |
+## Domain to not audit. |
604 |
+## </summary> |
605 |
+## </param> |
606 |
+# |
607 |
+interface(`corenet_dontaudit_sctp_connect_all_reserved_ports',` |
608 |
+ gen_require(` |
609 |
+ attribute reserved_port_type; |
610 |
+ ') |
611 |
+ |
612 |
+ dontaudit $1 reserved_port_type:sctp_socket name_connect; |
613 |
+') |
614 |
+ |
615 |
######################################## |
616 |
## <summary> |
617 |
## Do not audit attempts to receive packets from a NetLabel |
618 |
@@ -2689,6 +3040,7 @@ interface(`corenet_raw_recvfrom_labeled',` |
619 |
## </param> |
620 |
# |
621 |
interface(`corenet_all_recvfrom_labeled',` |
622 |
+ corenet_sctp_recvfrom_labeled($1, $2) |
623 |
corenet_tcp_recvfrom_labeled($1, $2) |
624 |
corenet_udp_recvfrom_labeled($1, $2) |
625 |
corenet_raw_recvfrom_labeled($1, $2) |
626 |
@@ -2959,6 +3311,24 @@ interface(`corenet_send_all_server_packets',` |
627 |
allow $1 server_packet_type:packet send; |
628 |
') |
629 |
|
630 |
+######################################## |
631 |
+## <summary> |
632 |
+## Receive SCTP packets from a NetLabel connection. |
633 |
+## </summary> |
634 |
+## <param name="domain"> |
635 |
+## <summary> |
636 |
+## Domain allowed access. |
637 |
+## </summary> |
638 |
+## </param> |
639 |
+# |
640 |
+interface(`corenet_sctp_recvfrom_netlabel',` |
641 |
+ gen_require(` |
642 |
+ type netlabel_peer_t; |
643 |
+ ') |
644 |
+ |
645 |
+ allow $1 netlabel_peer_t:peer recv; |
646 |
+') |
647 |
+ |
648 |
######################################## |
649 |
## <summary> |
650 |
## Receive all server packets. |
651 |
@@ -3010,6 +3380,27 @@ interface(`corenet_relabelto_all_server_packets',` |
652 |
allow $1 server_packet_type:packet relabelto; |
653 |
') |
654 |
|
655 |
+######################################## |
656 |
+## <summary> |
657 |
+## Receive SCTP packets from an unlabled connection. |
658 |
+## </summary> |
659 |
+## <param name="domain"> |
660 |
+## <summary> |
661 |
+## Domain allowed access. |
662 |
+## </summary> |
663 |
+## </param> |
664 |
+# |
665 |
+interface(`corenet_sctp_recvfrom_unlabeled',` |
666 |
+ gen_require(` |
667 |
+ attribute corenet_unlabeled_type; |
668 |
+ ') |
669 |
+ |
670 |
+ kernel_recvfrom_unlabeled_peer($1) |
671 |
+ |
672 |
+ typeattribute $1 corenet_unlabeled_type; |
673 |
+ kernel_sendrecv_unlabeled_association($1) |
674 |
+') |
675 |
+ |
676 |
######################################## |
677 |
## <summary> |
678 |
## Send all packets. |
679 |
@@ -3143,6 +3534,34 @@ interface(`corenet_ib_manage_subnet_unlabeled_endports',` |
680 |
kernel_ib_manage_subnet_unlabeled_endports($1) |
681 |
') |
682 |
|
683 |
+######################################## |
684 |
+## <summary> |
685 |
+## Rules for receiving labeled SCTP packets. |
686 |
+## </summary> |
687 |
+## <param name="domain"> |
688 |
+## <summary> |
689 |
+## Domain allowed access. |
690 |
+## </summary> |
691 |
+## </param> |
692 |
+## <param name="peer_domain"> |
693 |
+## <summary> |
694 |
+## Peer domain. |
695 |
+## </summary> |
696 |
+## </param> |
697 |
+# |
698 |
+interface(`corenet_sctp_recvfrom_labeled',` |
699 |
+ allow { $1 $2 } self:association sendto; |
700 |
+ allow $1 $2:association recvfrom; |
701 |
+ allow $2 $1:association recvfrom; |
702 |
+ |
703 |
+ allow $1 $2:peer recv; |
704 |
+ allow $2 $1:peer recv; |
705 |
+ |
706 |
+ # allow receiving packets from MLS-only peers using NetLabel |
707 |
+ corenet_sctp_recvfrom_netlabel($1) |
708 |
+ corenet_sctp_recvfrom_netlabel($2) |
709 |
+') |
710 |
+ |
711 |
######################################## |
712 |
## <summary> |
713 |
## Unconfined access to network objects. |
714 |
|
715 |
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in |
716 |
index 6a96d6cc..cb3d4718 100644 |
717 |
--- a/policy/modules/kernel/corenetwork.te.in |
718 |
+++ b/policy/modules/kernel/corenetwork.te.in |
719 |
@@ -313,9 +313,12 @@ network_port(zope, tcp,8021,s0) |
720 |
portcon udp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0) |
721 |
portcon tcp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0) |
722 |
portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) |
723 |
+portcon sctp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0) |
724 |
+portcon sctp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) |
725 |
portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0) |
726 |
portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0) |
727 |
portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0) |
728 |
+portcon sctp 1-511 gen_context(system_u:object_r:reserved_port_t, s0) |
729 |
|
730 |
######################################## |
731 |
# |
732 |
@@ -361,11 +364,12 @@ allow corenet_unconfined_type node_type:node { tcp_recv tcp_send udp_recv udp_se |
733 |
allow corenet_unconfined_type netif_type:netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send ingress egress }; |
734 |
allow corenet_unconfined_type packet_type:packet { send recv relabelto flow_in flow_out forward_in forward_out }; |
735 |
allow corenet_unconfined_type port_type:tcp_socket { send_msg recv_msg name_connect }; |
736 |
+allow corenet_unconfined_type port_type:sctp_socket { send_msg recv_msg name_connect }; |
737 |
allow corenet_unconfined_type port_type:udp_socket { send_msg recv_msg }; |
738 |
|
739 |
# Bind to any network address. |
740 |
-allow corenet_unconfined_type port_type:{ tcp_socket udp_socket rawip_socket } name_bind; |
741 |
-allow corenet_unconfined_type node_type:{ tcp_socket udp_socket rawip_socket } node_bind; |
742 |
+allow corenet_unconfined_type port_type:{ tcp_socket udp_socket rawip_socket sctp_socket } name_bind; |
743 |
+allow corenet_unconfined_type node_type:{ tcp_socket udp_socket rawip_socket sctp_socket } node_bind; |
744 |
|
745 |
# Infiniband |
746 |
corenet_ib_access_all_pkeys(corenet_unconfined_type) |
747 |
|
748 |
diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt |
749 |
index fdbb4927..e27330a9 100644 |
750 |
--- a/policy/support/obj_perm_sets.spt |
751 |
+++ b/policy/support/obj_perm_sets.spt |
752 |
@@ -44,12 +44,12 @@ define(`dgram_socket_class_set', `{ udp_socket unix_dgram_socket }') |
753 |
# |
754 |
# Stream socket classes. |
755 |
# |
756 |
-define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket }') |
757 |
+define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket sctp_socket }') |
758 |
|
759 |
# |
760 |
# Unprivileged socket classes (exclude rawip, netlink, packet). |
761 |
# |
762 |
-define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket }') |
763 |
+define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket sctp_socket }') |
764 |
|
765 |
|
766 |
######################################## |