[PATCH] SELinux: add support for NETLINK_KOBJECT_UEVENT

This patch adds SELinux support for the KOBJECT_UEVENT Netlink family, so
that SELinux can apply finer grained controls to it.  For example, security
policy for hald can be locked down to the KOBJECT_UEVENT Netlink family
only.  Currently, this family simply defaults to the default Netlink socket
class.

Note that some new permission definitions are added to sync with changes in
the core userspace policy package, which auto-generates header files.

Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 2 insertions, 0 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8a2cc75b3948..2ae7d3cb8df4 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -672,6 +672,8 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
                         return SECCLASS_NETLINK_IP6FW_SOCKET;
                 case NETLINK_DNRTMSG:
                         return SECCLASS_NETLINK_DNRT_SOCKET;
+                case NETLINK_KOBJECT_UEVENT:
+                        return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
                 default:
                         return SECCLASS_NETLINK_SOCKET;
                 }