TOMOYO: Add socket operation restriction support.

This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
socket's bind()/listen()/connect()/send() operations.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 31 insertions, 0 deletions

diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index cb7d507b6312..a1c3d9ccebfa 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -42,6 +42,37 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
         [TOMOYO_MAC_FILE_MOUNT]      = TOMOYO_MAC_CATEGORY_FILE,
         [TOMOYO_MAC_FILE_UMOUNT]     = TOMOYO_MAC_CATEGORY_FILE,
         [TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE,
+        /* CONFIG::network group */
+        [TOMOYO_MAC_NETWORK_INET_STREAM_BIND]       =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN]     =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT]    =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_INET_DGRAM_BIND]        =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_INET_DGRAM_SEND]        =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_INET_RAW_BIND]          =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_INET_RAW_SEND]          =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND]       =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN]     =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT]    =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND]        =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND]        =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND]    =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN]  =
+        TOMOYO_MAC_CATEGORY_NETWORK,
+        [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] =
+        TOMOYO_MAC_CATEGORY_NETWORK,
         /* CONFIG::misc group */
         [TOMOYO_MAC_ENVIRON]         = TOMOYO_MAC_CATEGORY_MISC,
 };