1 files changed, 150 insertions, 0 deletions
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
new file mode 100644
index 000000000000..8b32e959bb2e
--- /dev/null
+++ b/security/selinux/include/classmap.h
@@ -0,0 +1,150 @@
+#define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
+    "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append"
+#define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \
+    "rename", "execute", "swapon", "quotaon", "mounton"
+#define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \
+    "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom",  \
+    "sendto", "recv_msg", "send_msg", "name_bind"
+#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
+            "write", "associate", "unix_read", "unix_write"
+struct security_class_mapping secclass_map[] = {
+        { "security",
+          { "compute_av", "compute_create", "compute_member",
+            "check_context", "load_policy", "compute_relabel",
+            "compute_user", "setenforce", "setbool", "setsecparam",
+            "setcheckreqprot", NULL } },
+        { "process",
+          { "fork", "transition", "sigchld", "sigkill",
+            "sigstop", "signull", "signal", "ptrace", "getsched", "setsched",
+            "getsession", "getpgid", "setpgid", "getcap", "setcap", "share",
+            "getattr", "setexec", "setfscreate", "noatsecure", "siginh",
+            "setrlimit", "rlimitinh", "dyntransition", "setcurrent",
+            "execmem", "execstack", "execheap", "setkeycreate",
+            "setsockcreate", NULL } },
+        { "system",
+          { "ipc_info", "syslog_read", "syslog_mod",
+            "syslog_console", "module_request", NULL } },
+        { "capability",
+          { "chown", "dac_override", "dac_read_search",
+            "fowner", "fsetid", "kill", "setgid", "setuid", "setpcap",
+            "linux_immutable", "net_bind_service", "net_broadcast",
+            "net_admin", "net_raw", "ipc_lock", "ipc_owner", "sys_module",
+            "sys_rawio", "sys_chroot", "sys_ptrace", "sys_pacct", "sys_admin",
+            "sys_boot", "sys_nice", "sys_resource", "sys_time",
+            "sys_tty_config", "mknod", "lease", "audit_write",
+            "audit_control", "setfcap", NULL } },
+        { "filesystem",
+          { "mount", "remount", "unmount", "getattr",
+            "relabelfrom", "relabelto", "transition", "associate", "quotamod",
+            "quotaget", NULL } },
+        { "file",
+          { COMMON_FILE_PERMS,
+            "execute_no_trans", "entrypoint", "execmod", "open", NULL } },
+        { "dir",
+          { COMMON_FILE_PERMS, "add_name", "remove_name",
+            "reparent", "search", "rmdir", "open", NULL } },
+        { "fd", { "use", NULL } },
+        { "lnk_file",
+          { COMMON_FILE_PERMS, NULL } },
+        { "chr_file",
+          { COMMON_FILE_PERMS,
+            "execute_no_trans", "entrypoint", "execmod", "open", NULL } },
+        { "blk_file",
+          { COMMON_FILE_PERMS, "open", NULL } },
+        { "sock_file",
+          { COMMON_FILE_PERMS, "open", NULL } },
+        { "fifo_file",
+          { COMMON_FILE_PERMS, "open", NULL } },
+        { "socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "tcp_socket",
+          { COMMON_SOCK_PERMS,
+            "connectto", "newconn", "acceptfrom", "node_bind", "name_connect",
+            NULL } },
+        { "udp_socket",
+          { COMMON_SOCK_PERMS,
+            "node_bind", NULL } },
+        { "rawip_socket",
+          { COMMON_SOCK_PERMS,
+            "node_bind", NULL } },
+        { "node",
+          { "tcp_recv", "tcp_send", "udp_recv", "udp_send",
+            "rawip_recv", "rawip_send", "enforce_dest",
+            "dccp_recv", "dccp_send", "recvfrom", "sendto", NULL } },
+        { "netif",
+          {  "tcp_recv", "tcp_send", "udp_recv", "udp_send",
+             "rawip_recv", "rawip_send", "dccp_recv", "dccp_send",
+             "ingress", "egress", NULL } },
+        { "netlink_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "packet_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "key_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "unix_stream_socket",
+          { COMMON_SOCK_PERMS, "connectto", "newconn", "acceptfrom", NULL
+          } },
+        { "unix_dgram_socket",
+          { COMMON_SOCK_PERMS, NULL
+          } },
+        { "sem",
+          { COMMON_IPC_PERMS, NULL } },
+        { "msg", { "send", "receive", NULL } },
+        { "msgq",
+          { COMMON_IPC_PERMS, "enqueue", NULL } },
+        { "shm",
+          { COMMON_IPC_PERMS, "lock", NULL } },
+        { "ipc",
+          { COMMON_IPC_PERMS, NULL } },
+        { "netlink_route_socket",
+          { COMMON_SOCK_PERMS,
+            "nlmsg_read", "nlmsg_write", NULL } },
+        { "netlink_firewall_socket",
+          { COMMON_SOCK_PERMS,
+            "nlmsg_read", "nlmsg_write", NULL } },
+        { "netlink_tcpdiag_socket",
+          { COMMON_SOCK_PERMS,
+            "nlmsg_read", "nlmsg_write", NULL } },
+        { "netlink_nflog_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "netlink_xfrm_socket",
+          { COMMON_SOCK_PERMS,
+            "nlmsg_read", "nlmsg_write", NULL } },
+        { "netlink_selinux_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "netlink_audit_socket",
+          { COMMON_SOCK_PERMS,
+            "nlmsg_read", "nlmsg_write", "nlmsg_relay", "nlmsg_readpriv",
+            "nlmsg_tty_audit", NULL } },
+        { "netlink_ip6fw_socket",
+          { COMMON_SOCK_PERMS,
+            "nlmsg_read", "nlmsg_write", NULL } },
+        { "netlink_dnrt_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "association",
+          { "sendto", "recvfrom", "setcontext", "polmatch", NULL } },
+        { "netlink_kobject_uevent_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "appletalk_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { "packet",
+          { "send", "recv", "relabelto", "flow_in", "flow_out",
+            "forward_in", "forward_out", NULL } },
+        { "key",
+          { "view", "read", "write", "search", "link", "setattr", "create",
+            NULL } },
+        { "dccp_socket",
+          { COMMON_SOCK_PERMS,
+            "node_bind", "name_connect", NULL } },
+        { "memprotect", { "mmap_zero", NULL } },
+        { "peer", { "recv", NULL } },
+        { "capability2", { "mac_override", "mac_admin", NULL } },
+        { "kernel_service", { "use_as_override", "create_files_as", NULL } },
+        { "tun_socket",
+          { COMMON_SOCK_PERMS, NULL } },
+        { NULL }
+  };

diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h new file mode 100644 index 000000000000..8b32e959bb2e --- /dev/null +++ b/security/selinux/include/classmap.h
@@ -0,0 +1,150 @@
	1	#define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
	2	"getattr", "setattr", "lock", "relabelfrom", "relabelto", "append"
	3
	4	#define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \
	5	"rename", "execute", "swapon", "quotaon", "mounton"
	6
	7	#define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \
	8	"listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \
	9	"sendto", "recv_msg", "send_msg", "name_bind"
	10
	11	#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
	12	"write", "associate", "unix_read", "unix_write"
	13
	14	struct security_class_mapping secclass_map[] = {
	15	{ "security",
	16	{ "compute_av", "compute_create", "compute_member",
	17	"check_context", "load_policy", "compute_relabel",
	18	"compute_user", "setenforce", "setbool", "setsecparam",
	19	"setcheckreqprot", NULL } },
	20	{ "process",
	21	{ "fork", "transition", "sigchld", "sigkill",
	22	"sigstop", "signull", "signal", "ptrace", "getsched", "setsched",
	23	"getsession", "getpgid", "setpgid", "getcap", "setcap", "share",
	24	"getattr", "setexec", "setfscreate", "noatsecure", "siginh",
	25	"setrlimit", "rlimitinh", "dyntransition", "setcurrent",
	26	"execmem", "execstack", "execheap", "setkeycreate",
	27	"setsockcreate", NULL } },
	28	{ "system",
	29	{ "ipc_info", "syslog_read", "syslog_mod",
	30	"syslog_console", "module_request", NULL } },
	31	{ "capability",
	32	{ "chown", "dac_override", "dac_read_search",
	33	"fowner", "fsetid", "kill", "setgid", "setuid", "setpcap",
	34	"linux_immutable", "net_bind_service", "net_broadcast",
	35	"net_admin", "net_raw", "ipc_lock", "ipc_owner", "sys_module",
	36	"sys_rawio", "sys_chroot", "sys_ptrace", "sys_pacct", "sys_admin",
	37	"sys_boot", "sys_nice", "sys_resource", "sys_time",
	38	"sys_tty_config", "mknod", "lease", "audit_write",
	39	"audit_control", "setfcap", NULL } },
	40	{ "filesystem",
	41	{ "mount", "remount", "unmount", "getattr",
	42	"relabelfrom", "relabelto", "transition", "associate", "quotamod",
	43	"quotaget", NULL } },
	44	{ "file",
	45	{ COMMON_FILE_PERMS,
	46	"execute_no_trans", "entrypoint", "execmod", "open", NULL } },
	47	{ "dir",
	48	{ COMMON_FILE_PERMS, "add_name", "remove_name",
	49	"reparent", "search", "rmdir", "open", NULL } },
	50	{ "fd", { "use", NULL } },
	51	{ "lnk_file",
	52	{ COMMON_FILE_PERMS, NULL } },
	53	{ "chr_file",
	54	{ COMMON_FILE_PERMS,
	55	"execute_no_trans", "entrypoint", "execmod", "open", NULL } },
	56	{ "blk_file",
	57	{ COMMON_FILE_PERMS, "open", NULL } },
	58	{ "sock_file",
	59	{ COMMON_FILE_PERMS, "open", NULL } },
	60	{ "fifo_file",
	61	{ COMMON_FILE_PERMS, "open", NULL } },
	62	{ "socket",
	63	{ COMMON_SOCK_PERMS, NULL } },
	64	{ "tcp_socket",
	65	{ COMMON_SOCK_PERMS,
	66	"connectto", "newconn", "acceptfrom", "node_bind", "name_connect",
	67	NULL } },
	68	{ "udp_socket",
	69	{ COMMON_SOCK_PERMS,
	70	"node_bind", NULL } },
	71	{ "rawip_socket",
	72	{ COMMON_SOCK_PERMS,
	73	"node_bind", NULL } },
	74	{ "node",
	75	{ "tcp_recv", "tcp_send", "udp_recv", "udp_send",
	76	"rawip_recv", "rawip_send", "enforce_dest",
	77	"dccp_recv", "dccp_send", "recvfrom", "sendto", NULL } },
	78	{ "netif",
	79	{ "tcp_recv", "tcp_send", "udp_recv", "udp_send",
	80	"rawip_recv", "rawip_send", "dccp_recv", "dccp_send",
	81	"ingress", "egress", NULL } },
	82	{ "netlink_socket",
	83	{ COMMON_SOCK_PERMS, NULL } },
	84	{ "packet_socket",
	85	{ COMMON_SOCK_PERMS, NULL } },
	86	{ "key_socket",
	87	{ COMMON_SOCK_PERMS, NULL } },
	88	{ "unix_stream_socket",
	89	{ COMMON_SOCK_PERMS, "connectto", "newconn", "acceptfrom", NULL
	90	} },
	91	{ "unix_dgram_socket",
	92	{ COMMON_SOCK_PERMS, NULL
	93	} },
	94	{ "sem",
	95	{ COMMON_IPC_PERMS, NULL } },
	96	{ "msg", { "send", "receive", NULL } },
	97	{ "msgq",
	98	{ COMMON_IPC_PERMS, "enqueue", NULL } },
	99	{ "shm",
	100	{ COMMON_IPC_PERMS, "lock", NULL } },
	101	{ "ipc",
	102	{ COMMON_IPC_PERMS, NULL } },
	103	{ "netlink_route_socket",
	104	{ COMMON_SOCK_PERMS,
	105	"nlmsg_read", "nlmsg_write", NULL } },
	106	{ "netlink_firewall_socket",
	107	{ COMMON_SOCK_PERMS,
	108	"nlmsg_read", "nlmsg_write", NULL } },
	109	{ "netlink_tcpdiag_socket",
	110	{ COMMON_SOCK_PERMS,
	111	"nlmsg_read", "nlmsg_write", NULL } },
	112	{ "netlink_nflog_socket",
	113	{ COMMON_SOCK_PERMS, NULL } },
	114	{ "netlink_xfrm_socket",
	115	{ COMMON_SOCK_PERMS,
	116	"nlmsg_read", "nlmsg_write", NULL } },
	117	{ "netlink_selinux_socket",
	118	{ COMMON_SOCK_PERMS, NULL } },
	119	{ "netlink_audit_socket",
	120	{ COMMON_SOCK_PERMS,
	121	"nlmsg_read", "nlmsg_write", "nlmsg_relay", "nlmsg_readpriv",
	122	"nlmsg_tty_audit", NULL } },
	123	{ "netlink_ip6fw_socket",
	124	{ COMMON_SOCK_PERMS,
	125	"nlmsg_read", "nlmsg_write", NULL } },
	126	{ "netlink_dnrt_socket",
	127	{ COMMON_SOCK_PERMS, NULL } },
	128	{ "association",
	129	{ "sendto", "recvfrom", "setcontext", "polmatch", NULL } },
	130	{ "netlink_kobject_uevent_socket",
	131	{ COMMON_SOCK_PERMS, NULL } },
	132	{ "appletalk_socket",
	133	{ COMMON_SOCK_PERMS, NULL } },
	134	{ "packet",
	135	{ "send", "recv", "relabelto", "flow_in", "flow_out",
	136	"forward_in", "forward_out", NULL } },
	137	{ "key",
	138	{ "view", "read", "write", "search", "link", "setattr", "create",
	139	NULL } },
	140	{ "dccp_socket",
	141	{ COMMON_SOCK_PERMS,
	142	"node_bind", "name_connect", NULL } },
	143	{ "memprotect", { "mmap_zero", NULL } },
	144	{ "peer", { "recv", NULL } },
	145	{ "capability2", { "mac_override", "mac_admin", NULL } },
	146	{ "kernel_service", { "use_as_override", "create_files_as", NULL } },
	147	{ "tun_socket",
	148	{ COMMON_SOCK_PERMS, NULL } },
	149	{ NULL }
	150	};