summaryrefslogtreecommitdiffstats
path: root/security/selinux/include
diff options
context:
space:
mode:
authorChris PeBenito <cpebenito@tresys.com>2013-05-03 09:05:39 -0400
committerEric Paris <eparis@redhat.com>2013-07-25 13:03:38 -0400
commit2be4d74f2fd45460d70d4fe65cc1972ef45bf849 (patch)
tree5dd4b74ae295dc6ba58f974a3b748fe7a2f06d3c /security/selinux/include
parentb04eea886409de7460b5727b5931fb0bd417275f (diff)
downloadop-kernel-dev-2be4d74f2fd45460d70d4fe65cc1972ef45bf849.zip
op-kernel-dev-2be4d74f2fd45460d70d4fe65cc1972ef45bf849.tar.gz
Add SELinux policy capability for always checking packet and peer classes.
Currently the packet class in SELinux is not checked if there are no SECMARK rules in the security or mangle netfilter tables. Some systems prefer that packets are always checked, for example, to protect the system should the netfilter rules fail to load or if the nefilter rules were maliciously flushed. Add the always_check_network policy capability which, when enabled, treats SECMARK as enabled, even if there are no netfilter SECMARK rules and treats peer labeling as enabled, even if there is no Netlabel or labeled IPSEC configuration. Includes definition of "redhat1" SELinux policy capability, which exists in the SELinux userpace library, to keep ordering correct. The SELinux userpace portion of this was merged last year, but this kernel change fell on the floor. Signed-off-by: Chris PeBenito <cpebenito@tresys.com> Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'security/selinux/include')
-rw-r--r--security/selinux/include/security.h3
1 files changed, 3 insertions, 0 deletions
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 01a0382..004a247 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -69,12 +69,15 @@ extern int selinux_enabled;
enum {
POLICYDB_CAPABILITY_NETPEER,
POLICYDB_CAPABILITY_OPENPERM,
+ POLICYDB_CAPABILITY_REDHAT1,
+ POLICYDB_CAPABILITY_ALWAYSNETWORK,
__POLICYDB_CAPABILITY_MAX
};
#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
extern int selinux_policycap_netpeer;
extern int selinux_policycap_openperm;
+extern int selinux_policycap_alwaysnetwork;
/*
* type_datum properties
OpenPOWER on IntegriCloud