add defintion of bpf class and systemd perms

PATCH New Christian Göttsche 1 participant 1 message Mar 20, 2018

Share & tools

Christian Göttsche

author

2018-03-20 18:40 UTC #0 lore raw

PATCH 1/1 add defintion of bpf class and systemd perms

---
 policy/flask/access_vectors   | 9 +++++++++
 policy/flask/security_classes | 2 ++
 policy/modules/system/init.te | 1 +
 3 files changed, 12 insertions(+)

policy/flask/access_vectors +9 -0

index 9c9db71bf..b213ce5b0 100644
@@ -1079,3 +1079,12 @@ inherits socket
 
 class smc_socket
 inherits socket
+
+class bpf
+{
+	map_create
+	map_read
+	map_write
+	prog_load
+	prog_run
+}

policy/flask/security_classes +2 -0

index 3ff1b72d2..2ae343060 100644
@@ -190,4 +190,6 @@ class smc_socket
 
 class process2
 
+class bpf
+
 # FLASK

policy/modules/system/init.te +1 -0

index 057c33e87..a48919b18 100644
@@ -228,6 +228,7 @@ ifdef(`init_systemd',`
 	allow init_t self:netlink_route_socket create_netlink_socket_perms;
 	allow init_t initrc_t:unix_dgram_socket create_socket_perms;
 	allow init_t self:capability2 audit_read;
+	allow init_t self:bpf { map_create map_read map_write };
 
 	# for /run/systemd/inaccessible/{chr,blk}
 	allow init_t init_var_run_t:blk_file { create getattr };

Signature · 1 line

2.16.2