mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-02-17 10:10:30 -05:00
68e1e908cb
This patch adds support for genfscon per-file labeling of functionfs files as well as support for userspace to apply labels after new functionfs endpoints are created. This allows for separate labels and therefore access control on a per-endpoint basis. An example use case would be for the default endpoint EP0 used as a restricted control endpoint, and additional usb endpoints to be used by other more permissive domains. It should be noted that if there are multiple functionfs mounts on a system, genfs file labels will apply to all mounts, and therefore will not likely be as useful as the userspace relabeling portion of this patch - the addition to selinux_is_genfs_special_handling(). This patch introduces the functionfs_seclabel policycap to maintain existing functionfs genfscon behavior unless explicitly enabled. Signed-off-by: Neill Kapron <nkapron@google.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> [PM: trim changelog, apply boolean logic fixup] Signed-off-by: Paul Moore <paul@paul-moore.com>
28 lines
732 B
C
28 lines
732 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
#ifndef _SELINUX_POLICYCAP_H_
|
|
#define _SELINUX_POLICYCAP_H_
|
|
|
|
/* Policy capabilities */
|
|
enum {
|
|
POLICYDB_CAP_NETPEER,
|
|
POLICYDB_CAP_OPENPERM,
|
|
POLICYDB_CAP_EXTSOCKCLASS,
|
|
POLICYDB_CAP_ALWAYSNETWORK,
|
|
POLICYDB_CAP_CGROUPSECLABEL,
|
|
POLICYDB_CAP_NNP_NOSUID_TRANSITION,
|
|
POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS,
|
|
POLICYDB_CAP_IOCTL_SKIP_CLOEXEC,
|
|
POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT,
|
|
POLICYDB_CAP_NETLINK_XPERM,
|
|
POLICYDB_CAP_NETIF_WILDCARD,
|
|
POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
|
|
POLICYDB_CAP_FUNCTIONFS_SECLABEL,
|
|
__POLICYDB_CAP_MAX
|
|
};
|
|
#define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
|
|
|
|
extern const char *const selinux_policycap_names[__POLICYDB_CAP_MAX];
|
|
|
|
#endif /* _SELINUX_POLICYCAP_H_ */
|