diff options
| author | James Morris <jmorris@namei.org> | 2006-06-09 00:27:28 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-06-17 21:29:53 -0700 |
| commit | 29a395eac4c320c570e73f0a90d8953d80da8359 (patch) | |
| tree | 9d34d7987754004e76de76d3f9facbee804779b7 /security/selinux/include/av_permissions.h | |
| parent | 3e3ff15e6d8ba931fa9a6c7f9fe711edc77e96e5 (diff) | |
[SECMARK]: Add new flask definitions to SELinux
Secmark implements a new scheme for adding security markings to
packets via iptables, as well as changes to SELinux to use these
markings for security policy enforcement. The rationale for this
scheme is explained and discussed in detail in the original threads:
http://thread.gmane.org/gmane.linux.network/34927/
http://thread.gmane.org/gmane.linux.network/35244/
Examples of policy and rulesets, as well as a full archive of patches
for iptables and SELinux userland, may be found at:
http://people.redhat.com/jmorris/selinux/secmark/
The code has been tested with various compilation options and in
several scenarios, including with 'complicated' protocols such as FTP
and also with the new generic conntrack code with IPv6 connection
tracking.
This patch:
Add support for a new object class ('packet'), and associated
permissions ('send', 'recv', 'relabelto'). These are used to enforce
security policy for network packets labeled with SECMARK, and for
adding labeling rules.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'security/selinux/include/av_permissions.h')
| -rw-r--r-- | security/selinux/include/av_permissions.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h index 41b073b8da0..1d9cf3d306b 100644 --- a/security/selinux/include/av_permissions.h +++ b/security/selinux/include/av_permissions.h @@ -956,3 +956,6 @@ #define APPLETALK_SOCKET__SEND_MSG 0x00100000UL #define APPLETALK_SOCKET__NAME_BIND 0x00200000UL +#define PACKET__SEND 0x00000001UL +#define PACKET__RECV 0x00000002UL +#define PACKET__RELABELTO 0x00000004UL |