Skip to content
Snippets Groups Projects
  • Stephen Smalley's avatar
    01d95c23
    Update netlink socket classes. · 01d95c23
    Stephen Smalley authored
    
    Define new netlink socket security classes introduced by upstream kernel commit
    6c6d2e9bde1c1c87a7ead806f8f5e2181d41a652 ("selinux: update netlink socket
    classes").  This was merged in Linux 4.2 and is therefore only required
    for Android kernels based on 4.2 or newer (e.g. the android-4.4 branch
    of the kernel/common tree).
    
    Add the new socket classes to socket_class_set.
    Add an initial set of allow rules although further refinement
    will likely be necessary.  Any allow rule previously written
    on :netlink_socket may need to be rewritten or duplicated for
    one or more of the more specific classes.  For now, we retain
    the existing :netlink_socket rules for compatibility on older kernels.
    
    Change-Id: I5040b30edd2d374538490a080feda96dd4bae5bf
    Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    01d95c23
    History
    Update netlink socket classes.
    Stephen Smalley authored
    
    Define new netlink socket security classes introduced by upstream kernel commit
    6c6d2e9bde1c1c87a7ead806f8f5e2181d41a652 ("selinux: update netlink socket
    classes").  This was merged in Linux 4.2 and is therefore only required
    for Android kernels based on 4.2 or newer (e.g. the android-4.4 branch
    of the kernel/common tree).
    
    Add the new socket classes to socket_class_set.
    Add an initial set of allow rules although further refinement
    will likely be necessary.  Any allow rule previously written
    on :netlink_socket may need to be rewritten or duplicated for
    one or more of the more specific classes.  For now, we retain
    the existing :netlink_socket rules for compatibility on older kernels.
    
    Change-Id: I5040b30edd2d374538490a080feda96dd4bae5bf
    Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>