6a7a72b07a
In cases where directory read access has been neverallowed via no_rw_dir_perms, also neverallow the various watch* permissions. If read was disallowed by the neverallow assertions, there's an assumption that watch was also intended to not be allowed. Make that assumption explicit. References: * https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=ac5656d8a4cdd93cd2c74355ed12e5617817e0e7 *c4ab8edf74*dddbaaf1e8Test: compiles Change-Id: I8139eaf1165a5090c7b48e45f353170e58ddf1d9
15 lines
736 B
Text
15 lines
736 B
Text
#
|
|
# Common neverallow permissions
|
|
define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
|
|
define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads }')
|
|
define(`no_x_file_perms', `{ execute execute_no_trans }')
|
|
define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
|
|
|
|
#####################################
|
|
# neverallow_establish_socket_comms(src, dst)
|
|
# neverallow src domain establishing socket connections to dst domain.
|
|
#
|
|
define(`neverallow_establish_socket_comms', `
|
|
neverallow $1 $2:socket_class_set { connect sendto };
|
|
neverallow $1 $2:unix_stream_socket connectto;
|
|
')
|