448857f580
[ Upstream commit 65881e1db4e948614d9eb195b8e1197339822949 ] These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux always allows too. Furthermore, a failed FIOCLEX could result in a file descriptor being leaked to a process that should not have access to it. As this patch removes access controls, a policy capability needs to be enabled in policy to always allow these ioctls. Based-on-patch-by: Demi Marie Obenour <demiobenour@gmail.com> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> [PM: subject line tweak] Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
20 lines
466 B
C
20 lines
466 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _SELINUX_POLICYCAP_NAMES_H_
|
|
#define _SELINUX_POLICYCAP_NAMES_H_
|
|
|
|
#include "policycap.h"
|
|
|
|
/* Policy capability names */
|
|
const char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = {
|
|
"network_peer_controls",
|
|
"open_perms",
|
|
"extended_socket_class",
|
|
"always_check_network",
|
|
"cgroup_seclabel",
|
|
"nnp_nosuid_transition",
|
|
"genfs_seclabel_symlinks",
|
|
"ioctl_skip_cloexec"
|
|
};
|
|
|
|
#endif /* _SELINUX_POLICYCAP_NAMES_H_ */
|