mirror of
https://github.com/torvalds/linux.git
synced 2026-04-23 09:05:50 -04:00
68e1e908cb
This patch adds support for genfscon per-file labeling of functionfs files as well as support for userspace to apply labels after new functionfs endpoints are created. This allows for separate labels and therefore access control on a per-endpoint basis. An example use case would be for the default endpoint EP0 used as a restricted control endpoint, and additional usb endpoints to be used by other more permissive domains. It should be noted that if there are multiple functionfs mounts on a system, genfs file labels will apply to all mounts, and therefore will not likely be as useful as the userspace relabeling portion of this patch - the addition to selinux_is_genfs_special_handling(). This patch introduces the functionfs_seclabel policycap to maintain existing functionfs genfscon behavior unless explicitly enabled. Signed-off-by: Neill Kapron <nkapron@google.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> [PM: trim changelog, apply boolean logic fixup] Signed-off-by: Paul Moore <paul@paul-moore.com>
28 lines
631 B
C
28 lines
631 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
#ifndef _SELINUX_POLICYCAP_NAMES_H_
|
|
#define _SELINUX_POLICYCAP_NAMES_H_
|
|
|
|
#include "policycap.h"
|
|
|
|
/* clang-format off */
|
|
/* Policy capability names */
|
|
const char *const selinux_policycap_names[__POLICYDB_CAP_MAX] = {
|
|
"network_peer_controls",
|
|
"open_perms",
|
|
"extended_socket_class",
|
|
"always_check_network",
|
|
"cgroup_seclabel",
|
|
"nnp_nosuid_transition",
|
|
"genfs_seclabel_symlinks",
|
|
"ioctl_skip_cloexec",
|
|
"userspace_initial_context",
|
|
"netlink_xperm",
|
|
"netif_wildcard",
|
|
"genfs_seclabel_wildcard",
|
|
"functionfs_seclabel",
|
|
};
|
|
/* clang-format on */
|
|
|
|
#endif /* _SELINUX_POLICYCAP_NAMES_H_ */
|