commit: 5513c5076d69710712b8df417c5bd91913999bf9 Author: Christian Göttsche <cgzones <AT> googlemail <DOT> com> AuthorDate: Wed Mar 21 10:57:45 2018 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Sun Mar 25 10:28:06 2018 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5513c507
add definition of bpf class and systemd perms policy/flask/access_vectors | 9 +++++++++ policy/flask/security_classes | 2 ++ policy/modules/system/init.te | 1 + 3 files changed, 12 insertions(+) diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors index 4f57fb40..0630f012 100644 --- a/policy/flask/access_vectors +++ b/policy/flask/access_vectors @@ -1081,3 +1081,12 @@ inherits socket class smc_socket inherits socket + +class bpf +{ + map_create + map_read + map_write + prog_load + prog_run +} diff --git a/policy/flask/security_classes b/policy/flask/security_classes index 3ff1b72d..2ae34306 100644 --- a/policy/flask/security_classes +++ b/policy/flask/security_classes @@ -190,4 +190,6 @@ class smc_socket class process2 +class bpf + # FLASK diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 846ab7b5..94234055 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -228,6 +228,7 @@ ifdef(`init_systemd',` allow init_t self:netlink_route_socket create_netlink_socket_perms; allow init_t initrc_t:unix_dgram_socket create_socket_perms; allow init_t self:capability2 audit_read; + allow init_t self:bpf { map_create map_read map_write prog_load prog_run }; # for /run/systemd/inaccessible/{chr,blk} allow init_t init_var_run_t:blk_file { create getattr };