[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/flask/

[Sven Vermeulen]

commit:     5513c5076d69710712b8df417c5bd91913999bf9
Author:     Christian Göttsche <cgzones <AT> googlemail <DOT> com>
AuthorDate: Wed Mar 21 10:57:45 2018 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Mar 25 10:28:06 2018 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5513c507

add definition of bpf class and systemd perms

 policy/flask/access_vectors   | 9 +++++++++
 policy/flask/security_classes | 2 ++
 policy/modules/system/init.te | 1 +
 3 files changed, 12 insertions(+)

diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index 4f57fb40..0630f012 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -1081,3 +1081,12 @@ inherits socket
 
 class smc_socket
 inherits socket
+
+class bpf
+{
+       map_create
+       map_read
+       map_write
+       prog_load
+       prog_run
+}

diff --git a/policy/flask/security_classes b/policy/flask/security_classes
index 3ff1b72d..2ae34306 100644
--- a/policy/flask/security_classes
+++ b/policy/flask/security_classes
@@ -190,4 +190,6 @@ class smc_socket
 
 class process2
 
+class bpf
+
 # FLASK

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 846ab7b5..94234055 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -228,6 +228,7 @@ ifdef(`init_systemd',`
        allow init_t self:netlink_route_socket create_netlink_socket_perms;
        allow init_t initrc_t:unix_dgram_socket create_socket_perms;
        allow init_t self:capability2 audit_read;
+       allow init_t self:bpf { map_create map_read map_write prog_load 
prog_run };
 
        # for /run/systemd/inaccessible/{chr,blk}
        allow init_t init_var_run_t:blk_file { create getattr };