diff options
| author |   Stephen Smalley <sds@tycho.nsa.gov> | 2017-05-18 16:00:39 -0400 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2020-02-15 15:26:20 +0800 |
| commit | 8c38998a0c3024ef16de5fdc1bc12cef5c521759 (patch) | |
| tree | e100cf73681e81c3679b08a654ba8f7709180af3 /policy/modules/services/squid.te | |
| parent | Vagrant: allow VirtualBox provisionning to use dhclient and ip (diff) | |
| download | hardened-refpolicy-8c38998a0c3024ef16de5fdc1bc12cef5c521759.tar.gz hardened-refpolicy-8c38998a0c3024ef16de5fdc1bc12cef5c521759.tar.bz2 hardened-refpolicy-8c38998a0c3024ef16de5fdc1bc12cef5c521759.zip | |
access_vectors: Remove unused permissions
Remove unused permission definitions from SELinux.
Many of these were only ever used in pre-mainline
versions of SELinux, prior to Linux 2.6.0. Some of them
were used in the legacy network or compat_net=1 checks
that were disabled by default in Linux 2.6.18 and
fully removed in Linux 2.6.30.
The corresponding classmap declarations were removed from the
mainline kernel in:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42a9699a9fa179c0054ea3cf5ad3cc67104a6162
Permissions never used in mainline Linux:
file swapon
filesystem transition
tcp_socket { connectto newconn acceptfrom }
node enforce_dest
unix_stream_socket { newconn acceptfrom }
Legacy network checks, removed in 2.6.30:
socket { recv_msg send_msg }
node { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send }
netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send dccp_recv dccp_send }
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
Diffstat (limited to 'policy/modules/services/squid.te')
| -rw-r--r-- | policy/modules/services/squid.te | 13 |
1 files changed, 0 insertions, 13 deletions
diff --git a/policy/modules/services/squid.te b/policy/modules/services/squid.te index 78952c865..ef7166585 100644 --- a/policy/modules/services/squid.te +++ b/policy/modules/services/squid.te @@ -115,43 +115,33 @@ corenet_sendrecv_http_client_packets(squid_t) corenet_tcp_connect_http_port(squid_t) corenet_sendrecv_http_server_packets(squid_t) corenet_tcp_bind_http_port(squid_t) -corenet_tcp_sendrecv_http_port(squid_t) corenet_sendrecv_http_cache_client_packets(squid_t) corenet_tcp_connect_http_cache_port(squid_t) corenet_sendrecv_http_cache_server_packets(squid_t) corenet_tcp_bind_http_cache_port(squid_t) corenet_udp_bind_http_cache_port(squid_t) -corenet_tcp_sendrecv_http_cache_port(squid_t) -corenet_udp_sendrecv_http_cache_port(squid_t) corenet_sendrecv_ftp_client_packets(squid_t) corenet_tcp_connect_ftp_port(squid_t) corenet_sendrecv_ftp_server_packets(squid_t) corenet_tcp_bind_ftp_port(squid_t) -corenet_tcp_sendrecv_ftp_port(squid_t) corenet_sendrecv_gopher_client_packets(squid_t) corenet_tcp_connect_gopher_port(squid_t) corenet_sendrecv_gopher_server_packets(squid_t) corenet_tcp_bind_gopher_port(squid_t) corenet_udp_bind_gopher_port(squid_t) -corenet_tcp_sendrecv_gopher_port(squid_t) -corenet_udp_sendrecv_gopher_port(squid_t) corenet_sendrecv_squid_server_packets(squid_t) corenet_tcp_bind_squid_port(squid_t) corenet_udp_bind_squid_port(squid_t) -corenet_tcp_sendrecv_squid_port(squid_t) -corenet_udp_sendrecv_squid_port(squid_t) corenet_sendrecv_wccp_server_packets(squid_t) corenet_udp_bind_wccp_port(squid_t) -corenet_udp_sendrecv_wccp_port(squid_t) corenet_sendrecv_pgpkeyserver_client_packets(squid_t) corenet_tcp_connect_pgpkeyserver_port(squid_t) -corenet_tcp_sendrecv_pgpkeyserver_port(squid_t) corecmd_exec_bin(squid_t) corecmd_exec_shell(squid_t) @@ -194,7 +184,6 @@ tunable_policy(`squid_connect_any',` corenet_tcp_connect_all_ports(squid_t) corenet_tcp_bind_all_ports(squid_t) corenet_sendrecv_all_packets(squid_t) - corenet_tcp_sendrecv_all_ports(squid_t) ') tunable_policy(`squid_use_pinger',` @@ -206,7 +195,6 @@ tunable_policy(`squid_use_tproxy',` allow squid_t self:capability net_admin; corenet_sendrecv_netport_server_packets(squid_t) corenet_tcp_bind_netport_port(squid_t) - corenet_tcp_sendrecv_netport_port(squid_t) ') optional_policy(` @@ -219,7 +207,6 @@ optional_policy(` corenet_sendrecv_http_cache_client_packets(httpd_squid_script_t) corenet_tcp_connect_http_cache_port(httpd_squid_script_t) - corenet_tcp_sendrecv_http_cache_port(httpd_squid_script_t) sysnet_dns_name_resolve(httpd_squid_script_t) |