Bug 1564775
| Summary: | Define extended_socket_class policy capability | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Lukas Vrabec <lvrabec> |
| Component: | libsepol | Assignee: | Vit Mojzis <vmojzis> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | Ioanna Gkioka <igkioka> |
| Priority: | urgent | ||
| Version: | 7.6 | CC: | igkioka, lvrabec, mgrepl, mmalik, plautrba, vmojzis |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libsepol-2.5-9.el7 | Doc Type: | Enhancement |
| Doc Text: |
SELinux now supports `extended_socket_class`
This update introduces the `extended_socket_class` policy capability that enables a number of new SELinux object classes to support all of the known network socket address families. It also enables the use of separate security classes for Internet Control Message Protocol (ICMP) and Stream Control Transmission Protocol (SCTP) sockets, which were previously mapped to the `rawip_socket` class.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 08:09:35 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1427553 | ||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3077 |
Guys, Could you please add following commit into libsepol in RHEL-7.6? commit d479baa82d67c9ac56c1a6fa041abfb9168aa4b3 Author: Stephen Smalley <sds.gov> Date: Thu Dec 1 11:08:06 2016 -0500 libsepol: Define extended_socket_class policy capability Define the extended_socket_class policy capability used to enable the use of separate socket security classes for all network address families rather than the generic socket class. This also enables separate security classes for ICMP and SCTP sockets, which were previously mapped to the rawip_socket class. The legacy redhat1 policy capability that was only ever used in testing within Fedora for ptrace_child is reclaimed for this purpose; as far as I can tell, this policy capability is not enabled in any supported distro policy. Signed-off-by: Stephen Smalley <sds.gov> It's blocking selinux-policy build because of backports related to extended socket class. Thanks, Lukas.