Bug 1564775

Summary: Define extended_socket_class policy capability
Product: Red Hat Enterprise Linux 7 Reporter: Lukas Vrabec <lvrabec>
Component: libsepolAssignee: Vit Mojzis <vmojzis>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact: Ioanna Gkioka <igkioka>
Priority: urgent    
Version: 7.6CC: igkioka, lvrabec, mgrepl, mmalik, plautrba, vmojzis
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libsepol-2.5-9.el7 Doc Type: Enhancement
Doc Text:
SELinux now supports `extended_socket_class` This update introduces the `extended_socket_class` policy capability that enables a number of new SELinux object classes to support all of the known network socket address families. It also enables the use of separate security classes for Internet Control Message Protocol (ICMP) and Stream Control Transmission Protocol (SCTP) sockets, which were previously mapped to the `rawip_socket` class.
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-30 08:09:35 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1427553    

Description Lukas Vrabec 2018-04-07 19:15:30 UTC
Guys, 

Could you please add following commit into libsepol in RHEL-7.6? 

commit d479baa82d67c9ac56c1a6fa041abfb9168aa4b3
Author: Stephen Smalley <sds@tycho.nsa.gov>
Date:   Thu Dec 1 11:08:06 2016 -0500

    libsepol: Define extended_socket_class policy capability
    
    Define the extended_socket_class policy capability used to enable
    the use of separate socket security classes for all network address
    families rather than the generic socket class. This also enables
    separate security classes for ICMP and SCTP sockets, which were previously
    mapped to the rawip_socket class.
    
    The legacy redhat1 policy capability that was only ever used in testing
    within Fedora for ptrace_child is reclaimed for this purpose; as far as
    I can tell, this policy capability is not enabled in any supported distro
    policy.
    
    Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>


It's blocking selinux-policy build because of backports related to extended socket class.

Thanks,
Lukas.

Comment 10 errata-xmlrpc 2018-10-30 08:09:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3077