Bug 1564775 - Define extended_socket_class policy capability
Summary: Define extended_socket_class policy capability
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libsepol
Version: 7.6
Hardware: All
OS: Linux
urgent
unspecified
Target Milestone: rc
: ---
Assignee: Vit Mojzis
QA Contact: Milos Malik
Ioanna Gkioka
URL:
Whiteboard:
Depends On:
Blocks: 1427553
TreeView+ depends on / blocked
 
Reported: 2018-04-07 19:15 UTC by Lukas Vrabec
Modified: 2018-10-30 08:09 UTC (History)
6 users (show)

Fixed In Version: libsepol-2.5-9.el7
Doc Type: Enhancement
Doc Text:
SELinux now supports `extended_socket_class` This update introduces the `extended_socket_class` policy capability that enables a number of new SELinux object classes to support all of the known network socket address families. It also enables the use of separate security classes for Internet Control Message Protocol (ICMP) and Stream Control Transmission Protocol (SCTP) sockets, which were previously mapped to the `rawip_socket` class.
Clone Of:
Environment:
Last Closed: 2018-10-30 08:09:35 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3077 None None None 2018-10-30 08:09:49 UTC

Description Lukas Vrabec 2018-04-07 19:15:30 UTC 
Guys, 

Could you please add following commit into libsepol in RHEL-7.6? 

commit d479baa82d67c9ac56c1a6fa041abfb9168aa4b3
Author: Stephen Smalley <sds@tycho.nsa.gov>
Date:   Thu Dec 1 11:08:06 2016 -0500

    libsepol: Define extended_socket_class policy capability
    
    Define the extended_socket_class policy capability used to enable
    the use of separate socket security classes for all network address
    families rather than the generic socket class. This also enables
    separate security classes for ICMP and SCTP sockets, which were previously
    mapped to the rawip_socket class.
    
    The legacy redhat1 policy capability that was only ever used in testing
    within Fedora for ptrace_child is reclaimed for this purpose; as far as
    I can tell, this policy capability is not enabled in any supported distro
    policy.
    
    Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>


It's blocking selinux-policy build because of backports related to extended socket class.

Thanks,
Lukas.
Comment 10 errata-xmlrpc 2018-10-30 08:09:35 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3077
Note You need to log in before you can comment on or make changes to this bug.