ObjectClassesPerms - Revision history

StephenSmalley: /* process */

StephenSmalley — Tue, 05 Feb 2013 19:23:37 GMT

process

←Older revision		Revision as of 19:23, 5 February 2013
Line 1,635:		Line 1,635:
	\|\|signal\|\|Send a signal other than SIGKILL, SIGSTOP, or SIGCHLD.		\|\|signal\|\|Send a signal other than SIGKILL, SIGSTOP, or SIGCHLD.
	\|-		\|-
-	\|\|ptrace\|\|~~Trace program execution of parent or child~~.	+	\|\|ptrace\|\|Attach to another process for tracing.
	\|-		\|-
	\|\|getsched\|\|Get priority of a process.		\|\|getsched\|\|Get priority of a process.
Line 1,663:		Line 1,663:
	\|\|noatsecure\|\|Disable secure mode environment cleansing (AT_SECURE).\|\|v.16+		\|\|noatsecure\|\|Disable secure mode environment cleansing (AT_SECURE).\|\|v.16+
	\|-		\|-
-	\|\|siginh\|\|Inherit signal state from ~~old sid~~.\|\|v.16+	+	\|\|siginh\|\|Inherit signal state from caller.\|\|v.16+
	\|-		\|-
-	\|\|rlimitinh\|\|Inherit resource limits from ~~old sid~~.\|\|v.16+	+	\|\|rlimitinh\|\|Inherit resource limits from caller.\|\|v.16+
	\|-		\|-
	\|\|dyntransition\|\|Dynamically transition to a new context.\|\|2.6.11+		\|\|dyntransition\|\|Dynamically transition to a new context.\|\|2.6.11+

StephenSmalley: /* netlink_firewall_socket */

StephenSmalley — Tue, 05 Feb 2013 19:21:25 GMT

netlink_firewall_socket

←Older revision		Revision as of 19:21, 5 February 2013
Line 1,119:		Line 1,119:
	\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+		\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_read\|\|Read ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_read\|\|Read firewall configuration state.\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_write\|\|Write ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_write\|\|Write firewall configuration state.\|\|2.6.8+
	\|}		\|}

StephenSmalley: /* netlink_xfrm_socket */

StephenSmalley — Tue, 05 Feb 2013 19:20:37 GMT

netlink_xfrm_socket

←Older revision		Revision as of 19:20, 5 February 2013
Line 1,499:		Line 1,499:
	\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+		\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_read\|\|Read ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_read\|\|Read xfrm configuration state.\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_write\|\|Write ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_write\|\|Write xfrm configuration state.\|\|2.6.8+
	\|}		\|}

StephenSmalley: /* netlink_tcpdiag_socket */

StephenSmalley — Tue, 05 Feb 2013 19:19:56 GMT

netlink_tcpdiag_socket

←Older revision		Revision as of 19:19, 5 February 2013
Line 1,443:		Line 1,443:
	\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+		\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_read\|\|Read ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_read\|\|Read tcp diagnostics.\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_write\|\|~~Write netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_write\|\|Unused.\|\|2.6.8+
	\|}		\|}

StephenSmalley: /* netlink_route_socket */

StephenSmalley — Tue, 05 Feb 2013 19:19:16 GMT

netlink_route_socket

←Older revision		Revision as of 19:19, 5 February 2013
Line 1,335:		Line 1,335:
	\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+		\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_read\|\|Read ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_read\|\|Read route configuration state.\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_write\|\|Write ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_write\|\|Write route configuration state.\|\|2.6.8+
	\|}		\|}

StephenSmalley: /* dir */

StephenSmalley — Tue, 05 Feb 2013 19:15:27 GMT

dir

←Older revision		Revision as of 19:15, 5 February 2013
Line 502:		Line 502:
	\|\|relabelto\|\|see common file:relabelto		\|\|relabelto\|\|see common file:relabelto
	\|-		\|-
-	\|\|unlink\|\|~~see common file:unlink~~	+	\|\|unlink\|\|N/A
	\|-		\|-
	\|\|ioctl\|\|see common file:ioctl		\|\|ioctl\|\|see common file:ioctl
	\|-		\|-
-	\|\|execute\|\|~~see common file:execute~~	+	\|\|execute\|\|N/A
	\|-		\|-
-	\|\|append\|\|~~see common file:append~~	+	\|\|append\|\|N/A
	\|-		\|-
	\|\|read\|\|see common file:read		\|\|read\|\|see common file:read
Line 514:		Line 514:
	\|\|setattr\|\|see common file:setattr		\|\|setattr\|\|see common file:setattr
	\|-		\|-
-	\|\|swapon\|\|~~see common file:swapon~~	+	\|\|swapon\|\|N/A
	\|-		\|-
-	\|\|write\|\|~~see common file:~~write	+	\|\|write\|\|General write access; required for adding or removing
	\|-		\|-
	\|\|lock\|\|see common file:lock		\|\|lock\|\|see common file:lock
Line 526:		Line 526:
	\|\|mounton\|\|see common file:mounton		\|\|mounton\|\|see common file:mounton
	\|-		\|-
-	\|\|quotaon\|\|~~see common file:quotaon~~	+	\|\|quotaon\|\|N/A
	\|-		\|-
	\|\|relabelfrom\|\|see common file:relabelfrom		\|\|relabelfrom\|\|see common file:relabelfrom
	\|-		\|-
-	\|\|link\|\|~~see common file:link~~	+	\|\|link\|\|N/A
	\|-		\|-
-	\|\|search\|\|~~Required on all ancestor directories of a file being accessed, similar to DAC +x permission~~	+	\|\|search\|\|Search access
	\|-		\|-
	\|\|rmdir\|\|Remove the directory		\|\|rmdir\|\|Remove the directory
Line 538:		Line 538:
	\|\|remove_name\|\|Remove a file from the directory.		\|\|remove_name\|\|Remove a file from the directory.
	\|-		\|-
-	\|\|reparent\|\|~~Change~~ parent directory.	+	\|\|reparent\|\|Rename into a different parent directory (.. change).
	\|-		\|-
	\|\|add_name\|\|Add a file to the directory.		\|\|add_name\|\|Add a file to the directory.

StephenSmalley: /* netlink_audit_socket */

StephenSmalley — Tue, 05 Feb 2013 19:01:39 GMT

netlink_audit_socket

←Older revision		Revision as of 19:01, 5 February 2013
Line 1,005:		Line 1,005:
	\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+		\|\|name_bind\|\|see common socket:name_bind\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_read\|\|Read ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_read\|\|Read audit subsystem state (e.g. AUDIT_GET).\|\|2.6.8+
	\|-		\|-
-	\|\|nlmsg_write\|\|Write ~~netlink message~~.\|\|2.6.8+	+	\|\|nlmsg_write\|\|Write audit subsystem state (e.g. AUDIT_SET).\|\|2.6.8+
	\|-		\|-
	\|\|nlmsg_relay\|\|Send user space audit messages to the kernel audit system.\|\|2.6.12+		\|\|nlmsg_relay\|\|Send user space audit messages to the kernel audit system.\|\|2.6.12+
	\|-		\|-
-	\|\|nlmsg_readpriv\|\|~~List all auditing rules~~.\|\|2.6.12+	+	\|\|nlmsg_readpriv\|\|Read security-sensitive audit subsystem state.\|\|2.6.12+
	\|-		\|-
	\|\|nlmsg_tty_audit\|\|Control TTY auditing\|\|2.6.30+		\|\|nlmsg_tty_audit\|\|Control TTY auditing\|\|2.6.30+

StephenSmalley: /* capability2 */

StephenSmalley — Tue, 05 Feb 2013 18:57:46 GMT

capability2

←Older revision		Revision as of 18:57, 5 February 2013
Line 368:		Line 368:
	! Kernel Version/Capability		! Kernel Version/Capability
	\|-		\|-
-	\|\|mac_override\|\|~~''Unused~~ by SELinux''\|\|2.6.25+	+	\|\|mac_override\|\|Override MAC restrictions - Ignored by SELinux\|\|2.6.25+
	\|-		\|-
-	\|\|mac_admin\|\|~~Set or~~ get raw ~~(not yet defined in policy)~~ security context values.\|\|2.6.27+	+	\|\|mac_admin\|\|Change MAC configuration - For SELinux, get/set raw security context values unknown to the current policy.\|\|2.6.25+
		+	\|-
		+	\|\| syslog\|\|Configure kernel syslog subsystem\|\|
		+	\|-
		+	\|\| wake_alarm\|\|Trigger something that will wake the system\|\|
		+	\|-
		+	\|\| block_suspend\|\| Prevent system suspends\|\|
	\|}		\|}

StephenSmalley: /* capability */

StephenSmalley — Tue, 05 Feb 2013 18:54:15 GMT

capability

←Older revision		Revision as of 18:54, 5 February 2013
Line 297:		Line 297:
	! Kernel Version/Capability		! Kernel Version/Capability
	\|-		\|-
-	\|\|chown\|\|~~Allow~~ changing file ownership and group ownership.	+	\|\|chown\|\|Override restrictions on changing file ownership and group ownership.
	\|-		\|-
-	\|\|dac_override\|\|~~Overrides~~ all ~~discretionary~~ access ~~control including ACL execute access if applicable~~. ~~This does not include the access covered by LINUX_IMMUTABLE~~.	+	\|\|dac_override\|\|Override all DAC access restrictions. Checked before dac_read_search, so a dontaudit candidate.
	\|-		\|-
-	\|\|dac_read_search\|\|~~Overrides all discretionary~~ access ~~control for reading and searching~~.	+	\|\|dac_read_search\|\|Override DAC read/search access restrictions.
	\|-		\|-
-	\|\|fowner\|\|~~Grant~~ all file ~~operations otherwise restricted due to different ownership~~ except where ~~FSETID capability is applicable. DAC and MAC accesses are not overridden~~.	+	\|\|fowner\|\|Override all file owner requirements (e.g. for chmod, setxattr) except where fsetid applies.
	\|-		\|-
-	\|\|fsetid\|\|~~Overrides the following restrictions that the effective user ID~~	+	\|\|fsetid\|\|Override file owner and group requirements when setting setuid or setgid bits on a file. Can be checked as a side effect on chmod and write operations; dontaudit candidate.
-	~~shall match the~~ file owner ID when setting ~~the S_ISUID and S_ISGID~~	+
-	bits on ~~that~~ file~~; that the effective group ID (or one of the~~	+
-	~~supplementary group IDs) shall match the file owner ID when setting~~	+
-	~~the S_ISGID bit~~ on ~~that file~~; ~~that the S_ISUID and S_ISGID bits are~~	+
-	~~cleared on successful return from chown(2)~~.	+
	\|-		\|-
	\|\|kill\|\|Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.		\|\|kill\|\|Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
	\|-		\|-
-	\|\|setgid\|\|Allow setgid(2) ~~allow~~ setgroups(2) ~~allow fake~~ gids on credentials passed over a socket.	+	\|\|setgid\|\|Allow setgid(2) or setgroups(2) or forged gids on credentials passed over a socket.
	\|-		\|-
-	\|\|setuid\|\|Allow ~~all setsuid~~(2) ~~type calls including fsuid~~. Allow passing of forged ~~pids~~ on credentials passed over a socket.	+	\|\|setuid\|\|Allow set*uid(2). Allow passing of forged ids on credentials passed over a socket.
	\|-		\|-
-	\|\|setpcap\|\|~~Transfer~~ capability ~~maps~~ from ~~current process~~ to ~~any process~~.	+	\|\|setpcap\|\|Add capability from bounding set to inheritable set, drop capability from bounding set, modify secure bits.
	\|-		\|-
	\|\|linux_immutable\|\|Grant privilege to modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems.		\|\|linux_immutable\|\|Grant privilege to modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems.
Line 330:		Line 325:
	\|\|net_raw\|\|Allows opening of raw sockets and packet sockets.		\|\|net_raw\|\|Allows opening of raw sockets and packet sockets.
	\|-		\|-
-	\|\|ipc_lock\|\|~~Grants the capability to lock non-shared and~~ shared memory segments.	+	\|\|ipc_lock\|\|Allow locking shared memory segments and mlock/mlockall.
	\|-		\|-
-	\|\|ipc_owner\|\|~~Grant the ability to ignore~~ IPC ownership checks.	+	\|\|ipc_owner\|\|Override IPC ownership checks.
	\|-		\|-
	\|\|sys_module\|\|Allow unrestricted kernel modification including but not limited to loading and removing kernel modules. Allows modification of kernels bounding capability mask. See sysctl.		\|\|sys_module\|\|Allow unrestricted kernel modification including but not limited to loading and removing kernel modules. Allows modification of kernels bounding capability mask. See sysctl.
Line 348:		Line 343:
	\|\|sys_boot\|\|Grant ability to reboot the system.		\|\|sys_boot\|\|Grant ability to reboot the system.
	\|-		\|-
-	\|\|sys_nice\|\|Grants ~~privilage~~ to change priority of any process. Grants change of scheduling algorithm used by any process.	+	\|\|sys_nice\|\|Grants privilege to change priority of any process. Grants change of scheduling algorithm used by any process.
	\|-		\|-
	\|\|sys_resource\|\|Too many to list here (see /usr/include/linux/capability.h for details.)		\|\|sys_resource\|\|Too many to list here (see /usr/include/linux/capability.h for details.)
Line 360:		Line 355:
	\|\|lease\|\|Grants ability to take leases on a file. For details on what leases are see fcntl(2).		\|\|lease\|\|Grants ability to take leases on a file. For details on what leases are see fcntl(2).
	\|-		\|-
-	\|\|audit_write\|\|~~Send~~ audit ~~messsages~~ from user space.\|\|2.6.12+	+	\|\|audit_write\|\|Generate audit messages from user space.\|\|2.6.12+
	\|-		\|-
-	\|\|audit_control\|\|~~Change auditing~~ rules. Set login UID.\|\|2.6.12+	+	\|\|audit_control\|\|Control kernel audit configuration/rules. Set login UID.\|\|2.6.12+
	\|-		\|-
	\|\|setfcap\|\|Set file capabilities.\|\|2.6.25+		\|\|setfcap\|\|Set file capabilities.\|\|2.6.25+

StephenSmalley: /* common ipc */

StephenSmalley — Tue, 05 Feb 2013 18:23:17 GMT

common ipc

←Older revision		Revision as of 18:23, 5 February 2013
Line 74:		Line 74:
	\|\|destroy\|\|Destroy.		\|\|destroy\|\|Destroy.
	\|-		\|-
-	\|\|unix_write\|\|~~Unix~~ write access.	+	\|\|unix_write\|\|Generic write access.
	\|-		\|-
	\|\|getattr\|\|Get attributes, e.g. IPC_STAT *ctl operation.		\|\|getattr\|\|Get attributes, e.g. IPC_STAT *ctl operation.
Line 84:		Line 84:
	\|\|setattr\|\|Change attributes, e.g. IPC_SET.		\|\|setattr\|\|Change attributes, e.g. IPC_SET.
	\|-		\|-
-	\|\|unix_read\|\|~~Unix~~ read access.	+	\|\|unix_read\|\|Generic read access.
	\|-		\|-
	\|\|associate\|\|Associate a key		\|\|associate\|\|Associate a key