ObjectClassesPerms

From SELinux Wiki

Revision as of 18:10, 5 February 2013 by StephenSmalley (Talk | contribs)
Jump to: navigation, search

Contents

SELinux Object Classes and Permissions Reference

This document contains a list of all of the object classes and permissions for modern SELinux systems (starting in kernel 2.6.0). Each permission has a brief description of of the semantics of each permission, in addition to the versions of the kernel which support the permission and the policy capability that enables its enforcement (if applicable).

The document has the following caveats:

  • The permission descriptions are only for providing a general idea of the purposes of the permissions; a permission may mediate many operations.
  • Since SELinux development is ongoing, this document may be be incomplete or inaccurate.

Common Permission Sets

common database

Permission Description
createCreate a new database object.
dropRemove a database object.
getattrGet the attributes of a database object.
setattrSet the attributes of a database object.
relabelfromChange the security context based on existing type.
relabeltoChange the security context based on the new type.

common file

Permission Description
getattrGet file attributes for file, such as access mode. (e.g. stat, some ioctls. ...)
relabeltoRelabel to new security context.
unlinkRemove hard link (delete).
ioctlIO control system call requests not addressed by other permissions.
executeExecute
appendAppend file contents. i.e opened with O_APPEND flag.
readRead file contents.
setattrChange file attributes for file such as access mode. (e.g. chmod, some ioctls, ...)
swaponAllows file to be used for paging/swapping space.
writeWrite or append file contents.
lockSet and unset file locks.
createCreate new file.
renameRename a hard link.
mountonUse as mount point; only useful for directories and files in Linux.
quotaonEnabling quotas.
relabelfromRelabel from old security context.
linkCreate hard link to file

common ipc

Permission Description
writeWrite.
destroyDestroy.
unix_writeUnix write access.
getattrGet attributes, e.g. IPC_STAT *ctl operation.
createCreate.
readRead
setattrChange attributes, e.g. IPC_SET.
unix_readUnix read access.
associateAssociate a key

common socket

Permission Description
appendWrite to open fd marked with O_APPEND.
relabelfromChange the security context based on existing type.
createCreate new socket.
readRead from socket.
sendtoSend to socket.
connectInitiate connection.
recvfromLegacy NetLabel check; obsoleted by peer recv
send_msgLegacy check; no longer present.
bindBind a name to the socket.
lockApply file lock on a socket.
ioctlIO control system call requests not addressed by other permissions.
getattrGet socket attributes, e.g. fstat.
writeWrite to socket.
setoptSet socket options.
getoptGet socket options.
listenListen for connections.
setattrChange socket attributes.
shutdownShutdown connection.
relabeltoChange the security context based on the new type.
recv_msgObsolete.
acceptAccept a connection.
name_bindAssociate with port or file; for AF_INET sockets, controls relationship between a socket and it's port number; for AF_UNIX sockets, controls relationship between a socket and it's file

common x_device

Permission Description
getattr
setattr
use
read
write
getfocus
setfocus
bell
force_cursor
freeze
grab
manage
list_property
get_property
set_property
add
remove

Kernel Object Classes

appletalk_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.18+
relabelfromsee common socket:relabelfrom2.6.18+
createsee common socket:create2.6.18+
readsee common socket:read2.6.18+
sendtosee common socket:sendto2.6.18+
connectsee common socket:connect2.6.18+
recvfromsee common socket:recvfrom2.6.18+
send_msgsee common socket:send_msg2.6.18+
bindsee common socket:bind2.6.18+
locksee common socket:lock2.6.18+
ioctlsee common socket:ioctl2.6.18+
getattrsee common socket:getattr2.6.18+
writesee common socket:write2.6.18+
setoptsee common socket:setopt2.6.18+
getoptsee common socket:getopt2.6.18+
listensee common socket:listen2.6.18+
setattrsee common socket:setattr2.6.18+
shutdownsee common socket:shutdown2.6.18+
relabeltosee common socket:relabelto2.6.18+
recv_msgsee common socket:recv_msg2.6.18+
acceptsee common socket:accept2.6.18+
name_bindsee common socket:name_bind2.6.18+

association

Permission Description Kernel Version/Capability
sendtoSend to an IPSEC assocation.2.6.12+
recvfromReceive from an IPSEC association.2.6.12+
setcontextSet the context of an IPSEC association on creation.2.6.16+
polmatchMatch an IPSEC policy entry2.6.19+

blk_file

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link
openOpen a block device file.2.6.26+ / open_perms

capability

Permission Description Kernel Version/Capability
chownAllow changing file ownership and group ownership.
dac_overrideOverrides all discretionary access control including ACL execute access if applicable. This does not include the access covered by LINUX_IMMUTABLE.
dac_read_searchOverrides all discretionary access control for reading and searching.
fownerGrant all file operations otherwise restricted due to different ownership except where FSETID capability is applicable. DAC and MAC accesses are not overridden.
fsetidOverrides the following restrictions that the effective user ID
  shall match the file owner ID when setting the S_ISUID and S_ISGID
  bits on that file; that the effective group ID (or one of the
  supplementary group IDs) shall match the file owner ID when setting
  the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are
  cleared on successful return from chown(2).
killOverrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal.
setgidAllow setgid(2) allow setgroups(2) allow fake gids on credentials passed over a socket.
setuidAllow all setsuid(2) type calls including fsuid. Allow passing of forged pids on credentials passed over a socket.
setpcapTransfer capability maps from current process to any process.
linux_immutableGrant privilege to modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems.
net_bind_serviceAllow low port binding. Port < 1024 for TCP/UDP. VCI < 32 for ATM.
net_broadcastGrant network broadcasting and listening to incoming multicasts.
net_adminAllows all networking configurations and modifications. See linux/capability.h for details.
net_rawAllows opening of raw sockets and packet sockets.
ipc_lockGrants the capability to lock non-shared and shared memory segments.
ipc_ownerGrant the ability to ignore IPC ownership checks.
sys_moduleAllow unrestricted kernel modification including but not limited to loading and removing kernel modules. Allows modification of kernels bounding capability mask. See sysctl.
sys_rawioGrant permission to use ioperm(2) and iopl(2) as well as the ability to send messages to USB devices via /proc/bus/usb.
sys_chrootGrant use of the chroot(2) call.
sys_ptraceAllow a ptrace of any process.
sys_pacctAllow modification of accounting for any process.
sys_adminToo many to list here (see /usr/include/linux/capability.h)
sys_bootGrant ability to reboot the system.
sys_niceGrants privilage to change priority of any process. Grants change of scheduling algorithm used by any process.
sys_resourceToo many to list here (see /usr/include/linux/capability.h for details.)
sys_timeGrant permission to set system time and to set the real-time lock.
sys_tty_configGrant permission to configure tty devices. Allow vhangup(2) call on a tty.
mknodGrants permission to creation of character and block device nodes.
leaseGrants ability to take leases on a file. For details on what leases are see fcntl(2).
audit_writeSend audit messsages from user space.2.6.12+
audit_controlChange auditing rules. Set login UID.2.6.12+
setfcapSet file capabilities.2.6.25+

capability2

Permission Description Kernel Version/Capability
mac_overrideUnused by SELinux2.6.25+
mac_adminSet or get raw (not yet defined in policy) security context values.2.6.27+

chr_file

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link
execute_no_transExecute a file in the callers domain.2.6.11+
entrypointCan be executed as the entry point of the new domain in a transition.2.6.11+
execmodMake executable a file mapping that has been modified by copy-on-write. (Text relocation)2.6.11+
openOpen a character device file.2.6.26+ / open_perms

dccp_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.20+
relabelfromsee common socket:relabelfrom2.6.20+
createsee common socket:create2.6.20+
readsee common socket:read2.6.20+
sendtosee common socket:sendto2.6.20+
connectsee common socket:connect2.6.20+
recvfromsee common socket:recvfrom2.6.20+
send_msgsee common socket:send_msg2.6.20+
bindsee common socket:bind2.6.20+
locksee common socket:lock2.6.20+
ioctlsee common socket:ioctl2.6.20+
getattrsee common socket:getattr2.6.20+
writesee common socket:write2.6.20+
setoptsee common socket:setopt2.6.20+
getoptsee common socket:getopt2.6.20+
listensee common socket:listen2.6.20+
setattrsee common socket:setattr2.6.20+
shutdownsee common socket:shutdown2.6.20+
relabeltosee common socket:relabelto2.6.20+
recv_msgsee common socket:recv_msg2.6.20+
acceptsee common socket:accept2.6.20+
name_bindsee common socket:name_bind2.6.20+
connecttoConnect to server socket.2.6.20+
newconnCreate new socket for connection.2.6.20+
acceptfromAccept connection from client socket.2.6.20+
node_bindAbility to bind to a node.2.6.20+
name_connectConnect to a specific port number.2.6.20+

dir

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link
searchRequired on all ancestor directories of a file being accessed, similar to DAC +x permission
rmdirRemove the directory
remove_nameRemove a file from the directory.
reparentChange parent directory.
add_nameAdd a file to the directory.
openOpen a directory.2.6.26+ / open_perms

fd

Permission Description Kernel Version/Capability
usePermission to use an inherited file descriptor

fifo_file

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link
openOpen a FIFO.2.6.26+ / open_perms

file

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link
execute_no_transExecute a file in the callers domain.
entrypointCan be executed as the entry point of the new domain in a transition.
execmodMake executable a file mapping that has been modified by copy-on-write. (Text relocation)2.6.11+
openOpen a file.2.6.26+ / open_perms

filesystem

Permission Description Kernel Version/Capability
mountMount the filesystem.
remountChange filesystem mount flags.
unmountUnmount the filesystem.
getattrGet file attributes, such as access mode. (e.g. stat, some ioctls. ...)
relabelfromChange the security context based on existing type.
relabeltoChange the security context based on the new type.
transitionTransition to a new SID (change security context).
associateAssociate a file to the filesystem.
quotamodModify quota information.
quotagetGet quota information

ipc

Inherits from: common ipc

Permission Description Kernel Version/Capability
writesee common ipc:write
destroysee common ipc:destroy
unix_writesee common ipc:unix_write
getattrsee common ipc:getattr
createsee common ipc:create
readsee common ipc:read
setattrsee common ipc:setattr
unix_readsee common ipc:unix_read
associatesee common ipc:associate

kernel_service

Permission Description Kernel Version/Capability
use_as_overrideGrant a process the right to nominate an alternate process security ID for the kernel to use as an override for the SELinux subjective security when accessing stuff on behalf of another process.2.6.29+
create_files_asGrant a process the right to nominate a file creation label for a kernel service to use.2.6.29+

key

Permission Description Kernel Version/Capability
view2.6.18+
read2.6.18+
write2.6.18+
search2.6.18+
link2.6.18+
setattr2.6.18+
create2.6.18+

key_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind

lnk_file

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link

memprotect

Permission Description Kernel Version/Capability
mmap_zeroMmap the first page of memory.2.6.23+

msg

Permission Description Kernel Version/Capability
receiveRemove a message from a queue.
sendAdd a message to a queue.

msgq

Inherits from: common ipc

Permission Description Kernel Version/Capability
writesee common ipc:write
destroysee common ipc:destroy
unix_writesee common ipc:unix_write
getattrsee common ipc:getattr
createsee common ipc:create
readsee common ipc:read
setattrsee common ipc:setattr
unix_readsee common ipc:unix_read
associatesee common ipc:associate
enqueueMessage can be added to a queue.

netif

Permission Description Kernel Version/Capability
tcp_recvReceive TCP packet.
tcp_sendSend TCP packet.
udp_recvReceive UDP packet.
udp_sendSend UDP packet.
rawip_recvReceive raw IP packet.
rawip_sendSend raw IP packet.
dccp_recvReceive DCCP packet.2.6.20+
dccp_sendSend DCCP packet.2.6.20+
ingress2.6.25+ / network_peer_controls
egress2.6.25+ / network_peer_controls

netlink_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind

netlink_audit_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+
nlmsg_readRead netlink message.2.6.8+
nlmsg_writeWrite netlink message.2.6.8+
nlmsg_relaySend user space audit messages to the kernel audit system.2.6.12+
nlmsg_readprivList all auditing rules.2.6.12+
nlmsg_tty_auditControl TTY auditing2.6.30+

netlink_dnrt_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+

netlink_firewall_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+
nlmsg_readRead netlink message.2.6.8+
nlmsg_writeWrite netlink message.2.6.8+

netlink_ip6fw_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+
nlmsg_readRead netlink message.2.6.8+
nlmsg_writeWrite netlink message.2.6.8+

netlink_kobject_uevent_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.12+
relabelfromsee common socket:relabelfrom2.6.12+
createsee common socket:create2.6.12+
readsee common socket:read2.6.12+
sendtosee common socket:sendto2.6.12+
connectsee common socket:connect2.6.12+
recvfromsee common socket:recvfrom2.6.12+
send_msgsee common socket:send_msg2.6.12+
bindsee common socket:bind2.6.12+
locksee common socket:lock2.6.12+
ioctlsee common socket:ioctl2.6.12+
getattrsee common socket:getattr2.6.12+
writesee common socket:write2.6.12+
setoptsee common socket:setopt2.6.12+
getoptsee common socket:getopt2.6.12+
listensee common socket:listen2.6.12+
setattrsee common socket:setattr2.6.12+
shutdownsee common socket:shutdown2.6.12+
relabeltosee common socket:relabelto2.6.12+
recv_msgsee common socket:recv_msg2.6.12+
acceptsee common socket:accept2.6.12+
name_bindsee common socket:name_bind2.6.12+

netlink_nflog_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+

netlink_route_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+
nlmsg_readRead netlink message.2.6.8+
nlmsg_writeWrite netlink message.2.6.8+

netlink_selinux_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+

netlink_tcpdiag_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+
nlmsg_readRead netlink message.2.6.8+
nlmsg_writeWrite netlink message.2.6.8+

netlink_xfrm_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.8+
relabelfromsee common socket:relabelfrom2.6.8+
createsee common socket:create2.6.8+
readsee common socket:read2.6.8+
sendtosee common socket:sendto2.6.8+
connectsee common socket:connect2.6.8+
recvfromsee common socket:recvfrom2.6.8+
send_msgsee common socket:send_msg2.6.8+
bindsee common socket:bind2.6.8+
locksee common socket:lock2.6.8+
ioctlsee common socket:ioctl2.6.8+
getattrsee common socket:getattr2.6.8+
writesee common socket:write2.6.8+
setoptsee common socket:setopt2.6.8+
getoptsee common socket:getopt2.6.8+
listensee common socket:listen2.6.8+
setattrsee common socket:setattr2.6.8+
shutdownsee common socket:shutdown2.6.8+
relabeltosee common socket:relabelto2.6.8+
recv_msgsee common socket:recv_msg2.6.8+
acceptsee common socket:accept2.6.8+
name_bindsee common socket:name_bind2.6.8+
nlmsg_readRead netlink message.2.6.8+
nlmsg_writeWrite netlink message.2.6.8+

node

Permission Description Kernel Version/Capability
tcp_recvReceive TCP packet.
tcp_sendSend TCP packet.
udp_recvReceive UDP packet.
udp_sendSend UDP packet.
rawip_recvReceive raw IP packet.
rawip_sendSend raw IP packet.
enforce_destEnsure that the destination node can enforce restrictions on the destination socket.
dccp_recvReceive DCCP packet.2.6.20+
dccp_sendSend DCCP packet.2.6.20+
recvfrom2.6.25+ / network_peer_controls
sendto2.6.25+ / network_peer_controls

packet

Permission Description Kernel Version/Capability
sendSend a packet.2.6.18+
receiveReceive a packet.2.6.18+
relabeltoSet a labeling rule to the specified type.2.6.18+
flow_inDeprecated2.6.25+
flow_outDeprecated2.6.25+
forward_in2.6.25+
forward_out2.6.25+

packet_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind

peer

Permission Description Kernel Version/Capability
recvReceive from a labeled networking peer.2.6.25+ / network_peer_controls

process

Permission Description Kernel Version/Capability
forkFork into two processes.
transitionTransition to a new context on exec().
sigchldSend SIGCHLD signal.
sigkillSend SIGKILL signal.
sigstopSend SIGSTOP signal
signullTest for exisitence of another process without sending a signal
signalSend a signal other than SIGKILL, SIGSTOP, or SIGCHLD.
ptraceTrace program execution of parent or child.
getschedGet priority of a process.
setschedSet priority of a process.
getsessionGet session ID of another process.
getpgidGet group Process ID of a process.
setpgidSet group Process ID of a process.
getcapGet Linux capabilities.
setcapSet Linux capabilities.
shareAllow state sharing with cloned or forked process.
getattrGet attributes of a file.
setexecOverride the default context for the next exec().
setfscreateOverride the default context for file creation.
setrlimitChange process hard limits.
noatsecureDisable secure mode environment cleansing (AT_SECURE).v.16+
siginhInherit signal state from old sid.v.16+
rlimitinhInherit resource limits from old sid.v.16+
dyntransitionDynamically transition to a new context.2.6.11+
setcurrentSet the current process context.2.6.11+
execmemMake executable an anonymous mapping or private file mapping that is writable.2.6.13+
execstackMake the main process stack executable.2.6.13+
execheapMake the heap executable.2.6.13+
setkeycreateOverride the default context for key creation.2.6.18+
setsockcreateOverride the default context for socket creation.2.6.18+

rawip_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind
node_bindAbility to bind to a node.v.17+

security

Permission Description Kernel Version/Capability
compute_userGet user info in selinuxfs.
compute_relabelGet relabel info in selinuxfs.
compute_createGet create info in selinuxfs.
compute_avCompute an access vector given a source/target/class.
compute_memberDetermines the context to use when selecting a member of a polyinstantiated object.
setenforceChange the enforcement state of SELinux.
check_contextWrite context in selinuxfs.
load_policyLoad the security policy.
setboolSet a boolean value.2.6.5+
setsecparamSet kernel access vector cache tuning parameters.2.6.11+
setcheckreqprotSet if SELinux will check original protection mode or modified protection mode (read-implies-exec) for mmap/mprotect.2.6.12+

sem

Inherits from: common ipc

Permission Description Kernel Version/Capability
writesee common ipc:write
destroysee common ipc:destroy
unix_writesee common ipc:unix_write
getattrsee common ipc:getattr
createsee common ipc:create
readsee common ipc:read
setattrsee common ipc:setattr
unix_readsee common ipc:unix_read
associatesee common ipc:associate

shm

Inherits from: common ipc

Permission Description Kernel Version/Capability
writesee common ipc:write
destroysee common ipc:destroy
unix_writesee common ipc:unix_write
getattrsee common ipc:getattr
createsee common ipc:create
readsee common ipc:read
setattrsee common ipc:setattr
unix_readsee common ipc:unix_read
associatesee common ipc:associate
lock(Un)lock page(s) in memory.

sock_file

Inherits from: common file

Permission Description Kernel Version/Capability
getattrsee common file:getattr
relabeltosee common file:relabelto
unlinksee common file:unlink
ioctlsee common file:ioctl
executesee common file:execute
appendsee common file:append
readsee common file:read
setattrsee common file:setattr
swaponsee common file:swapon
writesee common file:write
locksee common file:lock
createsee common file:create
renamesee common file:rename
mountonsee common file:mounton
quotaonsee common file:quotaon
relabelfromsee common file:relabelfrom
linksee common file:link
openOpen a named socket file.2.6.26+ / open_perms

socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind

system

Permission Description Kernel Version/Capability
ipc_infoGet info for an ipc socket.
syslog_modPerform syslog operation other than syslog_read or console logging.
syslog_readPerform syslog read.
syslog_consolePerform syslog console.

tcp_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind
connecttoConnect to server socket.
newconnCreate new socket for connection.
acceptfromAccept connection from client socket.
node_bindAbility to bind to a node.2.6.2+
name_connectConnect to a specific port number.2.6.12+

tun_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append2.6.32+
relabelfromsee common socket:relabelfrom2.6.32+
createsee common socket:create2.6.32+
readsee common socket:read2.6.32+
sendtosee common socket:sendto2.6.32+
connectsee common socket:connect2.6.32+
recvfromsee common socket:recvfrom2.6.32+
send_msgsee common socket:send_msg2.6.32+
bindsee common socket:bind2.6.32+
locksee common socket:lock2.6.32+
ioctlsee common socket:ioctl2.6.32+
getattrsee common socket:getattr2.6.32+
writesee common socket:write2.6.32+
setoptsee common socket:setopt2.6.32+
getoptsee common socket:getopt2.6.32+
listensee common socket:listen2.6.32+
setattrsee common socket:setattr2.6.32+
shutdownsee common socket:shutdown2.6.32+
relabeltosee common socket:relabelto2.6.32+
recv_msgsee common socket:recv_msg2.6.32+
acceptsee common socket:accept2.6.32+
name_bindsee common socket:name_bind2.6.32+

udp_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind
node_bindAbility to bind to a node.2.6.2+

unix_dgram_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind

unix_stream_socket

Inherits from: common socket

Permission Description Kernel Version/Capability
appendsee common socket:append
relabelfromsee common socket:relabelfrom
createsee common socket:create
readsee common socket:read
sendtosee common socket:sendto
connectsee common socket:connect
recvfromsee common socket:recvfrom
send_msgsee common socket:send_msg
bindsee common socket:bind
locksee common socket:lock
ioctlsee common socket:ioctl
getattrsee common socket:getattr
writesee common socket:write
setoptsee common socket:setopt
getoptsee common socket:getopt
listensee common socket:listen
setattrsee common socket:setattr
shutdownsee common socket:shutdown
relabeltosee common socket:relabelto
recv_msgsee common socket:recv_msg
acceptsee common socket:accept
name_bindsee common socket:name_bind
connecttoConnect to server socket.
newconnCreate new socket for connection.
acceptfromAccept connection from client socket.

Database Object Classes

db_blob

Inherits from: common database

Permission Description
readRead a blob.
writeWrite a blob.
importImport a blob.
exportExport a blob.

db_column

Inherits from: common database

Permission Description
useDeprecated
select
update
insert

db_database

Inherits from: common database

Permission Description
access
install_module
load_module
get_paramDeprecated
set_paramDeprecated

db_procedure

Inherits from: common database

Permission Description
executeExecute a stored procedure.
entrypoint
install

db_table

Inherits from: common database

Permission Description
useDeprecated
select
update
insert
delete
lock

db_tuple

Permission Description
relabelfrom
relabelto
useDeprecated
select
update
insert
delete

DBus Object Classes

dbus

Permission Description
acquire_svc
send_msgSend a message on the bus.

MLS Context Translation Object Classes

context

Permission Description
translateTranslate a raw MLS label.
containsCalculate a MLS subset.

NSCD Object Classes

nscd

Permission Description
getpwd
getgrp
gethost
getstat
admin
shmempwd
shmemgrp
shmemhost
getserv
shmemserv

Password Object Classes

passwd

Permission Description
passwdUpdate user password.
chfnChange finger information. e.g real name, work room and phone and home phone.
chshChange login shell.
rootokAllow update if the user is root and the process has the rootok PAM permission.
crontabcrontab on another user.

X Server Object Classes

x_application_data

Permission Description
paste
paste_after_confirm
copy

x_client

Permission Description
destroyClose down a client.
getattrGet the attributes of an X client
setattrSet the attributes of an X client
manage

x_colormap

Permission Description
createCreate a new Colormap.
destroyFree a Colormap.
readRead color cells of colormap.
write
getattrGet the color gamut of a screen.
add_color
remove_color
installCopy a virtual colormap into the display hardware.
uninstallRemove a virtual colormap from the display hardware.
use

x_cursor

Permission Description
createCreate an arbitrary cursor object.
destroyDelete a cursor object.
read
write
getattrGet attributes of the cursor.
setattrSet attributes of the cursor.
useAssociate a cursor object with a window.

x_device

Inherits from: common x_device

Permission Description
getattrsee common x_device: getattr
setattrsee common x_device: setattr
usesee common x_device: use
readsee common x_device: read
writesee common x_device: write
getfocussee common x_device: getfocus
setfocussee common x_device: setfocus
bellsee common x_device: bell
force_cursorsee common x_device: force_cursor
freezesee common x_device: freeze
grabsee common x_device: grab
managesee common x_device: manage
list_propertysee common x_device: list_property
get_propertysee common x_device: get_property
set_propertysee common x_device: set_property
addsee common x_device: add
removesee common x_device: remove

x_drawable

Permission Description
createCreate a Drawable object.
destroyDestroy a Drawable.
read
write
blend
getattrGet attributes of a Drawable object
setattrSet attributes of a Drawable object
list_child
add_child
remove_child
list_property
get_property
set_property
manage
override
show
hide
send
receive

x_event

Permission Description
send
receive

x_extension

Permission Description
query
use

x_font

Permission Description
createLoad a font.
destroyFree (dereference) a font.
getattrObtain font names, path, etc.
add_glyph
remove_glyph
useUse a font for drawing.

x_gc

Permission Description
createCreate Graphic Contexts object.
destroyFree (dereference) a Graphics Contexts object.
getattrGet attributes for Graphic Contexts object.
setattrSet attributes for Graphic Contexts object.
use

x_keyboard

Inherits from: common x_device

Permission Description
getattrsee common x_device: getattr
setattrsee common x_device: setattr
usesee common x_device: use
readsee common x_device: read
writesee common x_device: write
getfocussee common x_device: getfocus
setfocussee common x_device: setfocus
bellsee common x_device: bell
force_cursorsee common x_device: force_cursor
freezesee common x_device: freeze
grabsee common x_device: grab
managesee common x_device: manage
list_propertysee common x_device: list_property
get_propertysee common x_device: get_property
set_propertysee common x_device: set_property
addsee common x_device: add
removesee common x_device: remove

x_pointer

Inherits from: common x_device

Permission Description
getattrsee common x_device: getattr
setattrsee common x_device: setattr
usesee common x_device: use
readsee common x_device: read
writesee common x_device: write
getfocussee common x_device: getfocus
setfocussee common x_device: setfocus
bellsee common x_device: bell
force_cursorsee common x_device: force_cursor
freezesee common x_device: freeze
grabsee common x_device: grab
managesee common x_device: manage
list_propertysee common x_device: list_property
get_propertysee common x_device: get_property
set_propertysee common x_device: set_property
addsee common x_device: add
removesee common x_device: remove

x_property

Permission Description
createCreate property object.
destroyFree (dereference) a property object.
readRead a property.
writeWrite a property.
appendAppend a property.
getattrGet the attributes of a property.
setattrSet the attributes of a property.

x_resource

Permission Description
read
write

x_screen

Permission Description
getattr
setattr
hide_cursor
show_cursor
saver_getattr
saver_setattr
saver_hide
saver_show

x_selection

Permission Description
read
write
getattr
setattr

x_server

Permission Description
getattr
setattr
record
debug
grab
manage

x_synthetic_event

Permission Description
send
receive
Personal tools