Difference between revisions of "ObjectClassesPerms"
(New page: = '''SELinux Object Classes and Permissions Reference''' = This document contains a list of all of the object classes and permissions for modern SELinux systems (starting in kernel 2.6.0)....) |
(→process) |
||
(21 intermediate revisions by 3 users not shown) | |||
Line 12: | Line 12: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Create a new database object. | + | ||create||Create a new database object. |
|- | |- | ||
− | ||drop||Remove a database object. | + | ||drop||Remove a database object. |
|- | |- | ||
− | ||getattr||Get the attributes of a database object. | + | ||getattr||Get the attributes of a database object. |
|- | |- | ||
− | ||setattr||Set the attributes of a database object. | + | ||setattr||Set the attributes of a database object. |
|- | |- | ||
− | ||relabelfrom||Change the security context based on existing type. | + | ||relabelfrom||Change the security context based on existing type. |
|- | |- | ||
− | ||relabelto||Change the security context based on the new type. | + | ||relabelto||Change the security context based on the new type. |
|} | |} | ||
Line 30: | Line 30: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||getattr||Get file attributes for | + | ||getattr||Get file attributes for file, such as access mode. (e.g. stat, some ioctls. ...) |
|- | |- | ||
− | ||relabelto|| | + | ||relabelto||Relabel to new security context. |
|- | |- | ||
− | ||unlink||Remove hard link (delete). | + | ||unlink||Remove hard link (delete). |
|- | |- | ||
− | ||ioctl||IO control system call requests not addressed by other permissions. | + | ||ioctl||IO control system call requests not addressed by other permissions. |
|- | |- | ||
− | ||execute||Execute | + | ||execute||Execute |
|- | |- | ||
− | ||append|| | + | ||append||Write to a file opened with O_APPEND. |
|- | |- | ||
− | ||read||Read file contents. | + | ||read||Read file contents. |
|- | |- | ||
− | ||setattr||Change file attributes for | + | ||setattr||Change file attributes for file such as access mode. (e.g. chmod, some ioctls, ...) |
|- | |- | ||
− | ||swapon||Allows file to be used for paging/swapping space. | + | ||swapon||Allows file to be used for paging/swapping space. |
|- | |- | ||
− | ||write||Write | + | ||write||Write to a file. |
|- | |- | ||
− | ||lock||Set and unset | + | ||lock||Set and unset file locks. |
|- | |- | ||
− | ||create||Create new | + | ||create||Create new file. |
|- | |- | ||
− | ||rename||Rename a | + | ||rename||Rename a file. |
|- | |- | ||
− | ||mounton||Use as mount point; only useful for directories and files in Linux. | + | ||mounton||Use as mount point; only useful for directories and files in Linux. |
|- | |- | ||
− | ||quotaon|| | + | ||quotaon||Use as a quota file. |
|- | |- | ||
− | ||relabelfrom|| | + | ||relabelfrom||Relabel from old security context. |
|- | |- | ||
− | ||link||Create hard link to | + | ||link||Create another hard link to file |
|} | |} | ||
Line 70: | Line 70: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||write||Write | + | ||write||Write. |
|- | |- | ||
− | ||destroy||Destroy. | + | ||destroy||Destroy. |
|- | |- | ||
− | ||unix_write|| | + | ||unix_write||Generic write access. |
|- | |- | ||
− | ||getattr||Get | + | ||getattr||Get attributes, e.g. IPC_STAT *ctl operation. |
|- | |- | ||
− | ||create||Create. | + | ||create||Create. |
|- | |- | ||
− | ||read||Read | + | ||read||Read |
|- | |- | ||
− | ||setattr||Change | + | ||setattr||Change attributes, e.g. IPC_SET. |
|- | |- | ||
− | ||unix_read|| | + | ||unix_read||Generic read access. |
|- | |- | ||
− | ||associate||Associate a key | + | ||associate||Associate a key |
|} | |} | ||
Line 94: | Line 94: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||append||Write | + | ||append||Write to open fd marked with O_APPEND. |
|- | |- | ||
− | ||relabelfrom||Change the security context based on existing type. | + | ||relabelfrom||Change the security context based on existing type. |
|- | |- | ||
− | ||create||Create new socket | + | ||create||Create new socket. |
|- | |- | ||
− | ||read||Read socket | + | ||read||Read from socket. |
|- | |- | ||
− | ||sendto||Send | + | ||sendto||Send to socket. |
|- | |- | ||
− | ||connect||Initiate connection. | + | ||connect||Initiate connection. |
|- | |- | ||
− | ||recvfrom|| | + | ||recvfrom||Legacy NetLabel check; obsoleted by peer recv |
|- | |- | ||
− | ||send_msg|| | + | ||send_msg||Legacy check; no longer present. |
|- | |- | ||
− | ||bind||Bind name. | + | ||bind||Bind a name to the socket. |
|- | |- | ||
− | ||lock|| | + | ||lock||Apply file lock on a socket. |
|- | |- | ||
− | ||ioctl||IO control system call requests not addressed by other permissions. | + | ||ioctl||IO control system call requests not addressed by other permissions. |
|- | |- | ||
− | ||getattr||Get | + | ||getattr||Get socket attributes, e.g. fstat. |
|- | |- | ||
− | ||write||Write | + | ||write||Write to socket. |
|- | |- | ||
− | ||setopt||Set socket options. | + | ||setopt||Set socket options. |
|- | |- | ||
− | ||getopt||Get socket options. | + | ||getopt||Get socket options. |
|- | |- | ||
− | ||listen||Listen for connections. | + | ||listen||Listen for connections. |
|- | |- | ||
− | ||setattr||Change | + | ||setattr||Change socket attributes. |
|- | |- | ||
− | ||shutdown||Shutdown connection. | + | ||shutdown||Shutdown connection. |
|- | |- | ||
− | ||relabelto||Change the security context based on the new type. | + | ||relabelto||Change the security context based on the new type. |
|- | |- | ||
− | ||recv_msg|| | + | ||recv_msg||Obsolete. |
|- | |- | ||
− | ||accept||Accept a connection. | + | ||accept||Accept a connection. |
|- | |- | ||
− | ||name_bind|| | + | ||name_bind||Associate with port or file; for AF_INET sockets, controls relationship between a socket and it's port number; for AF_UNIX sockets, controls relationship between a socket and it's file |
+ | |} | ||
+ | |||
+ | === common x_device === | ||
+ | {| border="1" | ||
+ | ! Permission | ||
+ | ! Description | ||
+ | |- | ||
+ | ||getattr | ||
+ | |- | ||
+ | ||setattr | ||
+ | |- | ||
+ | ||use | ||
+ | |- | ||
+ | ||read | ||
+ | |- | ||
+ | ||write | ||
+ | |- | ||
+ | ||getfocus | ||
+ | |- | ||
+ | ||setfocus | ||
+ | |- | ||
+ | ||bell | ||
+ | |- | ||
+ | ||force_cursor | ||
+ | |- | ||
+ | ||freeze | ||
+ | |- | ||
+ | ||grab | ||
+ | |- | ||
+ | ||manage | ||
+ | |- | ||
+ | ||list_property | ||
+ | |- | ||
+ | ||get_property | ||
+ | |- | ||
+ | ||set_property | ||
+ | |- | ||
+ | ||add | ||
+ | |- | ||
+ | ||remove | ||
|} | |} | ||
== Kernel Object Classes == | == Kernel Object Classes == | ||
=== appletalk_socket === | === appletalk_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 147: | Line 187: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.18+ | + | ||append||see common socket:append||2.6.18+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.18+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.18+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.18+ | + | ||create||see common socket:create||2.6.18+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.18+ | + | ||read||see common socket:read||2.6.18+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.18+ | + | ||sendto||see common socket:sendto||2.6.18+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.18+ | + | ||connect||see common socket:connect||2.6.18+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.18+ | + | ||recvfrom||see common socket:recvfrom||2.6.18+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.18+ | + | ||send_msg||see common socket:send_msg||2.6.18+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.18+ | + | ||bind||see common socket:bind||2.6.18+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.18+ | + | ||lock||see common socket:lock||2.6.18+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.18+ | + | ||ioctl||see common socket:ioctl||2.6.18+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.18+ | + | ||getattr||see common socket:getattr||2.6.18+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.18+ | + | ||write||see common socket:write||2.6.18+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.18+ | + | ||setopt||see common socket:setopt||2.6.18+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.18+ | + | ||getopt||see common socket:getopt||2.6.18+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.18+ | + | ||listen||see common socket:listen||2.6.18+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.18+ | + | ||setattr||see common socket:setattr||2.6.18+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.18+ | + | ||shutdown||see common socket:shutdown||2.6.18+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.18+ | + | ||relabelto||see common socket:relabelto||2.6.18+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.18+ | + | ||recv_msg||see common socket:recv_msg||2.6.18+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.18+ | + | ||accept||see common socket:accept||2.6.18+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.18+ | + | ||name_bind||see common socket:name_bind||2.6.18+ |
|} | |} | ||
Line 198: | Line 238: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||sendto||Send to an IPSEC assocation.||2.6.12+ | + | ||sendto||Send to an IPSEC assocation.||2.6.12+ |
|- | |- | ||
− | ||recvfrom||Receive from an IPSEC association.||2.6.12+ | + | ||recvfrom||Receive from an IPSEC association.||2.6.12+ |
|- | |- | ||
− | ||setcontext||Set the context of an IPSEC association on creation.||2.6.16+ | + | ||setcontext||Set the context of an IPSEC association on creation.||2.6.16+ |
|- | |- | ||
− | ||polmatch||Match an IPSEC policy entry||2.6.19+ | + | ||polmatch||Match an IPSEC policy entry||2.6.19+ |
|} | |} | ||
=== blk_file === | === blk_file === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 214: | Line 254: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink||see common file:unlink | + | ||unlink||see common file:unlink |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute||see common file:execute | + | ||execute||see common file:execute |
|- | |- | ||
− | ||append||see common file:append | + | ||append||see common file:append |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon||see common file:swapon | + | ||swapon||see common file:swapon |
|- | |- | ||
− | ||write||see common file:write | + | ||write||see common file:write |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon||see common file:quotaon | + | ||quotaon||see common file:quotaon |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link||see common file:link | + | ||link||see common file:link |
|- | |- | ||
− | ||open||Open a block device file.||2.6.26+ / open_perms | + | ||open||Open a block device file.||2.6.26+ / open_perms |
|} | |} | ||
Line 257: | Line 297: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||chown|| | + | ||chown||Override restrictions on changing file ownership and group ownership. |
|- | |- | ||
− | ||dac_override|| | + | ||dac_override||Override all DAC access restrictions. Checked before dac_read_search, so a dontaudit candidate. |
|- | |- | ||
− | ||dac_read_search|| | + | ||dac_read_search||Override DAC read/search access restrictions. |
|- | |- | ||
− | ||fowner|| | + | ||fowner||Override all file owner requirements (e.g. for chmod, setxattr) except where fsetid applies. |
|- | |- | ||
− | ||fsetid|| | + | ||fsetid||Override file owner and group requirements when setting setuid or setgid bits on a file. Can be checked as a side effect on chmod and write operations; dontaudit candidate. |
|- | |- | ||
− | ||kill|| | + | ||kill||Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. |
|- | |- | ||
− | ||setgid||Allow setgid(2) | + | ||setgid||Allow setgid(2) or setgroups(2) or forged gids on credentials passed over a socket. |
|- | |- | ||
− | ||setuid||Allow | + | ||setuid||Allow set*uid(2). Allow passing of forged ids on credentials passed over a socket. |
|- | |- | ||
− | ||setpcap|| | + | ||setpcap||Add capability from bounding set to inheritable set, drop capability from bounding set, modify secure bits. |
|- | |- | ||
− | ||linux_immutable||Grant privilege to modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems. | + | ||linux_immutable||Grant privilege to modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems. |
|- | |- | ||
− | ||net_bind_service||Allow low port binding. Port < 1024 for TCP/UDP. VCI < 32 for ATM. | + | ||net_bind_service||Allow low port binding. Port < 1024 for TCP/UDP. VCI < 32 for ATM. |
|- | |- | ||
− | ||net_broadcast||Grant network broadcasting and listening to incoming multicasts. | + | ||net_broadcast||Grant network broadcasting and listening to incoming multicasts. |
|- | |- | ||
− | ||net_admin||Allows all networking configurations and modifications. See linux/capability.h for details. | + | ||net_admin||Allows all networking configurations and modifications. See linux/capability.h for details. |
|- | |- | ||
− | ||net_raw||Allows opening of raw sockets and packet sockets. | + | ||net_raw||Allows opening of raw sockets and packet sockets. |
|- | |- | ||
− | ||ipc_lock|| | + | ||ipc_lock||Allow locking shared memory segments and mlock/mlockall. |
|- | |- | ||
− | ||ipc_owner|| | + | ||ipc_owner||Override IPC ownership checks. |
|- | |- | ||
− | ||sys_module||Allow unrestricted kernel modification including but not limited to loading and removing kernel modules. Allows modification of kernels bounding capability mask. See sysctl. | + | ||sys_module||Allow unrestricted kernel modification including but not limited to loading and removing kernel modules. Allows modification of kernels bounding capability mask. See sysctl. |
|- | |- | ||
− | ||sys_rawio||Grant permission to use ioperm(2) and iopl(2) as well as the ability to send messages to USB devices via /proc/bus/usb. | + | ||sys_rawio||Grant permission to use ioperm(2) and iopl(2) as well as the ability to send messages to USB devices via /proc/bus/usb. |
|- | |- | ||
− | ||sys_chroot||Grant use of the chroot(2) call. | + | ||sys_chroot||Grant use of the chroot(2) call. |
|- | |- | ||
− | ||sys_ptrace||Allow a ptrace of any process. | + | ||sys_ptrace||Allow a ptrace of any process. |
|- | |- | ||
− | ||sys_pacct||Allow modification of accounting for any process. | + | ||sys_pacct||Allow modification of accounting for any process. |
|- | |- | ||
− | ||sys_admin||Too many to list here (see /usr/include/linux/capability.h) | + | ||sys_admin||Too many to list here (see /usr/include/linux/capability.h) |
|- | |- | ||
− | ||sys_boot||Grant ability to reboot the system. | + | ||sys_boot||Grant ability to reboot the system. |
|- | |- | ||
− | ||sys_nice||Grants | + | ||sys_nice||Grants privilege to change priority of any process. Grants change of scheduling algorithm used by any process. |
|- | |- | ||
− | ||sys_resource||Too many to list here (see /usr/include/linux/capability.h for details.) | + | ||sys_resource||Too many to list here (see /usr/include/linux/capability.h for details.) |
|- | |- | ||
− | ||sys_time||Grant permission to set system time and to set the real-time lock. | + | ||sys_time||Grant permission to set system time and to set the real-time lock. |
|- | |- | ||
− | ||sys_tty_config||Grant permission to configure tty devices. Allow vhangup(2) call on a tty. | + | ||sys_tty_config||Grant permission to configure tty devices. Allow vhangup(2) call on a tty. |
|- | |- | ||
− | ||mknod||Grants permission to creation of character and block device nodes. | + | ||mknod||Grants permission to creation of character and block device nodes. |
|- | |- | ||
− | ||lease||Grants ability to take leases on a file. For details on what leases are see fcntl(2). | + | ||lease||Grants ability to take leases on a file. For details on what leases are see fcntl(2). |
|- | |- | ||
− | ||audit_write|| | + | ||audit_write||Generate audit messages from user space.||2.6.12+ |
|- | |- | ||
− | ||audit_control|| | + | ||audit_control||Control kernel audit configuration/rules. Set login UID.||2.6.12+ |
|- | |- | ||
− | ||setfcap||Set file capabilities.||2.6.25+ | + | ||setfcap||Set file capabilities.||2.6.25+ |
|} | |} | ||
Line 328: | Line 368: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||mac_override|| | + | ||mac_override||Override MAC restrictions - Ignored by SELinux||2.6.25+ |
+ | |- | ||
+ | ||mac_admin||Change MAC configuration - For SELinux, get/set raw security context values unknown to the current policy.||2.6.25+ | ||
+ | |- | ||
+ | || syslog||Configure kernel syslog subsystem|| | ||
+ | |- | ||
+ | || wake_alarm||Trigger something that will wake the system|| | ||
|- | |- | ||
− | || | + | || block_suspend|| Prevent system suspends|| |
|} | |} | ||
=== chr_file === | === chr_file === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 340: | Line 386: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink||see common file:unlink | + | ||unlink||see common file:unlink |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute||see common file:execute | + | ||execute||see common file:execute |
|- | |- | ||
− | ||append||see common file:append | + | ||append||see common file:append |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon||see common file:swapon | + | ||swapon||see common file:swapon |
|- | |- | ||
− | ||write||see common file:write | + | ||write||see common file:write |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon||see common file:quotaon | + | ||quotaon||see common file:quotaon |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link||see common file:link | + | ||link||see common file:link |
|- | |- | ||
− | ||execute_no_trans||Execute a file in the callers domain.||2.6.11+ | + | ||execute_no_trans||Execute a file in the callers domain.||2.6.11+ |
|- | |- | ||
− | ||entrypoint||Can be executed as the entry point of the new domain in a transition.||2.6.11+ | + | ||entrypoint||Can be executed as the entry point of the new domain in a transition.||2.6.11+ |
|- | |- | ||
− | ||execmod||Make executable a file mapping that has been modified by copy-on-write.||2.6.11+ | + | ||execmod||Make executable a file mapping that has been modified by copy-on-write. (Text relocation)||2.6.11+ |
|- | |- | ||
− | ||open||Open a character device file.||2.6.26+ / open_perms | + | ||open||Open a character device file.||2.6.26+ / open_perms |
|} | |} | ||
=== dccp_socket === | === dccp_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 390: | Line 436: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.20+ | + | ||append||see common socket:append||2.6.20+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.20+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.20+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.20+ | + | ||create||see common socket:create||2.6.20+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.20+ | + | ||read||see common socket:read||2.6.20+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.20+ | + | ||sendto||see common socket:sendto||2.6.20+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.20+ | + | ||connect||see common socket:connect||2.6.20+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.20+ | + | ||recvfrom||see common socket:recvfrom||2.6.20+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.20+ | + | ||send_msg||see common socket:send_msg||2.6.20+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.20+ | + | ||bind||see common socket:bind||2.6.20+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.20+ | + | ||lock||see common socket:lock||2.6.20+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.20+ | + | ||ioctl||see common socket:ioctl||2.6.20+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.20+ | + | ||getattr||see common socket:getattr||2.6.20+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.20+ | + | ||write||see common socket:write||2.6.20+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.20+ | + | ||setopt||see common socket:setopt||2.6.20+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.20+ | + | ||getopt||see common socket:getopt||2.6.20+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.20+ | + | ||listen||see common socket:listen||2.6.20+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.20+ | + | ||setattr||see common socket:setattr||2.6.20+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.20+ | + | ||shutdown||see common socket:shutdown||2.6.20+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.20+ | + | ||relabelto||see common socket:relabelto||2.6.20+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.20+ | + | ||recv_msg||see common socket:recv_msg||2.6.20+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.20+ | + | ||accept||see common socket:accept||2.6.20+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.20+ | + | ||name_bind||see common socket:name_bind||2.6.20+ |
|- | |- | ||
− | ||connectto||Connect to server socket.||2.6.20+ | + | ||connectto||Connect to server socket.||2.6.20+ |
|- | |- | ||
− | ||newconn||Create new socket for connection.||2.6.20+ | + | ||newconn||Create new socket for connection.||2.6.20+ |
|- | |- | ||
− | ||acceptfrom||Accept connection from client socket.||2.6.20+ | + | ||acceptfrom||Accept connection from client socket.||2.6.20+ |
|- | |- | ||
− | ||node_bind||Ability to bind to a node.||2.6.20+ | + | ||node_bind||Ability to bind to a node.||2.6.20+ |
|- | |- | ||
− | ||name_connect||Connect to a specific port number.||2.6.20+ | + | ||name_connect||Connect to a specific port number.||2.6.20+ |
|} | |} | ||
=== dir === | === dir === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 452: | Line 498: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink|| | + | ||unlink||N/A |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute|| | + | ||execute||N/A |
|- | |- | ||
− | ||append|| | + | ||append||N/A |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon|| | + | ||swapon||N/A |
|- | |- | ||
− | ||write|| | + | ||write||General write access; required for adding or removing |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon|| | + | ||quotaon||N/A |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link|| | + | ||link||N/A |
|- | |- | ||
− | ||search||Search | + | ||search||Search access |
|- | |- | ||
− | ||rmdir||Remove | + | ||rmdir||Remove the directory |
|- | |- | ||
− | ||remove_name||Remove a file from the directory. | + | ||remove_name||Remove a file from the directory. |
|- | |- | ||
− | ||reparent|| | + | ||reparent||Rename into a different parent directory (.. change). |
|- | |- | ||
− | ||add_name||Add a file to the directory. | + | ||add_name||Add a file to the directory. |
|- | |- | ||
− | ||open||Open a directory.||2.6.26+ / open_perms | + | ||open||Open a directory.||2.6.26+ / open_perms |
|} | |} | ||
Line 505: | Line 551: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||use||Permission to use an inherited file descriptor | + | ||use||Permission to use an inherited file descriptor |
|} | |} | ||
=== fifo_file === | === fifo_file === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 515: | Line 561: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink||see common file:unlink | + | ||unlink||see common file:unlink |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute||see common file:execute | + | ||execute||see common file:execute |
|- | |- | ||
− | ||append||see common file:append | + | ||append||see common file:append |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon||see common file:swapon | + | ||swapon||see common file:swapon |
|- | |- | ||
− | ||write||see common file:write | + | ||write||see common file:write |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon||see common file:quotaon | + | ||quotaon||see common file:quotaon |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link||see common file:link | + | ||link||see common file:link |
|- | |- | ||
− | ||open||Open a FIFO.||2.6.26+ / open_perms | + | ||open||Open a FIFO.||2.6.26+ / open_perms |
|} | |} | ||
=== file === | === file === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 559: | Line 605: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink||see common file:unlink | + | ||unlink||see common file:unlink |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute||see common file:execute | + | ||execute||see common file:execute |
|- | |- | ||
− | ||append||see common file:append | + | ||append||see common file:append |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon||see common file:swapon | + | ||swapon||see common file:swapon |
|- | |- | ||
− | ||write||see common file:write | + | ||write||see common file:write |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon||see common file:quotaon | + | ||quotaon||see common file:quotaon |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link||see common file:link | + | ||link||see common file:link |
|- | |- | ||
− | ||execute_no_trans||Execute a file in the callers domain. | + | ||execute_no_trans||Execute a file in the callers domain. |
|- | |- | ||
− | ||entrypoint||Can be executed as the entry point of the new domain in a transition. | + | ||entrypoint||Can be executed as the entry point of the new domain in a transition. |
|- | |- | ||
− | ||execmod||Make executable a file mapping that has been modified by copy-on-write.||2.6.11+ | + | ||execmod||Make executable a file mapping that has been modified by copy-on-write. (Text relocation)||2.6.11+ |
|- | |- | ||
− | ||open||Open a file.||2.6.26+ / open_perms | + | ||open||Open a file.||2.6.26+ / open_perms |
|} | |} | ||
Line 608: | Line 654: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||mount||Mount the filesystem. | + | ||mount||Mount the filesystem. |
|- | |- | ||
− | ||remount||Change filesystem mount flags. | + | ||remount||Change filesystem mount flags. |
|- | |- | ||
− | ||unmount||Unmount the filesystem. | + | ||unmount||Unmount the filesystem. |
|- | |- | ||
− | ||getattr||Get file attributes, such as access mode. (e.g. stat, some ioctls. ...) | + | ||getattr||Get file attributes, such as access mode. (e.g. stat, some ioctls. ...) |
|- | |- | ||
− | ||relabelfrom||Change the security context based on existing type. | + | ||relabelfrom||Change the security context based on existing type. |
|- | |- | ||
− | ||relabelto||Change the security context based on the new type. | + | ||relabelto||Change the security context based on the new type. |
|- | |- | ||
− | ||transition||Transition to a new SID (change security context). | + | ||transition||Transition to a new SID (change security context). |
|- | |- | ||
− | ||associate||Associate a file to the filesystem. | + | ||associate||Associate a file to the filesystem. |
|- | |- | ||
− | ||quotamod||Modify quota information. | + | ||quotamod||Modify quota information. |
|- | |- | ||
− | ||quotaget||Get quota information | + | ||quotaget||Get quota information |
|} | |} | ||
=== ipc === | === ipc === | ||
− | Inherits from: [# | + | Inherits from: [[#common ipc|common ipc]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 636: | Line 682: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||write||see common ipc:write | + | ||write||see common ipc:write |
|- | |- | ||
− | ||destroy||see common ipc:destroy | + | ||destroy||see common ipc:destroy |
|- | |- | ||
− | ||unix_write||see common ipc:unix_write | + | ||unix_write||see common ipc:unix_write |
|- | |- | ||
− | ||getattr||see common ipc:getattr | + | ||getattr||see common ipc:getattr |
|- | |- | ||
− | ||create||see common ipc:create | + | ||create||see common ipc:create |
|- | |- | ||
− | ||read||see common ipc:read | + | ||read||see common ipc:read |
|- | |- | ||
− | ||setattr||see common ipc:setattr | + | ||setattr||see common ipc:setattr |
|- | |- | ||
− | ||unix_read||see common ipc:unix_read | + | ||unix_read||see common ipc:unix_read |
|- | |- | ||
− | ||associate||see common ipc:associate | + | ||associate||see common ipc:associate |
|} | |} | ||
Line 661: | Line 707: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||use_as_override||Grant a process the right to nominate an alternate process security ID for the kernel to use as an override for the SELinux subjective security when accessing stuff on behalf of another process.||2.6.29+ | + | ||use_as_override||Grant a process the right to nominate an alternate process security ID for the kernel to use as an override for the SELinux subjective security when accessing stuff on behalf of another process.||2.6.29+ |
|- | |- | ||
− | ||create_files_as||Grant a process the right to nominate a file creation label for a kernel service to use.||2.6.29+ | + | ||create_files_as||Grant a process the right to nominate a file creation label for a kernel service to use.||2.6.29+ |
|} | |} | ||
Line 672: | Line 718: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||view||||2.6.18+ | + | ||view||||2.6.18+ |
|- | |- | ||
− | ||read||||2.6.18+ | + | ||read||||2.6.18+ |
|- | |- | ||
− | ||write||||2.6.18+ | + | ||write||||2.6.18+ |
|- | |- | ||
− | ||search||||2.6.18+ | + | ||search||||2.6.18+ |
|- | |- | ||
− | ||link||||2.6.18+ | + | ||link||||2.6.18+ |
|- | |- | ||
− | ||setattr||||2.6.18+ | + | ||setattr||||2.6.18+ |
|- | |- | ||
− | ||create||||2.6.18+ | + | ||create||||2.6.18+ |
|} | |} | ||
=== key_socket === | === key_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 694: | Line 740: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|} | |} | ||
=== lnk_file === | === lnk_file === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 746: | Line 792: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink||see common file:unlink | + | ||unlink||see common file:unlink |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute||see common file:execute | + | ||execute||see common file:execute |
|- | |- | ||
− | ||append||see common file:append | + | ||append||see common file:append |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon||see common file:swapon | + | ||swapon||see common file:swapon |
|- | |- | ||
− | ||write||see common file:write | + | ||write||see common file:write |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon||see common file:quotaon | + | ||quotaon||see common file:quotaon |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link||see common file:link | + | ||link||see common file:link |
|} | |} | ||
Line 787: | Line 833: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||mmap_zero||Mmap the first page of memory.||2.6.23+ | + | ||mmap_zero||Mmap the first page of memory.||2.6.23+ |
|} | |} | ||
Line 796: | Line 842: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||receive||Remove a message from a queue. | + | ||receive||Remove a message from a queue. |
|- | |- | ||
− | ||send||Add a message to a queue. | + | ||send||Add a message to a queue. |
|} | |} | ||
=== msgq === | === msgq === | ||
− | Inherits from: [# | + | Inherits from: [[#common ipc|common ipc]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 808: | Line 854: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||write||see common ipc:write | + | ||write||see common ipc:write |
|- | |- | ||
− | ||destroy||see common ipc:destroy | + | ||destroy||see common ipc:destroy |
|- | |- | ||
− | ||unix_write||see common ipc:unix_write | + | ||unix_write||see common ipc:unix_write |
|- | |- | ||
− | ||getattr||see common ipc:getattr | + | ||getattr||see common ipc:getattr |
|- | |- | ||
− | ||create||see common ipc:create | + | ||create||see common ipc:create |
|- | |- | ||
− | ||read||see common ipc:read | + | ||read||see common ipc:read |
|- | |- | ||
− | ||setattr||see common ipc:setattr | + | ||setattr||see common ipc:setattr |
|- | |- | ||
− | ||unix_read||see common ipc:unix_read | + | ||unix_read||see common ipc:unix_read |
|- | |- | ||
− | ||associate||see common ipc:associate | + | ||associate||see common ipc:associate |
|- | |- | ||
− | ||enqueue||Message can be added to a queue. | + | ||enqueue||Message can be added to a queue. |
|} | |} | ||
Line 835: | Line 881: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||tcp_recv||Receive TCP packet. | + | ||tcp_recv||Receive TCP packet. |
|- | |- | ||
− | ||tcp_send||Send TCP packet. | + | ||tcp_send||Send TCP packet. |
|- | |- | ||
− | ||udp_recv||Receive UDP packet. | + | ||udp_recv||Receive UDP packet. |
|- | |- | ||
− | ||udp_send||Send UDP packet. | + | ||udp_send||Send UDP packet. |
|- | |- | ||
− | ||rawip_recv||Receive raw IP packet. | + | ||rawip_recv||Receive raw IP packet. |
|- | |- | ||
− | ||rawip_send||Send raw IP packet. | + | ||rawip_send||Send raw IP packet. |
|- | |- | ||
− | ||dccp_recv||Receive DCCP packet.||2.6.20+ | + | ||dccp_recv||Receive DCCP packet.||2.6.20+ |
|- | |- | ||
− | ||dccp_send||Send DCCP packet.||2.6.20+ | + | ||dccp_send||Send DCCP packet.||2.6.20+ |
|- | |- | ||
− | ||ingress||||2.6.25+ / network_peer_controls | + | ||ingress||||2.6.25+ / network_peer_controls |
|- | |- | ||
− | ||egress||||2.6.25+ / network_peer_controls | + | ||egress||||2.6.25+ / network_peer_controls |
|} | |} | ||
=== netlink_socket === | === netlink_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 863: | Line 909: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|} | |} | ||
=== netlink_audit_socket === | === netlink_audit_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 915: | Line 961: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|- | |- | ||
− | ||nlmsg_read||Read | + | ||nlmsg_read||Read audit subsystem state (e.g. AUDIT_GET).||2.6.8+ |
|- | |- | ||
− | ||nlmsg_write||Write | + | ||nlmsg_write||Write audit subsystem state (e.g. AUDIT_SET).||2.6.8+ |
|- | |- | ||
− | ||nlmsg_relay||Send user space audit messages to the kernel audit system.||2.6.12+ | + | ||nlmsg_relay||Send user space audit messages to the kernel audit system.||2.6.12+ |
|- | |- | ||
− | ||nlmsg_readpriv|| | + | ||nlmsg_readpriv||Read security-sensitive audit subsystem state.||2.6.12+ |
|- | |- | ||
− | ||nlmsg_tty_audit||Control TTY auditing||2.6.30+ | + | ||nlmsg_tty_audit||Control TTY auditing||2.6.30+ |
|} | |} | ||
=== netlink_dnrt_socket === | === netlink_dnrt_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 977: | Line 1,023: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|} | |} | ||
=== netlink_firewall_socket === | === netlink_firewall_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,029: | Line 1,075: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|- | |- | ||
− | ||nlmsg_read||Read | + | ||nlmsg_read||Read firewall configuration state.||2.6.8+ |
|- | |- | ||
− | ||nlmsg_write||Write | + | ||nlmsg_write||Write firewall configuration state.||2.6.8+ |
|} | |} | ||
=== netlink_ip6fw_socket === | === netlink_ip6fw_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,085: | Line 1,131: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|- | |- | ||
− | ||nlmsg_read||Read netlink message.||2.6.8+ | + | ||nlmsg_read||Read netlink message.||2.6.8+ |
|- | |- | ||
− | ||nlmsg_write||Write netlink message.||2.6.8+ | + | ||nlmsg_write||Write netlink message.||2.6.8+ |
|} | |} | ||
=== netlink_kobject_uevent_socket === | === netlink_kobject_uevent_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,141: | Line 1,187: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.12+ | + | ||append||see common socket:append||2.6.12+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.12+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.12+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.12+ | + | ||create||see common socket:create||2.6.12+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.12+ | + | ||read||see common socket:read||2.6.12+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.12+ | + | ||sendto||see common socket:sendto||2.6.12+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.12+ | + | ||connect||see common socket:connect||2.6.12+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.12+ | + | ||recvfrom||see common socket:recvfrom||2.6.12+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.12+ | + | ||send_msg||see common socket:send_msg||2.6.12+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.12+ | + | ||bind||see common socket:bind||2.6.12+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.12+ | + | ||lock||see common socket:lock||2.6.12+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.12+ | + | ||ioctl||see common socket:ioctl||2.6.12+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.12+ | + | ||getattr||see common socket:getattr||2.6.12+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.12+ | + | ||write||see common socket:write||2.6.12+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.12+ | + | ||setopt||see common socket:setopt||2.6.12+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.12+ | + | ||getopt||see common socket:getopt||2.6.12+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.12+ | + | ||listen||see common socket:listen||2.6.12+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.12+ | + | ||setattr||see common socket:setattr||2.6.12+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.12+ | + | ||shutdown||see common socket:shutdown||2.6.12+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.12+ | + | ||relabelto||see common socket:relabelto||2.6.12+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.12+ | + | ||recv_msg||see common socket:recv_msg||2.6.12+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.12+ | + | ||accept||see common socket:accept||2.6.12+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.12+ | + | ||name_bind||see common socket:name_bind||2.6.12+ |
|} | |} | ||
=== netlink_nflog_socket === | === netlink_nflog_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,193: | Line 1,239: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|} | |} | ||
=== netlink_route_socket === | === netlink_route_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,245: | Line 1,291: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|- | |- | ||
− | ||nlmsg_read||Read | + | ||nlmsg_read||Read route configuration state.||2.6.8+ |
|- | |- | ||
− | ||nlmsg_write||Write | + | ||nlmsg_write||Write route configuration state.||2.6.8+ |
|} | |} | ||
=== netlink_selinux_socket === | === netlink_selinux_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,301: | Line 1,347: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|} | |} | ||
=== netlink_tcpdiag_socket === | === netlink_tcpdiag_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,353: | Line 1,399: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|- | |- | ||
− | ||nlmsg_read||Read | + | ||nlmsg_read||Read tcp diagnostics.||2.6.8+ |
|- | |- | ||
− | ||nlmsg_write|| | + | ||nlmsg_write||Unused.||2.6.8+ |
|} | |} | ||
=== netlink_xfrm_socket === | === netlink_xfrm_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,409: | Line 1,455: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append||2.6.8+ | + | ||append||see common socket:append||2.6.8+ |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom||2.6.8+ | + | ||relabelfrom||see common socket:relabelfrom||2.6.8+ |
|- | |- | ||
− | ||create||see common socket:create||2.6.8+ | + | ||create||see common socket:create||2.6.8+ |
|- | |- | ||
− | ||read||see common socket:read||2.6.8+ | + | ||read||see common socket:read||2.6.8+ |
|- | |- | ||
− | ||sendto||see common socket:sendto||2.6.8+ | + | ||sendto||see common socket:sendto||2.6.8+ |
|- | |- | ||
− | ||connect||see common socket:connect||2.6.8+ | + | ||connect||see common socket:connect||2.6.8+ |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom||2.6.8+ | + | ||recvfrom||see common socket:recvfrom||2.6.8+ |
|- | |- | ||
− | ||send_msg||see common socket:send_msg||2.6.8+ | + | ||send_msg||see common socket:send_msg||2.6.8+ |
|- | |- | ||
− | ||bind||see common socket:bind||2.6.8+ | + | ||bind||see common socket:bind||2.6.8+ |
|- | |- | ||
− | ||lock||see common socket:lock||2.6.8+ | + | ||lock||see common socket:lock||2.6.8+ |
|- | |- | ||
− | ||ioctl||see common socket:ioctl||2.6.8+ | + | ||ioctl||see common socket:ioctl||2.6.8+ |
|- | |- | ||
− | ||getattr||see common socket:getattr||2.6.8+ | + | ||getattr||see common socket:getattr||2.6.8+ |
|- | |- | ||
− | ||write||see common socket:write||2.6.8+ | + | ||write||see common socket:write||2.6.8+ |
|- | |- | ||
− | ||setopt||see common socket:setopt||2.6.8+ | + | ||setopt||see common socket:setopt||2.6.8+ |
|- | |- | ||
− | ||getopt||see common socket:getopt||2.6.8+ | + | ||getopt||see common socket:getopt||2.6.8+ |
|- | |- | ||
− | ||listen||see common socket:listen||2.6.8+ | + | ||listen||see common socket:listen||2.6.8+ |
|- | |- | ||
− | ||setattr||see common socket:setattr||2.6.8+ | + | ||setattr||see common socket:setattr||2.6.8+ |
|- | |- | ||
− | ||shutdown||see common socket:shutdown||2.6.8+ | + | ||shutdown||see common socket:shutdown||2.6.8+ |
|- | |- | ||
− | ||relabelto||see common socket:relabelto||2.6.8+ | + | ||relabelto||see common socket:relabelto||2.6.8+ |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg||2.6.8+ | + | ||recv_msg||see common socket:recv_msg||2.6.8+ |
|- | |- | ||
− | ||accept||see common socket:accept||2.6.8+ | + | ||accept||see common socket:accept||2.6.8+ |
|- | |- | ||
− | ||name_bind||see common socket:name_bind||2.6.8+ | + | ||name_bind||see common socket:name_bind||2.6.8+ |
|- | |- | ||
− | ||nlmsg_read||Read | + | ||nlmsg_read||Read xfrm configuration state.||2.6.8+ |
|- | |- | ||
− | ||nlmsg_write||Write | + | ||nlmsg_write||Write xfrm configuration state.||2.6.8+ |
|} | |} | ||
Line 1,464: | Line 1,510: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||tcp_recv||Receive TCP packet. | + | ||tcp_recv||Receive TCP packet. |
|- | |- | ||
− | ||tcp_send||Send TCP packet. | + | ||tcp_send||Send TCP packet. |
|- | |- | ||
− | ||udp_recv||Receive UDP packet. | + | ||udp_recv||Receive UDP packet. |
|- | |- | ||
− | ||udp_send||Send UDP packet. | + | ||udp_send||Send UDP packet. |
|- | |- | ||
− | ||rawip_recv||Receive raw IP packet. | + | ||rawip_recv||Receive raw IP packet. |
|- | |- | ||
− | ||rawip_send||Send raw IP packet. | + | ||rawip_send||Send raw IP packet. |
|- | |- | ||
− | ||enforce_dest||Ensure that the destination node can enforce restrictions on the destination socket. | + | ||enforce_dest||Ensure that the destination node can enforce restrictions on the destination socket. |
|- | |- | ||
− | ||dccp_recv||Receive DCCP packet.||2.6.20+ | + | ||dccp_recv||Receive DCCP packet.||2.6.20+ |
|- | |- | ||
− | ||dccp_send||Send DCCP packet.||2.6.20+ | + | ||dccp_send||Send DCCP packet.||2.6.20+ |
|- | |- | ||
− | ||recvfrom||||2.6.25+ / network_peer_controls | + | ||recvfrom||||2.6.25+ / network_peer_controls |
|- | |- | ||
− | ||sendto||||2.6.25+ / network_peer_controls | + | ||sendto||||2.6.25+ / network_peer_controls |
|} | |} | ||
Line 1,493: | Line 1,539: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||send||Send a packet.||2.6.18+ | + | ||send||Send a packet.||2.6.18+ |
|- | |- | ||
− | ||receive||Receive a packet.||2.6.18+ | + | ||receive||Receive a packet.||2.6.18+ |
|- | |- | ||
− | ||relabelto||Set a labeling rule to the specified type.||2.6.18+ | + | ||relabelto||Set a labeling rule to the specified type.||2.6.18+ |
|- | |- | ||
− | ||flow_in||''Deprecated''||2.6.25+ | + | ||flow_in||''Deprecated''||2.6.25+ |
|- | |- | ||
− | ||flow_out||''Deprecated''||2.6.25+ | + | ||flow_out||''Deprecated''||2.6.25+ |
|- | |- | ||
− | ||forward_in||||2.6.25+ | + | ||forward_in||||2.6.25+ |
|- | |- | ||
− | ||forward_out||||2.6.25+ | + | ||forward_out||||2.6.25+ |
|} | |} | ||
=== packet_socket === | === packet_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,515: | Line 1,561: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|} | |} | ||
Line 1,566: | Line 1,612: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||recv||Receive from a labeled networking peer.||2.6.25+ / network_peer_controls | + | ||recv||Receive from a labeled networking peer.||2.6.25+ / network_peer_controls |
|} | |} | ||
Line 1,575: | Line 1,621: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||fork||Fork into two processes. | + | ||fork||Fork into two processes. |
|- | |- | ||
− | ||transition||Transition to a new context on exec(). | + | ||transition||Transition to a new context on exec(). |
|- | |- | ||
− | ||sigchld||Send SIGCHLD signal. | + | ||sigchld||Send SIGCHLD signal. |
|- | |- | ||
− | ||sigkill||Send SIGKILL signal. | + | ||sigkill||Send SIGKILL signal. |
|- | |- | ||
− | ||sigstop||Send SIGSTOP signal | + | ||sigstop||Send SIGSTOP signal |
|- | |- | ||
− | ||signull||Test for exisitence of another process without sending a signal | + | ||signull||Test for exisitence of another process without sending a signal |
|- | |- | ||
− | ||signal||Send a signal other than SIGKILL, SIGSTOP, or SIGCHLD. | + | ||signal||Send a signal other than SIGKILL, SIGSTOP, or SIGCHLD. |
|- | |- | ||
− | ||ptrace|| | + | ||ptrace||Attach to another process for tracing. |
|- | |- | ||
− | ||getsched||Get priority of a process. | + | ||getsched||Get priority of a process. |
|- | |- | ||
− | ||setsched||Set priority of a process. | + | ||setsched||Set priority of a process. |
|- | |- | ||
− | ||getsession||Get session ID of another process. | + | ||getsession||Get session ID of another process. |
|- | |- | ||
− | ||getpgid||Get group Process ID of a process. | + | ||getpgid||Get group Process ID of a process. |
|- | |- | ||
− | ||setpgid||Set group Process ID of a process. | + | ||setpgid||Set group Process ID of a process. |
|- | |- | ||
− | ||getcap||Get Linux capabilities. | + | ||getcap||Get Linux capabilities. |
|- | |- | ||
− | ||setcap||Set Linux capabilities. | + | ||setcap||Set Linux capabilities. |
|- | |- | ||
− | ||share||Allow state sharing with cloned or forked process. | + | ||share||Allow state sharing with cloned or forked process. |
|- | |- | ||
− | ||getattr||Get attributes of a file. | + | ||getattr||Get attributes of a file. |
|- | |- | ||
− | ||setexec||Override the default context for the next exec(). | + | ||setexec||Override the default context for the next exec(). |
|- | |- | ||
− | ||setfscreate||Override the default context for file creation. | + | ||setfscreate||Override the default context for file creation. |
|- | |- | ||
− | ||setrlimit||Change process hard limits. | + | ||setrlimit||Change process hard limits. |
|- | |- | ||
− | ||noatsecure||Disable secure mode environment cleansing (AT_SECURE).||v.16+ | + | ||noatsecure||Disable secure mode environment cleansing (AT_SECURE).||v.16+ |
|- | |- | ||
− | ||siginh||Inherit signal state from | + | ||siginh||Inherit signal state from caller.||v.16+ |
|- | |- | ||
− | ||rlimitinh||Inherit resource limits from | + | ||rlimitinh||Inherit resource limits from caller.||v.16+ |
|- | |- | ||
− | ||dyntransition||Dynamically transition to a new context.||2.6.11+ | + | ||dyntransition||Dynamically transition to a new context.||2.6.11+ |
|- | |- | ||
− | ||setcurrent||Set the current process context.||2.6.11+ | + | ||setcurrent||Set the current process context.||2.6.11+ |
|- | |- | ||
− | ||execmem||Make executable an anonymous mapping or private file mapping that is writable.||2.6.13+ | + | ||execmem||Make executable an anonymous mapping or private file mapping that is writable.||2.6.13+ |
|- | |- | ||
− | ||execstack||Make the main process stack executable.||2.6.13+ | + | ||execstack||Make the main process stack executable.||2.6.13+ |
|- | |- | ||
− | ||execheap||Make the heap executable.||2.6.13+ | + | ||execheap||Make the heap executable.||2.6.13+ |
|- | |- | ||
− | ||setkeycreate||Override the default context for key creation.||2.6.18+ | + | ||setkeycreate||Override the default context for key creation.||2.6.18+ |
|- | |- | ||
− | ||setsockcreate||Override the default context for socket creation.||2.6.18+ | + | ||setsockcreate||Override the default context for socket creation.||2.6.18+ |
|} | |} | ||
=== rawip_socket === | === rawip_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,643: | Line 1,689: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|- | |- | ||
− | ||node_bind||Ability to bind to a node.||v.17+ | + | ||node_bind||Ability to bind to a node.||v.17+ |
|} | |} | ||
Line 1,696: | Line 1,742: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||compute_user||Get user info in selinuxfs. | + | ||compute_user||Get user info in selinuxfs. |
|- | |- | ||
− | ||compute_relabel||Get relabel info in selinuxfs. | + | ||compute_relabel||Get relabel info in selinuxfs. |
|- | |- | ||
− | ||compute_create||Get create info in selinuxfs. | + | ||compute_create||Get create info in selinuxfs. |
|- | |- | ||
− | ||compute_av||Compute an access vector given a source/target/class. | + | ||compute_av||Compute an access vector given a source/target/class. |
|- | |- | ||
− | ||compute_member||Determines the context to use when selecting a member of a polyinstantiated object. | + | ||compute_member||Determines the context to use when selecting a member of a polyinstantiated object. |
|- | |- | ||
− | ||setenforce||Change the enforcement state of SELinux. | + | ||setenforce||Change the enforcement state of SELinux. |
|- | |- | ||
− | ||check_context||Write context in selinuxfs. | + | ||check_context||Write context in selinuxfs. |
|- | |- | ||
− | ||load_policy||Load the security policy. | + | ||load_policy||Load the security policy. |
|- | |- | ||
− | ||setbool||Set a boolean value.||2.6.5+ | + | ||setbool||Set a boolean value.||2.6.5+ |
|- | |- | ||
− | ||setsecparam||Set kernel access vector cache tuning parameters.||2.6.11+ | + | ||setsecparam||Set kernel access vector cache tuning parameters.||2.6.11+ |
|- | |- | ||
− | ||setcheckreqprot||Set if SELinux will check original protection mode or modified protection mode (read-implies-exec) for mmap/mprotect.||2.6.12+ | + | ||setcheckreqprot||Set if SELinux will check original protection mode or modified protection mode (read-implies-exec) for mmap/mprotect.||2.6.12+ |
|} | |} | ||
=== sem === | === sem === | ||
− | Inherits from: [# | + | Inherits from: [[#common ipc|common ipc]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,726: | Line 1,772: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||write||see common ipc:write | + | ||write||see common ipc:write |
|- | |- | ||
− | ||destroy||see common ipc:destroy | + | ||destroy||see common ipc:destroy |
|- | |- | ||
− | ||unix_write||see common ipc:unix_write | + | ||unix_write||see common ipc:unix_write |
|- | |- | ||
− | ||getattr||see common ipc:getattr | + | ||getattr||see common ipc:getattr |
|- | |- | ||
− | ||create||see common ipc:create | + | ||create||see common ipc:create |
|- | |- | ||
− | ||read||see common ipc:read | + | ||read||see common ipc:read |
|- | |- | ||
− | ||setattr||see common ipc:setattr | + | ||setattr||see common ipc:setattr |
|- | |- | ||
− | ||unix_read||see common ipc:unix_read | + | ||unix_read||see common ipc:unix_read |
|- | |- | ||
− | ||associate||see common ipc:associate | + | ||associate||see common ipc:associate |
|} | |} | ||
=== shm === | === shm === | ||
− | Inherits from: [# | + | Inherits from: [[#common ipc|common ipc]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,752: | Line 1,798: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||write||see common ipc:write | + | ||write||see common ipc:write |
|- | |- | ||
− | ||destroy||see common ipc:destroy | + | ||destroy||see common ipc:destroy |
|- | |- | ||
− | ||unix_write||see common ipc:unix_write | + | ||unix_write||see common ipc:unix_write |
|- | |- | ||
− | ||getattr||see common ipc:getattr | + | ||getattr||see common ipc:getattr |
|- | |- | ||
− | ||create||see common ipc:create | + | ||create||see common ipc:create |
|- | |- | ||
− | ||read||see common ipc:read | + | ||read||see common ipc:read |
|- | |- | ||
− | ||setattr||see common ipc:setattr | + | ||setattr||see common ipc:setattr |
|- | |- | ||
− | ||unix_read||see common ipc:unix_read | + | ||unix_read||see common ipc:unix_read |
|- | |- | ||
− | ||associate||see common ipc:associate | + | ||associate||see common ipc:associate |
|- | |- | ||
− | ||lock||(Un)lock page(s) in memory. | + | ||lock||(Un)lock page(s) in memory. |
|} | |} | ||
=== sock_file === | === sock_file === | ||
− | Inherits from: [# | + | Inherits from: [[#common file|common file]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,780: | Line 1,826: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||getattr||see common file:getattr | + | ||getattr||see common file:getattr |
|- | |- | ||
− | ||relabelto||see common file:relabelto | + | ||relabelto||see common file:relabelto |
|- | |- | ||
− | ||unlink||see common file:unlink | + | ||unlink||see common file:unlink |
|- | |- | ||
− | ||ioctl||see common file:ioctl | + | ||ioctl||see common file:ioctl |
|- | |- | ||
− | ||execute||see common file:execute | + | ||execute||see common file:execute |
|- | |- | ||
− | ||append||see common file:append | + | ||append||see common file:append |
|- | |- | ||
− | ||read||see common file:read | + | ||read||see common file:read |
|- | |- | ||
− | ||setattr||see common file:setattr | + | ||setattr||see common file:setattr |
|- | |- | ||
− | ||swapon||see common file:swapon | + | ||swapon||see common file:swapon |
|- | |- | ||
− | ||write||see common file:write | + | ||write||see common file:write |
|- | |- | ||
− | ||lock||see common file:lock | + | ||lock||see common file:lock |
|- | |- | ||
− | ||create||see common file:create | + | ||create||see common file:create |
|- | |- | ||
− | ||rename||see common file:rename | + | ||rename||see common file:rename |
|- | |- | ||
− | ||mounton||see common file:mounton | + | ||mounton||see common file:mounton |
|- | |- | ||
− | ||quotaon||see common file:quotaon | + | ||quotaon||see common file:quotaon |
|- | |- | ||
− | ||relabelfrom||see common file:relabelfrom | + | ||relabelfrom||see common file:relabelfrom |
|- | |- | ||
− | ||link||see common file:link | + | ||link||see common file:link |
|- | |- | ||
− | ||open||Open a named socket file.||2.6.26+ / open_perms | + | ||open||Open a named socket file.||2.6.26+ / open_perms |
|} | |} | ||
=== socket === | === socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,824: | Line 1,870: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|} | |} | ||
Line 1,875: | Line 1,921: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||ipc_info||Get info for an ipc socket. | + | ||ipc_info||Get info for an ipc socket. |
|- | |- | ||
− | ||syslog_mod||Perform syslog operation other than syslog_read or console logging. | + | ||syslog_mod||Perform syslog operation other than syslog_read or console logging. |
|- | |- | ||
− | ||syslog_read||Perform syslog read. | + | ||syslog_read||Perform syslog read. |
|- | |- | ||
− | ||syslog_console||Perform syslog console. | + | ||syslog_console||Perform syslog console. |
|} | |} | ||
=== tcp_socket === | === tcp_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,891: | Line 1,937: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|- | |- | ||
− | ||connectto||Connect to server socket. | + | ||connectto||Connect to server socket. |
|- | |- | ||
− | ||newconn||Create new socket for connection. | + | ||newconn||Create new socket for connection. |
|- | |- | ||
− | ||acceptfrom||Accept connection from client socket. | + | ||acceptfrom||Accept connection from client socket. |
|- | |- | ||
− | ||node_bind||Ability to bind to a node.||2.6.2+ | + | ||node_bind||Ability to bind to a node.||2.6.2+ |
|- | |- | ||
− | ||name_connect||Connect to a specific port number.||2.6.12+|| | + | ||name_connect||Connect to a specific port number.||2.6.12+ |
+ | |} | ||
+ | |||
+ | === tun_socket === | ||
+ | Inherits from: [[#common socket|common socket]] | ||
+ | {| border="1" | ||
+ | ! Permission | ||
+ | ! Description | ||
+ | ! Kernel Version/Capability | ||
+ | |- | ||
+ | ||append||see common socket:append||2.6.32+ | ||
+ | |- | ||
+ | ||relabelfrom||see common socket:relabelfrom||2.6.32+ | ||
+ | |- | ||
+ | ||create||see common socket:create||2.6.32+ | ||
+ | |- | ||
+ | ||read||see common socket:read||2.6.32+ | ||
+ | |- | ||
+ | ||sendto||see common socket:sendto||2.6.32+ | ||
+ | |- | ||
+ | ||connect||see common socket:connect||2.6.32+ | ||
+ | |- | ||
+ | ||recvfrom||see common socket:recvfrom||2.6.32+ | ||
+ | |- | ||
+ | ||send_msg||see common socket:send_msg||2.6.32+ | ||
+ | |- | ||
+ | ||bind||see common socket:bind||2.6.32+ | ||
+ | |- | ||
+ | ||lock||see common socket:lock||2.6.32+ | ||
+ | |- | ||
+ | ||ioctl||see common socket:ioctl||2.6.32+ | ||
+ | |- | ||
+ | ||getattr||see common socket:getattr||2.6.32+ | ||
+ | |- | ||
+ | ||write||see common socket:write||2.6.32+ | ||
+ | |- | ||
+ | ||setopt||see common socket:setopt||2.6.32+ | ||
+ | |- | ||
+ | ||getopt||see common socket:getopt||2.6.32+ | ||
+ | |- | ||
+ | ||listen||see common socket:listen||2.6.32+ | ||
+ | |- | ||
+ | ||setattr||see common socket:setattr||2.6.32+ | ||
+ | |- | ||
+ | ||shutdown||see common socket:shutdown||2.6.32+ | ||
+ | |- | ||
+ | ||relabelto||see common socket:relabelto||2.6.32+ | ||
+ | |- | ||
+ | ||recv_msg||see common socket:recv_msg||2.6.32+ | ||
+ | |- | ||
+ | ||accept||see common socket:accept||2.6.32+ | ||
+ | |- | ||
+ | ||name_bind||see common socket:name_bind||2.6.32+ | ||
|} | |} | ||
=== udp_socket === | === udp_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 1,953: | Line 2,051: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|- | |- | ||
− | ||node_bind||Ability to bind to a node.||2.6.2+ | + | ||node_bind||Ability to bind to a node.||2.6.2+ |
|} | |} | ||
=== unix_dgram_socket === | === unix_dgram_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 2,007: | Line 2,105: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|} | |} | ||
=== unix_stream_socket === | === unix_stream_socket === | ||
− | Inherits from: [# | + | Inherits from: [[#common socket|common socket]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
Line 2,059: | Line 2,157: | ||
! Kernel Version/Capability | ! Kernel Version/Capability | ||
|- | |- | ||
− | ||append||see common socket:append | + | ||append||see common socket:append |
|- | |- | ||
− | ||relabelfrom||see common socket:relabelfrom | + | ||relabelfrom||see common socket:relabelfrom |
|- | |- | ||
− | ||create||see common socket:create | + | ||create||see common socket:create |
|- | |- | ||
− | ||read||see common socket:read | + | ||read||see common socket:read |
|- | |- | ||
− | ||sendto||see common socket:sendto | + | ||sendto||see common socket:sendto |
|- | |- | ||
− | ||connect||see common socket:connect | + | ||connect||see common socket:connect |
|- | |- | ||
− | ||recvfrom||see common socket:recvfrom | + | ||recvfrom||see common socket:recvfrom |
|- | |- | ||
− | ||send_msg||see common socket:send_msg | + | ||send_msg||see common socket:send_msg |
|- | |- | ||
− | ||bind||see common socket:bind | + | ||bind||see common socket:bind |
|- | |- | ||
− | ||lock||see common socket:lock | + | ||lock||see common socket:lock |
|- | |- | ||
− | ||ioctl||see common socket:ioctl | + | ||ioctl||see common socket:ioctl |
|- | |- | ||
− | ||getattr||see common socket:getattr | + | ||getattr||see common socket:getattr |
|- | |- | ||
− | ||write||see common socket:write | + | ||write||see common socket:write |
|- | |- | ||
− | ||setopt||see common socket:setopt | + | ||setopt||see common socket:setopt |
|- | |- | ||
− | ||getopt||see common socket:getopt | + | ||getopt||see common socket:getopt |
|- | |- | ||
− | ||listen||see common socket:listen | + | ||listen||see common socket:listen |
|- | |- | ||
− | ||setattr||see common socket:setattr | + | ||setattr||see common socket:setattr |
|- | |- | ||
− | ||shutdown||see common socket:shutdown | + | ||shutdown||see common socket:shutdown |
|- | |- | ||
− | ||relabelto||see common socket:relabelto | + | ||relabelto||see common socket:relabelto |
|- | |- | ||
− | ||recv_msg||see common socket:recv_msg | + | ||recv_msg||see common socket:recv_msg |
|- | |- | ||
− | ||accept||see common socket:accept | + | ||accept||see common socket:accept |
|- | |- | ||
− | ||name_bind||see common socket:name_bind | + | ||name_bind||see common socket:name_bind |
|- | |- | ||
− | ||connectto||Connect to server socket. | + | ||connectto||Connect to server socket. |
|- | |- | ||
− | ||newconn||Create new socket for connection. | + | ||newconn||Create new socket for connection. |
|- | |- | ||
− | ||acceptfrom||Accept connection from client socket. | + | ||acceptfrom||Accept connection from client socket. |
|} | |} | ||
== Database Object Classes == | == Database Object Classes == | ||
=== db_blob === | === db_blob === | ||
− | Inherits from: [# | + | Inherits from: [[#common database|common database]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
! Description | ! Description | ||
|- | |- | ||
− | ||read||Read a blob. | + | ||read||Read a blob. |
|- | |- | ||
− | ||write||Write a blob. | + | ||write||Write a blob. |
|- | |- | ||
− | ||import||Import a blob. | + | ||import||Import a blob. |
|- | |- | ||
− | ||export||Export a blob. | + | ||export||Export a blob. |
|} | |} | ||
=== db_column === | === db_column === | ||
− | Inherits from: [# | + | Inherits from: [[#common database|common database]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
! Description | ! Description | ||
|- | |- | ||
− | ||use||''Deprecated'' | + | ||use||''Deprecated'' |
|- | |- | ||
− | ||select | + | ||select |
|- | |- | ||
− | ||update | + | ||update |
|- | |- | ||
− | ||insert | + | ||insert |
|} | |} | ||
=== db_database === | === db_database === | ||
− | Inherits from: [# | + | Inherits from: [[#common database|common database]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
! Description | ! Description | ||
|- | |- | ||
− | ||access | + | ||access |
|- | |- | ||
− | ||install_module | + | ||install_module |
|- | |- | ||
− | ||load_module | + | ||load_module |
|- | |- | ||
− | ||get_param||''Deprecated'' | + | ||get_param||''Deprecated'' |
|- | |- | ||
− | ||set_param||''Deprecated'' | + | ||set_param||''Deprecated'' |
|} | |} | ||
=== db_procedure === | === db_procedure === | ||
− | Inherits from: [# | + | Inherits from: [[#common database|common database]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
! Description | ! Description | ||
|- | |- | ||
− | ||execute||Execute a stored procedure. | + | ||execute||Execute a stored procedure. |
|- | |- | ||
− | ||entrypoint | + | ||entrypoint |
|- | |- | ||
− | ||install | + | ||install |
|} | |} | ||
=== db_table === | === db_table === | ||
− | Inherits from: [# | + | Inherits from: [[#common database|common database]] |
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
! Description | ! Description | ||
|- | |- | ||
− | ||use||''Deprecated'' | + | ||use||''Deprecated'' |
|- | |- | ||
− | ||select | + | ||select |
|- | |- | ||
− | ||update | + | ||update |
|- | |- | ||
− | ||insert | + | ||insert |
|- | |- | ||
− | ||delete | + | ||delete |
|- | |- | ||
− | ||lock | + | ||lock |
|} | |} | ||
Line 2,195: | Line 2,293: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||relabelfrom | + | ||relabelfrom |
|- | |- | ||
− | ||relabelto | + | ||relabelto |
|- | |- | ||
− | ||use||''Deprecated'' | + | ||use||''Deprecated'' |
|- | |- | ||
− | ||select | + | ||select |
|- | |- | ||
− | ||update | + | ||update |
|- | |- | ||
− | ||insert | + | ||insert |
|- | |- | ||
− | ||delete | + | ||delete |
|} | |} | ||
Line 2,216: | Line 2,314: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||acquire_svc | + | ||acquire_svc |
|- | |- | ||
− | ||send_msg||Send a message on the bus. | + | ||send_msg||Send a message on the bus. |
|} | |} | ||
Line 2,227: | Line 2,325: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||translate||Translate a raw MLS label. | + | ||translate||Translate a raw MLS label. |
|- | |- | ||
− | ||contains||Calculate a MLS subset. | + | ||contains||Calculate a MLS subset. |
|} | |} | ||
Line 2,238: | Line 2,336: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||getpwd | + | ||getpwd |
|- | |- | ||
− | ||getgrp | + | ||getgrp |
|- | |- | ||
− | ||gethost | + | ||gethost |
|- | |- | ||
− | ||getstat | + | ||getstat |
|- | |- | ||
− | ||admin | + | ||admin |
|- | |- | ||
− | ||shmempwd | + | ||shmempwd |
|- | |- | ||
− | ||shmemgrp | + | ||shmemgrp |
|- | |- | ||
− | ||shmemhost | + | ||shmemhost |
|- | |- | ||
− | ||getserv | + | ||getserv |
|- | |- | ||
− | ||shmemserv | + | ||shmemserv |
|} | |} | ||
Line 2,265: | Line 2,363: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||passwd||Update user password. | + | ||passwd||Update user password. |
|- | |- | ||
− | ||chfn||Change finger information. e.g real name, work room and phone and home phone. | + | ||chfn||Change finger information. e.g real name, work room and phone and home phone. |
|- | |- | ||
− | ||chsh||Change login shell. | + | ||chsh||Change login shell. |
|- | |- | ||
− | ||rootok||Allow update if the user is root and the process has the rootok PAM permission. | + | ||rootok||Allow update if the user is root and the process has the rootok PAM permission. |
|- | |- | ||
− | ||crontab||crontab on another user. | + | ||crontab||crontab on another user. |
|} | |} | ||
Line 2,282: | Line 2,380: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||paste | + | ||paste |
|- | |- | ||
− | ||paste_after_confirm | + | ||paste_after_confirm |
|- | |- | ||
− | ||copy | + | ||copy |
|} | |} | ||
Line 2,294: | Line 2,392: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||destroy||Close down a client. | + | ||destroy||Close down a client. |
|- | |- | ||
− | ||getattr||Get the attributes of an X client | + | ||getattr||Get the attributes of an X client |
|- | |- | ||
− | ||setattr||Set the attributes of an X client | + | ||setattr||Set the attributes of an X client |
|- | |- | ||
− | ||manage | + | ||manage |
|} | |} | ||
Line 2,308: | Line 2,406: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Create a new Colormap. | + | ||create||Create a new Colormap. |
|- | |- | ||
− | ||destroy||Free a Colormap. | + | ||destroy||Free a Colormap. |
|- | |- | ||
− | ||read||Read color cells of colormap. | + | ||read||Read color cells of colormap. |
|- | |- | ||
− | ||write | + | ||write |
|- | |- | ||
− | ||getattr||Get the color gamut of a screen. | + | ||getattr||Get the color gamut of a screen. |
|- | |- | ||
− | ||add_color | + | ||add_color |
|- | |- | ||
− | ||remove_color | + | ||remove_color |
|- | |- | ||
− | ||install||Copy a virtual colormap into the display hardware. | + | ||install||Copy a virtual colormap into the display hardware. |
|- | |- | ||
− | ||uninstall||Remove a virtual colormap from the display hardware. | + | ||uninstall||Remove a virtual colormap from the display hardware. |
|- | |- | ||
− | ||use | + | ||use |
|} | |} | ||
Line 2,334: | Line 2,432: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Create an arbitrary cursor object. | + | ||create||Create an arbitrary cursor object. |
|- | |- | ||
− | ||destroy||Delete a cursor object. | + | ||destroy||Delete a cursor object. |
|- | |- | ||
− | ||read | + | ||read |
|- | |- | ||
− | ||write | + | ||write |
|- | |- | ||
− | ||getattr||Get attributes of the cursor. | + | ||getattr||Get attributes of the cursor. |
|- | |- | ||
− | ||setattr||Set attributes of the cursor. | + | ||setattr||Set attributes of the cursor. |
|- | |- | ||
− | ||use||Associate a cursor object with a window. | + | ||use||Associate a cursor object with a window. |
|} | |} | ||
=== x_device === | === x_device === | ||
+ | Inherits from: [[#common x_device|common x_device]] | ||
{| border="1" | {| border="1" | ||
! Permission | ! Permission | ||
! Description | ! Description | ||
|- | |- | ||
− | ||getattr|| | + | ||getattr||see common x_device: getattr |
|- | |- | ||
− | ||setattr|| | + | ||setattr||see common x_device: setattr |
|- | |- | ||
− | ||use|| | + | ||use||see common x_device: use |
|- | |- | ||
− | ||read|| | + | ||read||see common x_device: read |
|- | |- | ||
− | ||write|| | + | ||write||see common x_device: write |
|- | |- | ||
− | ||getfocus|| | + | ||getfocus||see common x_device: getfocus |
|- | |- | ||
− | ||setfocus|| | + | ||setfocus||see common x_device: setfocus |
|- | |- | ||
− | ||bell|| | + | ||bell||see common x_device: bell |
|- | |- | ||
− | ||force_cursor|| | + | ||force_cursor||see common x_device: force_cursor |
|- | |- | ||
− | ||freeze|| | + | ||freeze||see common x_device: freeze |
|- | |- | ||
− | ||grab|| | + | ||grab||see common x_device: grab |
|- | |- | ||
− | ||manage|| | + | ||manage||see common x_device: manage |
|- | |- | ||
− | ||list_property|| | + | ||list_property||see common x_device: list_property |
|- | |- | ||
− | ||get_property|| | + | ||get_property||see common x_device: get_property |
|- | |- | ||
− | ||set_property|| | + | ||set_property||see common x_device: set_property |
|- | |- | ||
− | ||add|| | + | ||add||see common x_device: add |
|- | |- | ||
− | ||remove|| | + | ||remove||see common x_device: remove |
|} | |} | ||
Line 2,394: | Line 2,493: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Create a Drawable object. | + | ||create||Create a Drawable object. |
|- | |- | ||
− | ||destroy||Destroy a Drawable. | + | ||destroy||Destroy a Drawable. |
|- | |- | ||
− | ||read | + | ||read |
|- | |- | ||
− | ||write | + | ||write |
|- | |- | ||
− | ||blend | + | ||blend |
|- | |- | ||
− | ||getattr||Get attributes of a Drawable object | + | ||getattr||Get attributes of a Drawable object |
|- | |- | ||
− | ||setattr||Set attributes of a Drawable object | + | ||setattr||Set attributes of a Drawable object |
|- | |- | ||
− | ||list_child | + | ||list_child |
|- | |- | ||
− | ||add_child | + | ||add_child |
|- | |- | ||
− | ||remove_child | + | ||remove_child |
|- | |- | ||
− | ||list_property | + | ||list_property |
|- | |- | ||
− | ||get_property | + | ||get_property |
|- | |- | ||
− | ||set_property | + | ||set_property |
|- | |- | ||
− | ||manage | + | ||manage |
|- | |- | ||
− | ||override | + | ||override |
|- | |- | ||
− | ||show | + | ||show |
|- | |- | ||
− | ||hide | + | ||hide |
|- | |- | ||
− | ||send | + | ||send |
|- | |- | ||
− | ||receive | + | ||receive |
|} | |} | ||
Line 2,438: | Line 2,537: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||send | + | ||send |
|- | |- | ||
− | ||receive | + | ||receive |
|} | |} | ||
Line 2,448: | Line 2,547: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||query | + | ||query |
|- | |- | ||
− | ||use | + | ||use |
|} | |} | ||
Line 2,458: | Line 2,557: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Load a font. | + | ||create||Load a font. |
|- | |- | ||
− | ||destroy||Free (dereference) a font. | + | ||destroy||Free (dereference) a font. |
|- | |- | ||
− | ||getattr||Obtain font names, path, etc. | + | ||getattr||Obtain font names, path, etc. |
|- | |- | ||
− | ||add_glyph | + | ||add_glyph |
|- | |- | ||
− | ||remove_glyph | + | ||remove_glyph |
|- | |- | ||
− | ||use||Use a font for drawing. | + | ||use||Use a font for drawing. |
|} | |} | ||
Line 2,476: | Line 2,575: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Create Graphic Contexts object.|| | + | ||create||Create Graphic Contexts object. |
+ | |- | ||
+ | ||destroy||Free (dereference) a Graphics Contexts object. | ||
+ | |- | ||
+ | ||getattr||Get attributes for Graphic Contexts object. | ||
+ | |- | ||
+ | ||setattr||Set attributes for Graphic Contexts object. | ||
+ | |- | ||
+ | ||use | ||
+ | |} | ||
+ | |||
+ | === x_keyboard === | ||
+ | Inherits from: [[#common x_device|common x_device]] | ||
+ | {| border="1" | ||
+ | ! Permission | ||
+ | ! Description | ||
+ | |- | ||
+ | ||getattr||see common x_device: getattr | ||
+ | |- | ||
+ | ||setattr||see common x_device: setattr | ||
+ | |- | ||
+ | ||use||see common x_device: use | ||
+ | |- | ||
+ | ||read||see common x_device: read | ||
+ | |- | ||
+ | ||write||see common x_device: write | ||
+ | |- | ||
+ | ||getfocus||see common x_device: getfocus | ||
+ | |- | ||
+ | ||setfocus||see common x_device: setfocus | ||
+ | |- | ||
+ | ||bell||see common x_device: bell | ||
+ | |- | ||
+ | ||force_cursor||see common x_device: force_cursor | ||
+ | |- | ||
+ | ||freeze||see common x_device: freeze | ||
+ | |- | ||
+ | ||grab||see common x_device: grab | ||
+ | |- | ||
+ | ||manage||see common x_device: manage | ||
+ | |- | ||
+ | ||list_property||see common x_device: list_property | ||
+ | |- | ||
+ | ||get_property||see common x_device: get_property | ||
+ | |- | ||
+ | ||set_property||see common x_device: set_property | ||
+ | |- | ||
+ | ||add||see common x_device: add | ||
+ | |- | ||
+ | ||remove||see common x_device: remove | ||
+ | |} | ||
+ | |||
+ | === x_pointer === | ||
+ | Inherits from: [[#common x_device|common x_device]] | ||
+ | {| border="1" | ||
+ | ! Permission | ||
+ | ! Description | ||
+ | |- | ||
+ | ||getattr||see common x_device: getattr | ||
+ | |- | ||
+ | ||setattr||see common x_device: setattr | ||
+ | |- | ||
+ | ||use||see common x_device: use | ||
+ | |- | ||
+ | ||read||see common x_device: read | ||
+ | |- | ||
+ | ||write||see common x_device: write | ||
+ | |- | ||
+ | ||getfocus||see common x_device: getfocus | ||
+ | |- | ||
+ | ||setfocus||see common x_device: setfocus | ||
+ | |- | ||
+ | ||bell||see common x_device: bell | ||
+ | |- | ||
+ | ||force_cursor||see common x_device: force_cursor | ||
+ | |- | ||
+ | ||freeze||see common x_device: freeze | ||
+ | |- | ||
+ | ||grab||see common x_device: grab | ||
+ | |- | ||
+ | ||manage||see common x_device: manage | ||
+ | |- | ||
+ | ||list_property||see common x_device: list_property | ||
|- | |- | ||
− | || | + | ||get_property||see common x_device: get_property |
|- | |- | ||
− | || | + | ||set_property||see common x_device: set_property |
|- | |- | ||
− | || | + | ||add||see common x_device: add |
|- | |- | ||
− | || | + | ||remove||see common x_device: remove |
|} | |} | ||
Line 2,492: | Line 2,673: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||create||Create property object. | + | ||create||Create property object. |
|- | |- | ||
− | ||destroy||Free (dereference) a property object. | + | ||destroy||Free (dereference) a property object. |
|- | |- | ||
− | ||read||Read a property. | + | ||read||Read a property. |
|- | |- | ||
− | ||write||Write a property. | + | ||write||Write a property. |
|- | |- | ||
− | ||append||Append a property. | + | ||append||Append a property. |
|- | |- | ||
− | ||getattr||Get the attributes of a property. | + | ||getattr||Get the attributes of a property. |
|- | |- | ||
− | ||setattr||Set the attributes of a property. | + | ||setattr||Set the attributes of a property. |
|} | |} | ||
Line 2,512: | Line 2,693: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||read | + | ||read |
|- | |- | ||
− | ||write | + | ||write |
|} | |} | ||
Line 2,522: | Line 2,703: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||getattr | + | ||getattr |
|- | |- | ||
− | ||setattr | + | ||setattr |
|- | |- | ||
− | ||hide_cursor | + | ||hide_cursor |
|- | |- | ||
− | ||show_cursor | + | ||show_cursor |
|- | |- | ||
− | ||saver_getattr | + | ||saver_getattr |
|- | |- | ||
− | ||saver_setattr | + | ||saver_setattr |
|- | |- | ||
− | ||saver_hide | + | ||saver_hide |
|- | |- | ||
− | ||saver_show | + | ||saver_show |
|} | |} | ||
Line 2,544: | Line 2,725: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||read | + | ||read |
|- | |- | ||
− | ||write | + | ||write |
|- | |- | ||
− | ||getattr | + | ||getattr |
|- | |- | ||
− | ||setattr | + | ||setattr |
|} | |} | ||
Line 2,558: | Line 2,739: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||getattr | + | ||getattr |
|- | |- | ||
− | ||setattr | + | ||setattr |
|- | |- | ||
− | ||record | + | ||record |
|- | |- | ||
− | ||debug | + | ||debug |
|- | |- | ||
− | ||grab | + | ||grab |
|- | |- | ||
− | ||manage | + | ||manage |
|} | |} | ||
Line 2,576: | Line 2,757: | ||
! Description | ! Description | ||
|- | |- | ||
− | ||send | + | ||send |
|- | |- | ||
− | ||receive | + | ||receive |
|} | |} |
Latest revision as of 19:23, 5 February 2013
Contents
- 1 SELinux Object Classes and Permissions Reference
- 1.1 Common Permission Sets
- 1.2 Kernel Object Classes
- 1.2.1 appletalk_socket
- 1.2.2 association
- 1.2.3 blk_file
- 1.2.4 capability
- 1.2.5 capability2
- 1.2.6 chr_file
- 1.2.7 dccp_socket
- 1.2.8 dir
- 1.2.9 fd
- 1.2.10 fifo_file
- 1.2.11 file
- 1.2.12 filesystem
- 1.2.13 ipc
- 1.2.14 kernel_service
- 1.2.15 key
- 1.2.16 key_socket
- 1.2.17 lnk_file
- 1.2.18 memprotect
- 1.2.19 msg
- 1.2.20 msgq
- 1.2.21 netif
- 1.2.22 netlink_socket
- 1.2.23 netlink_audit_socket
- 1.2.24 netlink_dnrt_socket
- 1.2.25 netlink_firewall_socket
- 1.2.26 netlink_ip6fw_socket
- 1.2.27 netlink_kobject_uevent_socket
- 1.2.28 netlink_nflog_socket
- 1.2.29 netlink_route_socket
- 1.2.30 netlink_selinux_socket
- 1.2.31 netlink_tcpdiag_socket
- 1.2.32 netlink_xfrm_socket
- 1.2.33 node
- 1.2.34 packet
- 1.2.35 packet_socket
- 1.2.36 peer
- 1.2.37 process
- 1.2.38 rawip_socket
- 1.2.39 security
- 1.2.40 sem
- 1.2.41 shm
- 1.2.42 sock_file
- 1.2.43 socket
- 1.2.44 system
- 1.2.45 tcp_socket
- 1.2.46 tun_socket
- 1.2.47 udp_socket
- 1.2.48 unix_dgram_socket
- 1.2.49 unix_stream_socket
- 1.3 Database Object Classes
- 1.4 DBus Object Classes
- 1.5 MLS Context Translation Object Classes
- 1.6 NSCD Object Classes
- 1.7 Password Object Classes
- 1.8 X Server Object Classes
- 1.8.1 x_application_data
- 1.8.2 x_client
- 1.8.3 x_colormap
- 1.8.4 x_cursor
- 1.8.5 x_device
- 1.8.6 x_drawable
- 1.8.7 x_event
- 1.8.8 x_extension
- 1.8.9 x_font
- 1.8.10 x_gc
- 1.8.11 x_keyboard
- 1.8.12 x_pointer
- 1.8.13 x_property
- 1.8.14 x_resource
- 1.8.15 x_screen
- 1.8.16 x_selection
- 1.8.17 x_server
- 1.8.18 x_synthetic_event
SELinux Object Classes and Permissions Reference
This document contains a list of all of the object classes and permissions for modern SELinux systems (starting in kernel 2.6.0). Each permission has a brief description of of the semantics of each permission, in addition to the versions of the kernel which support the permission and the policy capability that enables its enforcement (if applicable).
The document has the following caveats:
- The permission descriptions are only for providing a general idea of the purposes of the permissions; a permission may mediate many operations.
- Since SELinux development is ongoing, this document may be be incomplete or inaccurate.
Common Permission Sets
common database
Permission | Description |
---|---|
create | Create a new database object. |
drop | Remove a database object. |
getattr | Get the attributes of a database object. |
setattr | Set the attributes of a database object. |
relabelfrom | Change the security context based on existing type. |
relabelto | Change the security context based on the new type. |
common file
Permission | Description |
---|---|
getattr | Get file attributes for file, such as access mode. (e.g. stat, some ioctls. ...) |
relabelto | Relabel to new security context. |
unlink | Remove hard link (delete). |
ioctl | IO control system call requests not addressed by other permissions. |
execute | Execute |
append | Write to a file opened with O_APPEND. |
read | Read file contents. |
setattr | Change file attributes for file such as access mode. (e.g. chmod, some ioctls, ...) |
swapon | Allows file to be used for paging/swapping space. |
write | Write to a file. |
lock | Set and unset file locks. |
create | Create new file. |
rename | Rename a file. |
mounton | Use as mount point; only useful for directories and files in Linux. |
quotaon | Use as a quota file. |
relabelfrom | Relabel from old security context. |
link | Create another hard link to file |
common ipc
Permission | Description |
---|---|
write | Write. |
destroy | Destroy. |
unix_write | Generic write access. |
getattr | Get attributes, e.g. IPC_STAT *ctl operation. |
create | Create. |
read | Read |
setattr | Change attributes, e.g. IPC_SET. |
unix_read | Generic read access. |
associate | Associate a key |
common socket
Permission | Description |
---|---|
append | Write to open fd marked with O_APPEND. |
relabelfrom | Change the security context based on existing type. |
create | Create new socket. |
read | Read from socket. |
sendto | Send to socket. |
connect | Initiate connection. |
recvfrom | Legacy NetLabel check; obsoleted by peer recv |
send_msg | Legacy check; no longer present. |
bind | Bind a name to the socket. |
lock | Apply file lock on a socket. |
ioctl | IO control system call requests not addressed by other permissions. |
getattr | Get socket attributes, e.g. fstat. |
write | Write to socket. |
setopt | Set socket options. |
getopt | Get socket options. |
listen | Listen for connections. |
setattr | Change socket attributes. |
shutdown | Shutdown connection. |
relabelto | Change the security context based on the new type. |
recv_msg | Obsolete. |
accept | Accept a connection. |
name_bind | Associate with port or file; for AF_INET sockets, controls relationship between a socket and it's port number; for AF_UNIX sockets, controls relationship between a socket and it's file |
common x_device
Permission | Description |
---|---|
getattr | |
setattr | |
use | |
read | |
write | |
getfocus | |
setfocus | |
bell | |
force_cursor | |
freeze | |
grab | |
manage | |
list_property | |
get_property | |
set_property | |
add | |
remove |
Kernel Object Classes
appletalk_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.18+ |
relabelfrom | see common socket:relabelfrom | 2.6.18+ |
create | see common socket:create | 2.6.18+ |
read | see common socket:read | 2.6.18+ |
sendto | see common socket:sendto | 2.6.18+ |
connect | see common socket:connect | 2.6.18+ |
recvfrom | see common socket:recvfrom | 2.6.18+ |
send_msg | see common socket:send_msg | 2.6.18+ |
bind | see common socket:bind | 2.6.18+ |
lock | see common socket:lock | 2.6.18+ |
ioctl | see common socket:ioctl | 2.6.18+ |
getattr | see common socket:getattr | 2.6.18+ |
write | see common socket:write | 2.6.18+ |
setopt | see common socket:setopt | 2.6.18+ |
getopt | see common socket:getopt | 2.6.18+ |
listen | see common socket:listen | 2.6.18+ |
setattr | see common socket:setattr | 2.6.18+ |
shutdown | see common socket:shutdown | 2.6.18+ |
relabelto | see common socket:relabelto | 2.6.18+ |
recv_msg | see common socket:recv_msg | 2.6.18+ |
accept | see common socket:accept | 2.6.18+ |
name_bind | see common socket:name_bind | 2.6.18+ |
association
Permission | Description | Kernel Version/Capability |
---|---|---|
sendto | Send to an IPSEC assocation. | 2.6.12+ |
recvfrom | Receive from an IPSEC association. | 2.6.12+ |
setcontext | Set the context of an IPSEC association on creation. | 2.6.16+ |
polmatch | Match an IPSEC policy entry | 2.6.19+ |
blk_file
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | see common file:unlink | |
ioctl | see common file:ioctl | |
execute | see common file:execute | |
append | see common file:append | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | see common file:swapon | |
write | see common file:write | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | see common file:quotaon | |
relabelfrom | see common file:relabelfrom | |
link | see common file:link | |
open | Open a block device file. | 2.6.26+ / open_perms |
capability
Permission | Description | Kernel Version/Capability |
---|---|---|
chown | Override restrictions on changing file ownership and group ownership. | |
dac_override | Override all DAC access restrictions. Checked before dac_read_search, so a dontaudit candidate. | |
dac_read_search | Override DAC read/search access restrictions. | |
fowner | Override all file owner requirements (e.g. for chmod, setxattr) except where fsetid applies. | |
fsetid | Override file owner and group requirements when setting setuid or setgid bits on a file. Can be checked as a side effect on chmod and write operations; dontaudit candidate. | |
kill | Overrides the restriction that the real or effective user ID of a process sending a signal must match the real or effective user ID of the process receiving the signal. | |
setgid | Allow setgid(2) or setgroups(2) or forged gids on credentials passed over a socket. | |
setuid | Allow set*uid(2). Allow passing of forged ids on credentials passed over a socket. | |
setpcap | Add capability from bounding set to inheritable set, drop capability from bounding set, modify secure bits. | |
linux_immutable | Grant privilege to modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems. | |
net_bind_service | Allow low port binding. Port < 1024 for TCP/UDP. VCI < 32 for ATM. | |
net_broadcast | Grant network broadcasting and listening to incoming multicasts. | |
net_admin | Allows all networking configurations and modifications. See linux/capability.h for details. | |
net_raw | Allows opening of raw sockets and packet sockets. | |
ipc_lock | Allow locking shared memory segments and mlock/mlockall. | |
ipc_owner | Override IPC ownership checks. | |
sys_module | Allow unrestricted kernel modification including but not limited to loading and removing kernel modules. Allows modification of kernels bounding capability mask. See sysctl. | |
sys_rawio | Grant permission to use ioperm(2) and iopl(2) as well as the ability to send messages to USB devices via /proc/bus/usb. | |
sys_chroot | Grant use of the chroot(2) call. | |
sys_ptrace | Allow a ptrace of any process. | |
sys_pacct | Allow modification of accounting for any process. | |
sys_admin | Too many to list here (see /usr/include/linux/capability.h) | |
sys_boot | Grant ability to reboot the system. | |
sys_nice | Grants privilege to change priority of any process. Grants change of scheduling algorithm used by any process. | |
sys_resource | Too many to list here (see /usr/include/linux/capability.h for details.) | |
sys_time | Grant permission to set system time and to set the real-time lock. | |
sys_tty_config | Grant permission to configure tty devices. Allow vhangup(2) call on a tty. | |
mknod | Grants permission to creation of character and block device nodes. | |
lease | Grants ability to take leases on a file. For details on what leases are see fcntl(2). | |
audit_write | Generate audit messages from user space. | 2.6.12+ |
audit_control | Control kernel audit configuration/rules. Set login UID. | 2.6.12+ |
setfcap | Set file capabilities. | 2.6.25+ |
capability2
Permission | Description | Kernel Version/Capability |
---|---|---|
mac_override | Override MAC restrictions - Ignored by SELinux | 2.6.25+ |
mac_admin | Change MAC configuration - For SELinux, get/set raw security context values unknown to the current policy. | 2.6.25+ |
syslog | Configure kernel syslog subsystem | |
wake_alarm | Trigger something that will wake the system | |
block_suspend | Prevent system suspends |
chr_file
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | see common file:unlink | |
ioctl | see common file:ioctl | |
execute | see common file:execute | |
append | see common file:append | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | see common file:swapon | |
write | see common file:write | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | see common file:quotaon | |
relabelfrom | see common file:relabelfrom | |
link | see common file:link | |
execute_no_trans | Execute a file in the callers domain. | 2.6.11+ |
entrypoint | Can be executed as the entry point of the new domain in a transition. | 2.6.11+ |
execmod | Make executable a file mapping that has been modified by copy-on-write. (Text relocation) | 2.6.11+ |
open | Open a character device file. | 2.6.26+ / open_perms |
dccp_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.20+ |
relabelfrom | see common socket:relabelfrom | 2.6.20+ |
create | see common socket:create | 2.6.20+ |
read | see common socket:read | 2.6.20+ |
sendto | see common socket:sendto | 2.6.20+ |
connect | see common socket:connect | 2.6.20+ |
recvfrom | see common socket:recvfrom | 2.6.20+ |
send_msg | see common socket:send_msg | 2.6.20+ |
bind | see common socket:bind | 2.6.20+ |
lock | see common socket:lock | 2.6.20+ |
ioctl | see common socket:ioctl | 2.6.20+ |
getattr | see common socket:getattr | 2.6.20+ |
write | see common socket:write | 2.6.20+ |
setopt | see common socket:setopt | 2.6.20+ |
getopt | see common socket:getopt | 2.6.20+ |
listen | see common socket:listen | 2.6.20+ |
setattr | see common socket:setattr | 2.6.20+ |
shutdown | see common socket:shutdown | 2.6.20+ |
relabelto | see common socket:relabelto | 2.6.20+ |
recv_msg | see common socket:recv_msg | 2.6.20+ |
accept | see common socket:accept | 2.6.20+ |
name_bind | see common socket:name_bind | 2.6.20+ |
connectto | Connect to server socket. | 2.6.20+ |
newconn | Create new socket for connection. | 2.6.20+ |
acceptfrom | Accept connection from client socket. | 2.6.20+ |
node_bind | Ability to bind to a node. | 2.6.20+ |
name_connect | Connect to a specific port number. | 2.6.20+ |
dir
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | N/A | |
ioctl | see common file:ioctl | |
execute | N/A | |
append | N/A | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | N/A | |
write | General write access; required for adding or removing | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | N/A | |
relabelfrom | see common file:relabelfrom | |
link | N/A | |
search | Search access | |
rmdir | Remove the directory | |
remove_name | Remove a file from the directory. | |
reparent | Rename into a different parent directory (.. change). | |
add_name | Add a file to the directory. | |
open | Open a directory. | 2.6.26+ / open_perms |
fd
Permission | Description | Kernel Version/Capability |
---|---|---|
use | Permission to use an inherited file descriptor |
fifo_file
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | see common file:unlink | |
ioctl | see common file:ioctl | |
execute | see common file:execute | |
append | see common file:append | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | see common file:swapon | |
write | see common file:write | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | see common file:quotaon | |
relabelfrom | see common file:relabelfrom | |
link | see common file:link | |
open | Open a FIFO. | 2.6.26+ / open_perms |
file
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | see common file:unlink | |
ioctl | see common file:ioctl | |
execute | see common file:execute | |
append | see common file:append | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | see common file:swapon | |
write | see common file:write | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | see common file:quotaon | |
relabelfrom | see common file:relabelfrom | |
link | see common file:link | |
execute_no_trans | Execute a file in the callers domain. | |
entrypoint | Can be executed as the entry point of the new domain in a transition. | |
execmod | Make executable a file mapping that has been modified by copy-on-write. (Text relocation) | 2.6.11+ |
open | Open a file. | 2.6.26+ / open_perms |
filesystem
Permission | Description | Kernel Version/Capability |
---|---|---|
mount | Mount the filesystem. | |
remount | Change filesystem mount flags. | |
unmount | Unmount the filesystem. | |
getattr | Get file attributes, such as access mode. (e.g. stat, some ioctls. ...) | |
relabelfrom | Change the security context based on existing type. | |
relabelto | Change the security context based on the new type. | |
transition | Transition to a new SID (change security context). | |
associate | Associate a file to the filesystem. | |
quotamod | Modify quota information. | |
quotaget | Get quota information |
ipc
Inherits from: common ipc
Permission | Description | Kernel Version/Capability |
---|---|---|
write | see common ipc:write | |
destroy | see common ipc:destroy | |
unix_write | see common ipc:unix_write | |
getattr | see common ipc:getattr | |
create | see common ipc:create | |
read | see common ipc:read | |
setattr | see common ipc:setattr | |
unix_read | see common ipc:unix_read | |
associate | see common ipc:associate |
kernel_service
Permission | Description | Kernel Version/Capability |
---|---|---|
use_as_override | Grant a process the right to nominate an alternate process security ID for the kernel to use as an override for the SELinux subjective security when accessing stuff on behalf of another process. | 2.6.29+ |
create_files_as | Grant a process the right to nominate a file creation label for a kernel service to use. | 2.6.29+ |
key
Permission | Description | Kernel Version/Capability |
---|---|---|
view | 2.6.18+ | |
read | 2.6.18+ | |
write | 2.6.18+ | |
search | 2.6.18+ | |
link | 2.6.18+ | |
setattr | 2.6.18+ | |
create | 2.6.18+ |
key_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind |
lnk_file
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | see common file:unlink | |
ioctl | see common file:ioctl | |
execute | see common file:execute | |
append | see common file:append | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | see common file:swapon | |
write | see common file:write | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | see common file:quotaon | |
relabelfrom | see common file:relabelfrom | |
link | see common file:link |
memprotect
Permission | Description | Kernel Version/Capability |
---|---|---|
mmap_zero | Mmap the first page of memory. | 2.6.23+ |
msg
Permission | Description | Kernel Version/Capability |
---|---|---|
receive | Remove a message from a queue. | |
send | Add a message to a queue. |
msgq
Inherits from: common ipc
Permission | Description | Kernel Version/Capability |
---|---|---|
write | see common ipc:write | |
destroy | see common ipc:destroy | |
unix_write | see common ipc:unix_write | |
getattr | see common ipc:getattr | |
create | see common ipc:create | |
read | see common ipc:read | |
setattr | see common ipc:setattr | |
unix_read | see common ipc:unix_read | |
associate | see common ipc:associate | |
enqueue | Message can be added to a queue. |
netif
Permission | Description | Kernel Version/Capability |
---|---|---|
tcp_recv | Receive TCP packet. | |
tcp_send | Send TCP packet. | |
udp_recv | Receive UDP packet. | |
udp_send | Send UDP packet. | |
rawip_recv | Receive raw IP packet. | |
rawip_send | Send raw IP packet. | |
dccp_recv | Receive DCCP packet. | 2.6.20+ |
dccp_send | Send DCCP packet. | 2.6.20+ |
ingress | 2.6.25+ / network_peer_controls | |
egress | 2.6.25+ / network_peer_controls |
netlink_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind |
netlink_audit_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
nlmsg_read | Read audit subsystem state (e.g. AUDIT_GET). | 2.6.8+ |
nlmsg_write | Write audit subsystem state (e.g. AUDIT_SET). | 2.6.8+ |
nlmsg_relay | Send user space audit messages to the kernel audit system. | 2.6.12+ |
nlmsg_readpriv | Read security-sensitive audit subsystem state. | 2.6.12+ |
nlmsg_tty_audit | Control TTY auditing | 2.6.30+ |
netlink_dnrt_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
netlink_firewall_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
nlmsg_read | Read firewall configuration state. | 2.6.8+ |
nlmsg_write | Write firewall configuration state. | 2.6.8+ |
netlink_ip6fw_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
nlmsg_read | Read netlink message. | 2.6.8+ |
nlmsg_write | Write netlink message. | 2.6.8+ |
netlink_kobject_uevent_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.12+ |
relabelfrom | see common socket:relabelfrom | 2.6.12+ |
create | see common socket:create | 2.6.12+ |
read | see common socket:read | 2.6.12+ |
sendto | see common socket:sendto | 2.6.12+ |
connect | see common socket:connect | 2.6.12+ |
recvfrom | see common socket:recvfrom | 2.6.12+ |
send_msg | see common socket:send_msg | 2.6.12+ |
bind | see common socket:bind | 2.6.12+ |
lock | see common socket:lock | 2.6.12+ |
ioctl | see common socket:ioctl | 2.6.12+ |
getattr | see common socket:getattr | 2.6.12+ |
write | see common socket:write | 2.6.12+ |
setopt | see common socket:setopt | 2.6.12+ |
getopt | see common socket:getopt | 2.6.12+ |
listen | see common socket:listen | 2.6.12+ |
setattr | see common socket:setattr | 2.6.12+ |
shutdown | see common socket:shutdown | 2.6.12+ |
relabelto | see common socket:relabelto | 2.6.12+ |
recv_msg | see common socket:recv_msg | 2.6.12+ |
accept | see common socket:accept | 2.6.12+ |
name_bind | see common socket:name_bind | 2.6.12+ |
netlink_nflog_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
netlink_route_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
nlmsg_read | Read route configuration state. | 2.6.8+ |
nlmsg_write | Write route configuration state. | 2.6.8+ |
netlink_selinux_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
netlink_tcpdiag_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
nlmsg_read | Read tcp diagnostics. | 2.6.8+ |
nlmsg_write | Unused. | 2.6.8+ |
netlink_xfrm_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.8+ |
relabelfrom | see common socket:relabelfrom | 2.6.8+ |
create | see common socket:create | 2.6.8+ |
read | see common socket:read | 2.6.8+ |
sendto | see common socket:sendto | 2.6.8+ |
connect | see common socket:connect | 2.6.8+ |
recvfrom | see common socket:recvfrom | 2.6.8+ |
send_msg | see common socket:send_msg | 2.6.8+ |
bind | see common socket:bind | 2.6.8+ |
lock | see common socket:lock | 2.6.8+ |
ioctl | see common socket:ioctl | 2.6.8+ |
getattr | see common socket:getattr | 2.6.8+ |
write | see common socket:write | 2.6.8+ |
setopt | see common socket:setopt | 2.6.8+ |
getopt | see common socket:getopt | 2.6.8+ |
listen | see common socket:listen | 2.6.8+ |
setattr | see common socket:setattr | 2.6.8+ |
shutdown | see common socket:shutdown | 2.6.8+ |
relabelto | see common socket:relabelto | 2.6.8+ |
recv_msg | see common socket:recv_msg | 2.6.8+ |
accept | see common socket:accept | 2.6.8+ |
name_bind | see common socket:name_bind | 2.6.8+ |
nlmsg_read | Read xfrm configuration state. | 2.6.8+ |
nlmsg_write | Write xfrm configuration state. | 2.6.8+ |
node
Permission | Description | Kernel Version/Capability |
---|---|---|
tcp_recv | Receive TCP packet. | |
tcp_send | Send TCP packet. | |
udp_recv | Receive UDP packet. | |
udp_send | Send UDP packet. | |
rawip_recv | Receive raw IP packet. | |
rawip_send | Send raw IP packet. | |
enforce_dest | Ensure that the destination node can enforce restrictions on the destination socket. | |
dccp_recv | Receive DCCP packet. | 2.6.20+ |
dccp_send | Send DCCP packet. | 2.6.20+ |
recvfrom | 2.6.25+ / network_peer_controls | |
sendto | 2.6.25+ / network_peer_controls |
packet
Permission | Description | Kernel Version/Capability |
---|---|---|
send | Send a packet. | 2.6.18+ |
receive | Receive a packet. | 2.6.18+ |
relabelto | Set a labeling rule to the specified type. | 2.6.18+ |
flow_in | Deprecated | 2.6.25+ |
flow_out | Deprecated | 2.6.25+ |
forward_in | 2.6.25+ | |
forward_out | 2.6.25+ |
packet_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind |
peer
Permission | Description | Kernel Version/Capability |
---|---|---|
recv | Receive from a labeled networking peer. | 2.6.25+ / network_peer_controls |
process
Permission | Description | Kernel Version/Capability |
---|---|---|
fork | Fork into two processes. | |
transition | Transition to a new context on exec(). | |
sigchld | Send SIGCHLD signal. | |
sigkill | Send SIGKILL signal. | |
sigstop | Send SIGSTOP signal | |
signull | Test for exisitence of another process without sending a signal | |
signal | Send a signal other than SIGKILL, SIGSTOP, or SIGCHLD. | |
ptrace | Attach to another process for tracing. | |
getsched | Get priority of a process. | |
setsched | Set priority of a process. | |
getsession | Get session ID of another process. | |
getpgid | Get group Process ID of a process. | |
setpgid | Set group Process ID of a process. | |
getcap | Get Linux capabilities. | |
setcap | Set Linux capabilities. | |
share | Allow state sharing with cloned or forked process. | |
getattr | Get attributes of a file. | |
setexec | Override the default context for the next exec(). | |
setfscreate | Override the default context for file creation. | |
setrlimit | Change process hard limits. | |
noatsecure | Disable secure mode environment cleansing (AT_SECURE). | v.16+ |
siginh | Inherit signal state from caller. | v.16+ |
rlimitinh | Inherit resource limits from caller. | v.16+ |
dyntransition | Dynamically transition to a new context. | 2.6.11+ |
setcurrent | Set the current process context. | 2.6.11+ |
execmem | Make executable an anonymous mapping or private file mapping that is writable. | 2.6.13+ |
execstack | Make the main process stack executable. | 2.6.13+ |
execheap | Make the heap executable. | 2.6.13+ |
setkeycreate | Override the default context for key creation. | 2.6.18+ |
setsockcreate | Override the default context for socket creation. | 2.6.18+ |
rawip_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind | |
node_bind | Ability to bind to a node. | v.17+ |
security
Permission | Description | Kernel Version/Capability |
---|---|---|
compute_user | Get user info in selinuxfs. | |
compute_relabel | Get relabel info in selinuxfs. | |
compute_create | Get create info in selinuxfs. | |
compute_av | Compute an access vector given a source/target/class. | |
compute_member | Determines the context to use when selecting a member of a polyinstantiated object. | |
setenforce | Change the enforcement state of SELinux. | |
check_context | Write context in selinuxfs. | |
load_policy | Load the security policy. | |
setbool | Set a boolean value. | 2.6.5+ |
setsecparam | Set kernel access vector cache tuning parameters. | 2.6.11+ |
setcheckreqprot | Set if SELinux will check original protection mode or modified protection mode (read-implies-exec) for mmap/mprotect. | 2.6.12+ |
sem
Inherits from: common ipc
Permission | Description | Kernel Version/Capability |
---|---|---|
write | see common ipc:write | |
destroy | see common ipc:destroy | |
unix_write | see common ipc:unix_write | |
getattr | see common ipc:getattr | |
create | see common ipc:create | |
read | see common ipc:read | |
setattr | see common ipc:setattr | |
unix_read | see common ipc:unix_read | |
associate | see common ipc:associate |
shm
Inherits from: common ipc
Permission | Description | Kernel Version/Capability |
---|---|---|
write | see common ipc:write | |
destroy | see common ipc:destroy | |
unix_write | see common ipc:unix_write | |
getattr | see common ipc:getattr | |
create | see common ipc:create | |
read | see common ipc:read | |
setattr | see common ipc:setattr | |
unix_read | see common ipc:unix_read | |
associate | see common ipc:associate | |
lock | (Un)lock page(s) in memory. |
sock_file
Inherits from: common file
Permission | Description | Kernel Version/Capability |
---|---|---|
getattr | see common file:getattr | |
relabelto | see common file:relabelto | |
unlink | see common file:unlink | |
ioctl | see common file:ioctl | |
execute | see common file:execute | |
append | see common file:append | |
read | see common file:read | |
setattr | see common file:setattr | |
swapon | see common file:swapon | |
write | see common file:write | |
lock | see common file:lock | |
create | see common file:create | |
rename | see common file:rename | |
mounton | see common file:mounton | |
quotaon | see common file:quotaon | |
relabelfrom | see common file:relabelfrom | |
link | see common file:link | |
open | Open a named socket file. | 2.6.26+ / open_perms |
socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind |
system
Permission | Description | Kernel Version/Capability |
---|---|---|
ipc_info | Get info for an ipc socket. | |
syslog_mod | Perform syslog operation other than syslog_read or console logging. | |
syslog_read | Perform syslog read. | |
syslog_console | Perform syslog console. |
tcp_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind | |
connectto | Connect to server socket. | |
newconn | Create new socket for connection. | |
acceptfrom | Accept connection from client socket. | |
node_bind | Ability to bind to a node. | 2.6.2+ |
name_connect | Connect to a specific port number. | 2.6.12+ |
tun_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | 2.6.32+ |
relabelfrom | see common socket:relabelfrom | 2.6.32+ |
create | see common socket:create | 2.6.32+ |
read | see common socket:read | 2.6.32+ |
sendto | see common socket:sendto | 2.6.32+ |
connect | see common socket:connect | 2.6.32+ |
recvfrom | see common socket:recvfrom | 2.6.32+ |
send_msg | see common socket:send_msg | 2.6.32+ |
bind | see common socket:bind | 2.6.32+ |
lock | see common socket:lock | 2.6.32+ |
ioctl | see common socket:ioctl | 2.6.32+ |
getattr | see common socket:getattr | 2.6.32+ |
write | see common socket:write | 2.6.32+ |
setopt | see common socket:setopt | 2.6.32+ |
getopt | see common socket:getopt | 2.6.32+ |
listen | see common socket:listen | 2.6.32+ |
setattr | see common socket:setattr | 2.6.32+ |
shutdown | see common socket:shutdown | 2.6.32+ |
relabelto | see common socket:relabelto | 2.6.32+ |
recv_msg | see common socket:recv_msg | 2.6.32+ |
accept | see common socket:accept | 2.6.32+ |
name_bind | see common socket:name_bind | 2.6.32+ |
udp_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind | |
node_bind | Ability to bind to a node. | 2.6.2+ |
unix_dgram_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind |
unix_stream_socket
Inherits from: common socket
Permission | Description | Kernel Version/Capability |
---|---|---|
append | see common socket:append | |
relabelfrom | see common socket:relabelfrom | |
create | see common socket:create | |
read | see common socket:read | |
sendto | see common socket:sendto | |
connect | see common socket:connect | |
recvfrom | see common socket:recvfrom | |
send_msg | see common socket:send_msg | |
bind | see common socket:bind | |
lock | see common socket:lock | |
ioctl | see common socket:ioctl | |
getattr | see common socket:getattr | |
write | see common socket:write | |
setopt | see common socket:setopt | |
getopt | see common socket:getopt | |
listen | see common socket:listen | |
setattr | see common socket:setattr | |
shutdown | see common socket:shutdown | |
relabelto | see common socket:relabelto | |
recv_msg | see common socket:recv_msg | |
accept | see common socket:accept | |
name_bind | see common socket:name_bind | |
connectto | Connect to server socket. | |
newconn | Create new socket for connection. | |
acceptfrom | Accept connection from client socket. |
Database Object Classes
db_blob
Inherits from: common database
Permission | Description |
---|---|
read | Read a blob. |
write | Write a blob. |
import | Import a blob. |
export | Export a blob. |
db_column
Inherits from: common database
Permission | Description |
---|---|
use | Deprecated |
select | |
update | |
insert |
db_database
Inherits from: common database
Permission | Description |
---|---|
access | |
install_module | |
load_module | |
get_param | Deprecated |
set_param | Deprecated |
db_procedure
Inherits from: common database
Permission | Description |
---|---|
execute | Execute a stored procedure. |
entrypoint | |
install |
db_table
Inherits from: common database
Permission | Description |
---|---|
use | Deprecated |
select | |
update | |
insert | |
delete | |
lock |
db_tuple
Permission | Description |
---|---|
relabelfrom | |
relabelto | |
use | Deprecated |
select | |
update | |
insert | |
delete |
DBus Object Classes
dbus
Permission | Description |
---|---|
acquire_svc | |
send_msg | Send a message on the bus. |
MLS Context Translation Object Classes
context
Permission | Description |
---|---|
translate | Translate a raw MLS label. |
contains | Calculate a MLS subset. |
NSCD Object Classes
nscd
Permission | Description |
---|---|
getpwd | |
getgrp | |
gethost | |
getstat | |
admin | |
shmempwd | |
shmemgrp | |
shmemhost | |
getserv | |
shmemserv |
Password Object Classes
passwd
Permission | Description |
---|---|
passwd | Update user password. |
chfn | Change finger information. e.g real name, work room and phone and home phone. |
chsh | Change login shell. |
rootok | Allow update if the user is root and the process has the rootok PAM permission. |
crontab | crontab on another user. |
X Server Object Classes
x_application_data
Permission | Description |
---|---|
paste | |
paste_after_confirm | |
copy |
x_client
Permission | Description |
---|---|
destroy | Close down a client. |
getattr | Get the attributes of an X client |
setattr | Set the attributes of an X client |
manage |
x_colormap
Permission | Description |
---|---|
create | Create a new Colormap. |
destroy | Free a Colormap. |
read | Read color cells of colormap. |
write | |
getattr | Get the color gamut of a screen. |
add_color | |
remove_color | |
install | Copy a virtual colormap into the display hardware. |
uninstall | Remove a virtual colormap from the display hardware. |
use |
x_cursor
Permission | Description |
---|---|
create | Create an arbitrary cursor object. |
destroy | Delete a cursor object. |
read | |
write | |
getattr | Get attributes of the cursor. |
setattr | Set attributes of the cursor. |
use | Associate a cursor object with a window. |
x_device
Inherits from: common x_device
Permission | Description |
---|---|
getattr | see common x_device: getattr |
setattr | see common x_device: setattr |
use | see common x_device: use |
read | see common x_device: read |
write | see common x_device: write |
getfocus | see common x_device: getfocus |
setfocus | see common x_device: setfocus |
bell | see common x_device: bell |
force_cursor | see common x_device: force_cursor |
freeze | see common x_device: freeze |
grab | see common x_device: grab |
manage | see common x_device: manage |
list_property | see common x_device: list_property |
get_property | see common x_device: get_property |
set_property | see common x_device: set_property |
add | see common x_device: add |
remove | see common x_device: remove |
x_drawable
Permission | Description |
---|---|
create | Create a Drawable object. |
destroy | Destroy a Drawable. |
read | |
write | |
blend | |
getattr | Get attributes of a Drawable object |
setattr | Set attributes of a Drawable object |
list_child | |
add_child | |
remove_child | |
list_property | |
get_property | |
set_property | |
manage | |
override | |
show | |
hide | |
send | |
receive |
x_event
Permission | Description |
---|---|
send | |
receive |
x_extension
Permission | Description |
---|---|
query | |
use |
x_font
Permission | Description |
---|---|
create | Load a font. |
destroy | Free (dereference) a font. |
getattr | Obtain font names, path, etc. |
add_glyph | |
remove_glyph | |
use | Use a font for drawing. |
x_gc
Permission | Description |
---|---|
create | Create Graphic Contexts object. |
destroy | Free (dereference) a Graphics Contexts object. |
getattr | Get attributes for Graphic Contexts object. |
setattr | Set attributes for Graphic Contexts object. |
use |
x_keyboard
Inherits from: common x_device
Permission | Description |
---|---|
getattr | see common x_device: getattr |
setattr | see common x_device: setattr |
use | see common x_device: use |
read | see common x_device: read |
write | see common x_device: write |
getfocus | see common x_device: getfocus |
setfocus | see common x_device: setfocus |
bell | see common x_device: bell |
force_cursor | see common x_device: force_cursor |
freeze | see common x_device: freeze |
grab | see common x_device: grab |
manage | see common x_device: manage |
list_property | see common x_device: list_property |
get_property | see common x_device: get_property |
set_property | see common x_device: set_property |
add | see common x_device: add |
remove | see common x_device: remove |
x_pointer
Inherits from: common x_device
Permission | Description |
---|---|
getattr | see common x_device: getattr |
setattr | see common x_device: setattr |
use | see common x_device: use |
read | see common x_device: read |
write | see common x_device: write |
getfocus | see common x_device: getfocus |
setfocus | see common x_device: setfocus |
bell | see common x_device: bell |
force_cursor | see common x_device: force_cursor |
freeze | see common x_device: freeze |
grab | see common x_device: grab |
manage | see common x_device: manage |
list_property | see common x_device: list_property |
get_property | see common x_device: get_property |
set_property | see common x_device: set_property |
add | see common x_device: add |
remove | see common x_device: remove |
x_property
Permission | Description |
---|---|
create | Create property object. |
destroy | Free (dereference) a property object. |
read | Read a property. |
write | Write a property. |
append | Append a property. |
getattr | Get the attributes of a property. |
setattr | Set the attributes of a property. |
x_resource
Permission | Description |
---|---|
read | |
write |
x_screen
Permission | Description |
---|---|
getattr | |
setattr | |
hide_cursor | |
show_cursor | |
saver_getattr | |
saver_setattr | |
saver_hide | |
saver_show |
x_selection
Permission | Description |
---|---|
read | |
write | |
getattr | |
setattr |
x_server
Permission | Description |
---|---|
getattr | |
setattr | |
record | |
debug | |
grab | |
manage |
x_synthetic_event
Permission | Description |
---|---|
send | |
receive |