Commit b424485a authored by Eric Paris's avatar Eric Paris Committed by James Morris

SELinux: Move execmod to the common perms

execmod "could" show up on non regular files and non chr files.  The current
implementation would actually make these checks against non-existant bits
since the code assumes the execmod permission is same for all file types.
To make this line up for chr files we had to define execute_no_trans and
entrypoint permissions.  These permissions are unreachable and only existed
to to make FILE__EXECMOD and CHR_FILE__EXECMOD the same.  This patch drops
those needless perms as well.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarStephen D. Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 49b7b8de
...@@ -3,7 +3,7 @@ ...@@ -3,7 +3,7 @@
#define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \ #define COMMON_FILE_PERMS COMMON_FILE_SOCK_PERMS, "unlink", "link", \
"rename", "execute", "swapon", "quotaon", "mounton", "audit_access", \ "rename", "execute", "swapon", "quotaon", "mounton", "audit_access", \
"open" "open", "execmod"
#define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \ #define COMMON_SOCK_PERMS COMMON_FILE_SOCK_PERMS, "bind", "connect", \
"listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \ "listen", "accept", "getopt", "setopt", "shutdown", "recvfrom", \
...@@ -44,7 +44,7 @@ struct security_class_mapping secclass_map[] = { ...@@ -44,7 +44,7 @@ struct security_class_mapping secclass_map[] = {
"quotaget", NULL } }, "quotaget", NULL } },
{ "file", { "file",
{ COMMON_FILE_PERMS, { COMMON_FILE_PERMS,
"execute_no_trans", "entrypoint", "execmod", NULL } }, "execute_no_trans", "entrypoint", NULL } },
{ "dir", { "dir",
{ COMMON_FILE_PERMS, "add_name", "remove_name", { COMMON_FILE_PERMS, "add_name", "remove_name",
"reparent", "search", "rmdir", NULL } }, "reparent", "search", "rmdir", NULL } },
...@@ -52,8 +52,7 @@ struct security_class_mapping secclass_map[] = { ...@@ -52,8 +52,7 @@ struct security_class_mapping secclass_map[] = {
{ "lnk_file", { "lnk_file",
{ COMMON_FILE_PERMS, NULL } }, { COMMON_FILE_PERMS, NULL } },
{ "chr_file", { "chr_file",
{ COMMON_FILE_PERMS, { COMMON_FILE_PERMS, NULL } },
"execute_no_trans", "entrypoint", "execmod", NULL } },
{ "blk_file", { "blk_file",
{ COMMON_FILE_PERMS, NULL } }, { COMMON_FILE_PERMS, NULL } },
{ "sock_file", { "sock_file",
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment