On 11/14/19 9:24 AM, Stephen Smalley wrote:
On 11/12/19 12:15 PM, Richard Haines wrote:
Test relevant key management socket permissions.
Signed-off-by: Richard Haines <richard_c_haines@xxxxxxxxxxxxxx>
Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
Sorry, on second thought I had a question below.
<snip>
diff --git a/policy/test_key_socket.te b/policy/test_key_socket.te
new file mode 100644
index 0000000..5c36c72
--- /dev/null
+++ b/policy/test_key_socket.te
@@ -0,0 +1,75 @@
+#
+############## Test key management socket 'key_socket'
#####################
+#
+attribute keysockdomain;
+
+type test_key_sock_t;
+domain_type(test_key_sock_t)
+unconfined_runs_test(test_key_sock_t)
+typeattribute test_key_sock_t testdomain;
+typeattribute test_key_sock_t keysockdomain;
+
+# key_socket rules:
+allow test_key_sock_t self:rawip_socket { create };
Why was the above rule on rawip_socket necessary (and likewise for the
other domains)?
+allow test_key_sock_t self:capability { net_admin };
+allow test_key_sock_t self:key_socket { create write read setopt };
+# For CONFIG_NET_KEY=m
+allow test_key_sock_t kernel_t:system { module_request };
