blob: 22d7feda09336aa523c98315bd0c9d706ee017a7 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001# FLASK
2
3#
4# Define the security object classes
5#
6
7# Classes marked as userspace are classes
8# for userspace object managers
9
10class security
11class process
12class system
13class capability
14
15# file-related classes
16class filesystem
17class file
18class dir
19class fd
20class lnk_file
21class chr_file
22class blk_file
23class sock_file
24class fifo_file
25
26# network-related classes
27class socket
28class tcp_socket
29class udp_socket
30class rawip_socket
31class node
32class netif
33class netlink_socket
34class packet_socket
35class key_socket
36class unix_stream_socket
37class unix_dgram_socket
38
39# sysv-ipc-related classes
40class sem
41class msg
42class msgq
43class shm
44class ipc
45
Stephen Smalley2dd4e512012-01-04 12:33:27 -050046# extended netlink sockets
47class netlink_route_socket
48class netlink_firewall_socket
49class netlink_tcpdiag_socket
50class netlink_nflog_socket
51class netlink_xfrm_socket
52class netlink_selinux_socket
53class netlink_audit_socket
54class netlink_ip6fw_socket
55class netlink_dnrt_socket
56
Stephen Smalley2dd4e512012-01-04 12:33:27 -050057# IPSec association
58class association
59
60# Updated Netlink class for KOBJECT_UEVENT family.
61class netlink_kobject_uevent_socket
62
63class appletalk_socket
64
65class packet
66
67# Kernel access key retention
68class key
69
Stephen Smalley2dd4e512012-01-04 12:33:27 -050070class dccp_socket
71
72class memprotect
73
Stephen Smalley2dd4e512012-01-04 12:33:27 -050074# network peer labels
75class peer
76
77# Capabilities >= 32
78class capability2
79
Stephen Smalley2dd4e512012-01-04 12:33:27 -050080# kernel services that need to override task security, e.g. cachefiles
81class kernel_service
82
83class tun_socket
84
Stephen Smalley2dd4e512012-01-04 12:33:27 -050085class binder
Stephen Smalley2dd4e512012-01-04 12:33:27 -050086
Stephen Smalley01d95c22015-05-21 16:17:26 -040087# Updated netlink classes for more recent netlink protocols.
88class netlink_iscsi_socket
89class netlink_fib_lookup_socket
90class netlink_connector_socket
91class netlink_netfilter_socket
92class netlink_generic_socket
93class netlink_scsitransport_socket
94class netlink_rdma_socket
95class netlink_crypto_socket
96
Stephen Smalley8a003602016-04-27 09:42:57 -040097# Capability checks when on a non-init user namespace
98class cap_userns
99class cap2_userns
100
Stephen Smalley431bdd92016-12-08 13:35:27 -0500101# New socket classes introduced by extended_socket_class policy capability.
102# These two were previously mapped to rawip_socket.
103class sctp_socket
104class icmp_socket
105# These were previously mapped to socket.
106class ax25_socket
107class ipx_socket
108class netrom_socket
109class atmpvc_socket
110class x25_socket
111class rose_socket
112class decnet_socket
113class atmsvc_socket
114class rds_socket
115class irda_socket
116class pppox_socket
117class llc_socket
118class can_socket
119class tipc_socket
120class bluetooth_socket
121class iucv_socket
122class rxrpc_socket
123class isdn_socket
124class phonet_socket
125class ieee802154_socket
126class caif_socket
127class alg_socket
128class nfc_socket
129class vsock_socket
130class kcm_socket
131class qipcrtr_socket
132
Stephen Smalley124720a2012-04-04 10:11:16 -0400133# Property service
134class property_service # userspace
135
Riley Spahnf90c41f2014-06-05 15:52:02 -0700136# Service manager
137class service_manager # userspace
138
Riley Spahn1196d2a2014-06-17 14:58:52 -0700139# Keystore Key
140class keystore_key # userspace
141
Riley Spahn70f75ce2014-07-02 12:42:59 -0700142class drmservice # userspace
Stephen Smalley2dd4e512012-01-04 12:33:27 -0500143# FLASK