diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.in b/refpolicy/policy/modules/kernel/corenetwork.if.in index 7b00bd3..60fd6df 100644 --- a/refpolicy/policy/modules/kernel/corenetwork.if.in +++ b/refpolicy/policy/modules/kernel/corenetwork.if.in @@ -13,7 +13,7 @@ ## # define(`corenet_tcp_sendrecv_generic_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_t:netif { tcp_send tcp_recv }; ') @@ -29,7 +29,7 @@ define(`corenet_tcp_sendrecv_generic_if_depend',` # corenet_udp_send_generic_if(domain) # define(`corenet_udp_send_generic_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_t:netif udp_send; ') @@ -45,7 +45,7 @@ define(`corenet_udp_send_generic_if_depend',` # corenet_udp_receive_generic_if(domain) # define(`corenet_udp_receive_generic_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_t:netif udp_recv; ') @@ -70,7 +70,7 @@ define(`corenet_udp_sendrecv_generic_if',` # corenet_raw_send_generic_if(domain) # define(`corenet_raw_send_generic_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_t:netif rawip_send; allow $1 self:capability net_raw; @@ -88,7 +88,7 @@ define(`corenet_raw_send_generic_if_depend',` # corenet_raw_receive_generic_if(domain) # define(`corenet_raw_receive_generic_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_t:netif rawip_recv; ') @@ -113,7 +113,7 @@ define(`corenet_raw_sendrecv_generic_if',` # corenet_tcp_sendrecv_all_if(domain) # define(`corenet_tcp_sendrecv_all_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_type:netif { tcp_send tcp_recv }; ') @@ -129,7 +129,7 @@ define(`corenet_tcp_sendrecv_all_if_depend',` # corenet_udp_send_all_if(domain) # define(`corenet_udp_send_all_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_type:netif udp_send; ') @@ -145,7 +145,7 @@ define(`corenet_udp_send_all_if_depend',` # corenet_udp_receive_all_if(domain) # define(`corenet_udp_receive_all_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_type:netif udp_recv; ') @@ -170,7 +170,7 @@ define(`corenet_udp_sendrecv_all_if',` # corenet_raw_send_all_if(domain) # define(`corenet_raw_send_all_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_type:netif rawip_send; allow $1 self:capability net_raw; @@ -188,7 +188,7 @@ define(`corenet_raw_send_all_if_depend',` # corenet_raw_receive_all_if(domain) # define(`corenet_raw_receive_all_if',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 netif_type:netif rawip_recv; ') @@ -213,7 +213,7 @@ define(`corenet_raw_sendrecv_all_if',` # corenet_tcp_sendrecv_generic_node(domain) # define(`corenet_tcp_sendrecv_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:node { tcp_send tcp_recv }; ') @@ -229,7 +229,7 @@ define(`corenet_tcp_sendrecv_generic_node_depend',` # corenet_udp_send_generic_node(domain) # define(`corenet_udp_send_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:node udp_send; ') @@ -245,7 +245,7 @@ define(`corenet_udp_send_generic_node_depend',` # corenet_udp_receive_generic_node(domain) # define(`corenet_udp_receive_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:node udp_recv; ') @@ -270,7 +270,7 @@ define(`corenet_udp_sendrecv_generic_node',` # corenet_raw_send_generic_node(domain) # define(`corenet_raw_send_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:node rawip_send; allow $1 self:capability net_raw; @@ -288,7 +288,7 @@ define(`corenet_raw_send_generic_node_depend',` # corenet_raw_receive_generic_node(domain) # define(`corenet_raw_receive_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:node rawip_recv; ') @@ -313,7 +313,7 @@ define(`corenet_raw_sendrecv_generic_node',` # corenet_tcp_bind_generic_node(domain) # define(`corenet_tcp_bind_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:tcp_socket node_bind; ') @@ -329,7 +329,7 @@ define(`corenet_tcp_bind_generic_node_depend',` # corenet_udp_bind_generic_node(domain) # define(`corenet_udp_bind_generic_node',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_t:udp_socket node_bind; ') @@ -345,7 +345,7 @@ define(`corenet_udp_bind_generic_node_depend',` # corenet_tcp_sendrecv_all_nodes(domain) # define(`corenet_tcp_sendrecv_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:node { tcp_send tcp_recv }; ') @@ -361,7 +361,7 @@ define(`corenet_tcp_sendrecv_all_nodes_depend',` # corenet_udp_send_all_nodes(domain) # define(`corenet_udp_send_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:node udp_send; ') @@ -377,7 +377,7 @@ define(`corenet_udp_send_all_nodes_depend',` # corenet_udp_receive_all_nodes(domain) # define(`corenet_udp_receive_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:node udp_recv; ') @@ -402,7 +402,7 @@ define(`corenet_udp_sendrecv_all_nodes',` # corenet_raw_send_all_nodes(domain) # define(`corenet_raw_send_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:node rawip_send; allow $1 self:capability net_raw; @@ -420,7 +420,7 @@ define(`corenet_raw_send_all_nodes_depend',` # corenet_raw_receive_all_nodes(domain) # define(`corenet_raw_receive_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:node rawip_recv; ') @@ -445,7 +445,7 @@ define(`corenet_raw_sendrecv_all_nodes',` # corenet_tcp_bind_all_nodes(domain) # define(`corenet_tcp_bind_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:tcp_socket node_bind; ') @@ -461,7 +461,7 @@ define(`corenet_tcp_bind_all_nodes_depend',` # corenet_udp_bind_all_nodes(domain) # define(`corenet_udp_bind_all_nodes',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 node_type:udp_socket node_bind; ') @@ -477,7 +477,7 @@ define(`corenet_udp_bind_all_nodes_depend',` # corenet_tcp_sendrecv_generic_port(domain) # define(`corenet_tcp_sendrecv_generic_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_t:tcp_socket { send_msg recv_msg }; ') @@ -493,7 +493,7 @@ define(`corenet_tcp_sendrecv_generic_port_depend',` # corenet_udp_send_generic_port(domain) # define(`corenet_udp_send_generic_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_t:udp_socket send_msg; ') @@ -509,7 +509,7 @@ define(`corenet_udp_send_generic_port_depend',` # corenet_udp_receive_generic_port(domain) # define(`corenet_udp_receive_generic_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_t:udp_socket recv_msg; ') @@ -534,7 +534,7 @@ define(`corenet_udp_sendrecv_generic_port',` # corenet_tcp_bind_generic_port(domain) # define(`corenet_tcp_bind_generic_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_t:tcp_socket name_bind; ') @@ -550,7 +550,7 @@ define(`corenet_tcp_bind_generic_port_depend',` # corenet_udp_bind_generic_port(domain) # define(`corenet_udp_bind_generic_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_t:udp_socket name_bind; ') @@ -566,7 +566,7 @@ define(`corenet_udp_bind_generic_port_depend',` # corenet_tcp_sendrecv_all_ports(domain) # define(`corenet_tcp_sendrecv_all_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_type:tcp_socket { send_msg recv_msg }; ') @@ -582,7 +582,7 @@ define(`corenet_tcp_sendrecv_all_ports_depend',` # corenet_udp_send_all_ports(domain) # define(`corenet_udp_send_all_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_type:udp_socket send_msg; ') @@ -598,7 +598,7 @@ define(`corenet_udp_send_all_ports_depend',` # corenet_udp_receive_all_ports(domain) # define(`corenet_udp_receive_all_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_type:udp_socket recv_msg; ') @@ -623,7 +623,7 @@ define(`corenet_udp_sendrecv_all_ports',` # corenet_tcp_bind_all_ports(domain) # define(`corenet_tcp_bind_all_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_type:tcp_socket name_bind; ') @@ -639,7 +639,7 @@ define(`corenet_tcp_bind_all_ports_depend',` # corenet_udp_bind_all_ports(domain) # define(`corenet_udp_bind_all_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 port_type:udp_socket name_bind; ') @@ -655,7 +655,7 @@ define(`corenet_udp_bind_all_ports_depend',` # corenet_tcp_sendrecv_reserved_port(domain) # define(`corenet_tcp_sendrecv_reserved_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_t:tcp_socket { send_msg recv_msg }; ') @@ -671,7 +671,7 @@ define(`corenet_tcp_sendrecv_reserved_port_depend',` # corenet_udp_send_reserved_port(domain) # define(`corenet_udp_send_reserved_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_t:udp_socket send_msg; ') @@ -687,7 +687,7 @@ define(`corenet_udp_send_reserved_port_depend',` # corenet_udp_receive_reserved_port(domain) # define(`corenet_udp_receive_reserved_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_t:udp_socket recv_msg; ') @@ -712,7 +712,7 @@ define(`corenet_udp_sendrecv_reserved_port',` # corenet_tcp_bind_reserved_port(domain) # define(`corenet_tcp_bind_reserved_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_t:tcp_socket name_bind; allow $1 self:capability net_bind_service; @@ -730,7 +730,7 @@ define(`corenet_tcp_bind_reserved_port_depend',` # corenet_udp_bind_reserved_port(domain) # define(`corenet_udp_bind_reserved_port',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_t:udp_socket name_bind; allow $1 self:capability net_bind_service; @@ -748,7 +748,7 @@ define(`corenet_udp_bind_reserved_port_depend',` # corenet_tcp_sendrecv_all_reserved_ports(domain) # define(`corenet_tcp_sendrecv_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_type:tcp_socket { send_msg recv_msg }; ') @@ -764,7 +764,7 @@ define(`corenet_tcp_sendrecv_all_reserved_ports_depend',` # corenet_udp_send_all_reserved_ports(domain) # define(`corenet_udp_send_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_type:udp_socket send_msg; ') @@ -780,7 +780,7 @@ define(`corenet_udp_send_all_reserved_ports_depend',` # corenet_udp_receive_all_reserved_ports(domain) # define(`corenet_udp_receive_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_type:udp_socket recv_msg; ') @@ -805,7 +805,7 @@ define(`corenet_udp_sendrecv_all_reserved_ports',` # corenet_tcp_bind_all_reserved_ports(domain) # define(`corenet_tcp_bind_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_type:tcp_socket name_bind; allow $1 self:capability net_bind_service; @@ -823,7 +823,7 @@ define(`corenet_tcp_bind_all_reserved_ports_depend',` # corenet_dontaudit_tcp_bind_all_reserved_ports(domain) # define(`corenet_dontaudit_tcp_bind_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) dontaudit $1 reserved_port_type:tcp_socket name_bind; ') @@ -839,7 +839,7 @@ define(`corenet_dontaudit_tcp_bind_all_reserved_ports_depend',` # corenet_udp_bind_all_reserved_ports(domain) # define(`corenet_udp_bind_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) allow $1 reserved_port_type:udp_socket name_bind; allow $1 self:capability net_bind_service; @@ -857,7 +857,7 @@ define(`corenet_udp_bind_all_reserved_ports_depend',` # corenet_dontaudit_udp_bind_all_reserved_ports(domain) # define(`corenet_dontaudit_udp_bind_all_reserved_ports',` - requires_block_template(`$0'_depend) + gen_require(`$0'_depend) dontaudit $1 reserved_port_type:udp_socket name_bind; ') diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.m4 b/refpolicy/policy/modules/kernel/corenetwork.if.m4 index 192e6a9..d4a71be 100644 --- a/refpolicy/policy/modules/kernel/corenetwork.if.m4 +++ b/refpolicy/policy/modules/kernel/corenetwork.if.m4 @@ -17,7 +17,7 @@ define(`create_netif_interfaces',`` ## # define(`corenet_tcp_sendrecv_$1',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_netif_t:netif { tcp_send tcp_recv }; ') @@ -40,7 +40,7 @@ define(`corenet_tcp_sendrecv_$1_depend',` ## # define(`corenet_udp_send_$1',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_netif_t:netif udp_send; ') @@ -63,7 +63,7 @@ define(`corenet_udp_send_$1_depend',` ## # define(`corenet_udp_receive_$1',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_netif_t:netif udp_recv; ') @@ -102,7 +102,7 @@ define(`corenet_udp_sendrecv_$1',` ## # define(`corenet_raw_send_$1',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_netif_t:netif rawip_send; allow dollarsone self:capability net_raw; @@ -127,7 +127,7 @@ define(`corenet_raw_send_$1_depend',` ## # define(`corenet_raw_receive_$1',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_netif_t:netif rawip_recv; ') @@ -174,7 +174,7 @@ define(`create_node_interfaces',`` ## # define(`corenet_tcp_sendrecv_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:node { tcp_send tcp_recv }; ') @@ -197,7 +197,7 @@ define(`corenet_tcp_sendrecv_$1_node_depend',` ## # define(`corenet_udp_send_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:node udp_send; ') @@ -220,7 +220,7 @@ define(`corenet_udp_send_$1_node_depend',` ## # define(`corenet_udp_receive_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:node udp_recv; ') @@ -259,7 +259,7 @@ define(`corenet_udp_sendrecv_$1_node',` ## # define(`corenet_raw_send_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:node rawip_send; allow dollarsone self:capability net_raw; @@ -284,7 +284,7 @@ define(`corenet_raw_send_$1_node_depend',` ## # define(`corenet_raw_receive_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:node rawip_recv; ') @@ -323,7 +323,7 @@ define(`corenet_raw_sendrecv_$1_node',` ## # define(`corenet_tcp_bind_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:tcp_socket node_bind; ') @@ -346,7 +346,7 @@ define(`corenet_tcp_bind_$1_node_depend',` ## # define(`corenet_udp_bind_$1_node',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_node_t:udp_socket node_bind; ') @@ -377,7 +377,7 @@ define(`create_port_interfaces',`` ## # define(`corenet_tcp_sendrecv_$1_port',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_port_t:tcp_socket { send_msg recv_msg }; ') @@ -400,7 +400,7 @@ define(`corenet_tcp_sendrecv_$1_port_depend',` ## # define(`corenet_udp_send_$1_port',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_port_t:udp_socket send_msg; ') @@ -423,7 +423,7 @@ define(`corenet_udp_send_$1_port_depend',` ## # define(`corenet_udp_receive_$1_port',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_port_t:udp_socket recv_msg; ') @@ -462,7 +462,7 @@ define(`corenet_udp_sendrecv_$1_port',` ## # define(`corenet_tcp_bind_$1_port',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_port_t:tcp_socket name_bind; $2 ') @@ -486,7 +486,7 @@ define(`corenet_tcp_bind_$1_port_depend',` ## # define(`corenet_udp_bind_$1_port',` - requires_block_template(`dollarszero'_depend) + gen_require(`dollarszero'_depend) allow dollarsone $1_port_t:udp_socket name_bind; $2 diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.m4 b/refpolicy/policy/modules/kernel/corenetwork.te.m4 index f591654..431d718 100644 --- a/refpolicy/policy/modules/kernel/corenetwork.te.m4 +++ b/refpolicy/policy/modules/kernel/corenetwork.te.m4 @@ -2,7 +2,7 @@ # network_interface(linux_interfacename,mls_sensitivity) # define(`network_interface',` -requires_block_template(`type unlabeled_t') +gen_require(`type unlabeled_t') type $1_netif_t alias netif_$1_t, netif_type; netifcon $1 context_template(system_u:object_r:$1_netif_t,$2) context_template(system_u:object_r:unlabeled_t,$2) ')