commit: b7a2d9d84420e7f4390bf8f71b475512e28e50ef
Author: Chris PeBenito <chpebeni <AT> linux <DOT> microsoft <DOT> com>
AuthorDate: Mon Jun 20 14:52:30 2022 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep 3 18:41:55 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b7a2d9d8
mcs: Add additional SysV IPC constraints.
Signed-off-by: Chris PeBenito <chpebeni <AT> linux.microsoft.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/mcs | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/policy/mcs b/policy/mcs
index c9b7e83e..e8006b11 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -120,7 +120,16 @@ mlsconstrain { tcp_socket udp_socket rawip_socket
sctp_socket } node_bind
mlsconstrain key { create link read search setattr view write }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
-mlsconstrain { ipc sem msgq shm } { create destroy setattr write unix_write }
+mlsconstrain { ipc sem msgq shm } { create destroy setattr read unix_read
write unix_write }
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
+mlsconstrain msg { send receive }
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
+mlsconstrain msgq enqueue
+ (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
+mlsconstrain shm lock
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain context contains
