Align policy classes and access vectors to kernel definitions about selinux HOT 5 CLOSED

FYI @wrabcak

from selinux.

pebenito took care of some of this for refpolicy via:
SELinuxProject/refpolicy@e5dbe75
SELinuxProject/refpolicy@c656b97
SELinuxProject/refpolicy@3952ecb

I just opened a PR for removing unused permissions in:
SELinuxProject/refpolicy#159

If/when that gets merged, I have another commit to remove the netlink_firewall and netlink_ip6fw classes that were removed from the kernel a while back but that could break legacy userspace object managers if not using dynamic class/perm support.

Looks like the ipc class is no longer used and could be dropped from both kernel and policy. It was a fallback in case we couldn't determine the finer-grained shm/sem/msgq class in older code.

Could then also re-order security_classes to match classmap.h order if desired, putting all kernel classes together at the beginning in the same order as the kernel to make the mapping the identity mapping. That also could break legacy userspace. Not strictly necessary but kind of nice if all the kernel classes were contiguous in policy.

FYI @WOnder93 @pebenito @jeffvanderstoep

from selinux.

SELinuxProject/refpolicy#161 removes the two obsolete netlink classes. This change unlike the previous one is likely not compatible with RHEL6 kernels, and could possibly impact userspace on RHEL7 if it still has any userspace object managers that use the old flask.h/av_permissions.h definitions for classes/perms instead of dynamically mapping them.

from selinux.

Amended SELinuxProject/refpolicy#161 to rename instead of remove to preserve userspace compatibility.
Given userspace compatibility constraints impacting even RHEL8 for dbus-daemon, don't think we can ever re-order security_classes to match classmap order, so dropping that as a goal for this issue.
So I think I can close this issue once the above PR is merged (or rejected).

from selinux.

refpolicy is now aligned to the kernel classes and access vector definitions aside from some class ordering issues (unfixable without breaking userspace) and not yet having recently added classes (perf_event, lockdown). It already has the watch permissions, unlike Fedora policy.
Some of the changes were already in Android policy and I submitted the rest just now so it should be aligned shortly unless they decide they cannot remove the chr_file:execute_no_trans/entrypoint and packet:flow_in/flow_out definitions compatibly. I'm going to close this issue as complete to the extent feasible today.

from selinux.