[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     712733031648611660a45cf614edc3c5e1253c0a
Author:     Chris PeBenito <chpebeni <AT> linux <DOT> microsoft <DOT> com>
AuthorDate: Mon Jun 20 18:50:20 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Sep  3 18:41:55 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=71273303

mcs: Add additional socket constraints.

Signed-off-by: Chris PeBenito <chpebeni <AT> linux.microsoft.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/mcs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index af880058..039ed224 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -86,9 +86,21 @@ mlsconstrain { file lnk_file fifo_file } { create relabelto }
 mlsconstrain process { transition dyntransition ptrace sigkill sigstop signal }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain socket_class_set { create ioctl read write setattr append bind connect getopt setopt shutdown }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
+mlsconstrain stream_socket_class_set { listen accept }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 mlsconstrain { tcp_socket udp_socket rawip_socket sctp_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain unix_stream_socket connectto
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
+mlsconstrain unix_dgram_socket sendto
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 mlsconstrain key { create link read search setattr view write }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));