From:   Russell Coker <russell@coker.com.au>
To:     selinux-refpolicy@vger.kernel.org
Subject: connected_stream_socket_perms
Date:   Thu, 10 Jan 2019 21:51:20 +1100
Message-ID: <1657648.nfkMHCI95s@liv>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind 
connect getopt setopt shutdown }')

define(`connected_socket_perms', `{ create ioctl read getattr write setattr 
append bind getopt setopt shutdown }')

The difference between these 2 is that connected_socket_perms includes create 
while rw_socket_perms has connect.  Why doesn't rw_socket_perms have create?  
Or if we are saying "rw_socket_perms only means reading and writing" then why 
does it have connect?

Does this all make sense?

I expect that a lot of policy has been written based on using whichever of 
those macros seems to match an audit2allow rule and vaguely match the concept 
of what someone imagines the program in question is doing.

Would it make sense to have another macro defined to { ioctl read getattr write 
setattr append bind getopt setopt shutdown } so that there can be a more 
obvious progression of which macro is a superset of which other macro?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/