SELinux [Electronic resources]

Appendix B. SELinux Operations

Table B-1 summarizes SELinux operations, identifying their related object classes and giving an approximate description of them. In future SELinux releases, SELinux developers may change the roster of operations, associate operations with object classes differently, or modify the function performed by an operation. The table is sorted alphabetically by the name of the operation. The SELinux file src/policy/flask/access_vectors shows the relationship between object classes and operations and is sorted by object class.

Table B-1. SELinux operations

Operation

Object classes

Description

accept

key_socket , netlink_socket , packet_socket , raw_ipsocket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Accept a connection.

acceptfrom

tcp_socket , unix_stream_socket

Accept connection from client socket.

add_name

dir

Add a name.

append

blk_file , chr_file , dir , fifo_file , file , key_socket , lnk_file , netlink_socket , packet_socket , rawip_socket , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Write or append file or socket contents.

associate

filesystem , ipc , msgq , sem , shm

Associate a file or key with a filesystem, queue, semaphore set, or memory segment.

avc_toggle

system

Toggle between permissive and enforcing modes.

bdflush

system

Control the buffer-dirty-flush daemon.

bind

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Bind name to socket.

change_sid

security

Determine the SID of an object during relabeling.

check_context

security

Write context in selinuxfs filesystem.

chfn

passwd

Change user account information (real name, work room and phone, and home phone).

chown

capability

Change file ownership and group ownership.

chsh

passwd

Change login shell.

compute_av

security

Compute an access vector given a source, target, and class.

compute_create

security

Set create information in selinuxfs filesystem.

compute_member

security

Set member information in selinuxfs filesystem.

compute_relabel

security

Set relabel information in selinuxfs filesystem.

compute_user

security

Set user information in selinuxfs filesystem.

connect

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Initiate connection.

connectto

tcp_socket , unix_stream_socket

Connect to server socket.

context_to_sid

security

Convert a context to an SID.

create

blk_file , chr_file , dir , fifo_file , file , ipc , key_socket , lnk_file , msgq , netlink_socket , packet_socket , rawip_socket , sem , shm , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Create new file, IPC object, queue, semaphore set, or shared memory segment.

dac_override

capability

Override discretionary access control except LINUX_IMMUTABLE .

dac_read_search

capability

Overrides all discretionary access control.

destroy

ipc , msgq , sem , shm

Destroy IPC object, message queue, semaphore set, or shared memory segment.

enforce_dest

node

Destination node can enforce restrictions on the destination socket.

enqueue

msgq

Message may reside on queue.

entrypoint

file

Enter a new domain via this program.

execute

blk_file , chr_file , dir , fifo_file , file , lnk_file , sock_file

Execute.

execute_no_trans

file

Execute file without a domain transition.

fork

process

Fork into two processes.

fowner

capability

Grant file operations otherwise restricted due to ownership.

fsetid

capability

overrides effective user ID checks for set user ID and set group ID files

get_sids , get_user_sids

security

Get the list of active SIDs.

getattr

blk_file , chr_file , dir , fifo_file , file , filesystem , ipc , key_socket , lnk_file , msgq , netlink_socket , packet_socket , process , rawip_socket , sem , shm , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Get file, process, message queue, or shared memory segment attributes.

getcap

process

Get process capabilities.

getopt

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Get socket options.

getpgid

process

Get process group ID.

getsched

process

Get process priority.

getsession

process

Get session ID.

ioctl

blk_file , chr_file , dir , fifo_file , file , key_socket , lnk_file , netlink_socket , packet_socket , rawip_socket , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

I/O control system call requests not addressed by other permissions.

ipc_info

system

Get information for an IPC socket.

ipc_lock

capability

Lock nonshared and shared memory segments.

ipc_owner

capability

Ignore IPC ownership checks.

kill

capability

Raise signal any process.

lease

capability

Take fcntl( ) leases on a file.

link

blk_file , chr_file , dir , fifo_file , file , lnk_file , sock_file

Create hard link to file.

linux_immutable

capability

Modify S_IMMUTABLE and S_APPEND file attributes on supporting filesystems.

listen

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Listen for connections.

load_policy

security

Load the security policy.

lock

blk_file , chr_file , dir , fifo_file , file , key_socket , lnk_file , netlink_socket , packet_socket , rawip_socket , sh , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket, unix_stream_socket

Set and unset file or memory page locks.

member_sid

security

Determine SID to use when selecting a member of a polyinstantiated object .

mknod

capability

Create character or block device nodes.

mount

filesystem

Mount a filesystem.

mounton

blk_file , chr_file , dir , fifo_file , file , lnk_file , sock_file

Use as filesystem mount point.

name_bind

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Bind port to IP or file to Unix socket.

net_admin

capability

Network configuration changes.

net_bind_service

capability

Bind to privileged port.

net_raw

capability

Open raw socket or packet socket.

netbroadcast

capability

Send network broadcast or listen to incoming multicasts.

newconn

tcp_socket , unix_stream_socket

Create new socket for connection.

nfsd_control

system

Control the NFS server.

noatsecure

process

Allow GLibc secure mode.

node_bind

rawip_socket , tcp_socket , udp_socket

Bind socket.

passwd

passwd

Change user password.

ptrace

process

Trace program execution of parent or child.

quotaget

filesystem

Get quota information.

quotamod

filesystem

Modify quota information.

quotaon

blk_file , chr_file , dir , fifo_file , file , lnk_file , sock_file

Enable quotas.

rawip_recv

netif , node

Receive raw IP packet.

rawip_send

netif , node

Send raw IP packet.

read

blk_file , chr_file , dir , fifo_file , file , ipc , key_socket , lnk_file , msgq , netlink_socket , packet_socket , rawip_socket , sem , shm , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Read file, IPC, message queue, or shared memory segment contents.

receive

msg

Remove message from a queue.

recv_msg

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Receive datagram message having SID unequal to socket.

recvfrom

key_socket , netlink_socket , packet_socket , rawip-socket , socket , tcp_socket , udp-socket , unix_dgram_socket , unix_stream_socket

Receive datagrams from socket.

relabelfrom

blk_file , chr_file , dir , fifo_file , file , filesystem , key_socket , lnk_file , netlink_socket , packet_socket , rawip_socket , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Change the security context based on existing type.

relabelto

blk_file , chr_file , dir , fifo_file , file , filesystem , key_socket , lnk_file , netlink_socket , packet_socket , rawip_socket , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Change the security context based on the new type.

remount

filesystem

Change mounted filesystem options.

remove_name

dir

Remove a name.

rename

blk_file, chr_file , dir , fifo_file , lnk_file , sock_file

Rename a hard link.

reparent

dir

Change parent directory.

rlimitinh

process

Inherit resource limits from old SID.

rmdir

dir

Remove directory.

rootok

passwd

Update password if the user is root and the process has the rootok permission.

search

dir

Search directory.

send

msg

Add message to a queue.

send_msg

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Send datagram message having SID unequal to that of sending socket.

sendto

key_socket, netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Send datagrams to socket.

setattr

blk_file , chr_file , dir , fifo_file , file , ipc , key_socket , lnk_file , msgq , netlink_socket , packet_socket , rawip_socket , sem , shm , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Change attributes of file, shared memory segment, or message queue.

setbool

security

Set a boolean value.

setcap

process

Set process capabilities.

setenforce

security

Change the SELinux enforcement mode.

setfscreate

process

Set fscreate context.

setgid

capability

Allow setgid( ) calls, and fake group IDs on credentials passed over a socket.

setopt

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Set IPSec or socket options socket.

setpcap

capability

Transfer process capability map.

setpgid

process

Set process group ID.

setrlimit

process

Change process hard limits.

setsched

process

Set process priority.

setuid

capability

Allow setsuid( ) and fake UIDs on credentials passed over a socket.

share

process

Allow state sharing with cloned or forked process.

shutdown

key_socket , netlink_socket , packet_socket , rawip_socket , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Shutdown connection.

sid_to_context

security

Convert a SID to a context.

sigchld

process

Send SIGCHLD signal.

siginh

process

Inherit signal state from old SID.

sigkill

process

Send SIGKILL signal.

signal

process

Send a signal other than SIGKILL , SIGSTOP , or SIGCHLD .

signull

process

Test for existence of another process without sending a signal.

sigstop

process

Send SIGSTOP signal.

swapon

blk_file , chr_file , dir , fifo_file , lnk_file , sock_file

Allow file to be used for swap space.

sys_admin

capability

Various system capabilities (see /usr/include/linux/capability.h).

sys_boot

capability

Reboot the system.

sys_chroot

capability

Use chroot( ) .

sys_module

capability

Load and remove kernel modules and otherwise modify kernel.

sys_nice

capability

Change process priority and scheduling options.

sys_pacct

capability

Change process accounting state.

sys_ptrace

capability

Trace any process.

sys_rawio

capability

Perform raw I/O.

sys_resource

capability

Various capabilities (see /usr/include/linux/capability.h).

sys_time

capability

Set system time and real-time clock.

sys_tty_config

capability

Configure tty devices.

syslog_console

system

Log to syslog console.

syslog_mod

system

Perform syslog operation other than reading syslog or logging to console.

syslog_read

system

Read syslog

tcp_recv

netif , node

Receive TCP packet.

tcp_send

netif , node

Send TCP packet.

transition

filesystem , process

Transition to a new SID.

transition_sid

security

Determine SID for a new object.

udp_recv

netif , node

Receive UDP packet.

udp_send

netif , node

Send UDP packet.

unix_read

ipc , msgq , sem , shm

Perform IPC read.

unix_write

ipc , msgq , sem , shm

Perform IPC write or append.

unlink

blk_file , chr_file , dir , fifo_file , file , lnk_file , sock_file

Remove (delete) hard link.

unmount

filesystem

Unmount filesystem.

use

fd

Use an inherited file descriptor.

write

blk_file , chr_file , dir , fifo_file , file , ipc , key_socket , lnk_file , msgq , netlink_socket , packet_socket , rawip_socket , sem , shm , sock_file , socket , tcp_socket , udp_socket , unix_dgram_socket , unix_stream_socket

Write or append file or IPC object contents.