2

This shows the permissions associated with the tcp_socket class:

> seinfo -c tcp_socket -x

Classes: 1
   class tcp_socket
inherits socket
{
        connectto
        name_connect
        node_bind
        newconn
        acceptfrom
}

But drilling down is not so useful:

seinfo -c socket -x

Classes: 1
   class socket
inherits socket

I'm aware of this and that I can dig through reference policy sources and hopefully find the canonical answer, but the former is "now somewhat historical" ("a list ... from the Fedora F-20 policy sources") and the latter is somewhat tedious.

2

A brief perusal of man seinfo hints at the distinction between an actual object class and a "common permission set".

-c [CLASS], --class [CLASS] Print a list of object classes or, if CLASS is provided, print the named object class. With -x, print a list of permissions for each displayed object class.

[...]

--common [COMMON] Print a list of common permission sets or, if COMMON is provided, print the named common. With -x, print a list of permissions in the set.

And lo:

> seinfo --common socket -x

Commons: 1
   common socket
{
        recv_msg
        append
        relabelfrom
        ioctl
        getattr
        lock
        recvfrom
        relabelto
        shutdown
        setattr
        write
        bind
        name_bind
        accept
        getopt
        create
        setopt
        map
        connect
        send_msg
        listen
        read
        sendto
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.