selinux: support wildcard network interface names

Browse source

Add support for wildcard matching of network interface names.  This is
useful for auto-generated interfaces, for example podman creates network
interfaces for containers with the naming scheme podman0, podman1,
podman2, ...

To maintain backward compatibility guard this feature with a new policy
capability 'netif_wildcard'.

Netifcon definitions are compared against in the order given by the
policy, so userspace tools should sort them in a reasonable order.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Christian Göttsche 2025-03-02 16:40:45 +01:00 • committed by Paul Moore

parent 6ae0042f4d

commit 8af43b61c1

4 changed files with 22 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

security/selinux/include/policycap.h

View file

1

security/selinux/include/policycap_names.h

View file

8

security/selinux/include/security.h

View file

16

security/selinux/ss/services.c

View file