Constraints overhaul - #1221

Open

pebenito wants to merge 22 commits into

SELinuxProject:mainfrom

pebenito:constraints-overhaul

Commits on Sep 2, 2026

Constrain anonymous file classes
pebenito
committed
135c6a2
Add MLS and MCS file class sets
pebenito
committed
2bdb15c
Constrain Binder operations
pebenito
committed
c0e1d1d
Constrain BPF operations
pebenito
committed
b08f3e2
Constrain perf event operations
pebenito
committed
07d71e7
Constrain io_uring operations
pebenito
committed
4205a6d
Add MLS, MCS, and UBAC socket class sets
pebenito
committed
60228ba
Add missing MLS and UBAC constraints for X classes.
pebenito
committed
5b65aea
Add missing UBAC, MLS, and MCS constraints for db classes.
pebenito
committed
6c67cef
Add watch permissions to MLS and MCS.
pebenito
committed
98bcb8e
MLS: Constrain socket range configured by setsockcreate.
pebenito
committed
932b26f
Add missing process permissions for UBAC, MLS, and MCS.
pebenito
committed
257e2a3
Add db_language:implement MLS and MCS constraints.
pebenito
committed
3130892
Add db_schema:add_name,remove_name MCS constraint.
pebenito
committed
a5f1dbb
Add x_drawable:set_property,override,show,hide MLS constraint.
pebenito
committed
1258c05
Add x_device:create,destroy,set_property,add,remove MLS constraint.
pebenito
committed
2ce2b0c
Add x_device:list_property,get_property MLS constraint.
pebenito
committed
ed6c44b
Add x_application_data:copy MLS constraint.
pebenito
committed
fc440b0
Add currently unchecked socket permission constraints.
pebenito
committed
c99421d
Add file and socket ioctl MLS constraints.
pebenito
committed
67d318c
Add file:map,entrypoint MCS constraint.
pebenito
committed
9a49fbc
AGENTS.md: Add instructions for updating constraints.
pebenito
committed
1eff920

Navigation Menu

Uh oh!

Constraints overhaul - #1221

Constraints overhaul#1221
pebenito wants to merge 22 commits into
SELinuxProject:mainfrom
pebenito:constraints-overhaul

Commits on Sep 2, 2026

Constrain anonymous file classes

Add MLS and MCS file class sets

Constrain Binder operations

Constrain BPF operations

Constrain perf event operations

Constrain io_uring operations

Add MLS, MCS, and UBAC socket class sets

Add missing MLS and UBAC constraints for X classes.

Add missing UBAC, MLS, and MCS constraints for db classes.

Add watch permissions to MLS and MCS.

MLS: Constrain socket range configured by setsockcreate.

Add missing process permissions for UBAC, MLS, and MCS.

Add db_language:implement MLS and MCS constraints.

Add db_schema:add_name,remove_name MCS constraint.

Add x_drawable:set_property,override,show,hide MLS constraint.

Add x_device:create,destroy,set_property,add,remove MLS constraint.

Add x_device:list_property,get_property MLS constraint.

Add x_application_data:copy MLS constraint.

Add currently unchecked socket permission constraints.

Add file and socket ioctl MLS constraints.

Add file:map,entrypoint MCS constraint.

AGENTS.md: Add instructions for updating constraints.