diff --git a/parser/network.cc b/parser/network.cc index 88040c938..0f14df756 100644 --- a/parser/network.cc +++ b/parser/network.cc @@ -612,6 +612,15 @@ bool network_rule::gen_net_rule(Profile &prof, u16 family, unsigned int type_mas buffer << "\\x" << std::setfill('0') << std::setw(2) << std::hex << (type_mask & 0xff); } + if (!features_supports_inet) { + buf = buffer.str(); + if (!prof.policy.rules->add_rule(buf.c_str(), rule_mode == RULE_DENY, map_perms(AA_VALID_NET_PERMS), + dedup_perms_rule_t::audit == AUDIT_FORCE ? map_perms(AA_VALID_NET_PERMS) : 0, + parseopts)) + return false; + return true; + } + if (perms & AA_PEER_NET_PERMS) { gen_ip_conds(buffer, peer, true, false); diff --git a/parser/parser.h b/parser/parser.h index b3c19eea3..1f9b1d501 100644 --- a/parser/parser.h +++ b/parser/parser.h @@ -341,6 +341,7 @@ extern int kernel_load; extern int kernel_supports_setload; extern int features_supports_network; extern int features_supports_networkv8; +extern int features_supports_inet; extern int kernel_supports_policydb; extern int kernel_supports_diff_encode; extern int features_supports_mount; diff --git a/parser/parser_common.c b/parser/parser_common.c index ff245d057..5887a7a41 100644 --- a/parser/parser_common.c +++ b/parser/parser_common.c @@ -69,6 +69,7 @@ int kernel_load = 1; int kernel_supports_setload = 0; /* kernel supports atomic set loads */ int features_supports_network = 0; /* kernel supports network rules */ int features_supports_networkv8 = 0; /* kernel supports 4.17 network rules */ +int features_supports_inet = 0; /* kernel supports inet network rules */ int features_supports_unix = 0; /* kernel supports unix socket rules */ int kernel_supports_policydb = 0; /* kernel supports new policydb */ int features_supports_mount = 0; /* kernel supports mount rules */ diff --git a/parser/parser_main.c b/parser/parser_main.c index 936017c12..2f98b298a 100644 --- a/parser/parser_main.c +++ b/parser/parser_main.c @@ -919,6 +919,9 @@ void set_supported_features() features_supports_networkv8 = features_intersect(kernel_features, policy_features, "network_v8"); + features_supports_inet = features_intersect(kernel_features, + policy_features, + "network/af_inet"); features_supports_unix = features_intersect(kernel_features, policy_features, "network/af_unix");