selinux-policy/policy/modules/kernel/mls.te


policy_module(mls, 1.7.1)

########################################
#
# Declarations
#

attribute mlsfileread;
attribute mlsfilereadtoclr;
attribute mlsfilewrite;
attribute mlsfilewritetoclr;
attribute mlsfilewriteinrange;
attribute mlsfileupgrade;
attribute mlsfiledowngrade;

attribute mlsnetread;
attribute mlsnetreadtoclr;
attribute mlsnetwrite;
attribute mlsnetwritetoclr;
attribute mlsnetwriteranged;
attribute mlsnetupgrade;
attribute mlsnetdowngrade;
attribute mlsnetrecvall;
attribute mlsnetinbound;
attribute mlsnetoutbound;

attribute mlsipcread;
attribute mlsipcreadtoclr;
attribute mlsipcwrite;
attribute mlsipcwritetoclr;

attribute mlsprocread;
attribute mlsprocreadtoclr;
attribute mlsprocwrite;
attribute mlsprocwritetoclr;
attribute mlsprocsetsl;

attribute mlsxwinread;
attribute mlsxwinreadtoclr;
attribute mlsxwinwrite;
attribute mlsxwinwritetoclr;
attribute mlsxwinreadproperty;
attribute mlsxwinwriteproperty;
attribute mlsxwinreadselection;
attribute mlsxwinwriteselection;
attribute mlsxwinreadcolormap;
attribute mlsxwinwritecolormap;
attribute mlsxwinwritexinput;

attribute mlsdbread;
attribute mlsdbreadtoclr;
attribute mlsdbwrite;
attribute mlsdbwritetoclr;
attribute mlsdbwriteinrange;
attribute mlsdbupgrade;
attribute mlsdbdowngrade;

attribute mlstrustedobject;

attribute privrangetrans;
attribute mlsrangetrans;

attribute mlsfduse; 
attribute mlsfdshare;

attribute mlstranslate;

attribute mlsdbusrecv;
attribute mlsdbussend;
add mls privileges 2005-09-26 20:26:32 +00:00
trunk: add MLS constrains for ingress/egress permissions from Paul Moore. Add MLS constraints for several network related access controls including the new ingress/egress controls and the older Secmark controls. Based on the following post to the SELinux Reference Policy mailing list: * http://oss.tresys.com/pipermail/refpolicy/2009-February/000579.html 2009-03-02 15:16:49 +00:00			`policy_module(mls, 1.7.1)`
add mls privileges 2005-09-26 20:26:32 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`attribute mlsfileread;`
			`attribute mlsfilereadtoclr;`
			`attribute mlsfilewrite;`
			`attribute mlsfilewritetoclr;`
Christopher J. PeBenito wrote: > We could add another 'or' on the above constraint: > > or ( (t2 == mlsfilewrite_in_range) and (l1 dom l2) and (h1 domby h2) ) > > I believe that would be the constraint you were looking for. I don't > like the name of that attribute, but I couldn't come up with a better > one off the top of my head. :) > Attached is a patch which I've tested against selinux-policy-2.4.2-1 that implements this additional constraint. The name is still a bit forced, but it works. -matt <mra at hp dot com> 2006-11-01 15:42:22 +00:00			`attribute mlsfilewriteinrange;`
add mls privileges 2005-09-26 20:26:32 +00:00			`attribute mlsfileupgrade;`
			`attribute mlsfiledowngrade;`

			`attribute mlsnetread;`
			`attribute mlsnetreadtoclr;`
			`attribute mlsnetwrite;`
			`attribute mlsnetwritetoclr;`
Update MLS constraints from LSPP evaluated policy. 2007-08-24 14:14:29 +00:00			`attribute mlsnetwriteranged;`
add mls privileges 2005-09-26 20:26:32 +00:00			`attribute mlsnetupgrade;`
			`attribute mlsnetdowngrade;`
			`attribute mlsnetrecvall;`
trunk: add MLS constrains for ingress/egress permissions from Paul Moore. Add MLS constraints for several network related access controls including the new ingress/egress controls and the older Secmark controls. Based on the following post to the SELinux Reference Policy mailing list: * http://oss.tresys.com/pipermail/refpolicy/2009-February/000579.html 2009-03-02 15:16:49 +00:00			`attribute mlsnetinbound;`
			`attribute mlsnetoutbound;`
add mls privileges 2005-09-26 20:26:32 +00:00
			`attribute mlsipcread;`
			`attribute mlsipcreadtoclr;`
			`attribute mlsipcwrite;`
			`attribute mlsipcwritetoclr;`

			`attribute mlsprocread;`
			`attribute mlsprocreadtoclr;`
			`attribute mlsprocwrite;`
			`attribute mlsprocwritetoclr;`
			`attribute mlsprocsetsl;`

			`attribute mlsxwinread;`
			`attribute mlsxwinreadtoclr;`
			`attribute mlsxwinwrite;`
			`attribute mlsxwinwritetoclr;`
part of dan's mega patch 2006-01-06 22:51:40 +00:00			`attribute mlsxwinreadproperty;`
			`attribute mlsxwinwriteproperty;`
trunk: MLS constraints for the x_selection class, from Eamon Walsh. 2009-06-05 13:36:19 +00:00			`attribute mlsxwinreadselection;`
			`attribute mlsxwinwriteselection;`
part of dan's mega patch 2006-01-06 22:51:40 +00:00			`attribute mlsxwinreadcolormap;`
			`attribute mlsxwinwritecolormap;`
			`attribute mlsxwinwritexinput;`
add mls privileges 2005-09-26 20:26:32 +00:00
trunk: Database userspace object manager classes from KaiGai Kohei. 2007-08-09 13:15:07 +00:00			`attribute mlsdbread;`
			`attribute mlsdbreadtoclr;`
			`attribute mlsdbwrite;`
			`attribute mlsdbwritetoclr;`
			`attribute mlsdbwriteinrange;`
			`attribute mlsdbupgrade;`
			`attribute mlsdbdowngrade;`

add mls privileges 2005-09-26 20:26:32 +00:00			`attribute mlstrustedobject;`

			`attribute privrangetrans;`
			`attribute mlsrangetrans;`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00
add mls fd constraints 2006-09-15 19:05:03 +00:00			`attribute mlsfduse;`
			`attribute mlsfdshare;`
enhanced setransd support from darrel goeddel 2006-10-20 14:44:23 +00:00
			`attribute mlstranslate;`
trunk: add mls constraints to dbus. 2008-01-03 20:37:25 +00:00
			`attribute mlsdbusrecv;`
			`attribute mlsdbussend;`