selinux-policy/refpolicy/policy/mcs

ifdef(`enable_mcs',`
#
# Define sensitivities 
#
# Each sensitivity has a name and zero or more aliases.
#
# MCS is single-sensitivity.
#
sensitivity s0;

#
# Define the ordering of the sensitivity levels (least to greatest)
#
dominance { s0 }


#
# Define the categories
#
# Each category has a name and zero or more aliases.
#
category c0;
category c1;
category c2;
category c3;
category c4;
category c5;
category c6;
category c7;
category c8;
category c9;
category c10;
category c11;
category c12;
category c13;
category c14;
category c15;
category c16;
category c17;
category c18;
category c19;
category c20;
category c21;
category c22;
category c23;
category c24;
category c25;
category c26;
category c27;
category c28;
category c29;
category c30;
category c31;
category c32;
category c33;
category c34;
category c35;
category c36;
category c37;
category c38;
category c39;
category c40;
category c41;
category c42;
category c43;
category c44;
category c45;
category c46;
category c47;
category c48;
category c49;
category c50;
category c51;
category c52;
category c53;
category c54;
category c55;
category c56;
category c57;
category c58;
category c59;
category c60;
category c61;
category c62;
category c63;
category c64;
category c65;
category c66;
category c67;
category c68;
category c69;
category c70;
category c71;
category c72;
category c73;
category c74;
category c75;
category c76;
category c77;
category c78;
category c79;
category c80;
category c81;
category c82;
category c83;
category c84;
category c85;
category c86;
category c87;
category c88;
category c89;
category c90;
category c91;
category c92;
category c93;
category c94;
category c95;
category c96;
category c97;
category c98;
category c99;
category c100;
category c101;
category c102;
category c103;
category c104;
category c105;
category c106;
category c107;
category c108;
category c109;
category c110;
category c111;
category c112;
category c113;
category c114;
category c115;
category c116;
category c117;
category c118;
category c119;
category c120;
category c121;
category c122;
category c123;
category c124;
category c125;
category c126;
category c127;
category c128;
category c129;
category c130;
category c131;
category c132;
category c133;
category c134;
category c135;
category c136;
category c137;
category c138;
category c139;
category c140;
category c141;
category c142;
category c143;
category c144;
category c145;
category c146;
category c147;
category c148;
category c149;
category c150;
category c151;
category c152;
category c153;
category c154;
category c155;
category c156;
category c157;
category c158;
category c159;
category c160;
category c161;
category c162;
category c163;
category c164;
category c165;
category c166;
category c167;
category c168;
category c169;
category c170;
category c171;
category c172;
category c173;
category c174;
category c175;
category c176;
category c177;
category c178;
category c179;
category c180;
category c181;
category c182;
category c183;
category c184;
category c185;
category c186;
category c187;
category c188;
category c189;
category c190;
category c191;
category c192;
category c193;
category c194;
category c195;
category c196;
category c197;
category c198;
category c199;
category c200;
category c201;
category c202;
category c203;
category c204;
category c205;
category c206;
category c207;
category c208;
category c209;
category c210;
category c211;
category c212;
category c213;
category c214;
category c215;
category c216;
category c217;
category c218;
category c219;
category c220;
category c221;
category c222;
category c223;
category c224;
category c225;
category c226;
category c227;
category c228;
category c229;
category c230;
category c231;
category c232;
category c233;
category c234;
category c235;
category c236;
category c237;
category c238;
category c239;
category c240;
category c241;
category c242;
category c243;
category c244;
category c245;
category c246;
category c247;
category c248;
category c249;
category c250;
category c251;
category c252;
category c253;
category c254;
category c255;


#
# Each MCS level specifies a sensitivity and zero or more categories which may
# be associated with that sensitivity.
#
level s0:c0.c255;

#
# Define the MCS policy
#
# mlsconstrain class_set perm_set expression ;
#
# mlsvalidatetrans class_set expression ;
#
# expression : ( expression )
#	     | not expression
#	     | expression and expression
#	     | expression or expression
#	     | u1 op u2
#	     | r1 role_mls_op r2
#	     | t1 op t2
#	     | l1 role_mls_op l2
#	     | l1 role_mls_op h2
#	     | h1 role_mls_op l2
#	     | h1 role_mls_op h2
#	     | l1 role_mls_op h1
#	     | l2 role_mls_op h2
#	     | u1 op names
#	     | u2 op names
#	     | r1 op names
#	     | r2 op names
#	     | t1 op names
#	     | t2 op names
#	     | u3 op names (NOTE: this is only available for mlsvalidatetrans)
#	     | r3 op names (NOTE: this is only available for mlsvalidatetrans)
#	     | t3 op names (NOTE: this is only available for mlsvalidatetrans)
#
# op : == | !=
# role_mls_op : == | != | eq | dom | domby | incomp
#
# names : name | { name_list }
# name_list : name | name_list name
#

#
# MCS policy for the file classes
#
# Constrain file access so that the high range of the process dominates
# the high range of the file.  We use the high range of the process so
# that processes can always simply run at s0.
#
# Only files are constrained by MCS at this stage.
#
mlsconstrain file { write setattr append unlink link rename
		    create ioctl lock execute } (h1 dom h2);

mlsconstrain file { read } ((h1 dom h2) or 
			    ( t1 == mlsfileread ));


# new file labels must be dominated by the relabeling subject clearance
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom relabelto }
	( h1 dom h2 );

define(`nogetattr_file_perms', `{ create ioctl read lock write setattr append 
link unlink rename relabelfrom relabelto }')

define(`nogetattr_dir_perms', `{ create read lock setattr ioctl link unlink 
rename search add_name remove_name reparent write rmdir relabelfrom 
relabelto }')

# XXX
#
# For some reason, we need to reference the mlsfileread attribute
# or we get a build error.  Below is a dummy entry to do this.
mlsconstrain xextension query ( t1 == mlsfileread );

') dnl end enable_mcs