## Multilevel security policy ## ##

## This module contains interfaces for handling multilevel ## security. The interfaces allow the specified subjects ## and objects to be allowed certain privileges in the ## MLS rules. ##

##
## ## Contains attributes used in MLS policy. ## ######################################## ## ## Make specified domain MLS trusted ## for reading from files at higher levels. ## ## ## ## Domain allowed access. ## ## ## # interface(`mls_file_read_up',` gen_require(` attribute mlsfileread; ') typeattribute $1 mlsfileread; ') ######################################## ## ## Make specified domain MLS trusted ## for writing to files at lower levels. ## ## ## ## Domain allowed access. ## ## ## # interface(`mls_file_write_down',` gen_require(` attribute mlsfilewrite; ') typeattribute $1 mlsfilewrite; ') ######################################## ## ## Make specified domain MLS trusted ## for raising the level of files. ## ## ## ## Domain allowed access. ## ## ## # interface(`mls_file_upgrade',` gen_require(` attribute mlsfileupgrade; ') typeattribute $1 mlsfileupgrade; ') ######################################## ## ## Make specified domain MLS trusted ## for lowering the level of files. ## ## ## ## Domain allowed access. ## ## ## # interface(`mls_file_downgrade',` gen_require(` attribute mlsfiledowngrade; ') typeattribute $1 mlsfiledowngrade; ') ######################################## ## ## Make specified domain MLS trusted ## for reading from sockets at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_socket_read_all_levels',` gen_require(` attribute mlsnetread; ') typeattribute $1 mlsnetread; ') ######################################## ## ## Make specified domain MLS trusted ## for reading from sockets at any level ## that is dominated by the process clearance. ## ## ## ## Domain allowed access. ## ## # interface(`mls_socket_read_to_clearance',` gen_require(` attribute mlsnetreadtoclr; ') typeattribute $1 mlsnetreadtoclr; ') ######################################## ## ## Make specified domain MLS trusted ## for writing to sockets at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_socket_write_all_levels',` gen_require(` attribute mlsnetwrite; ') typeattribute $1 mlsnetwrite; ') ######################################## ## ## Make specified domain MLS trusted ## for receiving network data from ## network interfaces or hosts at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_net_receive_all_levels',` gen_require(` attribute mlsnetrecvall; ') typeattribute $1 mlsnetrecvall; ') ######################################## ## ## Make specified domain MLS trusted ## for reading from System V IPC objects ## at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_sysvipc_read_all_levels',` gen_require(` attribute mlsipcread; ') typeattribute $1 mlsipcread; ') ######################################## ## ## Make specified domain MLS trusted ## for writing to System V IPC objects ## at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_sysvipc_write_all_levels',` gen_require(` attribute mlsipcwrite; ') typeattribute $1 mlsipcwrite; ') ######################################## ## ## Allow the specified domain to do a MLS ## range transition that changes ## the current level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_rangetrans_source',` gen_require(` attribute privrangetrans; ') typeattribute $1 privrangetrans; ') ######################################## ## ## Make specified domain a target domain ## for MLS range transitions that change ## the current level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_rangetrans_target',` gen_require(` attribute mlsrangetrans; ') typeattribute $1 mlsrangetrans; ') ######################################## ## ## Make specified domain MLS trusted ## for reading from processes at higher levels. ## ## ## ## Domain allowed access. ## ## # interface(`mls_process_read_up',` gen_require(` attribute mlsprocread; ') typeattribute $1 mlsprocread; ') ######################################## ## ## Make specified domain MLS trusted ## for writing to processes at lower levels. ## ## ## ## Domain allowed access. ## ## # interface(`mls_process_write_down',` gen_require(` attribute mlsprocwrite; ') typeattribute $1 mlsprocwrite; ') ######################################## ## ## Make specified domain MLS trusted ## for setting the level of processes ## it executes. ## ## ## ## Domain allowed access. ## ## # interface(`mls_process_set_level',` gen_require(` attribute mlsprocsetsl; ') typeattribute $1 mlsprocsetsl; ') ######################################## ## ## Make specified domain MLS trusted ## for reading from X objects at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_xwin_read_all_levels',` gen_require(` attribute mlsxwinread; ') typeattribute $1 mlsxwinread; ') ######################################## ## ## Make specified domain MLS trusted ## for writing to X objects at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_xwin_write_all_levels',` gen_require(` attribute mlsxwinwrite; ') typeattribute $1 mlsxwinwrite; ') ######################################## ## ## Make specified domain MLS trusted ## for reading from X colormaps at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_colormap_read_all_levels',` gen_require(` attribute mlsxwinreadcolormap; ') typeattribute $1 mlsxwinreadcolormap; ') ######################################## ## ## Make specified domain MLS trusted ## for writing to X colormaps at any level. ## ## ## ## Domain allowed access. ## ## # interface(`mls_colormap_write_all_levels',` gen_require(` attribute mlsxwinwritecolormap; ') typeattribute $1 mlsxwinwritecolormap; ') ######################################## ## ## Make specified object MLS trusted. ## ## ##

## Make specified object MLS trusted. This ## allows all levels to read and write the ## object. ##

##

## This currently only applies to filesystem ## objects, for example, files and directories. ##

##
## ## ## The type of the object. ## ## # interface(`mls_trusted_object',` gen_require(` attribute mlstrustedobject; ') typeattribute $1 mlstrustedobject; ') ######################################## ## ## Make the specified domain trusted ## to inherit and use file descriptors ## from all levels. ## ## ## ## Domain allowed access. ## ## # interface(`mls_fd_use_all_levels',` gen_require(` attribute mlsfduse; ') typeattribute $1 mlsfduse; ') ######################################## ## ## Make the file descriptors from the ## specifed domain inheritable by ## all levels. ## ## ## ## Domain allowed access. ## ## # interface(`mls_fd_share_all_levels',` gen_require(` attribute mlsfdshare; ') typeattribute $1 mlsfdshare; ')