357 lines
6.2 KiB
Plaintext
357 lines
6.2 KiB
Plaintext
ifdef(`enable_mcs',`
|
|
#
|
|
# Define sensitivities
|
|
#
|
|
# Each sensitivity has a name and zero or more aliases.
|
|
#
|
|
# MCS is single-sensitivity.
|
|
#
|
|
sensitivity s0;
|
|
|
|
#
|
|
# Define the ordering of the sensitivity levels (least to greatest)
|
|
#
|
|
dominance { s0 }
|
|
|
|
|
|
#
|
|
# Define the categories
|
|
#
|
|
# Each category has a name and zero or more aliases.
|
|
#
|
|
category c0;
|
|
category c1;
|
|
category c2;
|
|
category c3;
|
|
category c4;
|
|
category c5;
|
|
category c6;
|
|
category c7;
|
|
category c8;
|
|
category c9;
|
|
category c10;
|
|
category c11;
|
|
category c12;
|
|
category c13;
|
|
category c14;
|
|
category c15;
|
|
category c16;
|
|
category c17;
|
|
category c18;
|
|
category c19;
|
|
category c20;
|
|
category c21;
|
|
category c22;
|
|
category c23;
|
|
category c24;
|
|
category c25;
|
|
category c26;
|
|
category c27;
|
|
category c28;
|
|
category c29;
|
|
category c30;
|
|
category c31;
|
|
category c32;
|
|
category c33;
|
|
category c34;
|
|
category c35;
|
|
category c36;
|
|
category c37;
|
|
category c38;
|
|
category c39;
|
|
category c40;
|
|
category c41;
|
|
category c42;
|
|
category c43;
|
|
category c44;
|
|
category c45;
|
|
category c46;
|
|
category c47;
|
|
category c48;
|
|
category c49;
|
|
category c50;
|
|
category c51;
|
|
category c52;
|
|
category c53;
|
|
category c54;
|
|
category c55;
|
|
category c56;
|
|
category c57;
|
|
category c58;
|
|
category c59;
|
|
category c60;
|
|
category c61;
|
|
category c62;
|
|
category c63;
|
|
category c64;
|
|
category c65;
|
|
category c66;
|
|
category c67;
|
|
category c68;
|
|
category c69;
|
|
category c70;
|
|
category c71;
|
|
category c72;
|
|
category c73;
|
|
category c74;
|
|
category c75;
|
|
category c76;
|
|
category c77;
|
|
category c78;
|
|
category c79;
|
|
category c80;
|
|
category c81;
|
|
category c82;
|
|
category c83;
|
|
category c84;
|
|
category c85;
|
|
category c86;
|
|
category c87;
|
|
category c88;
|
|
category c89;
|
|
category c90;
|
|
category c91;
|
|
category c92;
|
|
category c93;
|
|
category c94;
|
|
category c95;
|
|
category c96;
|
|
category c97;
|
|
category c98;
|
|
category c99;
|
|
category c100;
|
|
category c101;
|
|
category c102;
|
|
category c103;
|
|
category c104;
|
|
category c105;
|
|
category c106;
|
|
category c107;
|
|
category c108;
|
|
category c109;
|
|
category c110;
|
|
category c111;
|
|
category c112;
|
|
category c113;
|
|
category c114;
|
|
category c115;
|
|
category c116;
|
|
category c117;
|
|
category c118;
|
|
category c119;
|
|
category c120;
|
|
category c121;
|
|
category c122;
|
|
category c123;
|
|
category c124;
|
|
category c125;
|
|
category c126;
|
|
category c127;
|
|
category c128;
|
|
category c129;
|
|
category c130;
|
|
category c131;
|
|
category c132;
|
|
category c133;
|
|
category c134;
|
|
category c135;
|
|
category c136;
|
|
category c137;
|
|
category c138;
|
|
category c139;
|
|
category c140;
|
|
category c141;
|
|
category c142;
|
|
category c143;
|
|
category c144;
|
|
category c145;
|
|
category c146;
|
|
category c147;
|
|
category c148;
|
|
category c149;
|
|
category c150;
|
|
category c151;
|
|
category c152;
|
|
category c153;
|
|
category c154;
|
|
category c155;
|
|
category c156;
|
|
category c157;
|
|
category c158;
|
|
category c159;
|
|
category c160;
|
|
category c161;
|
|
category c162;
|
|
category c163;
|
|
category c164;
|
|
category c165;
|
|
category c166;
|
|
category c167;
|
|
category c168;
|
|
category c169;
|
|
category c170;
|
|
category c171;
|
|
category c172;
|
|
category c173;
|
|
category c174;
|
|
category c175;
|
|
category c176;
|
|
category c177;
|
|
category c178;
|
|
category c179;
|
|
category c180;
|
|
category c181;
|
|
category c182;
|
|
category c183;
|
|
category c184;
|
|
category c185;
|
|
category c186;
|
|
category c187;
|
|
category c188;
|
|
category c189;
|
|
category c190;
|
|
category c191;
|
|
category c192;
|
|
category c193;
|
|
category c194;
|
|
category c195;
|
|
category c196;
|
|
category c197;
|
|
category c198;
|
|
category c199;
|
|
category c200;
|
|
category c201;
|
|
category c202;
|
|
category c203;
|
|
category c204;
|
|
category c205;
|
|
category c206;
|
|
category c207;
|
|
category c208;
|
|
category c209;
|
|
category c210;
|
|
category c211;
|
|
category c212;
|
|
category c213;
|
|
category c214;
|
|
category c215;
|
|
category c216;
|
|
category c217;
|
|
category c218;
|
|
category c219;
|
|
category c220;
|
|
category c221;
|
|
category c222;
|
|
category c223;
|
|
category c224;
|
|
category c225;
|
|
category c226;
|
|
category c227;
|
|
category c228;
|
|
category c229;
|
|
category c230;
|
|
category c231;
|
|
category c232;
|
|
category c233;
|
|
category c234;
|
|
category c235;
|
|
category c236;
|
|
category c237;
|
|
category c238;
|
|
category c239;
|
|
category c240;
|
|
category c241;
|
|
category c242;
|
|
category c243;
|
|
category c244;
|
|
category c245;
|
|
category c246;
|
|
category c247;
|
|
category c248;
|
|
category c249;
|
|
category c250;
|
|
category c251;
|
|
category c252;
|
|
category c253;
|
|
category c254;
|
|
category c255;
|
|
|
|
|
|
#
|
|
# Each MCS level specifies a sensitivity and zero or more categories which may
|
|
# be associated with that sensitivity.
|
|
#
|
|
level s0:c0.c255;
|
|
|
|
#
|
|
# Define the MCS policy
|
|
#
|
|
# mlsconstrain class_set perm_set expression ;
|
|
#
|
|
# mlsvalidatetrans class_set expression ;
|
|
#
|
|
# expression : ( expression )
|
|
# | not expression
|
|
# | expression and expression
|
|
# | expression or expression
|
|
# | u1 op u2
|
|
# | r1 role_mls_op r2
|
|
# | t1 op t2
|
|
# | l1 role_mls_op l2
|
|
# | l1 role_mls_op h2
|
|
# | h1 role_mls_op l2
|
|
# | h1 role_mls_op h2
|
|
# | l1 role_mls_op h1
|
|
# | l2 role_mls_op h2
|
|
# | u1 op names
|
|
# | u2 op names
|
|
# | r1 op names
|
|
# | r2 op names
|
|
# | t1 op names
|
|
# | t2 op names
|
|
# | u3 op names (NOTE: this is only available for mlsvalidatetrans)
|
|
# | r3 op names (NOTE: this is only available for mlsvalidatetrans)
|
|
# | t3 op names (NOTE: this is only available for mlsvalidatetrans)
|
|
#
|
|
# op : == | !=
|
|
# role_mls_op : == | != | eq | dom | domby | incomp
|
|
#
|
|
# names : name | { name_list }
|
|
# name_list : name | name_list name
|
|
#
|
|
|
|
#
|
|
# MCS policy for the file classes
|
|
#
|
|
# Constrain file access so that the high range of the process dominates
|
|
# the high range of the file. We use the high range of the process so
|
|
# that processes can always simply run at s0.
|
|
#
|
|
# Only files are constrained by MCS at this stage.
|
|
#
|
|
mlsconstrain file { write setattr append unlink link rename
|
|
create ioctl lock execute } (h1 dom h2);
|
|
|
|
mlsconstrain file { read } ((h1 dom h2) or
|
|
( t1 == mlsfileread ));
|
|
|
|
|
|
# new file labels must be dominated by the relabeling subject clearance
|
|
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom relabelto }
|
|
( h1 dom h2 );
|
|
|
|
define(`nogetattr_file_perms', `{ create ioctl read lock write setattr append
|
|
link unlink rename relabelfrom relabelto }')
|
|
|
|
define(`nogetattr_dir_perms', `{ create read lock setattr ioctl link unlink
|
|
rename search add_name remove_name reparent write rmdir relabelfrom
|
|
relabelto }')
|
|
|
|
# XXX
|
|
#
|
|
# For some reason, we need to reference the mlsfileread attribute
|
|
# or we get a build error. Below is a dummy entry to do this.
|
|
mlsconstrain xextension query ( t1 == mlsfileread );
|
|
|
|
') dnl end enable_mcs
|