a9e03b3752
* fix userdom_search_all_users_home_content() to use search_dir_perms; * change ssh daemon macro to use userdom_search_all_users_home_dirs() instead of _home_content()
108 lines
2.8 KiB
Plaintext
108 lines
2.8 KiB
Plaintext
ifdef(`enable_mcs',`
|
|
#
|
|
# Define sensitivities
|
|
#
|
|
# Each sensitivity has a name and zero or more aliases.
|
|
#
|
|
# MCS is single-sensitivity.
|
|
#
|
|
sensitivity s0;
|
|
|
|
#
|
|
# Define the ordering of the sensitivity levels (least to greatest)
|
|
#
|
|
dominance { s0 }
|
|
|
|
|
|
#
|
|
# Define the categories
|
|
#
|
|
# Each category has a name and zero or more aliases.
|
|
#
|
|
|
|
# generate declarations for c0 to c255
|
|
gen_cats(256)
|
|
|
|
#
|
|
# Each MCS level specifies a sensitivity and zero or more categories which may
|
|
# be associated with that sensitivity.
|
|
#
|
|
level s0:c0.c255;
|
|
|
|
#
|
|
# Define the MCS policy
|
|
#
|
|
# mlsconstrain class_set perm_set expression ;
|
|
#
|
|
# mlsvalidatetrans class_set expression ;
|
|
#
|
|
# expression : ( expression )
|
|
# | not expression
|
|
# | expression and expression
|
|
# | expression or expression
|
|
# | u1 op u2
|
|
# | r1 role_mls_op r2
|
|
# | t1 op t2
|
|
# | l1 role_mls_op l2
|
|
# | l1 role_mls_op h2
|
|
# | h1 role_mls_op l2
|
|
# | h1 role_mls_op h2
|
|
# | l1 role_mls_op h1
|
|
# | l2 role_mls_op h2
|
|
# | u1 op names
|
|
# | u2 op names
|
|
# | r1 op names
|
|
# | r2 op names
|
|
# | t1 op names
|
|
# | t2 op names
|
|
# | u3 op names (NOTE: this is only available for mlsvalidatetrans)
|
|
# | r3 op names (NOTE: this is only available for mlsvalidatetrans)
|
|
# | t3 op names (NOTE: this is only available for mlsvalidatetrans)
|
|
#
|
|
# op : == | !=
|
|
# role_mls_op : == | != | eq | dom | domby | incomp
|
|
#
|
|
# names : name | { name_list }
|
|
# name_list : name | name_list name
|
|
#
|
|
|
|
#
|
|
# MCS policy for the file classes
|
|
#
|
|
# Constrain file access so that the high range of the process dominates
|
|
# the high range of the file. We use the high range of the process so
|
|
# that processes can always simply run at s0.
|
|
#
|
|
# Note that getattr on files is always permitted.
|
|
#
|
|
mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
|
|
( h1 dom h2 );
|
|
|
|
# New filesystem object labels must be dominated by the relabeling subject
|
|
# clearance, also the objects are single-level.
|
|
mlsconstrain file { create relabelto }
|
|
(( h1 dom h2 ) and ( l2 eq h2 ));
|
|
|
|
# At this time we do not restrict "ps" type operations via MCS. This
|
|
# will probably change in future.
|
|
mlsconstrain file { read }
|
|
(( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
|
|
|
|
# new file labels must be dominated by the relabeling subject clearance
|
|
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
|
|
( h1 dom h2 );
|
|
|
|
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
|
|
(( h1 dom h2 ) and ( l2 eq h2 ));
|
|
|
|
mlsconstrain process { transition dyntransition }
|
|
(( h1 dom h2 ) or ( t1 == mcssetcats ));
|
|
|
|
mlsconstrain process { ptrace }
|
|
(( h1 dom h2) or ( t1 == mcsptraceall ));
|
|
|
|
mlsconstrain process { sigkill sigstop }
|
|
(( h1 dom h2 ) or ( t1 == mcskillall ));
|
|
|
|
') dnl end enable_mcs
|