ifdef(`enable_mcs',`

#

# Define sensitivities 

#

# Each sensitivity has a name and zero or more aliases.

#

# MCS is single-sensitivity.

#

sensitivity s0;

#

# Define the ordering of the sensitivity levels (least to greatest)

#

dominance { s0 }

#

# Define the categories

#

# Each category has a name and zero or more aliases.

#

category c0; category c1; category c2; category c3;

category c4; category c5; category c6; category c7;

category c8; category c9; category c10; category c11;

category c12; category c13; category c14; category c15;

category c16; category c17; category c18; category c19;

category c20; category c21; category c22; category c23;

category c24; category c25; category c26; category c27;

category c28; category c29; category c30; category c31;

category c32; category c33; category c34; category c35;

category c36; category c37; category c38; category c39;

category c40; category c41; category c42; category c43;

category c44; category c45; category c46; category c47;

category c48; category c49; category c50; category c51;

category c52; category c53; category c54; category c55;

category c56; category c57; category c58; category c59;

category c60; category c61; category c62; category c63;

category c64; category c65; category c66; category c67;

category c68; category c69; category c70; category c71;

category c72; category c73; category c74; category c75;

category c76; category c77; category c78; category c79;

category c80; category c81; category c82; category c83;

category c84; category c85; category c86; category c87;

category c88; category c89; category c90; category c91;

category c92; category c93; category c94; category c95;

category c96; category c97; category c98; category c99;

category c100; category c101; category c102; category c103;

category c104; category c105; category c106; category c107;

category c108; category c109; category c110; category c111;

category c112; category c113; category c114; category c115;

category c116; category c117; category c118; category c119;

category c120; category c121; category c122; category c123;

category c124; category c125; category c126; category c127;

category c128; category c129; category c130; category c131;

category c132; category c133; category c134; category c135;

category c136; category c137; category c138; category c139;

category c140; category c141; category c142; category c143;

category c144; category c145; category c146; category c147;

category c148; category c149; category c150; category c151;

category c152; category c153; category c154; category c155;

category c156; category c157; category c158; category c159;

category c160; category c161; category c162; category c163;

category c164; category c165; category c166; category c167;

category c168; category c169; category c170; category c171;

category c172; category c173; category c174; category c175;

category c176; category c177; category c178; category c179;

category c180; category c181; category c182; category c183;

category c184; category c185; category c186; category c187;

category c188; category c189; category c190; category c191;

category c192; category c193; category c194; category c195;

category c196; category c197; category c198; category c199;

category c200; category c201; category c202; category c203;

category c204; category c205; category c206; category c207;

category c208; category c209; category c210; category c211;

category c212; category c213; category c214; category c215;

category c216; category c217; category c218; category c219;

category c220; category c221; category c222; category c223;

category c224; category c225; category c226; category c227;

category c228; category c229; category c230; category c231;

category c232; category c233; category c234; category c235;

category c236; category c237; category c238; category c239;

category c240; category c241; category c242; category c243;

category c244; category c245; category c246; category c247;

category c248; category c249; category c250; category c251;

category c252; category c253; category c254; category c255;

#

# Each MCS level specifies a sensitivity and zero or more categories which may

# be associated with that sensitivity.

#

level s0:c0.c255;

#

# Define the MCS policy

#

# mlsconstrain class_set perm_set expression ;

#

# mlsvalidatetrans class_set expression ;

#

# expression : ( expression )

#	     | not expression

#	     | expression and expression

#	     | expression or expression

#	     | u1 op u2

#	     | r1 role_mls_op r2

#	     | t1 op t2

#	     | l1 role_mls_op l2

#	     | l1 role_mls_op h2

#	     | h1 role_mls_op l2

#	     | h1 role_mls_op h2

#	     | l1 role_mls_op h1

#	     | l2 role_mls_op h2

#	     | u1 op names

#	     | u2 op names

#	     | r1 op names

#	     | r2 op names

#	     | t1 op names

#	     | t2 op names

#	     | u3 op names (NOTE: this is only available for mlsvalidatetrans)

#	     | r3 op names (NOTE: this is only available for mlsvalidatetrans)

#	     | t3 op names (NOTE: this is only available for mlsvalidatetrans)

#

# op : == | !=

# role_mls_op : == | != | eq | dom | domby | incomp

#

# names : name | { name_list }

# name_list : name | name_list name

#

#

# MCS policy for the file classes

#

# Constrain file access so that the high range of the process dominates

# the high range of the file.  We use the high range of the process so

# that processes can always simply run at s0.

#

# Only files are constrained by MCS at this stage.

#

mlsconstrain file { write setattr append unlink link rename

		    ioctl lock execute relabelfrom } (h1 dom h2);

mlsconstrain file { create relabelto } ((h1 dom h2) and (l2 eq h2));

mlsconstrain file { read } ((h1 dom h2) or 

			    ( t1 == mlsfileread ));

# new file labels must be dominated by the relabeling subject clearance

mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }

	( h1 dom h2 );

mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }

	(( h1 dom h2 ) and ( l2 eq h2 ));

mlsconstrain process { ptrace } ( h1 dom h2 );

mlsconstrain process { sigkill sigstop } ( h1 dom h2 ) or

		( t1 == mcskillall );

define(`nogetattr_file_perms', `{ create ioctl read lock write setattr append 

link unlink rename relabelfrom relabelto }')

define(`nogetattr_dir_perms', `{ create read lock setattr ioctl link unlink 

rename search add_name remove_name reparent write rmdir relabelfrom 

relabelto }')

# XXX

#

# For some reason, we need to reference the mlsfileread attribute

# or we get a build error.  Below is a dummy entry to do this.

mlsconstrain xextension query ( t1 == mlsfileread );

') dnl end enable_mcs