## <summary>Multilevel security policy</summary>

## <desc>

##	

##	This module contains interfaces for handling multilevel

##	security.  The interfaces allow the specified subjects

##	and objects to be allowed certain privileges in the

##	MLS rules.

##	

## </desc>

## <required val="true">

##	Contains attributes used in MLS policy.

## </required>

########################################

## <summary>

##	Make specified domain MLS trusted

##	for reading from files at higher levels.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_file_read_up',`

	gen_require(`

		attribute mlsfileread;

	')

	typeattribute $1 mlsfileread;

')

########################################

## <summary>

##	Make specified domain MLS trusted

##	for writing to files at lower levels.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_file_write_down',`

	gen_require(`

		attribute mlsfilewrite;

	')

	typeattribute $1 mlsfilewrite;

')

########################################

## <summary>

##	Make specified domain MLS trusted

##	for raising the level of files.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_file_upgrade',`

	gen_require(`

		attribute mlsfileupgrade;

	')

	typeattribute $1 mlsfileupgrade;

')

########################################

## <summary>

##	Make specified domain MLS trusted

##	for lowering the level of files.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_file_downgrade',`

	gen_require(`

		attribute mlsfiledowngrade;

	')

	typeattribute $1 mlsfiledowngrade;

')

########################################

## <summary>

##	Allow the specified domain to do a MLS

##	range transition that changes

##	the current level.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_rangetrans_source',`

	gen_require(`

		attribute privrangetrans;

	')

	typeattribute $1 privrangetrans;

')

########################################

## <summary>

##	Make specified domain a target domain

##	for MLS range transitions that change

##	the current level.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_rangetrans_target',`

	gen_require(`

		attribute mlsrangetrans;

	')

	typeattribute $1 mlsrangetrans;

')

########################################

## <summary>

##	Make specified domain MLS trusted

##	for reading from processes at higher levels.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_process_read_up',`

	gen_require(`

		attribute mlsprocread;

	')

	typeattribute $1 mlsprocread;

')

########################################

## <summary>

##	Make specified domain MLS trusted

##	for writing to processes at lower levels.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_process_write_down',`

	gen_require(`

		attribute mlsprocwrite;

	')

	typeattribute $1 mlsprocwrite;

')

########################################

## <summary>

##	Make specified domain MLS trusted

##	for setting the level of processes

##	it executes.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the process performing this action.

##	</summary>

## </param>

#

interface(`mls_process_set_level',`

	gen_require(`

		attribute mlsprocsetsl;

	')

	typeattribute $1 mlsprocsetsl;

')

########################################

## <summary>

##	Make specified object MLS trusted.

## </summary>

## <desc>

##	

##	Make specified object MLS trusted.  This

##	allows all levels to read and write the

##	object.

##	

##	

##	This currently only applies to filesystem

##	objects, for example, files and directories.

##	

## </desc>

## <param name="domain">

##	<summary>

##	The type of the object.

##	</summary>

## </param>

#

interface(`mls_trusted_object',`

	gen_require(`

		attribute mlstrustedobject;

	')

	typeattribute $1 mlstrustedobject;

')