#

# Define sensitivities 

#

# Each sensitivity has a name and zero or more aliases.

#

# MCS is single-sensitivity.

#

sensitivity s0;

#

# Define the ordering of the sensitivity levels (least to greatest)

#

dominance { s0 }

#

# Define the categories

#

# Each category has a name and zero or more aliases.

#

category c0;

category c1;

category c2;

category c3;

category c4;

category c5;

category c6;

category c7;

category c8;

category c9;

category c10;

category c11;

category c12;

category c13;

category c14;

category c15;

category c16;

category c17;

category c18;

category c19;

category c20;

category c21;

category c22;

category c23;

category c24;

category c25;

category c26;

category c27;

category c28;

category c29;

category c30;

category c31;

category c32;

category c33;

category c34;

category c35;

category c36;

category c37;

category c38;

category c39;

category c40;

category c41;

category c42;

category c43;

category c44;

category c45;

category c46;

category c47;

category c48;

category c49;

category c50;

category c51;

category c52;

category c53;

category c54;

category c55;

category c56;

category c57;

category c58;

category c59;

category c60;

category c61;

category c62;

category c63;

category c64;

category c65;

category c66;

category c67;

category c68;

category c69;

category c70;

category c71;

category c72;

category c73;

category c74;

category c75;

category c76;

category c77;

category c78;

category c79;

category c80;

category c81;

category c82;

category c83;

category c84;

category c85;

category c86;

category c87;

category c88;

category c89;

category c90;

category c91;

category c92;

category c93;

category c94;

category c95;

category c96;

category c97;

category c98;

category c99;

category c100;

category c101;

category c102;

category c103;

category c104;

category c105;

category c106;

category c107;

category c108;

category c109;

category c110;

category c111;

category c112;

category c113;

category c114;

category c115;

category c116;

category c117;

category c118;

category c119;

category c120;

category c121;

category c122;

category c123;

category c124;

category c125;

category c126;

category c127;

#

# Each MCS level specifies a sensitivity and zero or more categories which may

# be associated with that sensitivity.

#

level s0:c0.c127;

#

# Define the MCS policy

#

# mlsconstrain class_set perm_set expression ;

#

# mlsvalidatetrans class_set expression ;

#

# expression : ( expression )

#	     | not expression

#	     | expression and expression

#	     | expression or expression

#	     | u1 op u2

#	     | r1 role_mls_op r2

#	     | t1 op t2

#	     | l1 role_mls_op l2

#	     | l1 role_mls_op h2

#	     | h1 role_mls_op l2

#	     | h1 role_mls_op h2

#	     | l1 role_mls_op h1

#	     | l2 role_mls_op h2

#	     | u1 op names

#	     | u2 op names

#	     | r1 op names

#	     | r2 op names

#	     | t1 op names

#	     | t2 op names

#	     | u3 op names (NOTE: this is only available for mlsvalidatetrans)

#	     | r3 op names (NOTE: this is only available for mlsvalidatetrans)

#	     | t3 op names (NOTE: this is only available for mlsvalidatetrans)

#

# op : == | !=

# role_mls_op : == | != | eq | dom | domby | incomp

#

# names : name | { name_list }

# name_list : name | name_list name

#

#

# MCS policy for the file classes

#

# Constrain file access so that the high range of the process dominates

# the high range of the file.  We use the high range of the process so

# that processes can always simply run at s0.

#

# Only files are constrained by MCS at this stage.

#

mlsconstrain file { read write setattr append unlink link rename

		    create ioctl lock execute } (h1 dom h2);

# XXX

#

# For some reason, we need to reference the mlsfileread attribute

# or we get a build error.  Below is a dummy entry to do this.

mlsconstrain xextension query ( t1 == mlsfileread );