#

# Define sensitivities 

#

# Each sensitivity has a name and zero or more aliases.

#

# MCS is single-sensitivity.

#

sensitivity s0;

#

# Define the ordering of the sensitivity levels (least to greatest)

#

dominance { s0 }

#

# Define the categories

#

# Each category has a name and zero or more aliases.

#

category c0;

category c1;

category c2;

category c3;

category c4;

category c5;

category c6;

category c7;

category c8;

category c9;

category c10;

category c11;

category c12;

category c13;

category c14;

category c15;

category c16;

category c17;

category c18;

category c19;

category c20;

category c21;

category c22;

category c23;

category c24;

category c25;

category c26;

category c27;

category c28;

category c29;

category c30;

category c31;

category c32;

category c33;

category c34;

category c35;

category c36;

category c37;

category c38;

category c39;

category c40;

category c41;

category c42;

category c43;

category c44;

category c45;

category c46;

category c47;

category c48;

category c49;

category c50;

category c51;

category c52;

category c53;

category c54;

category c55;

category c56;

category c57;

category c58;

category c59;

category c60;

category c61;

category c62;

category c63;

category c64;

category c65;

category c66;

category c67;

category c68;

category c69;

category c70;

category c71;

category c72;

category c73;

category c74;

category c75;

category c76;

category c77;

category c78;

category c79;

category c80;

category c81;

category c82;

category c83;

category c84;

category c85;

category c86;

category c87;

category c88;

category c89;

category c90;

category c91;

category c92;

category c93;

category c94;

category c95;

category c96;

category c97;

category c98;

category c99;

category c100;

category c101;

category c102;

category c103;

category c104;

category c105;

category c106;

category c107;

category c108;

category c109;

category c110;

category c111;

category c112;

category c113;

category c114;

category c115;

category c116;

category c117;

category c118;

category c119;

category c120;

category c121;

category c122;

category c123;

category c124;

category c125;

category c126;

category c127;

category c128;

category c129;

category c130;

category c131;

category c132;

category c133;

category c134;

category c135;

category c136;

category c137;

category c138;

category c139;

category c140;

category c141;

category c142;

category c143;

category c144;

category c145;

category c146;

category c147;

category c148;

category c149;

category c150;

category c151;

category c152;

category c153;

category c154;

category c155;

category c156;

category c157;

category c158;

category c159;

category c160;

category c161;

category c162;

category c163;

category c164;

category c165;

category c166;

category c167;

category c168;

category c169;

category c170;

category c171;

category c172;

category c173;

category c174;

category c175;

category c176;

category c177;

category c178;

category c179;

category c180;

category c181;

category c182;

category c183;

category c184;

category c185;

category c186;

category c187;

category c188;

category c189;

category c190;

category c191;

category c192;

category c193;

category c194;

category c195;

category c196;

category c197;

category c198;

category c199;

category c200;

category c201;

category c202;

category c203;

category c204;

category c205;

category c206;

category c207;

category c208;

category c209;

category c210;

category c211;

category c212;

category c213;

category c214;

category c215;

category c216;

category c217;

category c218;

category c219;

category c220;

category c221;

category c222;

category c223;

category c224;

category c225;

category c226;

category c227;

category c228;

category c229;

category c230;

category c231;

category c232;

category c233;

category c234;

category c235;

category c236;

category c237;

category c238;

category c239;

category c240;

category c241;

category c242;

category c243;

category c244;

category c245;

category c246;

category c247;

category c248;

category c249;

category c250;

category c251;

category c252;

category c253;

category c254;

category c255;

#

# Each MCS level specifies a sensitivity and zero or more categories which may

# be associated with that sensitivity.

#

level s0:c0.c255;

#

# Define the MCS policy

#

# mlsconstrain class_set perm_set expression ;

#

# mlsvalidatetrans class_set expression ;

#

# expression : ( expression )

#	     | not expression

#	     | expression and expression

#	     | expression or expression

#	     | u1 op u2

#	     | r1 role_mls_op r2

#	     | t1 op t2

#	     | l1 role_mls_op l2

#	     | l1 role_mls_op h2

#	     | h1 role_mls_op l2

#	     | h1 role_mls_op h2

#	     | l1 role_mls_op h1

#	     | l2 role_mls_op h2

#	     | u1 op names

#	     | u2 op names

#	     | r1 op names

#	     | r2 op names

#	     | t1 op names

#	     | t2 op names

#	     | u3 op names (NOTE: this is only available for mlsvalidatetrans)

#	     | r3 op names (NOTE: this is only available for mlsvalidatetrans)

#	     | t3 op names (NOTE: this is only available for mlsvalidatetrans)

#

# op : == | !=

# role_mls_op : == | != | eq | dom | domby | incomp

#

# names : name | { name_list }

# name_list : name | name_list name

#

#

# MCS policy for the file classes

#

# Constrain file access so that the high range of the process dominates

# the high range of the file.  We use the high range of the process so

# that processes can always simply run at s0.

#

# Only files are constrained by MCS at this stage.

#

mlsconstrain file { write setattr append unlink link rename

		    create ioctl lock execute } (h1 dom h2);

mlsconstrain file { read } ((h1 dom h2) or 

			    ( t1 == mlsfileread ));

# new file labels must be dominated by the relabeling subject's clearance

mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom relabelto }

	( h1 dom h2 );

define(`nogetattr_file_perms', `{ create ioctl read lock write setattr append 

link unlink rename relabelfrom relabelto }')

define(`nogetattr_dir_perms', `{ create read lock setattr ioctl link unlink 

rename search add_name remove_name reparent write rmdir relabelfrom 

relabelto }')

# XXX

#

# For some reason, we need to reference the mlsfileread attribute

# or we get a build error.  Below is a dummy entry to do this.

mlsconstrain xextension query ( t1 == mlsfileread );