Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Define sensitivities 
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Each sensitivity has a name and zero or more aliases.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
sensitivity s0;
Chris PeBenito 0fbfa5
sensitivity s1;
Chris PeBenito 0fbfa5
sensitivity s2;
Chris PeBenito 0fbfa5
sensitivity s3;
Chris PeBenito 0fbfa5
sensitivity s4;
Chris PeBenito 0fbfa5
sensitivity s5;
Chris PeBenito 0fbfa5
sensitivity s6;
Chris PeBenito 0fbfa5
sensitivity s7;
Chris PeBenito 0fbfa5
sensitivity s8;
Chris PeBenito 0fbfa5
sensitivity s9;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Define the ordering of the sensitivity levels (least to greatest)
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
dominance { s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Define the categories
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Each category has a name and zero or more aliases.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
category c0;
Chris PeBenito 0fbfa5
category c1;
Chris PeBenito 0fbfa5
category c2;
Chris PeBenito 0fbfa5
category c3;
Chris PeBenito 0fbfa5
category c4;
Chris PeBenito 0fbfa5
category c5;
Chris PeBenito 0fbfa5
category c6;
Chris PeBenito 0fbfa5
category c7;
Chris PeBenito 0fbfa5
category c8;
Chris PeBenito 0fbfa5
category c9;
Chris PeBenito 0fbfa5
category c10;
Chris PeBenito 0fbfa5
category c11;
Chris PeBenito 0fbfa5
category c12;
Chris PeBenito 0fbfa5
category c13;
Chris PeBenito 0fbfa5
category c14;
Chris PeBenito 0fbfa5
category c15;
Chris PeBenito 0fbfa5
category c16;
Chris PeBenito 0fbfa5
category c17;
Chris PeBenito 0fbfa5
category c18;
Chris PeBenito 0fbfa5
category c19;
Chris PeBenito 0fbfa5
category c20;
Chris PeBenito 0fbfa5
category c21;
Chris PeBenito 0fbfa5
category c22;
Chris PeBenito 0fbfa5
category c23;
Chris PeBenito 0fbfa5
category c24;
Chris PeBenito 0fbfa5
category c25;
Chris PeBenito 0fbfa5
category c26;
Chris PeBenito 0fbfa5
category c27;
Chris PeBenito 0fbfa5
category c28;
Chris PeBenito 0fbfa5
category c29;
Chris PeBenito 0fbfa5
category c30;
Chris PeBenito 0fbfa5
category c31;
Chris PeBenito 0fbfa5
category c32;
Chris PeBenito 0fbfa5
category c33;
Chris PeBenito 0fbfa5
category c34;
Chris PeBenito 0fbfa5
category c35;
Chris PeBenito 0fbfa5
category c36;
Chris PeBenito 0fbfa5
category c37;
Chris PeBenito 0fbfa5
category c38;
Chris PeBenito 0fbfa5
category c39;
Chris PeBenito 0fbfa5
category c40;
Chris PeBenito 0fbfa5
category c41;
Chris PeBenito 0fbfa5
category c42;
Chris PeBenito 0fbfa5
category c43;
Chris PeBenito 0fbfa5
category c44;
Chris PeBenito 0fbfa5
category c45;
Chris PeBenito 0fbfa5
category c46;
Chris PeBenito 0fbfa5
category c47;
Chris PeBenito 0fbfa5
category c48;
Chris PeBenito 0fbfa5
category c49;
Chris PeBenito 0fbfa5
category c50;
Chris PeBenito 0fbfa5
category c51;
Chris PeBenito 0fbfa5
category c52;
Chris PeBenito 0fbfa5
category c53;
Chris PeBenito 0fbfa5
category c54;
Chris PeBenito 0fbfa5
category c55;
Chris PeBenito 0fbfa5
category c56;
Chris PeBenito 0fbfa5
category c57;
Chris PeBenito 0fbfa5
category c58;
Chris PeBenito 0fbfa5
category c59;
Chris PeBenito 0fbfa5
category c60;
Chris PeBenito 0fbfa5
category c61;
Chris PeBenito 0fbfa5
category c62;
Chris PeBenito 0fbfa5
category c63;
Chris PeBenito 0fbfa5
category c64;
Chris PeBenito 0fbfa5
category c65;
Chris PeBenito 0fbfa5
category c66;
Chris PeBenito 0fbfa5
category c67;
Chris PeBenito 0fbfa5
category c68;
Chris PeBenito 0fbfa5
category c69;
Chris PeBenito 0fbfa5
category c70;
Chris PeBenito 0fbfa5
category c71;
Chris PeBenito 0fbfa5
category c72;
Chris PeBenito 0fbfa5
category c73;
Chris PeBenito 0fbfa5
category c74;
Chris PeBenito 0fbfa5
category c75;
Chris PeBenito 0fbfa5
category c76;
Chris PeBenito 0fbfa5
category c77;
Chris PeBenito 0fbfa5
category c78;
Chris PeBenito 0fbfa5
category c79;
Chris PeBenito 0fbfa5
category c80;
Chris PeBenito 0fbfa5
category c81;
Chris PeBenito 0fbfa5
category c82;
Chris PeBenito 0fbfa5
category c83;
Chris PeBenito 0fbfa5
category c84;
Chris PeBenito 0fbfa5
category c85;
Chris PeBenito 0fbfa5
category c86;
Chris PeBenito 0fbfa5
category c87;
Chris PeBenito 0fbfa5
category c88;
Chris PeBenito 0fbfa5
category c89;
Chris PeBenito 0fbfa5
category c90;
Chris PeBenito 0fbfa5
category c91;
Chris PeBenito 0fbfa5
category c92;
Chris PeBenito 0fbfa5
category c93;
Chris PeBenito 0fbfa5
category c94;
Chris PeBenito 0fbfa5
category c95;
Chris PeBenito 0fbfa5
category c96;
Chris PeBenito 0fbfa5
category c97;
Chris PeBenito 0fbfa5
category c98;
Chris PeBenito 0fbfa5
category c99;
Chris PeBenito 0fbfa5
category c100;
Chris PeBenito 0fbfa5
category c101;
Chris PeBenito 0fbfa5
category c102;
Chris PeBenito 0fbfa5
category c103;
Chris PeBenito 0fbfa5
category c104;
Chris PeBenito 0fbfa5
category c105;
Chris PeBenito 0fbfa5
category c106;
Chris PeBenito 0fbfa5
category c107;
Chris PeBenito 0fbfa5
category c108;
Chris PeBenito 0fbfa5
category c109;
Chris PeBenito 0fbfa5
category c110;
Chris PeBenito 0fbfa5
category c111;
Chris PeBenito 0fbfa5
category c112;
Chris PeBenito 0fbfa5
category c113;
Chris PeBenito 0fbfa5
category c114;
Chris PeBenito 0fbfa5
category c115;
Chris PeBenito 0fbfa5
category c116;
Chris PeBenito 0fbfa5
category c117;
Chris PeBenito 0fbfa5
category c118;
Chris PeBenito 0fbfa5
category c119;
Chris PeBenito 0fbfa5
category c120;
Chris PeBenito 0fbfa5
category c121;
Chris PeBenito 0fbfa5
category c122;
Chris PeBenito 0fbfa5
category c123;
Chris PeBenito 0fbfa5
category c124;
Chris PeBenito 0fbfa5
category c125;
Chris PeBenito 0fbfa5
category c126;
Chris PeBenito 0fbfa5
category c127;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Each MLS level specifies a sensitivity and zero or more categories which may
Chris PeBenito 0fbfa5
# be associated with that sensitivity.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
level s0:c0 . c127;
Chris PeBenito 0fbfa5
level s1:c0 . c127;
Chris PeBenito 0fbfa5
level s2:c0 . c127;
Chris PeBenito 0fbfa5
level s3:c0 . c127;
Chris PeBenito 0fbfa5
level s4:c0 . c127;
Chris PeBenito 0fbfa5
level s5:c0 . c127;
Chris PeBenito 0fbfa5
level s6:c0 . c127;
Chris PeBenito 0fbfa5
level s7:c0 . c127;
Chris PeBenito 0fbfa5
level s8:c0 . c127;
Chris PeBenito 0fbfa5
level s9:c0 . c127;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Define the MLS policy
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# mlsconstrain class_set perm_set expression ;
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# mlsvalidatetrans class_set expression ;
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# expression : ( expression )
Chris PeBenito 0fbfa5
#	     | not expression
Chris PeBenito 0fbfa5
#	     | expression and expression
Chris PeBenito 0fbfa5
#	     | expression or expression
Chris PeBenito 0fbfa5
#	     | u1 op u2
Chris PeBenito 0fbfa5
#	     | r1 role_mls_op r2
Chris PeBenito 0fbfa5
#	     | t1 op t2
Chris PeBenito 0fbfa5
#	     | l1 role_mls_op l2
Chris PeBenito 0fbfa5
#	     | l1 role_mls_op h2
Chris PeBenito 0fbfa5
#	     | h1 role_mls_op l2
Chris PeBenito 0fbfa5
#	     | h1 role_mls_op h2
Chris PeBenito 0fbfa5
#	     | l1 role_mls_op h1
Chris PeBenito 0fbfa5
#	     | l2 role_mls_op h2
Chris PeBenito 0fbfa5
#	     | u1 op names
Chris PeBenito 0fbfa5
#	     | u2 op names
Chris PeBenito 0fbfa5
#	     | r1 op names
Chris PeBenito 0fbfa5
#	     | r2 op names
Chris PeBenito 0fbfa5
#	     | t1 op names
Chris PeBenito 0fbfa5
#	     | t2 op names
Chris PeBenito 0fbfa5
#	     | u3 op names (NOTE: this is only available for mlsvalidatetrans)
Chris PeBenito 0fbfa5
#	     | r3 op names (NOTE: this is only available for mlsvalidatetrans)
Chris PeBenito 0fbfa5
#	     | t3 op names (NOTE: this is only available for mlsvalidatetrans)
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# op : == | !=
Chris PeBenito 0fbfa5
# role_mls_op : == | != | eq | dom | domby | incomp
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# names : name | { name_list }
Chris PeBenito 0fbfa5
# name_list : name | name_list name
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the file classes
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# make sure these file classes are "single level"
Chris PeBenito 0fbfa5
mlsconstrain { file lnk_file fifo_file } { create relabelto }
Chris PeBenito 0fbfa5
	( l2 eq h2 );
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# new file labels must be dominated by the relabeling subject's clearance
Chris PeBenito 0fbfa5
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } relabelto
Chris PeBenito 0fbfa5
	( h1 dom h2 );
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the file "read" ops (note the check is dominance of the low level)
Chris PeBenito 0fbfa5
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { read getattr execute }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilereadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfileread ) or
Chris PeBenito 0fbfa5
	 ( t2 == mlstrustedobject ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain dir search
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilereadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfileread ) or
Chris PeBenito 0fbfa5
	 ( t2 == mlstrustedobject ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the "single level" file "write" ops
Chris PeBenito 0fbfa5
mlsconstrain { file lnk_file fifo_file } { write create setattr relabelfrom append unlink link rename mounton }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfilewrite ) or
Chris PeBenito 0fbfa5
	 ( t2 == mlstrustedobject ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the "ranged" file "write" ops
Chris PeBenito 0fbfa5
mlsconstrain { dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
Chris PeBenito 0fbfa5
	((( l1 dom l2 ) and ( l1 domby h2 )) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfilewrite ) or
Chris PeBenito 0fbfa5
	 ( t2 == mlstrustedobject ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain dir { add_name remove_name reparent rmdir }
Chris PeBenito 0fbfa5
	((( l1 dom l2 ) and ( l1 domby h2 )) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfilewrite ) or
Chris PeBenito 0fbfa5
	 ( t2 == mlstrustedobject ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# { dir file lnk_file chr_file blk_file sock_file fifo_file } { ioctl lock swapon quotaon }
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# file { execute_no_trans entrypoint }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the file upgrade/downgrade rule
Chris PeBenito 0fbfa5
mlsvalidatetrans { file lnk_file chr_file blk_file sock_file fifo_file }
Chris PeBenito 0fbfa5
	((( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	  (( t3 == mlsfileupgrade ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	  (( t3 == mlsfiledowngrade ) and ( l1 dom l2 )) or
Chris PeBenito 0fbfa5
	  (( t3 == mlsfiledowngrade ) and ( l1 incomp l2 ))) and
Chris PeBenito 0fbfa5
	 (( h1 eq h2 ) or
Chris PeBenito 0fbfa5
	  (( t3 == mlsfileupgrade ) and ( h1 domby h2 )) or
Chris PeBenito 0fbfa5
	  (( t3 == mlsfiledowngrade ) and ( h1 dom h2 )) or
Chris PeBenito 0fbfa5
	  (( t3 == mlsfiledowngrade ) and ( h1 incomp h2 ))));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# create can also require the upgrade/downgrade checks if the creating process
Chris PeBenito 0fbfa5
# has used setfscreate (note that both the high and low level of the object
Chris PeBenito 0fbfa5
# default to the process' sensitivity level)
Chris PeBenito 0fbfa5
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } create
Chris PeBenito 0fbfa5
	((( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	  (( t1 == mlsfileupgrade ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	  (( t1 == mlsfiledowngrade ) and ( l1 dom l2 )) or
Chris PeBenito 0fbfa5
	  (( t1 == mlsfiledowngrade ) and ( l1 incomp l2 ))) and
Chris PeBenito 0fbfa5
	 (( l1 eq h2 ) or
Chris PeBenito 0fbfa5
	  (( t1 == mlsfileupgrade ) and ( l1 domby h2 )) or
Chris PeBenito 0fbfa5
	  (( t1 == mlsfiledowngrade ) and ( l1 dom h2 )) or
Chris PeBenito 0fbfa5
	  (( t1 == mlsfiledowngrade ) and ( l1 incomp h2 ))));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the filesystem class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# new filesystem labels must be dominated by the relabeling subject's clearance
Chris PeBenito 0fbfa5
mlsconstrain filesystem relabelto
Chris PeBenito 0fbfa5
	( h1 dom h2 );
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the filesystem "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain filesystem { getattr quotaget }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilereadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfileread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# all the filesystem "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain filesystem { mount remount unmount relabelfrom quotamod }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsfilewritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsfilewrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# filesystem { transition associate }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the socket classes
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# new socket labels must be dominated by the relabeling subject's clearance
Chris PeBenito 0fbfa5
mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } relabelto
Chris PeBenito 0fbfa5
	( h1 dom h2 );
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the socket "read" ops (note the check is dominance of the low level)
Chris PeBenito 0fbfa5
mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { read getattr listen accept getopt recvfrom recv_msg }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsnetread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain { tcp_socket unix_stream_socket } acceptfrom
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsnetread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain { netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_xfrm_socket netlink_audit_socket netlink_ip6fw_socket } nlmsg_read
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsnetread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the socket "write" ops
Chris PeBenito 0fbfa5
mlsconstrain { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { setattr relabelfrom connect setopt shutdown }
Chris PeBenito 0fbfa5
	((( l1 dom l2 ) and ( l1 domby h2 )) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsnetwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain { tcp_socket unix_stream_socket } { connectto newconn }
Chris PeBenito 0fbfa5
	((( l1 dom l2 ) and ( l1 domby h2 )) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsnetwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsnetwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# { socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket unix_stream_socket unix_dgram_socket netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_ip6fw_socket netlink_dnrt_socket } { ioctl write create lock append bind sendto send_msg name_bind }
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# { tcp_socket udp_socket rawip_socket } node_bind
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# { netlink_route_socket netlink_firewall_socket netlink_tcpdiag_socket netlink_xfrm_socket netlink_audit_socket netlink_ip6fw_socket } nlmsg_write
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the ipc classes
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the ipc "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain { ipc sem msgq shm } { getattr read unix_read }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsipcreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsipcread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain msg receive
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsipcreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsipcread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the ipc "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain { ipc sem msgq shm } { create destroy setattr write unix_write }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsipcwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain msgq enqueue
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsipcwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain shm lock
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsipcwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
mlsconstrain msg send
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsipcwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsipcwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# { ipc sem msgq shm } associate
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the fd class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# fd use
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the node class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# node { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send enforce_dest }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the netif class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# netif { tcp_recv tcp_send udp_recv udp_send rawip_recv rawip_send enforce_dest }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the process class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# new process labels must be dominated by the relabeling subject's clearance
Chris PeBenito 0fbfa5
# and sensitivity level changes require privilege
Chris PeBenito 0fbfa5
mlsconstrain process transition
Chris PeBenito 0fbfa5
	(( h1 dom h2 ) and
Chris PeBenito 0fbfa5
	 (( l1 eq l2 ) or ( t1 == mlsprocsetsl ) or
Chris PeBenito 0fbfa5
	  (( t1 == privrangetrans ) and ( t2 == mlsrangetrans ))));
Chris PeBenito 0fbfa5
mlsconstrain process dyntransition
Chris PeBenito 0fbfa5
	(( h1 dom h2 ) and
Chris PeBenito 0fbfa5
	 (( l1 eq l2 ) or ( t1 == mlsprocsetsl )));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# all the process "read" ops
Chris PeBenito 0fbfa5
mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsprocreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsprocread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# all the process "write" ops (note the check is equality on the low level)
Chris PeBenito 0fbfa5
mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec setfscreate setcurrent ptrace share }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsprocwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# process { fork sigchld signull noatsecure siginh setrlimit rlimitinh}
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the security class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# security *
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the system class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# system *
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the capability class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# capability *
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the passwd class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# passwd *
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the drawable class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the drawable "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain drawable { getattr copy }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the drawable "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain drawable { create destroy draw copy }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the gc class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the gc "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain gc getattr
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the gc "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain gc { create free setattr }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the window class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the window "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain window { listprop getattr enumerate mousemotion inputevent drawevent windowchangeevent windowchangerequest serverchangeevent extensionevent }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the window "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# window { map unmap }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the font class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the font "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain font { load getattr }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the font "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain font free
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# font use
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the colormap class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the colormap "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain colormap { list read getattr }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the colormap "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain colormap { create free install uninstall store setattr }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the property class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the property "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain property { read }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the property "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain property { create free write }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the cursor class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the cursor "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain cursor { create createglyph free assign setattr }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the xclient class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xclient "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xclient kill
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the xinput class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xinput "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xinput { lookup getattr mousemotion }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xinput "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xinput { setattr setfocus warppointer activegrab passivegrab ungrab bell relabelinput }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the xserver class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xserver "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xserver { gethostlist getfontpath getattr screensaver }
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xserver "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xserver { sethostlist setfontpath grab ungrab screensaver }
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the xextension class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xextension "read" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xextension query
Chris PeBenito 0fbfa5
	(( l1 dom l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinread ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# the xextension "write" ops (implicit single level)
Chris PeBenito 0fbfa5
mlsconstrain xextension use
Chris PeBenito 0fbfa5
	(( l1 eq l2 ) or
Chris PeBenito 0fbfa5
	 (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
Chris PeBenito 0fbfa5
	 ( t1 == mlsxwinwrite ));
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the pax class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# pax { pageexec emutramp mprotect randmmap randexec segmexec }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the dbus class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# dbus { acquire_svc send_msg }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the nscd class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# nscd { getpwd getgrp gethost getstat admin shmempwd shmemgrp shmemhost }
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# MLS policy for the association class
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# these access vectors have no MLS restrictions
Chris PeBenito 0fbfa5
# association { sendto recvfrom }
Chris PeBenito 0fbfa5