| # |
| # Define sensitivities |
| # |
| # Each sensitivity has a name and zero or more aliases. |
| # |
| # MCS is single-sensitivity. |
| # |
| sensitivity s0; |
| |
| # |
| # Define the ordering of the sensitivity levels (least to greatest) |
| # |
| dominance { s0 } |
| |
| |
| # |
| # Define the categories |
| # |
| # Each category has a name and zero or more aliases. |
| # |
| category c0; category c1; category c2; category c3; |
| category c4; category c5; category c6; category c7; |
| category c8; category c9; category c10; category c11; |
| category c12; category c13; category c14; category c15; |
| category c16; category c17; category c18; category c19; |
| category c20; category c21; category c22; category c23; |
| category c24; category c25; category c26; category c27; |
| category c28; category c29; category c30; category c31; |
| category c32; category c33; category c34; category c35; |
| category c36; category c37; category c38; category c39; |
| category c40; category c41; category c42; category c43; |
| category c44; category c45; category c46; category c47; |
| category c48; category c49; category c50; category c51; |
| category c52; category c53; category c54; category c55; |
| category c56; category c57; category c58; category c59; |
| category c60; category c61; category c62; category c63; |
| category c64; category c65; category c66; category c67; |
| category c68; category c69; category c70; category c71; |
| category c72; category c73; category c74; category c75; |
| category c76; category c77; category c78; category c79; |
| category c80; category c81; category c82; category c83; |
| category c84; category c85; category c86; category c87; |
| category c88; category c89; category c90; category c91; |
| category c92; category c93; category c94; category c95; |
| category c96; category c97; category c98; category c99; |
| category c100; category c101; category c102; category c103; |
| category c104; category c105; category c106; category c107; |
| category c108; category c109; category c110; category c111; |
| category c112; category c113; category c114; category c115; |
| category c116; category c117; category c118; category c119; |
| category c120; category c121; category c122; category c123; |
| category c124; category c125; category c126; category c127; |
| category c128; category c129; category c130; category c131; |
| category c132; category c133; category c134; category c135; |
| category c136; category c137; category c138; category c139; |
| category c140; category c141; category c142; category c143; |
| category c144; category c145; category c146; category c147; |
| category c148; category c149; category c150; category c151; |
| category c152; category c153; category c154; category c155; |
| category c156; category c157; category c158; category c159; |
| category c160; category c161; category c162; category c163; |
| category c164; category c165; category c166; category c167; |
| category c168; category c169; category c170; category c171; |
| category c172; category c173; category c174; category c175; |
| category c176; category c177; category c178; category c179; |
| category c180; category c181; category c182; category c183; |
| category c184; category c185; category c186; category c187; |
| category c188; category c189; category c190; category c191; |
| category c192; category c193; category c194; category c195; |
| category c196; category c197; category c198; category c199; |
| category c200; category c201; category c202; category c203; |
| category c204; category c205; category c206; category c207; |
| category c208; category c209; category c210; category c211; |
| category c212; category c213; category c214; category c215; |
| category c216; category c217; category c218; category c219; |
| category c220; category c221; category c222; category c223; |
| category c224; category c225; category c226; category c227; |
| category c228; category c229; category c230; category c231; |
| category c232; category c233; category c234; category c235; |
| category c236; category c237; category c238; category c239; |
| category c240; category c241; category c242; category c243; |
| category c244; category c245; category c246; category c247; |
| category c248; category c249; category c250; category c251; |
| category c252; category c253; category c254; category c255; |
| |
| |
| # |
| # Each MCS level specifies a sensitivity and zero or more categories which may |
| # be associated with that sensitivity. |
| # |
| level s0:c0.c255; |
| |
| # |
| # Define the MCS policy |
| # |
| # mlsconstrain class_set perm_set expression ; |
| # |
| # mlsvalidatetrans class_set expression ; |
| # |
| # expression : ( expression ) |
| # | not expression |
| # | expression and expression |
| # | expression or expression |
| # | u1 op u2 |
| # | r1 role_mls_op r2 |
| # | t1 op t2 |
| # | l1 role_mls_op l2 |
| # | l1 role_mls_op h2 |
| # | h1 role_mls_op l2 |
| # | h1 role_mls_op h2 |
| # | l1 role_mls_op h1 |
| # | l2 role_mls_op h2 |
| # | u1 op names |
| # | u2 op names |
| # | r1 op names |
| # | r2 op names |
| # | t1 op names |
| # | t2 op names |
| # | u3 op names (NOTE: this is only available for mlsvalidatetrans) |
| # | r3 op names (NOTE: this is only available for mlsvalidatetrans) |
| # | t3 op names (NOTE: this is only available for mlsvalidatetrans) |
| # |
| # op : == | != |
| # role_mls_op : == | != | eq | dom | domby | incomp |
| # |
| # names : name | { name_list } |
| # name_list : name | name_list name |
| # |
| |
| # |
| # MCS policy for the file classes |
| # |
| # Constrain file access so that the high range of the process dominates |
| # the high range of the file. We use the high range of the process so |
| # that processes can always simply run at s0. |
| # |
| # Only files are constrained by MCS at this stage. |
| # |
| mlsconstrain file { write setattr append unlink link rename |
| create ioctl lock execute } (h1 dom h2); |
| |
| mlsconstrain file { read } ((h1 dom h2) or |
| ( t1 == mlsfileread )); |
| |
| |
| # new file labels must be dominated by the relabeling subject's clearance |
| mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom relabelto } |
| ( h1 dom h2 ); |
| |
| define(`nogetattr_file_perms', `{ create ioctl read lock write setattr append |
| link unlink rename relabelfrom relabelto }') |
| |
| define(`nogetattr_dir_perms', `{ create read lock setattr ioctl link unlink |
| rename search add_name remove_name reparent write rmdir relabelfrom |
| relabelto }') |
| |
| # XXX |
| # |
| # For some reason, we need to reference the mlsfileread attribute |
| # or we get a build error. Below is a dummy entry to do this. |
| mlsconstrain xextension query ( t1 == mlsfileread ); |
| |