blob: 4d0301125495e6595dd9b202d82a5b8821202dba (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
|
ifdef(`enable_mcs',`
#
# Define sensitivities
#
# MCS is single-sensitivity.
gen_sens(1)
#
# Define the categories
#
# Generate declarations
gen_cats(mcs_num_cats)
#
# Each MCS level specifies a sensitivity and zero or more categories which may
# be associated with that sensitivity.
#
gen_levels(1,mcs_num_cats)
#
# Define the MCS policy
#
# mlsconstrain class_set perm_set expression ;
#
# mlsvalidatetrans class_set expression ;
#
# expression : ( expression )
# | not expression
# | expression and expression
# | expression or expression
# | u1 op u2
# | r1 role_mls_op r2
# | t1 op t2
# | l1 role_mls_op l2
# | l1 role_mls_op h2
# | h1 role_mls_op l2
# | h1 role_mls_op h2
# | l1 role_mls_op h1
# | l2 role_mls_op h2
# | u1 op names
# | u2 op names
# | r1 op names
# | r2 op names
# | t1 op names
# | t2 op names
# | u3 op names (NOTE: this is only available for mlsvalidatetrans)
# | r3 op names (NOTE: this is only available for mlsvalidatetrans)
# | t3 op names (NOTE: this is only available for mlsvalidatetrans)
#
# op : == | !=
# role_mls_op : == | != | eq | dom | domby | incomp
#
# names : name | { name_list }
# name_list : name | name_list name
#
#
# MCS policy for the file classes
#
# Constrain file access so that the high range of the process dominates
# the high range of the file. We use the high range of the process so
# that processes can always simply run at s0.
#
# Note:
# - getattr on dirs/files is not constrained.
# - /proc/pid operations are not constrained.
mlsconstrain file { read ioctl lock execute execute_no_trans }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain file { write setattr append unlink link rename }
(( h1 dom h2 ) or ( t1 == mcswriteall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain dir { search read ioctl lock }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
(( h1 dom h2 ) or ( t1 == mcswriteall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain fifo_file { open }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and ( t2 == domain )));
mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
(( h1 dom h2 ) or ( t1 == mcsreadall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
(( h1 dom h2 ) or ( t1 == mcswriteall ) or
(( t1 != mcs_constrained_type ) and (t2 == domain)));
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
mlsconstrain file { create relabelto }
(( h1 dom h2 ) and ( l2 eq h2 ));
# new file labels must be dominated by the relabeling subject clearance
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
( h1 dom h2 );
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
(( h1 dom h2 ) and ( l2 eq h2 ));
mlsconstrain process { transition dyntransition }
(( h1 dom h2 ) or ( t1 == mcssetcats ));
mlsconstrain process { ptrace }
(( h1 dom h2) or ( t1 == mcsptraceall ));
mlsconstrain process { sigkill sigstop }
(( h1 dom h2 ) or ( t1 == mcskillall ));
mlsconstrain process { signal }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
#
# MCS policy for SELinux-enabled databases
#
# Any database object must be dominated by the relabeling subject
# clearance, also the objects are single-level.
mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_blob } { create relabelto }
(( h1 dom h2 ) and ( l2 eq h2 ));
mlsconstrain { db_tuple } { insert relabelto }
(( h1 dom h2 ) and ( l2 eq h2 ));
# Access control for any database objects based on MCS rules.
mlsconstrain db_database { drop getattr setattr relabelfrom access install_module load_module get_param set_param }
( h1 dom h2 );
mlsconstrain db_schema { drop getattr setattr relabelfrom search }
( h1 dom h2 );
mlsconstrain db_table { drop getattr setattr relabelfrom select update insert delete lock }
( h1 dom h2 );
mlsconstrain db_column { drop getattr setattr relabelfrom select update insert }
( h1 dom h2 );
mlsconstrain db_tuple { relabelfrom select update delete use }
( h1 dom h2 );
mlsconstrain db_sequence { drop getattr setattr relabelfrom get_value next_value set_value }
( h1 dom h2 );
mlsconstrain db_view { drop getattr setattr relabelfrom expand }
( h1 dom h2 );
mlsconstrain db_procedure { drop getattr setattr relabelfrom execute install entrypoint }
( h1 dom h2 );
mlsconstrain db_language { drop getattr setattr relabelfrom execute }
( h1 dom h2 );
mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
( h1 dom h2 );
') dnl end enable_mcs
|
GitWeb