Import dssp5

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>

4 files changed, 318 insertions, 0 deletions

diff --git a/src/misc/constrain/ibac.cil b/src/misc/constrain/ibac.cil
new file mode 100644
index 0000000..ae2d4b8
--- /dev/null
+++ b/src/misc/constrain/ibac.cil
@@ -0,0 +1,84 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block ibac
+
+  (constrain (constrainobject (create relabelto))
+	     (or (or (or (eq u1 u2)
+			 (and (eq t1 objchangesys.typeattr)
+			      (eq u2 .sys.id)))
+		     (eq t1 objchange.typeattr))
+		 (eq t1 exempt.typeattr)))
+
+  (constrain (process (dyntransition transition))
+	     (or (or (or (eq u1 u2)
+			 (and (eq t1 subjchange.typeattr)
+			      (eq t2 subjchangetarget.typeattr)))
+		     (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id)))
+		 (eq t1 exempt.typeattr)))
+
+  (block change
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchange.type (typeattr))
+    (call subjchange.type (typeattr)))
+
+  (block changesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchangesys.type (typeattr))
+    (call subjchangesys.type (typeattr)))
+
+  (block exempt
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangetarget
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
+
+(in subj.unconfined
+
+    (call .ibac.exempt.type (typeattr)))
diff --git a/src/misc/constrain/mcs.cil b/src/misc/constrain/mcs.cil
new file mode 100644
index 0000000..849d525
--- /dev/null
+++ b/src/misc/constrain/mcs.cil
@@ -0,0 +1,38 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(defaultrange blk_file source low)
+(defaultrange chr_file source low)
+(defaultrange dir source low)
+(defaultrange fifo_file source low)
+(defaultrange file source low)
+(defaultrange lnk_file source low)
+(defaultrange sock_file source low)
+
+(block mcs
+
+  (mlsconstrain (constrainobject (create relabelto))
+		(or (neq t1 constrained.typeattr)
+		    (and (dom h1 h2) (eq l2 h2))))
+
+  (mlsconstrain (constrainobject (append getattr read setattr write))
+		(or (dom h1 h2)
+		    (neq t1 constrained.typeattr)))
+
+  (mlsconstrain
+   (process (dyntransition getrlimit getsched ptrace setrlimit setsched
+			   sigchld sigkill signal signull sigstop
+			   transition))
+   (or (dom h1 h2)
+       (neq t1 constrained.typeattr)))
+
+  (mlsconstrain (fifo_file (append getattr read write setattr))
+		(or (dom h1 h2)
+		    (neq t1 constrained.typeattr)))
+
+  (block constrained
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
diff --git a/src/misc/constrain/rbac.cil b/src/misc/constrain/rbac.cil
new file mode 100644
index 0000000..790d554
--- /dev/null
+++ b/src/misc/constrain/rbac.cil
@@ -0,0 +1,84 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block rbac
+
+  (constrain (constrainobject (create relabelto))
+	     (or (or (or (eq r1 r2)
+			 (and (eq t1 objchangesys.typeattr)
+			      (eq r2 .sys.role)))
+		     (eq t1 objchange.typeattr))
+		 (eq t1 exempt.typeattr)))
+
+  (constrain (process (dyntransition transition))
+	     (or (or (or (eq r1 r2)
+			 (and (eq t1 subjchange.typeattr)
+			      (eq t2 subjchangetarget.typeattr)))
+		     (and (eq t1 subjchangesys.typeattr) (eq r2 .sys.role)))
+		 (eq t1 exempt.typeattr)))
+
+  (block change
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchange.type (typeattr))
+    (call subjchange.type (typeattr)))
+
+  (block changesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchangesys.type (typeattr))
+    (call subjchangesys.type (typeattr)))
+
+  (block exempt
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangetarget
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
+
+(in subj.unconfined
+
+    (call .rbac.exempt.type (typeattr)))
diff --git a/src/misc/constrain/rbacsep.cil b/src/misc/constrain/rbacsep.cil
new file mode 100644
index 0000000..a3e1b6f
--- /dev/null
+++ b/src/misc/constrain/rbacsep.cil
@@ -0,0 +1,112 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block rbacsep
+
+  (constrain (fifo_file (append getattr read setattr write))
+	     (or (or (or (or (eq r1 r2)
+			     (and (eq r1 exempt.roleattr)
+				  (neq t1 constrained.typeattr)))
+			 (eq t1 exempt.subj.typeattr))
+		     (eq t2 exempt.obj.typeattr))
+		 (and (eq t1 exemptsource.typeattr)
+		      (eq t2 exempttarget.typeattr))))
+
+  (constrain (constrainobject (append setattr write))
+	     (or (or (or (eq r1 r2)
+			 (and (eq r1 exempt.roleattr)
+			      (neq t1 constrained.typeattr)))
+		     (eq t1 exempt.subj.typeattr))
+		 (eq t2 exempt.obj.typeattr)))
+
+  (constrain (constrainobject (getattr read))
+	     (or (or (or (or (or (eq r1 r2)
+				 (and (eq r1 exempt.roleattr)
+				      (neq t1 constrained.typeattr)))
+			     (eq t1 exempt.subj.typeattr))
+			 (eq t2 exempt.obj.typeattr))
+		     (and (eq r2 exempt.roleattr) (eq t2 typeattr)))
+		 (and
+		  (eq t1 readstatesource.typeattr)
+		  (eq t2 readstatetarget.typeattr))))
+
+  (constrain
+   (process (getrlimit getsched ptrace setrlimit setsched sigchld sigkill
+		       signal signull sigstop))
+   (or (or (or (eq r1 r2)
+	       (and (eq r1 exempt.roleattr) (neq t1 constrained.typeattr)))
+	   (eq t1 exempt.subj.typeattr))
+       (and (eq t1 exemptsource.typeattr) (eq t2 exempttarget.typeattr))))
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (block constrained
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block exempt
+
+    (macro role ((role ARG1))
+	   (roleattributeset roleattr ARG1))
+
+    (roleattribute roleattr)
+
+    (block obj
+
+      (macro type ((type ARG1))
+	     (typeattributeset typeattr ARG1))
+
+      (typeattribute typeattr))
+
+    (block subj
+
+      (macro type ((type ARG1))
+	     (typeattributeset typeattr ARG1))
+
+      (typeattribute typeattr)))
+
+  (block exemptsource
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block exempttarget
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block readstatesource
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block readstatetarget
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
+
+(in obj
+
+    (call .rbacsep.type (typeattr)))
+
+(in subj.unconfined
+
+    (call .rbacsep.exempt.subj.type (typeattr)))
+
+(in sys
+
+    (call .rbacsep.exempt.role (role)))