Import dssp5

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>

4 files changed, 196 insertions, 0 deletions

diff --git a/src/selinux/booleanfile.cil b/src/selinux/booleanfile.cil
new file mode 100644
index 0000000..9cde7eb
--- /dev/null
+++ b/src/selinux/booleanfile.cil
@@ -0,0 +1,93 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block booleanfile
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (blockinherit .file.all_macro_template_files)
+
+  (call .obj.type (typeattr))
+
+  (block base_template
+
+    (blockabstract base_template)
+
+    (context booleanfile_context (.sys.id .sys.role booleanfile lowlevelrange))
+
+    (type booleanfile)
+    (call .booleanfile.type (booleanfile)))
+
+  (block macro_template_files
+
+    (blockabstract macro_template_files)
+
+    (macro append_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile append_file))
+
+    (macro appendinherited_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile appendinherited_file))
+
+    (macro create_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile create_file))
+
+    (macro delete_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile delete_file))
+
+    (macro execute_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile execute_file))
+
+    (macro manage_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile manage_file))
+
+    (macro mapexecute_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile mapexecute_file))
+
+    (macro mounton_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile mounton_file))
+
+    (macro read_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile read_file))
+
+    (macro readinherited_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile readinherited_file))
+
+    (macro readwrite_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile readwrite_file))
+
+    (macro readwriteinherited_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile readwriteinherited_file))
+
+    (macro rename_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile rename_file))
+
+    (macro write_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile write_file))
+
+    (macro writeinherited_booleanfile_files ((type ARG1))
+	   (allow ARG1 booleanfile writeinherited_file)))
+
+  (block template
+
+    (blockabstract template)
+
+    (blockinherit .booleanfile.base_template)
+    (blockinherit .booleanfile.macro_template_files))
+
+  (block unconfined
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (allow typeattr booleanfile.typeattr
+	   (file (not (audit_access entrypoint execmod relabelfrom
+				    relabelto))))))
+
+(in selinux.unconfined
+
+    (call .booleanfile.unconfined.type (typeattr)))
diff --git a/src/selinux/booleanfile/invalidassociationsbooleanfile.cil b/src/selinux/booleanfile/invalidassociationsbooleanfile.cil
new file mode 100644
index 0000000..1eaf3c0
--- /dev/null
+++ b/src/selinux/booleanfile/invalidassociationsbooleanfile.cil
@@ -0,0 +1,35 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(tunable invalid_associations true)
+
+(block invalid_associations
+
+  (genfscon "selinuxfs" "/booleans/invalid_associations" booleanfile_context)
+
+  (blockinherit .booleanfile.template))
+
+(block invalidassociations
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (block except
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (typeattributeset typeattr
+		      (and invalidassociations.typeattr
+			   (not (exception.typeattr)))))
+
+  (block exception
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
diff --git a/src/selinux/booleanfile/invalidpacketsbooleanfile.cil b/src/selinux/booleanfile/invalidpacketsbooleanfile.cil
new file mode 100644
index 0000000..9b638a0
--- /dev/null
+++ b/src/selinux/booleanfile/invalidpacketsbooleanfile.cil
@@ -0,0 +1,34 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(tunable invalid_packets true)
+
+(block invalid_packets
+
+  (genfscon "selinuxfs" "/booleans/invalid_packets" booleanfile_context)
+
+  (blockinherit .booleanfile.template))
+
+(block invalidpackets
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (block except
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (typeattributeset typeattr
+		      (and invalidpackets.typeattr (not (exception.typeattr)))))
+
+  (block exception
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
diff --git a/src/selinux/booleanfile/invalidpeersbooleanfile.cil b/src/selinux/booleanfile/invalidpeersbooleanfile.cil
new file mode 100644
index 0000000..3a0b6cd
--- /dev/null
+++ b/src/selinux/booleanfile/invalidpeersbooleanfile.cil
@@ -0,0 +1,34 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(tunable invalid_peers true)
+
+(block invalid_peers
+
+  (genfscon "selinuxfs" "/booleans/invalid_peers" booleanfile_context)
+
+  (blockinherit .booleanfile.template))
+
+(block invalidpeers
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (block except
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (typeattributeset typeattr
+		      (and invalidpeers.typeattr (not (exception.typeattr)))))
+
+  (block exception
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))