1 files changed, 67 insertions, 0 deletions
diff --git a/src/file/authfile.cil b/src/file/authfile.cil
new file mode 100644
index 0000000..a458691
--- /dev/null
+++ b/src/file/authfile.cil
@@ -0,0 +1,67 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(in file
+
+    (call auth.relabelto.type (unconfined.typeattr))
+    (call auth.write.type (unconfined.typeattr))
+
+    (block auth
+
+      (macro type ((type ARG1))
+	     (typeattributeset typeattr ARG1))
+
+      (blockinherit file.all_macro_template_dirs)
+      (blockinherit file.all_macro_template_fifo_files)
+      (blockinherit file.all_macro_template_files)
+      (blockinherit file.all_macro_template_lnk_files)
+      (blockinherit file.all_macro_template_sock_files)
+
+      (typeattribute typeattr)
+
+      (call exception.type (typeattr))
+
+      (call .xattr.associate_fs (typeattr))
+
+      (block base_template
+
+	(blockabstract base_template)
+
+	(blockinherit .file.base_template)
+
+	(call .file.auth.type (file)))
+
+      (block relabelto
+
+	(macro type ((type ARG1))
+	       (typeattributeset typeattr ARG1))
+
+	(typeattribute not_typeattr)
+	(typeattribute typeattr)
+
+	(typeattributeset not_typeattr (not typeattr))
+
+	(neverallow not_typeattr auth.typeattr (file (relabelto))))
+
+      (block template
+
+	(blockabstract template)
+
+	(blockinherit .file.auth.base_template)
+	(blockinherit .file.macro_template_dirs)
+	(blockinherit .file.macro_template_fifo_files)
+	(blockinherit .file.macro_template_files)
+	(blockinherit .file.macro_template_lnk_files)
+	(blockinherit .file.macro_template_sock_files))
+
+      (block write
+
+	(macro type ((type ARG1))
+	       (typeattributeset typeattr ARG1))
+
+	(typeattribute not_typeattr)
+	(typeattribute typeattr)
+
+	(typeattributeset not_typeattr (not typeattr))
+
+	(neverallow not_typeattr auth.typeattr (file (append write))))))