diff options
Diffstat (limited to 'src/invalid.cil')
| -rw-r--r-- | src/invalid.cil | 441 |
1 files changed, 441 insertions, 0 deletions
diff --git a/src/invalid.cil b/src/invalid.cil new file mode 100644 index 0000000..b11a4e0 --- /dev/null +++ b/src/invalid.cil @@ -0,0 +1,441 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-License-Identifier: Unlicense + +(sidcontext unlabeled (sys.id sys.role invalid lowlevelrange)) + +(macro addname_invalid_dirs ((type ARG1)) + (allow ARG1 invalid addname_dir)) + +(macro append_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid append_blk_file)) + +(macro append_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid append_chr_file)) + +(macro append_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid append_fifo_file)) + +(macro append_invalid_files ((type ARG1)) + (allow ARG1 invalid append_file)) + +(macro appendinherited_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid appendinherited_blk_file)) + +(macro appendinherited_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid appendinherited_chr_file)) + +(macro appendinherited_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid appendinherited_fifo_file)) + +(macro appendinherited_invalid_files ((type ARG1)) + (allow ARG1 invalid appendinherited_file)) + +(macro create_invalid ((type ARG1)) + (allow ARG1 invalid (files (create)))) + +(macro create_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid create_blk_file)) + +(macro create_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid create_chr_file)) + +(macro create_invalid_dirs ((type ARG1)) + (allow ARG1 invalid create_dir)) + +(macro create_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid create_fifo_file)) + +(macro create_invalid_files ((type ARG1)) + (allow ARG1 invalid create_file)) + +(macro create_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid create_lnk_file)) + +(macro create_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid create_sock_file)) + +(macro delete_invalid ((type ARG1)) + (allow ARG1 invalid (files (delete)))) + +(macro delete_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid delete_blk_file)) + +(macro delete_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid delete_chr_file)) + +(macro delete_invalid_dirs ((type ARG1)) + (allow ARG1 invalid delete_dir)) + +(macro delete_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid delete_fifo_file)) + +(macro delete_invalid_files ((type ARG1)) + (allow ARG1 invalid delete_file)) + +(macro delete_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid delete_lnk_file)) + +(macro delete_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid delete_sock_file)) + +(macro deletename_invalid_dirs ((type ARG1)) + (allow ARG1 invalid deletename_dir)) + +(macro execute_invalid_files ((type ARG1)) + (allow ARG1 invalid execute_file)) + +(macro getattr_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (getattr)))) + +(macro getrlimit_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (getrlimit)))) + +(macro getsched_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (getsched)))) + +(macro invalid_type_transition ((type ARG1)(type ARG2)(class ARG3)(name ARG4)) + (typetransition ARG1 invalid ARG3 ARG4 ARG2) + (call addname_invalid_dirs (ARG1))) + +(macro list_invalid_dirs ((type ARG1)) + (allow ARG1 invalid list_dir)) + +(macro listinherited_invalid_dirs ((type ARG1)) + (allow ARG1 invalid listinherited_dir)) + +(macro manage_invalid ((type ARG1)) + (allow ARG1 invalid (files (manage)))) + +(macro manage_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid manage_blk_file)) + +(macro manage_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid manage_chr_file)) + +(macro manage_invalid_dirs ((type ARG1)) + (allow ARG1 invalid manage_dir)) + +(macro manage_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid manage_fifo_file)) + +(macro manage_invalid_files ((type ARG1)) + (allow ARG1 invalid manage_file)) + +(macro manage_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid manage_lnk_file)) + +(macro manage_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid manage_sock_file)) + +(macro mapexecute_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid mapexecute_chr_file)) + +(macro mapexecute_invalid_files ((type ARG1)) + (allow ARG1 invalid mapexecute_file)) + +(macro mounton_invalid_dirs ((type ARG1)) + (allow ARG1 invalid mounton_dir)) + +(macro mounton_invalid_files ((type ARG1)) + (allow ARG1 invalid mounton_file)) + +(macro nnptransition_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process2 (nnp_transition)))) + +(macro noatsecure_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (noatsecure)))) + +(macro nosuidtransition_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process2 (nosuid_transition)))) + +(macro ps_invalid_states ((type ARG1)) + (allow ARG1 invalid (state (ps)))) + +(macro ptrace_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (ptrace)))) + +(macro read_invalid ((type ARG1)) + (allow ARG1 invalid (files (read)))) + +(macro read_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid read_blk_file)) + +(macro read_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid read_chr_file)) + +(macro read_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid read_fifo_file)) + +(macro read_invalid_files ((type ARG1)) + (allow ARG1 invalid read_file)) + +(macro read_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid read_lnk_file)) + +(macro read_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid read_sock_file)) + +(macro read_invalid_states ((type ARG1)) + (allow ARG1 invalid (state (read)))) + +(macro readinherited_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid readinherited_blk_file)) + +(macro readinherited_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid readinherited_chr_file)) + +(macro readinherited_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid readinherited_fifo_file)) + +(macro readinherited_invalid_files ((type ARG1)) + (allow ARG1 invalid readinherited_file)) + +(macro readinherited_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid readinherited_sock_file)) + +(macro readwrite_invalid ((type ARG1)) + (allow ARG1 invalid (files (readwrite)))) + +(macro readwrite_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid readwrite_blk_file)) + +(macro readwrite_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid readwrite_chr_file)) + +(macro readwrite_invalid_dirs ((type ARG1)) + (allow ARG1 invalid readwrite_dir)) + +(macro readwrite_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid readwrite_fifo_file)) + +(macro readwrite_invalid_files ((type ARG1)) + (allow ARG1 invalid readwrite_file)) + +(macro readwrite_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid readwrite_lnk_file)) + +(macro readwrite_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid readwrite_sock_file)) + +(macro readwriteinherited_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid readwriteinherited_blk_file)) + +(macro readwriteinherited_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid readwriteinherited_chr_file)) + +(macro readwriteinherited_invalid_dirs ((type ARG1)) + (allow ARG1 invalid readwriteinherited_dir)) + +(macro readwriteinherited_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid readwriteinherited_fifo_file)) + +(macro readwriteinherited_invalid_files ((type ARG1)) + (allow ARG1 invalid readwriteinherited_file)) + +(macro readwriteinherited_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid readwriteinherited_sock_file)) + +(macro relabel_invalid ((type ARG1)) + (allow ARG1 invalid (files (relabel)))) + +(macro relabel_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid relabel_blk_file)) + +(macro relabel_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid relabel_chr_file)) + +(macro relabel_invalid_dirs ((type ARG1)) + (allow ARG1 invalid relabel_dir)) + +(macro relabel_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid relabel_fifo_file)) + +(macro relabel_invalid_files ((type ARG1)) + (allow ARG1 invalid relabel_file)) + +(macro relabel_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid relabel_lnk_file)) + +(macro relabel_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid relabel_sock_file)) + +(macro relabelfrom_invalid ((type ARG1)) + (allow ARG1 invalid (files (relabelfrom)))) + +(macro relabelfrom_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid relabelfrom_blk_file)) + +(macro relabelfrom_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid relabelfrom_chr_file)) + +(macro relabelfrom_invalid_dirs ((type ARG1)) + (allow ARG1 invalid relabelfrom_dir)) + +(macro relabelfrom_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid relabelfrom_fifo_file)) + +(macro relabelfrom_invalid_files ((type ARG1)) + (allow ARG1 invalid relabelfrom_file)) + +(macro relabelfrom_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid relabelfrom_lnk_file)) + +(macro relabelfrom_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid relabelfrom_sock_file)) + +(macro relabelto_invalid ((type ARG1)) + (allow ARG1 invalid (files (relabelto)))) + +(macro relabelto_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid relabelto_blk_file)) + +(macro relabelto_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid relabelto_chr_file)) + +(macro relabelto_invalid_dirs ((type ARG1)) + (allow ARG1 invalid relabelto_dir)) + +(macro relabelto_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid relabelto_fifo_file)) + +(macro relabelto_invalid_files ((type ARG1)) + (allow ARG1 invalid relabelto_file)) + +(macro relabelto_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid relabelto_lnk_file)) + +(macro relabelto_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid relabelto_sock_file)) + +(macro rename_invalid ((type ARG1)) + (allow ARG1 invalid (files (rename)))) + +(macro rename_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid rename_blk_file)) + +(macro rename_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid rename_chr_file)) + +(macro rename_invalid_dirs ((type ARG1)) + (allow ARG1 invalid rename_dir)) + +(macro rename_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid rename_fifo_file)) + +(macro rename_invalid_files ((type ARG1)) + (allow ARG1 invalid rename_file)) + +(macro rename_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid rename_lnk_file)) + +(macro rename_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid rename_sock_file)) + +(macro rlimitinh_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (rlimitinh)))) + +(macro search_invalid_dirs ((type ARG1)) + (allow ARG1 invalid search_dir)) + +(macro setrlimit_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (setrlimit)))) + +(macro setsched_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (setsched)))) + +(macro sigchld_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (sigchld)))) + +(macro sigkill_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (sigkill)))) + +(macro signal_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (signal)))) + +(macro signull_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (signull)))) + +(macro sigstop_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (sigstop)))) + +(macro transition_invalid_processes ((type ARG1)) + (allow ARG1 invalid (process (transition)))) + +(macro write_invalid ((type ARG1)) + (allow ARG1 invalid (files (write)))) + +(macro write_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid write_blk_file)) + +(macro write_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid write_chr_file)) + +(macro write_invalid_dirs ((type ARG1)) + (allow ARG1 invalid write_dir)) + +(macro write_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid write_fifo_file)) + +(macro write_invalid_files ((type ARG1)) + (allow ARG1 invalid write_file)) + +(macro write_invalid_lnk_files ((type ARG1)) + (allow ARG1 invalid write_lnk_file)) + +(macro write_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid write_sock_file)) + +(macro writeinherited_invalid_blk_files ((type ARG1)) + (allow ARG1 invalid writeinherited_blk_file)) + +(macro writeinherited_invalid_chr_files ((type ARG1)) + (allow ARG1 invalid writeinherited_chr_file)) + +(macro writeinherited_invalid_dirs ((type ARG1)) + (allow ARG1 invalid writeinherited_dir)) + +(macro writeinherited_invalid_fifo_files ((type ARG1)) + (allow ARG1 invalid writeinherited_fifo_file)) + +(macro writeinherited_invalid_files ((type ARG1)) + (allow ARG1 invalid writeinherited_file)) + +(macro writeinherited_invalid_sock_files ((type ARG1)) + (allow ARG1 invalid writeinherited_sock_file)) + +(type invalid) +(roletype sys.role invalid) + +(call .xattr.associate_fs (invalid)) + +(block invalid + + (block unconfined + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (allow typeattr .invalid + (process (not (dyntransition execheap execstack transition)))) + (allow typeattr .invalid + (process2 (not (nnp_transition nosuid_transition)))) + + (allow typeattr .invalid + (blk_file (not (audit_access execmod map mounton relabelto)))) + (allow typeattr .invalid + (chr_file (not (audit_access execmod mounton relabelto)))) + (allow typeattr .invalid (dir (not (audit_access execmod relabelto)))) + (allow typeattr .invalid + (fifo_file (not (audit_access execmod map mounton relabelto)))) + (allow typeattr .invalid + (file (not (audit_access entrypoint execmod relabelto)))) + (allow typeattr .invalid + (lnk_file (not (audit_access execmod map mounton relabelto)))) + (allow typeattr .invalid + (sock_file (not (audit_access execmod map mounton relabelto)))))) + +(in unconfined + + (call .invalid.unconfined.type (typeattr))) |