1 files changed, 46 insertions, 0 deletions
diff --git a/src/misc/av/keyav.cil b/src/misc/av/keyav.cil
new file mode 100644
index 0000000..2d8bf4c
--- /dev/null
+++ b/src/misc/av/keyav.cil
@@ -0,0 +1,46 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(class key (create link read search setattr view write))
+(classorder (unordered key))
+
+(in ibac
+
+    (constrain (key (create))
+	       (or (or (or (eq u1 u2)
+			   (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id)))
+		       (eq t1 subjchange.typeattr))
+		   (eq t1 exempt.typeattr))))
+
+(in invalid.unconfined
+
+    (allow typeattr .invalid (key (all))))
+
+(in mcs
+
+    (mlsconstrain (key (create read setattr view write))
+		  (or (dom h1 h2)
+		      (neq t1 constrained.typeattr))))
+
+(in rbac
+
+    (constrain (key (create))
+	       (or (or (or (eq r1 r2)
+			   (and (eq t1 subjchangesys.typeattr)
+				(eq r2 .sys.role)))
+		       (eq t1 subjchange.typeattr))
+		   (eq t1 exempt.typeattr))))
+
+(in rbacsep
+
+    (constrain (key (read setattr view write))
+	       (or (or (or (eq r1 r2)
+			   (and (eq r1 exempt.roleattr)
+				(neq t1 constrained.typeattr)))
+		       (eq t1 exempt.subj.typeattr))
+		   (and (eq t1 exemptsource.typeattr)
+			(eq t2 exempttarget.typeattr)))))
+
+(in subj.unconfined
+
+    (allow typeattr subj.typeattr (key (all))))