diff options
Diffstat (limited to 'src/misc/av/perfeventav.cil')
| -rw-r--r-- | src/misc/av/perfeventav.cil | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/src/misc/av/perfeventav.cil b/src/misc/av/perfeventav.cil new file mode 100644 index 0000000..1946d80 --- /dev/null +++ b/src/misc/av/perfeventav.cil @@ -0,0 +1,30 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-License-Identifier: Unlicense + +(class perf_event (cpu kernel open read tracepoint write)) +(classorder (unordered perf_event)) + +(in invalid.unconfined + + (allow typeattr .invalid (perf_event (read write)))) + +(in mcs + + (mlsconstrain (perf_event (read write)) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) + +(in rbacsep + + (constrain (perf_event (read write)) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) + +(in subj.unconfined + + (allow typeattr self (perf_event (not (read write)))) + (allow typeattr subj.typeattr (perf_event (read write)))) |