1 files changed, 84 insertions, 0 deletions
diff --git a/src/misc/constrain/rbac.cil b/src/misc/constrain/rbac.cil
new file mode 100644
index 0000000..790d554
--- /dev/null
+++ b/src/misc/constrain/rbac.cil
@@ -0,0 +1,84 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block rbac
+
+  (constrain (constrainobject (create relabelto))
+	     (or (or (or (eq r1 r2)
+			 (and (eq t1 objchangesys.typeattr)
+			      (eq r2 .sys.role)))
+		     (eq t1 objchange.typeattr))
+		 (eq t1 exempt.typeattr)))
+
+  (constrain (process (dyntransition transition))
+	     (or (or (or (eq r1 r2)
+			 (and (eq t1 subjchange.typeattr)
+			      (eq t2 subjchangetarget.typeattr)))
+		     (and (eq t1 subjchangesys.typeattr) (eq r2 .sys.role)))
+		 (eq t1 exempt.typeattr)))
+
+  (block change
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchange.type (typeattr))
+    (call subjchange.type (typeattr)))
+
+  (block changesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchangesys.type (typeattr))
+    (call subjchangesys.type (typeattr)))
+
+  (block exempt
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangetarget
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
+
+(in subj.unconfined
+
+    (call .rbac.exempt.type (typeattr)))