summaryrefslogtreecommitdiff
path: root/src/misc/constrain
diff options
context:
space:
mode:
Diffstat (limited to 'src/misc/constrain')
-rw-r--r--src/misc/constrain/ibac.cil84
-rw-r--r--src/misc/constrain/mcs.cil38
-rw-r--r--src/misc/constrain/rbac.cil84
-rw-r--r--src/misc/constrain/rbacsep.cil112
4 files changed, 318 insertions, 0 deletions
diff --git a/src/misc/constrain/ibac.cil b/src/misc/constrain/ibac.cil
new file mode 100644
index 0000000..ae2d4b8
--- /dev/null
+++ b/src/misc/constrain/ibac.cil
@@ -0,0 +1,84 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block ibac
+
+ (constrain (constrainobject (create relabelto))
+ (or (or (or (eq u1 u2)
+ (and (eq t1 objchangesys.typeattr)
+ (eq u2 .sys.id)))
+ (eq t1 objchange.typeattr))
+ (eq t1 exempt.typeattr)))
+
+ (constrain (process (dyntransition transition))
+ (or (or (or (eq u1 u2)
+ (and (eq t1 subjchange.typeattr)
+ (eq t2 subjchangetarget.typeattr)))
+ (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id)))
+ (eq t1 exempt.typeattr)))
+
+ (block change
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)
+
+ (call objchange.type (typeattr))
+ (call subjchange.type (typeattr)))
+
+ (block changesys
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)
+
+ (call objchangesys.type (typeattr))
+ (call subjchangesys.type (typeattr)))
+
+ (block exempt
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block objchange
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block objchangesys
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subjchange
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subjchangesys
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subjchangetarget
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)))
+
+(in subj.unconfined
+
+ (call .ibac.exempt.type (typeattr)))
diff --git a/src/misc/constrain/mcs.cil b/src/misc/constrain/mcs.cil
new file mode 100644
index 0000000..849d525
--- /dev/null
+++ b/src/misc/constrain/mcs.cil
@@ -0,0 +1,38 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(defaultrange blk_file source low)
+(defaultrange chr_file source low)
+(defaultrange dir source low)
+(defaultrange fifo_file source low)
+(defaultrange file source low)
+(defaultrange lnk_file source low)
+(defaultrange sock_file source low)
+
+(block mcs
+
+ (mlsconstrain (constrainobject (create relabelto))
+ (or (neq t1 constrained.typeattr)
+ (and (dom h1 h2) (eq l2 h2))))
+
+ (mlsconstrain (constrainobject (append getattr read setattr write))
+ (or (dom h1 h2)
+ (neq t1 constrained.typeattr)))
+
+ (mlsconstrain
+ (process (dyntransition getrlimit getsched ptrace setrlimit setsched
+ sigchld sigkill signal signull sigstop
+ transition))
+ (or (dom h1 h2)
+ (neq t1 constrained.typeattr)))
+
+ (mlsconstrain (fifo_file (append getattr read write setattr))
+ (or (dom h1 h2)
+ (neq t1 constrained.typeattr)))
+
+ (block constrained
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)))
diff --git a/src/misc/constrain/rbac.cil b/src/misc/constrain/rbac.cil
new file mode 100644
index 0000000..790d554
--- /dev/null
+++ b/src/misc/constrain/rbac.cil
@@ -0,0 +1,84 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block rbac
+
+ (constrain (constrainobject (create relabelto))
+ (or (or (or (eq r1 r2)
+ (and (eq t1 objchangesys.typeattr)
+ (eq r2 .sys.role)))
+ (eq t1 objchange.typeattr))
+ (eq t1 exempt.typeattr)))
+
+ (constrain (process (dyntransition transition))
+ (or (or (or (eq r1 r2)
+ (and (eq t1 subjchange.typeattr)
+ (eq t2 subjchangetarget.typeattr)))
+ (and (eq t1 subjchangesys.typeattr) (eq r2 .sys.role)))
+ (eq t1 exempt.typeattr)))
+
+ (block change
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)
+
+ (call objchange.type (typeattr))
+ (call subjchange.type (typeattr)))
+
+ (block changesys
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)
+
+ (call objchangesys.type (typeattr))
+ (call subjchangesys.type (typeattr)))
+
+ (block exempt
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block objchange
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block objchangesys
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subjchange
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subjchangesys
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subjchangetarget
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)))
+
+(in subj.unconfined
+
+ (call .rbac.exempt.type (typeattr)))
diff --git a/src/misc/constrain/rbacsep.cil b/src/misc/constrain/rbacsep.cil
new file mode 100644
index 0000000..a3e1b6f
--- /dev/null
+++ b/src/misc/constrain/rbacsep.cil
@@ -0,0 +1,112 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block rbacsep
+
+ (constrain (fifo_file (append getattr read setattr write))
+ (or (or (or (or (eq r1 r2)
+ (and (eq r1 exempt.roleattr)
+ (neq t1 constrained.typeattr)))
+ (eq t1 exempt.subj.typeattr))
+ (eq t2 exempt.obj.typeattr))
+ (and (eq t1 exemptsource.typeattr)
+ (eq t2 exempttarget.typeattr))))
+
+ (constrain (constrainobject (append setattr write))
+ (or (or (or (eq r1 r2)
+ (and (eq r1 exempt.roleattr)
+ (neq t1 constrained.typeattr)))
+ (eq t1 exempt.subj.typeattr))
+ (eq t2 exempt.obj.typeattr)))
+
+ (constrain (constrainobject (getattr read))
+ (or (or (or (or (or (eq r1 r2)
+ (and (eq r1 exempt.roleattr)
+ (neq t1 constrained.typeattr)))
+ (eq t1 exempt.subj.typeattr))
+ (eq t2 exempt.obj.typeattr))
+ (and (eq r2 exempt.roleattr) (eq t2 typeattr)))
+ (and
+ (eq t1 readstatesource.typeattr)
+ (eq t2 readstatetarget.typeattr))))
+
+ (constrain
+ (process (getrlimit getsched ptrace setrlimit setsched sigchld sigkill
+ signal signull sigstop))
+ (or (or (or (eq r1 r2)
+ (and (eq r1 exempt.roleattr) (neq t1 constrained.typeattr)))
+ (eq t1 exempt.subj.typeattr))
+ (and (eq t1 exemptsource.typeattr) (eq t2 exempttarget.typeattr))))
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)
+
+ (block constrained
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block exempt
+
+ (macro role ((role ARG1))
+ (roleattributeset roleattr ARG1))
+
+ (roleattribute roleattr)
+
+ (block obj
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block subj
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)))
+
+ (block exemptsource
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block exempttarget
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block readstatesource
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr))
+
+ (block readstatetarget
+
+ (macro type ((type ARG1))
+ (typeattributeset typeattr ARG1))
+
+ (typeattribute typeattr)))
+
+(in obj
+
+ (call .rbacsep.type (typeattr)))
+
+(in subj.unconfined
+
+ (call .rbacsep.exempt.subj.type (typeattr)))
+
+(in sys
+
+ (call .rbacsep.exempt.role (role)))
generated by cgit v1.2.3 (git 2.46.0) at 2025-09-21 04:33:04 +0000