1 files changed, 141 insertions, 0 deletions
diff --git a/src/sys/pstorefile.cil b/src/sys/pstorefile.cil
new file mode 100644
index 0000000..b987c04
--- /dev/null
+++ b/src/sys/pstorefile.cil
@@ -0,0 +1,141 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block pstorefile
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (blockinherit .file.all_macro_template_dirs)
+  (blockinherit .file.all_macro_template_files)
+
+  (call .obj.type (typeattr))
+
+  (call .pstore.associate_fs (typeattr))
+
+  (block base_template
+
+    (blockabstract base_template)
+
+    (context pstorefile_context (.sys.id .sys.role pstorefile lowlevelrange))
+
+    (type pstorefile)
+    (call .pstorefile.type (pstorefile)))
+
+  (block macro_template_dirs
+
+    (blockabstract macro_template_dirs)
+
+    (macro addname_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile addname_dir))
+
+    (macro create_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile create_dir))
+
+    (macro delete_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile delete_dir))
+
+    (macro deletename_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile deletename_dir))
+
+    (macro list_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile list_dir))
+
+    (macro listinherited_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile listinherited_dir))
+
+    (macro manage_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile manage_dir))
+
+    (macro mounton_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile mounton_dir))
+
+    (macro readwrite_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile readwrite_dir))
+
+    (macro readwriteinherited_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile readwriteinherited_dir))
+
+    (macro rename_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile rename_dir))
+
+    (macro search_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile search_dir))
+
+    (macro write_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile write_dir))
+
+    (macro writeinherited_pstorefile_dirs ((type ARG1))
+	   (allow ARG1 pstorefile writeinherited_dir)))
+
+  (block macro_template_files
+
+    (blockabstract macro_template_files)
+
+    (macro append_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile append_file))
+
+    (macro appendinherited_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile appendinherited_file))
+
+    (macro create_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile create_file))
+
+    (macro delete_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile delete_file))
+
+    (macro execute_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile execute_file))
+
+    (macro manage_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile manage_file))
+
+    (macro mapexecute_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile mapexecute_file))
+
+    (macro mounton_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile mounton_file))
+
+    (macro read_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile read_file))
+
+    (macro readinherited_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile readinherited_file))
+
+    (macro readwrite_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile readwrite_file))
+
+    (macro readwriteinherited_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile readwriteinherited_file))
+
+    (macro rename_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile rename_file))
+
+    (macro write_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile write_file))
+
+    (macro writeinherited_pstorefile_files ((type ARG1))
+	   (allow ARG1 pstorefile writeinherited_file)))
+
+  (block template
+
+    (blockabstract template)
+
+    (blockinherit .pstorefile.base_template)
+    (blockinherit .pstorefile.macro_template_files))
+
+  (block unconfined
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (allow typeattr pstorefile.typeattr (dir (not execmod)))
+    (allow typeattr pstorefile.typeattr (file (not (entrypoint execmod))))))
+
+(in sys.unconfined
+
+    (call .pstorefile.unconfined.type (typeattr)))