From 0c187b6ff97f91c41dab65a6426dc61f77305cdf Mon Sep 17 00:00:00 2001 From: Dominick Grift Date: Sun, 20 Aug 2023 15:44:41 +0200 Subject: Import dssp5 Signed-off-by: Dominick Grift --- src/misc/av/bpfav.cil | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 src/misc/av/bpfav.cil (limited to 'src/misc/av/bpfav.cil') diff --git a/src/misc/av/bpfav.cil b/src/misc/av/bpfav.cil new file mode 100644 index 0000000..8258a1d --- /dev/null +++ b/src/misc/av/bpfav.cil @@ -0,0 +1,30 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(class bpf (map_create map_read map_write prog_load prog_run)) +(classorder (unordered bpf)) + +(in invalid.unconfined + + (allow typeattr .invalid (bpf (map_read map_write prog_run)))) + +(in mcs + + (mlsconstrain (bpf (map_read map_write prog_run)) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) + +(in rbacsep + + (constrain (bpf (map_read map_write prog_run)) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) + +(in subj.unconfined + + (allow typeattr self (bpf (not (map_read map_write prog_run)))) + (allow typeattr subj.typeattr (bpf (map_read map_write prog_run)))) -- cgit v1.2.3