From 0c187b6ff97f91c41dab65a6426dc61f77305cdf Mon Sep 17 00:00:00 2001 From: Dominick Grift Date: Sun, 20 Aug 2023 15:44:41 +0200 Subject: Import dssp5 Signed-off-by: Dominick Grift --- src/misc/av/keyav.cil | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 src/misc/av/keyav.cil (limited to 'src/misc/av/keyav.cil') diff --git a/src/misc/av/keyav.cil b/src/misc/av/keyav.cil new file mode 100644 index 0000000..2d8bf4c --- /dev/null +++ b/src/misc/av/keyav.cil @@ -0,0 +1,46 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(class key (create link read search setattr view write)) +(classorder (unordered key)) + +(in ibac + + (constrain (key (create)) + (or (or (or (eq u1 u2) + (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) + +(in invalid.unconfined + + (allow typeattr .invalid (key (all)))) + +(in mcs + + (mlsconstrain (key (create read setattr view write)) + (or (dom h1 h2) + (neq t1 constrained.typeattr)))) + +(in rbac + + (constrain (key (create)) + (or (or (or (eq r1 r2) + (and (eq t1 subjchangesys.typeattr) + (eq r2 .sys.role))) + (eq t1 subjchange.typeattr)) + (eq t1 exempt.typeattr)))) + +(in rbacsep + + (constrain (key (read setattr view write)) + (or (or (or (eq r1 r2) + (and (eq r1 exempt.roleattr) + (neq t1 constrained.typeattr))) + (eq t1 exempt.subj.typeattr)) + (and (eq t1 exemptsource.typeattr) + (eq t2 exempttarget.typeattr))))) + +(in subj.unconfined + + (allow typeattr subj.typeattr (key (all)))) -- cgit v1.2.3