From 0c187b6ff97f91c41dab65a6426dc61f77305cdf Mon Sep 17 00:00:00 2001
From: Dominick Grift <dominick.grift@defensec.nl>
Date: Sun, 20 Aug 2023 15:44:41 +0200
Subject: Import dssp5

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
 src/misc/constrain/ibac.cil | 84 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 src/misc/constrain/ibac.cil

(limited to 'src/misc/constrain/ibac.cil')

diff --git a/src/misc/constrain/ibac.cil b/src/misc/constrain/ibac.cil
new file mode 100644
index 0000000..ae2d4b8
--- /dev/null
+++ b/src/misc/constrain/ibac.cil
@@ -0,0 +1,84 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block ibac
+
+  (constrain (constrainobject (create relabelto))
+	     (or (or (or (eq u1 u2)
+			 (and (eq t1 objchangesys.typeattr)
+			      (eq u2 .sys.id)))
+		     (eq t1 objchange.typeattr))
+		 (eq t1 exempt.typeattr)))
+
+  (constrain (process (dyntransition transition))
+	     (or (or (or (eq u1 u2)
+			 (and (eq t1 subjchange.typeattr)
+			      (eq t2 subjchangetarget.typeattr)))
+		     (and (eq t1 subjchangesys.typeattr) (eq u2 .sys.id)))
+		 (eq t1 exempt.typeattr)))
+
+  (block change
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchange.type (typeattr))
+    (call subjchange.type (typeattr)))
+
+  (block changesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call objchangesys.type (typeattr))
+    (call subjchangesys.type (typeattr)))
+
+  (block exempt
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block objchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchange
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangesys
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr))
+
+  (block subjchangetarget
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)))
+
+(in subj.unconfined
+
+    (call .ibac.exempt.type (typeattr)))
-- 
cgit v1.2.3