From 0c187b6ff97f91c41dab65a6426dc61f77305cdf Mon Sep 17 00:00:00 2001 From: Dominick Grift Date: Sun, 20 Aug 2023 15:44:41 +0200 Subject: Import dssp5 Signed-off-by: Dominick Grift --- src/misc/constrain/mcs.cil | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 src/misc/constrain/mcs.cil (limited to 'src/misc/constrain/mcs.cil') diff --git a/src/misc/constrain/mcs.cil b/src/misc/constrain/mcs.cil new file mode 100644 index 0000000..849d525 --- /dev/null +++ b/src/misc/constrain/mcs.cil @@ -0,0 +1,38 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(defaultrange blk_file source low) +(defaultrange chr_file source low) +(defaultrange dir source low) +(defaultrange fifo_file source low) +(defaultrange file source low) +(defaultrange lnk_file source low) +(defaultrange sock_file source low) + +(block mcs + + (mlsconstrain (constrainobject (create relabelto)) + (or (neq t1 constrained.typeattr) + (and (dom h1 h2) (eq l2 h2)))) + + (mlsconstrain (constrainobject (append getattr read setattr write)) + (or (dom h1 h2) + (neq t1 constrained.typeattr))) + + (mlsconstrain + (process (dyntransition getrlimit getsched ptrace setrlimit setsched + sigchld sigkill signal signull sigstop + transition)) + (or (dom h1 h2) + (neq t1 constrained.typeattr))) + + (mlsconstrain (fifo_file (append getattr read write setattr)) + (or (dom h1 h2) + (neq t1 constrained.typeattr))) + + (block constrained + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr))) -- cgit v1.2.3