From 0c187b6ff97f91c41dab65a6426dc61f77305cdf Mon Sep 17 00:00:00 2001 From: Dominick Grift Date: Sun, 20 Aug 2023 15:44:41 +0200 Subject: Import dssp5 Signed-off-by: Dominick Grift --- src/selinux/booleanfile.cil | 93 ++++++++++++++++++++++ .../booleanfile/invalidassociationsbooleanfile.cil | 35 ++++++++ .../booleanfile/invalidpacketsbooleanfile.cil | 34 ++++++++ .../booleanfile/invalidpeersbooleanfile.cil | 34 ++++++++ 4 files changed, 196 insertions(+) create mode 100644 src/selinux/booleanfile.cil create mode 100644 src/selinux/booleanfile/invalidassociationsbooleanfile.cil create mode 100644 src/selinux/booleanfile/invalidpacketsbooleanfile.cil create mode 100644 src/selinux/booleanfile/invalidpeersbooleanfile.cil (limited to 'src/selinux') diff --git a/src/selinux/booleanfile.cil b/src/selinux/booleanfile.cil new file mode 100644 index 0000000..9cde7eb --- /dev/null +++ b/src/selinux/booleanfile.cil @@ -0,0 +1,93 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(block booleanfile + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (blockinherit .file.all_macro_template_files) + + (call .obj.type (typeattr)) + + (block base_template + + (blockabstract base_template) + + (context booleanfile_context (.sys.id .sys.role booleanfile lowlevelrange)) + + (type booleanfile) + (call .booleanfile.type (booleanfile))) + + (block macro_template_files + + (blockabstract macro_template_files) + + (macro append_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile append_file)) + + (macro appendinherited_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile appendinherited_file)) + + (macro create_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile create_file)) + + (macro delete_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile delete_file)) + + (macro execute_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile execute_file)) + + (macro manage_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile manage_file)) + + (macro mapexecute_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile mapexecute_file)) + + (macro mounton_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile mounton_file)) + + (macro read_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile read_file)) + + (macro readinherited_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile readinherited_file)) + + (macro readwrite_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile readwrite_file)) + + (macro readwriteinherited_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile readwriteinherited_file)) + + (macro rename_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile rename_file)) + + (macro write_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile write_file)) + + (macro writeinherited_booleanfile_files ((type ARG1)) + (allow ARG1 booleanfile writeinherited_file))) + + (block template + + (blockabstract template) + + (blockinherit .booleanfile.base_template) + (blockinherit .booleanfile.macro_template_files)) + + (block unconfined + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (allow typeattr booleanfile.typeattr + (file (not (audit_access entrypoint execmod relabelfrom + relabelto)))))) + +(in selinux.unconfined + + (call .booleanfile.unconfined.type (typeattr))) diff --git a/src/selinux/booleanfile/invalidassociationsbooleanfile.cil b/src/selinux/booleanfile/invalidassociationsbooleanfile.cil new file mode 100644 index 0000000..1eaf3c0 --- /dev/null +++ b/src/selinux/booleanfile/invalidassociationsbooleanfile.cil @@ -0,0 +1,35 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(tunable invalid_associations true) + +(block invalid_associations + + (genfscon "selinuxfs" "/booleans/invalid_associations" booleanfile_context) + + (blockinherit .booleanfile.template)) + +(block invalidassociations + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (block except + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (typeattributeset typeattr + (and invalidassociations.typeattr + (not (exception.typeattr))))) + + (block exception + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr))) diff --git a/src/selinux/booleanfile/invalidpacketsbooleanfile.cil b/src/selinux/booleanfile/invalidpacketsbooleanfile.cil new file mode 100644 index 0000000..9b638a0 --- /dev/null +++ b/src/selinux/booleanfile/invalidpacketsbooleanfile.cil @@ -0,0 +1,34 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(tunable invalid_packets true) + +(block invalid_packets + + (genfscon "selinuxfs" "/booleans/invalid_packets" booleanfile_context) + + (blockinherit .booleanfile.template)) + +(block invalidpackets + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (block except + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (typeattributeset typeattr + (and invalidpackets.typeattr (not (exception.typeattr))))) + + (block exception + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr))) diff --git a/src/selinux/booleanfile/invalidpeersbooleanfile.cil b/src/selinux/booleanfile/invalidpeersbooleanfile.cil new file mode 100644 index 0000000..3a0b6cd --- /dev/null +++ b/src/selinux/booleanfile/invalidpeersbooleanfile.cil @@ -0,0 +1,34 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift +;; SPDX-License-Identifier: Unlicense + +(tunable invalid_peers true) + +(block invalid_peers + + (genfscon "selinuxfs" "/booleans/invalid_peers" booleanfile_context) + + (blockinherit .booleanfile.template)) + +(block invalidpeers + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (block except + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (typeattributeset typeattr + (and invalidpeers.typeattr (not (exception.typeattr))))) + + (block exception + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr))) -- cgit v1.2.3