5 # MCS is single-sensitivity.
10 # Define the categories
12 # Generate declarations
14 gen_cats(mcs_num_cats)
17 # Each MCS level specifies a sensitivity and zero or more categories which may
18 # be associated with that sensitivity.
21 gen_levels(1,mcs_num_cats)
24 # Define the MCS policy
26 # mlsconstrain class_set perm_set expression ;
28 # mlsvalidatetrans class_set expression ;
30 # expression : ( expression )
32 # | expression and expression
33 # | expression or expression
49 # | u3 op names (NOTE: this is only available for mlsvalidatetrans)
50 # | r3 op names (NOTE: this is only available for mlsvalidatetrans)
51 # | t3 op names (NOTE: this is only available for mlsvalidatetrans)
54 # role_mls_op : == | != | eq | dom | domby | incomp
56 # names : name | { name_list }
57 # name_list : name | name_list name
61 # MCS policy for the file classes
63 # Constrain file access so that the high range of the process dominates
64 # the high range of the file. We use the high range of the process so
65 # that processes can always simply run at s0.
68 # - getattr on dirs/files is not constrained.
69 # - /proc/pid operations are not constrained.
71 mlsconstrain file { read ioctl lock execute execute_no_trans }
72 (( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
74 mlsconstrain file { write setattr append unlink link rename }
75 (( h1 dom h2 ) or ( t1 == mcswriteall ) or ( t2 == domain ));
77 mlsconstrain dir { search read ioctl lock }
78 (( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
80 mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
81 (( h1 dom h2 ) or ( t1 == mcswriteall ) or ( t2 == domain ));
83 # New filesystem object labels must be dominated by the relabeling subject
84 # clearance, also the objects are single-level.
85 mlsconstrain file { create relabelto }
86 (( h1 dom h2 ) and ( l2 eq h2 ));
88 # new file labels must be dominated by the relabeling subject clearance
89 mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file file } { relabelfrom }
92 mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file file } { create relabelto }
93 (( h1 dom h2 ) and ( l2 eq h2 ));
95 mlsconstrain process { transition dyntransition }
96 (( h1 dom h2 ) or ( t1 == mcssetcats ));
98 mlsconstrain process { ptrace }
99 (( h1 dom h2) or ( t1 == mcsptraceall ));
101 mlsconstrain process { sigkill sigstop }
102 (( h1 dom h2 ) or ( t1 == mcskillall ));
105 # MCS policy for SELinux-enabled databases
108 # Any database object must be dominated by the relabeling subject
109 # clearance, also the objects are single-level.
110 mlsconstrain { db_database db_table db_procedure db_column db_blob } { create relabelto }
111 (( h1 dom h2 ) and ( l2 eq h2 ));
113 mlsconstrain { db_tuple } { insert relabelto }
114 (( h1 dom h2 ) and ( l2 eq h2 ));
116 # Access control for any database objects based on MCS rules.
117 mlsconstrain db_database { drop getattr setattr relabelfrom access install_module load_module get_param set_param }
120 mlsconstrain db_table { drop getattr setattr relabelfrom select update insert delete use lock }
123 mlsconstrain db_column { drop getattr setattr relabelfrom select update insert use }
126 mlsconstrain db_tuple { relabelfrom select update delete use }
129 mlsconstrain db_procedure { drop getattr setattr execute install }
132 mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
135 ') dnl end enable_mcs