default trans rules for Rawhide policy

[people/stevee/selinux-policy.git] / policy / mcs

diff --git a/policy/mcs b/policy/mcs
index bc9693c7f3acf1798e612ccba3576eda31e2cc31..38146ed70ff42403943d57435b0791efb8a385a7 100644 (file)
--- a/policy/mcs
+++ b/policy/mcs
@@ -1,4 +1,6 @@
 ifdef(`enable_mcs',`
+default_range dir_file_class_set target low;
+
 #
 # Define sensitivities 
 #
@@ -69,16 +71,32 @@ gen_levels(1,mcs_num_cats)
 #  - /proc/pid operations are not constrained.
 
 mlsconstrain file { read ioctl lock execute execute_no_trans }
-       (( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
+       (( h1 dom h2 ) or ( t1 == mcsreadall ) or 
+        (( t1 != mcsuntrustedproc ) and (t2 == domain)));
 
 mlsconstrain file { write setattr append unlink link rename }
-       (( h1 dom h2 ) or ( t1 == mcswriteall ) or ( t2 == domain ));
+       (( h1 dom h2 ) or ( t1 == mcswriteall ) or
+        (( t1 != mcsuntrustedproc ) and (t2 == domain)));
 
 mlsconstrain dir { search read ioctl lock }
-       (( h1 dom h2 ) or ( t1 == mcsreadall ) or ( t2 == domain ));
+       (( h1 dom h2 ) or ( t1 == mcsreadall ) or 
+        (( t1 != mcsuntrustedproc ) and (t2 == domain)));
 
 mlsconstrain dir { write setattr append unlink link rename add_name remove_name }
-       (( h1 dom h2 ) or ( t1 == mcswriteall ) or ( t2 == domain ));
+       (( h1 dom h2 ) or ( t1 == mcswriteall ) or
+        (( t1 != mcsuntrustedproc ) and (t2 == domain)));
+
+mlsconstrain fifo_file { open }
+    (( h1 dom h2 ) or ( t1 == mcsreadall ) or
+     (( t1 != mcsuntrustedproc ) and ( t2 == domain )));
+
+mlsconstrain { lnk_file chr_file blk_file sock_file } { getattr read ioctl }
+    (( h1 dom h2 ) or ( t1 == mcsreadall ) or
+     (( t1 != mcsuntrustedproc ) and (t2 == domain)));
+
+mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
+    (( h1 dom h2 ) or ( t1 == mcswriteall ) or
+     (( t1 != mcsuntrustedproc ) and (t2 == domain)));
 
 # New filesystem object labels must be dominated by the relabeling subject
 # clearance, also the objects are single-level.
@@ -86,11 +104,14 @@ mlsconstrain file { create relabelto }
        (( h1 dom h2 ) and ( l2 eq h2 ));
 
 # new file labels must be dominated by the relabeling subject clearance
-mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file file } { relabelfrom }
-       ( h1 dom h2 );
+mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
+       (( h1 dom h2 ) or ( t1 == mcswriteall ));
 
-mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file file } { create relabelto }
-       (( h1 dom h2 ) and ( l2 eq h2 ));
+mlsconstrain { file lnk_file fifo_file } { create relabelto }
+       ( l2 eq h2 );
+
+mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
+       ( h1 dom h2 );
 
 mlsconstrain process { transition dyntransition }
        (( h1 dom h2 ) or ( t1 == mcssetcats ));
@@ -110,7 +131,7 @@ mlsconstrain process { signal }
 
 # Any database object must be dominated by the relabeling subject
 # clearance, also the objects are single-level.
-mlsconstrain { db_database db_table db_procedure db_column db_blob } { create relabelto }
+mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_blob } { create relabelto }
        (( h1 dom h2 ) and ( l2 eq h2 ));
 
 mlsconstrain { db_tuple } { insert relabelto }
@@ -120,6 +141,9 @@ mlsconstrain { db_tuple } { insert relabelto }
 mlsconstrain db_database { drop getattr setattr relabelfrom access install_module load_module get_param set_param }
        ( h1 dom h2 );
 
+mlsconstrain db_language { drop getattr setattr relabelfrom execute }
+       ( h1 dom h2 );
+
 mlsconstrain db_table { drop getattr setattr relabelfrom select update insert delete use lock }
        ( h1 dom h2 );
 
@@ -129,13 +153,36 @@ mlsconstrain db_column { drop getattr setattr relabelfrom select update insert u
 mlsconstrain db_tuple { relabelfrom select update delete use }
        ( h1 dom h2 );
 
-mlsconstrain db_procedure { drop getattr setattr execute install }
+mlsconstrain db_sequence { drop getattr setattr relabelfrom get_value next_value set_value }
+       ( h1 dom h2 );
+
+mlsconstrain db_view { drop getattr setattr relabelfrom expand }
+       ( h1 dom h2 );
+
+mlsconstrain db_procedure { drop getattr setattr relabelfrom execute install }
+       ( h1 dom h2 );
+
+mlsconstrain db_language { drop getattr setattr relabelfrom execute }
        ( h1 dom h2 );
 
 mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
        ( h1 dom h2 );
 
+mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
+       (( h1 dom h2 ) or ( t1 == mcsnetwrite ));
+
+# the node recvfrom/sendto ops, the recvfrom permission is a "write" operation
+# because the subject in this particular case is the remote domain which is
+# writing data out the network node which is acting as the object
+mlsconstrain { node } { recvfrom }
+       ((( l1 dom l2 ) and ( l1 domby h2 )) or
+        ( t1 == mcsnetwrite ) or
+        ( t1 == unlabeled_t ));
+mlsconstrain { node } { sendto }
+       ((( l1 dom l2 ) and ( l1 domby h2 )) or
+        ( t1 == mcsnetwrite ));
+
 mlsconstrain packet { send recv }
-       ( h1 dom h2 );
+       (( h1 dom h2 ) or ( t1 == mcsnetwrite ));
 
 ') dnl end enable_mcs