RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/kernel/mls.te

75 lines
1.5 KiB
Plaintext
Raw Normal View History

Bump module versions for release.
2016-10-23 20:58:59 +00:00
policy_module(mls, 1.9.0)
add mls privileges
2005-09-26 20:26:32 +00:00
########################################
#
# Declarations
#
attribute mlsfileread;
attribute mlsfilereadtoclr;
attribute mlsfilewrite;
attribute mlsfilewritetoclr;
Christopher J. PeBenito wrote: > We could add another 'or' on the above constraint: > > or ( (t2 == mlsfilewrite_in_range) and (l1 dom l2) and (h1 domby h2) ) > > I believe that would be the constraint you were looking for. I don't > like the name of that attribute, but I couldn't come up with a better > one off the top of my head. :) > Attached is a patch which I've tested against selinux-policy-2.4.2-1 that implements this additional constraint. The name is still a bit forced, but it works. -matt <mra at hp dot com>
2006-11-01 15:42:22 +00:00
attribute mlsfilewriteinrange;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute mlsfileupgrade;
attribute mlsfiledowngrade;
Add new MLS attribute to allow relabeling objects higher than system low. This exception is needed for package managers when processing sensitive data. Example of denial: type=AVC msg=audit(1461664028.583:784): avc: denied { relabelto } for pid=14322 comm="yum" name="libvirt" dev="dm-0" ino=670147 scontext=root:system_r:rpm_t:s0 tcontext=system_u:object_r:virt_cache_t:s0-s15:c0.c1023 tclass=dir
2016-07-27 15:35:03 +00:00
attribute mlsfilerelabeltoclr;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute mlsnetread;
attribute mlsnetreadtoclr;
attribute mlsnetwrite;
attribute mlsnetwritetoclr;
Update MLS constraints from LSPP evaluated policy.
2007-08-24 14:14:29 +00:00
attribute mlsnetwriteranged;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute mlsnetupgrade;
attribute mlsnetdowngrade;
attribute mlsnetrecvall;
trunk: add MLS constrains for ingress/egress permissions from Paul Moore. Add MLS constraints for several network related access controls including the new ingress/egress controls and the older Secmark controls. Based on the following post to the SELinux Reference Policy mailing list: * http://oss.tresys.com/pipermail/refpolicy/2009-February/000579.html
2009-03-02 15:16:49 +00:00
attribute mlsnetinbound;
attribute mlsnetoutbound;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute mlsipcread;
attribute mlsipcreadtoclr;
attribute mlsipcwrite;
attribute mlsipcwritetoclr;
mls mcs: Add constraints for key class Taken from fedoras policy https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs
2017-11-02 17:30:45 +00:00
attribute mlskeywrite;
attribute mlskeywritetoclr;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute mlsprocread;
attribute mlsprocreadtoclr;
attribute mlsprocwrite;
attribute mlsprocwritetoclr;
attribute mlsprocsetsl;
attribute mlsxwinread;
attribute mlsxwinreadtoclr;
attribute mlsxwinwrite;
attribute mlsxwinwritetoclr;
part of dan's mega patch
2006-01-06 22:51:40 +00:00
attribute mlsxwinreadproperty;
attribute mlsxwinwriteproperty;
trunk: MLS constraints for the x_selection class, from Eamon Walsh.
2009-06-05 13:36:19 +00:00
attribute mlsxwinreadselection;
attribute mlsxwinwriteselection;
part of dan's mega patch
2006-01-06 22:51:40 +00:00
attribute mlsxwinreadcolormap;
attribute mlsxwinwritecolormap;
attribute mlsxwinwritexinput;
add mls privileges
2005-09-26 20:26:32 +00:00
trunk: Database userspace object manager classes from KaiGai Kohei.
2007-08-09 13:15:07 +00:00
attribute mlsdbread;
attribute mlsdbreadtoclr;
attribute mlsdbwrite;
attribute mlsdbwritetoclr;
attribute mlsdbwriteinrange;
attribute mlsdbupgrade;
attribute mlsdbdowngrade;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute mlstrustedobject;
Adds attribute mlstrustedsocket, along with the interface. Sample AVC: type=AVC msg=audit(1459979143.990:219): avc: denied { sendto } for pid=1935 comm="charon" path="/dev/log" scontext=system_u:system_r:initrc_t:s0-s3:c0.c31 tcontext=system_u:system_r:syslogd_t:s3:c0.c31 tclass=unix_dgram_socket permissive=0 This was discussed in 2010: http://oss.tresys.com/pipermail/refpolicy/2010-November/003444.html
2016-04-06 21:53:20 +00:00
attribute mlstrustedsocket;
add mls privileges
2005-09-26 20:26:32 +00:00
attribute privrangetrans;
attribute mlsrangetrans;
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15
2005-10-13 20:59:36 +00:00
remove trailing whitespaces
2016-12-06 12:28:10 +00:00
attribute mlsfduse;
add mls fd constraints
2006-09-15 19:05:03 +00:00
attribute mlsfdshare;
enhanced setransd support from darrel goeddel
2006-10-20 14:44:23 +00:00
attribute mlstranslate;
trunk: add mls constraints to dbus.
2008-01-03 20:37:25 +00:00
attribute mlsdbusrecv;
attribute mlsdbussend;