selinux-refpolicy/policy/modules/kernel/mcs.te

policy_module(mcs, 1.3.0)

########################################
#
# Declarations
#

attribute mcskillall;
attribute mcsptraceall;
attribute mcssetcats;
attribute mcswriteall;
attribute mcsreadall;
attribute mcs_constrained_type;
Bump module versions for release. 2013-04-24 20:14:52 +00:00			`policy_module(mcs, 1.3.0)`
patch from dan Tue, 14 Feb 2006 09:01:16 -0500 2006-02-16 19:32:13 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`attribute mcskillall;`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`attribute mcsptraceall;`
Constrain transitions in MCS so unconfined_t cannot have arbitrary category sets. 2006-03-29 16:23:17 +00:00			`attribute mcssetcats;`
revise MCS constraints to use only MCS-specific attributes. 2009-10-07 15:48:14 +00:00			`attribute mcswriteall;`
			`attribute mcsreadall;`
Implement mcs_constrained_type This process is not allowed to interact with subjects or operate on objects that it would otherwise be able to interact with or operate on respectively. This is, i think, to make sure that specified processes cannot interact with subject or operate on objects regardless of its mcs range. It is used by svirt and probably also by sandbox Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2012-11-27 16:59:19 +00:00			`attribute mcs_constrained_type;`