setools/tests/constraintquery.conf

class test1
class test10
class test11a
class test11b
class test11c
class test12a
class test12b
class test12c
class test20a
class test20b
class test20c
class test21a
class test21b
class test21c

sid kernel
sid security

common test
{
	low_w
	med_w
	hi_w
	low_r
	med_r
	hi_r
}


class test1
inherits test

class test10
inherits test

class test11a
inherits test

class test11b
inherits test

class test11c
inherits test

class test12a
inherits test

class test12b
inherits test

class test12c
inherits test

class test20a
{
    test20ap
    test20bp
}

class test20b
{
    test20ap
    test20bp
}

class test20c
{
    test20ap
    test20bp
}

class test21a
{
    test21ap
    test21bp
}

class test21b
{
    test21ap
    test21bp
}

class test21c
{
    test21ap
    test21bp
}


sensitivity low_s;
sensitivity medium_s alias med;
sensitivity high_s;

dominance { low_s med high_s }

category here;
category there;
category elsewhere alias lost;

level low_s:here.there;
level med:here, elsewhere;
level high_s:here.lost;

# test 1:
# ruletype: mlsconstrain
# tclass: unset
# perms: unset
mlsconstrain test1 hi_r ((l1 dom l2) or (t1 == mls_exempt));

attribute mls_exempt;

type system;
role system;
role system types system;

user system roles system level med range low_s - high_s:here.lost;

# test 10:
# ruletype: unset
# tclass: test10
# perms: unset
constrain test10 hi_w (u1 == u2);

# test 11:
# ruletype: unset
# tclass: test11a, test11b
# perms: unset
constrain test11a hi_w (u1 == u2);
constrain test11b hi_w (u1 == u2);
constrain test11c hi_w (u1 == u2);

# test 12:
# ruletype: unset
# tclass: intoflow12(a|c), regex
# perms: unset
constrain test12a hi_w (u1 == u2);
constrain test12b hi_w (u1 == u2);
constrain test12c hi_w (u1 == u2);

# test 20:
# ruletype: unset
# tclass: unset
# perms: test20ap, test20bp
constrain test20a test20ap (u1 == u2);
constrain test20b test20bp (u1 == u2);

# test 21:
# ruletype: unset
# tclass: unset
# perms: test21ap, test21bp, equal
constrain test21a test21ap (u1 == u2);
constrain test21b test21bp (u1 == u2);
constrain test21c { test21bp test21ap } (u1 == u2);

#isids
sid kernel system:system:system:medium_s:here
sid security system:system:system:high_s:lost

#fs_use
fs_use_trans devpts system:object_r:system:low_s;
fs_use_xattr ext3 system:object_r:system:low_s;
fs_use_task pipefs system:object_r:system:low_s;

#genfscon
genfscon proc / system:object_r:system:med
genfscon proc /sys system:object_r:system:low_s
genfscon selinuxfs / system:object_r:system:high_s:here.there

portcon tcp 80 system:object_r:system:low_s

netifcon eth0 system:object_r:system:low_s system:object_r:system:low_s

nodecon 127.0.0.1 255.255.255.255 system:object_r:system:low_s:here
nodecon ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:low_s:here