class infoflow

sid kernel

class infoflow
{
    hi_w
    hi_r
    med_r
    med_w
}

type system;
role system;
role system types system;

#################################################

type src;
type tgt;
type flow_true;
type flow_false;

type src_remain;
type tgt_remain;
type flow_remain;

bool condition false;

allow src_remain flow_remain:infoflow hi_w;
allow tgt_remain flow_remain:infoflow hi_r;

if (condition) {
    allow src flow_true:infoflow hi_w;
    allow tgt flow_true:infoflow hi_r;
    allow tgt flow_true:infoflow hi_r;

    allow src_remain flow_remain:infoflow med_w;
    allow tgt_remain flow_remain:infoflow med_r;
}
else {
    allow src flow_false:infoflow hi_w;
    allow tgt flow_false:infoflow hi_r;
}

#################################################

#users
user system roles system;

#isids
sid kernel system:system:system