mirror of
https://github.com/SELinuxProject/setools
synced 2025-01-30 19:51:39 +00:00
3532ed2fff
Add updates to seinfo and sesearch to test libqpol updates added via [1]. Also include extra tests for Xen and xperms. Note, xperms cannot yet test the extended perms as needs more work on libqpol. [1] 0001-setools-V4-libqpol-policy-V30-updates-xen-xperm-stat.patch Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
232 lines
4.0 KiB
Plaintext
232 lines
4.0 KiB
Plaintext
class infoflow
|
|
class infoflow2
|
|
class infoflow3
|
|
class infoflow4
|
|
class infoflow5
|
|
class infoflow6
|
|
class infoflow7
|
|
|
|
sid kernel
|
|
sid security
|
|
|
|
common infoflow
|
|
{
|
|
low_w
|
|
med_w
|
|
hi_w
|
|
low_r
|
|
med_r
|
|
hi_r
|
|
}
|
|
|
|
class infoflow
|
|
inherits infoflow
|
|
|
|
class infoflow2
|
|
inherits infoflow
|
|
{
|
|
super_w
|
|
super_r
|
|
}
|
|
|
|
class infoflow3
|
|
{
|
|
null
|
|
}
|
|
|
|
class infoflow4
|
|
inherits infoflow
|
|
|
|
class infoflow5
|
|
inherits infoflow
|
|
|
|
class infoflow6
|
|
inherits infoflow
|
|
|
|
class infoflow7
|
|
inherits infoflow
|
|
{
|
|
super_w
|
|
super_r
|
|
super_none
|
|
super_both
|
|
super_unmapped
|
|
}
|
|
|
|
sensitivity s0;
|
|
sensitivity s1;
|
|
sensitivity s2;
|
|
sensitivity s3;
|
|
sensitivity s4;
|
|
sensitivity s5;
|
|
sensitivity s6;
|
|
|
|
dominance { s0 s1 s2 s3 s4 s5 s6 }
|
|
|
|
category c0;
|
|
category c1;
|
|
category c2;
|
|
category c3;
|
|
category c4;
|
|
|
|
#level decl
|
|
level s0:c0.c4;
|
|
level s1:c0.c4;
|
|
level s2:c0.c4;
|
|
level s3:c0.c4;
|
|
level s4:c0.c4;
|
|
level s5:c0.c4;
|
|
level s6:c0.c4;
|
|
|
|
#some constraints
|
|
mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));
|
|
|
|
attribute mls_exempt;
|
|
|
|
type system;
|
|
role system;
|
|
role system types system;
|
|
|
|
role role20_r;
|
|
role role21a_r;
|
|
role role21b_r;
|
|
role role21c_r;
|
|
|
|
role role20_r types system;
|
|
role role21a_r types system;
|
|
role role21b_r types system;
|
|
role role21c_r types system;
|
|
|
|
type type30;
|
|
type type31a;
|
|
type type31b;
|
|
type type31c;
|
|
role system types { type30 type31a type31b type31c };
|
|
|
|
allow system self:infoflow hi_w;
|
|
|
|
#users
|
|
user system roles { system role20_r role21a_r role21b_r role21c_r } level s0 range s0 - s6:c0.c4;
|
|
user user10 roles system level s0 range s0 - s2:c0.c4;
|
|
user user11a roles system level s0 range s0 - s2:c0.c4;
|
|
user user11b roles system level s0 range s0 - s2:c0.c4;
|
|
user user11c roles system level s0 range s0 - s2:c0.c4;
|
|
|
|
#normal constraints
|
|
constrain infoflow hi_w (u1 == u2);
|
|
|
|
#isids
|
|
sid kernel system:system:system:s0
|
|
sid security system:system:system:s0
|
|
|
|
# test 1:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: unset
|
|
devicetreecon "/dev/tree1" system:system:system:s0:c0.c1
|
|
|
|
# test 10:
|
|
# irq: unset
|
|
# user: user10, exact
|
|
# role: unset
|
|
# type: unset
|
|
# range: unset
|
|
devicetreecon "/dev/tree10" user10:system:system:s0:c0.c1
|
|
|
|
# test 11:
|
|
# irq: unset
|
|
# user: user11(a|b), regex
|
|
# role: unset
|
|
# type: unset
|
|
# range: unset
|
|
devicetreecon "/dev/tree11" user11a:system:system:s0:c0.c1
|
|
devicetreecon "/dev/tree11000" user11b:system:system:s0:c0.c1
|
|
devicetreecon "/dev/tree11001" user11c:system:system:s0:c0.c1
|
|
|
|
# test 20:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: role20_r, exact
|
|
# type: unset
|
|
# range: unset
|
|
devicetreecon "/dev/tree20" system:role20_r:system:s0:c0.c1
|
|
|
|
# test 21:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: role20(a|c)_r, regex
|
|
# type: unset
|
|
# range: unset
|
|
devicetreecon "/dev/tree21" system:role21a_r:system:s0:c0.c1
|
|
devicetreecon "/dev/tree21000" system:role21b_r:system:s0:c0.c1
|
|
devicetreecon "/dev/tree21001" system:role21c_r:system:s0:c0.c1
|
|
|
|
# test 30:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: type30
|
|
# range: unset
|
|
devicetreecon "/dev/tree30" system:system:type30:s0:c0.c1
|
|
|
|
# test 31:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: type31(b|c)
|
|
# range: unset
|
|
devicetreecon "/dev/tree31" system:system:type31a:s0:c0.c1
|
|
devicetreecon "/dev/tree31000" system:system:type31b:s0:c0.c1
|
|
devicetreecon "/dev/tree31001" system:system:type31c:s0:c0.c1
|
|
|
|
# test 40:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: equal
|
|
devicetreecon "/dev/tree40" system:system:system:s0:c1 - s0:c0.c4
|
|
|
|
# test 41:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: overlap
|
|
devicetreecon "/dev/tree41" system:system:system:s1:c1 - s1:c1.c3
|
|
|
|
# test 42:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: subset
|
|
devicetreecon "/dev/tree42" system:system:system:s2:c1 - s2:c1.c3
|
|
|
|
# test 43:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: superset
|
|
devicetreecon "/dev/tree43" system:system:system:s3:c1 - s3:c1.c3
|
|
|
|
# test 44:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: proper subset
|
|
devicetreecon "/dev/tree44" system:system:system:s4:c1 - s4:c1.c3
|
|
|
|
# test 45:
|
|
# irq: unset
|
|
# user: unset
|
|
# role: unset
|
|
# type: unset
|
|
# range: proper superset
|
|
devicetreecon "/dev/tree45" system:system:system:s5:c1 - s5:c1.c3
|
|
|