nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mcs: combine single-level object creation constraints

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-10-14 10:21:48 -04:00
parent d355d046d2
commit 10bfc890d2
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
policy/mcs
View File

@ -91,7 +91,7 @@ mlsconstrain { lnk_file chr_file blk_file sock_file } { write setattr }
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
mlsconstrain file { create relabelto }
mlsconstrain { file lnk_file fifo_file } { create relabelto }
((( h1 dom h2 ) and ( l2 eq h2 )) or
( t1 != mcs_constrained_type ));
@ -99,9 +99,6 @@ mlsconstrain file { create relabelto }
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { file lnk_file fifo_file } { create relabelto }
(( l2 eq h2 ) or ( t1 != mcs_constrained_type ));
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));