selinux/libsepol/cil/test/policy.conf

144 lines
4.0 KiB
Plaintext

class file
class process
class char
sid kernel
sid security
sid unlabeled
common file {ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton }
class file inherits file { execute_no_trans entrypoint execmod open audit_access }
class char inherits file { foo transition }
class process { open }
sensitivity s0 alias sens0;
sensitivity s1;
dominance { s0 s1 }
category c0 alias cat0;
category c1;
category c2;
level s0:c0.c2;
level s1:c0.c2;
mlsconstrain file { open } (not (((l1 eq l2) and (u1 eq u2)) or (r1 eq r2)));
mlsconstrain file { open } (((l1 eq l2) and (u1 eq u2)) or (r1 != r2));
mlsconstrain file { open } (l1 dom h2);
mlsconstrain file { open } (h1 domby l2);
mlsconstrain file { open } (l1 incomp l2);
mlsvalidatetrans file (h1 domby l2);
attribute foo_type;
attribute bar_type;
attribute baz_type;
attribute exec_type;
type bin_t, bar_type, exec_type;
type kernel_t, foo_type, exec_type, baz_type;
type security_t, baz_type;
type unlabeled_t, baz_type;
type exec_t, baz_type;
type console_t, baz_type;
type auditadm_t, baz_type;
type console_device_t, baz_type;
type user_tty_device_t, baz_type;
type device_t, baz_type;
type getty_t, baz_type;
type a_t, baz_type;
type b_t, baz_type;
typealias bin_t alias sbin_t;
bool secure_mode false;
bool console_login true;
bool b1 false;
role system_r;
role user_r;
role system_r types bin_t;
role system_r types kernel_t;
role system_r types security_t;
role system_r types unlabeled_t;
policycap open_perms;
permissive device_t;
range_transition device_t console_t : file s0:c0 - s1:c0.c1;
type_transition device_t console_t : file console_device_t;
type_member device_t bin_t : file exec_t;
if console_login{
type_change auditadm_t console_device_t : file user_tty_device_t;
}
role_transition system_r bin_t user_r;
auditallow device_t auditadm_t: file { open };
dontaudit device_t auditadm_t: file { read };
allow system_r user_r;
allow console_t console_device_t: char { write setattr };
allow console_t console_device_t: file { open read getattr };
allow foo_type self: file { execute };
allow bin_t device_t: file { execute };
allow bin_t exec_t: file { execute };
allow bin_t bin_t: file { execute };
allow a_t b_t : file { write };
allow console_t console_device_t: file { read write getattr setattr lock append };
allow kernel_t kernel_t : file { execute };
if b1 {
allow a_t b_t : file { read };
}
if secure_mode{
auditallow device_t exec_t: file { read write };
}
if console_login{
allow getty_t console_device_t: file { getattr open read write append };
}
else {
dontaudit getty_t console_device_t: file { getattr open read write append };
}
if (not ((secure_mode eq console_login) xor ((secure_mode or console_login) and secure_mode))){
allow bin_t exec_t: file { execute };
}
user system_u roles system_r level s0:c0 range s0:c0 - s1:c0,c1;
user user_u roles user_r level s0:c0 range s0:c0 - s0:c0;
validatetrans file (t1 == exec_t);
constrain char transition (not (((t1 eq exec_t) and (t2 eq bin_t)) or (r1 eq r2)));
constrain file { open } (r1 dom r2);
constrain file { open } (r1 domby r2);
constrain file { open } (r1 incomp r2);
constrain file { open read getattr } (not (((t1 eq exec_t) and (t2 eq bin_t)) or (r1 eq r2)));
constrain char { write setattr } (not (((t1 eq exec_t) and (t2 eq bin_t)) or (r1 eq r2)));
sid kernel system_u:system_r:kernel_t:s0:c0 - s1:c0,c1
sid security system_u:system_r:security_t:s0:c0 - s1:c0,c1
sid unlabeled system_u:system_r:unlabeled_t:s0:c0 - s1:c0,c1
fs_use_xattr ext3 system_u:system_r:bin_t:s0:c0 - s1:c0,c1;
genfscon proc /usr/bin system_u:system_r:bin_t:s0:c0 - s1:c0,c1
portcon tcp 22 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
portcon udp 25 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
netifcon eth0 system_u:system_r:bin_t:s0:c0 - s1:c0,c1 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
nodecon 192.25.35.200 192.168.1.1 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
nodecon 2001:db8:ac10:fe01:: 2001:de0:da88:2222:: system_u:system_r:bin_t:s0:c0 - s1:c0,c1