mirror of
https://github.com/SELinuxProject/setools
synced 2025-03-01 02:21:51 +00:00
6f4860dd7a
Create a test case for testing user's default level not in the range, #72 even though it is not yet fixed.
251 lines
5.1 KiB
Plaintext
251 lines
5.1 KiB
Plaintext
class infoflow
|
|
class infoflow2
|
|
class infoflow3
|
|
class infoflow4
|
|
class infoflow5
|
|
class infoflow6
|
|
class infoflow7
|
|
class removed_class
|
|
class modified_add_perm
|
|
class modified_remove_perm
|
|
class modified_change_common
|
|
|
|
sid kernel
|
|
sid security
|
|
sid matched_sid
|
|
sid removed_sid
|
|
sid modified_sid
|
|
|
|
common infoflow
|
|
{
|
|
low_w
|
|
med_w
|
|
hi_w
|
|
low_r
|
|
med_r
|
|
hi_r
|
|
}
|
|
|
|
common removed_common
|
|
{
|
|
old_com
|
|
}
|
|
|
|
common modified_remove_perm
|
|
{
|
|
same_perm
|
|
removed_perm
|
|
}
|
|
|
|
common modified_add_perm
|
|
{
|
|
matched_perm
|
|
}
|
|
|
|
class infoflow
|
|
inherits infoflow
|
|
|
|
class infoflow2
|
|
inherits infoflow
|
|
{
|
|
super_w
|
|
super_r
|
|
}
|
|
|
|
class infoflow3
|
|
{
|
|
null
|
|
}
|
|
|
|
class infoflow4
|
|
inherits infoflow
|
|
|
|
class infoflow5
|
|
inherits infoflow
|
|
|
|
class infoflow6
|
|
inherits infoflow
|
|
|
|
class infoflow7
|
|
inherits infoflow
|
|
{
|
|
super_w
|
|
super_r
|
|
super_none
|
|
super_both
|
|
super_unmapped
|
|
}
|
|
|
|
class removed_class
|
|
{
|
|
null_perm
|
|
}
|
|
|
|
class modified_add_perm
|
|
{
|
|
same_perm
|
|
}
|
|
|
|
class modified_remove_perm
|
|
{
|
|
same_perm
|
|
removed_perm
|
|
}
|
|
|
|
class modified_change_common
|
|
inherits removed_common
|
|
|
|
sensitivity s0 alias { al1 al2 };
|
|
sensitivity s1 alias { al3 };
|
|
sensitivity s2;
|
|
sensitivity s3;
|
|
sensitivity s40;
|
|
sensitivity s41;
|
|
sensitivity s42;
|
|
sensitivity s43;
|
|
sensitivity s44;
|
|
sensitivity s45;
|
|
sensitivity s47;
|
|
|
|
dominance { s0 s1 s2 s3 s40 s41 s42 s43 s44 s45 s47 }
|
|
|
|
category c0 alias { spam eggs };
|
|
category c1 alias { bar };
|
|
category c2;
|
|
category c3;
|
|
category c4;
|
|
category c5;
|
|
|
|
#level decl
|
|
level s0:c0.c4;
|
|
level s1:c0.c4;
|
|
level s2:c0.c4;
|
|
level s3:c0.c4;
|
|
level s40:c1;
|
|
level s41:c0.c4;
|
|
level s42:c0.c4;
|
|
level s43:c0.c4;
|
|
level s44:c0.c4;
|
|
level s45:c0.c4;
|
|
level s47:c0.c4;
|
|
|
|
#some constraints
|
|
mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));
|
|
|
|
attribute mls_exempt;
|
|
attribute an_attr;
|
|
attribute removed_attr;
|
|
|
|
type system;
|
|
role system;
|
|
role system types system;
|
|
|
|
################################################################################
|
|
# Type enforcement declarations and rules
|
|
|
|
type removed_type;
|
|
|
|
type modified_remove_attr, an_attr;
|
|
|
|
type modified_remove_alias alias an_alias;
|
|
|
|
type modified_remove_permissive;
|
|
permissive modified_remove_permissive;
|
|
|
|
type modified_add_attr;
|
|
|
|
type modified_add_alias;
|
|
|
|
type modified_add_permissive;
|
|
|
|
role removed_role;
|
|
|
|
role modified_add_type;
|
|
|
|
role modified_remove_type;
|
|
role modified_remove_type types { system };
|
|
|
|
# booleans
|
|
bool same_bool true;
|
|
bool removed_bool true;
|
|
bool modified_bool false;
|
|
|
|
|
|
################################################################################
|
|
|
|
# policycaps
|
|
policycap open_perms;
|
|
policycap network_peer_controls;
|
|
|
|
#users
|
|
user system roles system level s0 range s0;
|
|
|
|
user removed_user roles system level s0 range s0;
|
|
|
|
user modified_add_role roles system level s2 range s2;
|
|
user modified_remove_role roles { system removed_role } level s2 range s2;
|
|
user modified_change_level roles system level s2:c0 range s2:c0 - s2:c0,c1;
|
|
|
|
# this is an invalid user: default level is not within the range.
|
|
user modified_change_range roles system level s3:c1 range s3:c1.c3;
|
|
|
|
#normal constraints
|
|
constrain infoflow hi_w (u1 == u2);
|
|
|
|
#isids
|
|
sid kernel system:system:system:s0
|
|
sid security system:system:system:s0
|
|
sid matched_sid system:system:system:s0
|
|
sid removed_sid removed_user:system:system:s0
|
|
sid modified_sid system:system:system:s0
|
|
|
|
#fs_use
|
|
fs_use_trans devpts system:object_r:system:s0;
|
|
fs_use_xattr ext3 system:object_r:system:s0;
|
|
fs_use_task pipefs system:object_r:system:s0;
|
|
fs_use_task removed_fsuse system:object_r:system:s0;
|
|
fs_use_trans modified_fsuse removed_user:object_r:system:s0;
|
|
|
|
#genfscon
|
|
genfscon proc / system:object_r:system:s0
|
|
genfscon proc /sys system:object_r:system:s0
|
|
genfscon selinuxfs / system:object_r:system:s0
|
|
genfscon removed_genfs / system:object_r:system:s0
|
|
genfscon change_path /old system:object_r:system:s0
|
|
genfscon modified_genfs / -s removed_user:object_r:system:s0
|
|
|
|
# matched portcons
|
|
portcon tcp 80 system:object_r:system:s0
|
|
portcon udp 80 system:object_r:system:s0
|
|
portcon udp 30-40 system:object_r:system:s0
|
|
|
|
# removed portcons
|
|
portcon udp 1024 system:object_r:system:s0
|
|
portcon tcp 1024-1026 system:object_r:system:s0
|
|
|
|
# modified portcons
|
|
portcon udp 3024 removed_user:object_r:system:s0
|
|
portcon tcp 3024-3026 removed_user:object_r:system:s0
|
|
|
|
netifcon eth0 system:object_r:system:s0 system:object_r:system:s0
|
|
netifcon removed_netif system:object_r:system:s0 system:object_r:system:s0
|
|
netifcon mod_ctx_netif removed_user:object_r:system:s0 system:object_r:system:s0
|
|
netifcon mod_pkt_netif system:object_r:system:s0 removed_user:object_r:system:s0
|
|
netifcon mod_both_netif removed_user:object_r:system:s0 removed_user:object_r:system:s0
|
|
|
|
# matched nodecons
|
|
nodecon 127.0.0.1 255.255.255.255 system:object_r:system:s0
|
|
nodecon ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:s0
|
|
|
|
# removed nodecons
|
|
nodecon 127.0.0.2 255.255.255.255 removed_user:object_r:system:s0
|
|
nodecon ::2 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff removed_user:object_r:system:s0
|
|
|
|
# modified nodecons
|
|
nodecon 127.0.0.3 255.255.255.255 modified_change_level:object_r:system:s2:c1
|
|
nodecon ::3 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff modified_change_level:object_r:system:s2:c0,c1
|
|
|
|
# change netmask (add/remove)
|
|
nodecon 127.0.0.5 255.255.255.255 system:object_r:system:s0
|
|
nodecon ::5 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:s0
|