diff --git a/policy/modules/kernel/mcs.if b/policy/modules/kernel/mcs.if index 508e609da..b08a6e849 100644 --- a/policy/modules/kernel/mcs.if +++ b/policy/modules/kernel/mcs.if @@ -3,6 +3,34 @@ ## Contains attributes used in MCS policy. ## +######################################## +## +## Constrain by category access control (MCS). +## +## +##

+## Constrain the specified type by category based +## access control (MCS) This prevents this domain from +## interacting with subjects and operating on objects +## that it otherwise would be able to interact +## with or operate on respectively. +##

+##
+## +## +## Type to be constrained by MCS. +## +## +## +# +interface(`mcs_constrained',` + gen_require(` + attribute mcs_constrained_type; + ') + + typeattribute $1 mcs_constrained_type; +') + ######################################## ## ## This domain is allowed to read files and directories @@ -102,31 +130,3 @@ interface(`mcs_process_set_categories',` typeattribute $1 mcssetcats; ') - -######################################## -## -## Constrain by category access control (MCS). -## -## -##

-## Constrain the specified type by category based -## access control (MCS) This prevents this domain from -## interacting with subjects and operating on objects -## that it otherwise would be able to interact -## with or operate on respectively. -##

-##
-## -## -## Type to be constrained by MCS. -## -## -## -# -interface(`mcs_constrained',` - gen_require(` - attribute mcs_constrained_type; - ') - - typeattribute $1 mcs_constrained_type; -')