• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1(type bin_t)
2(type kernel_t)
3(type security_t)
4(type unlabeled_t)
5
6(policycap open_perms)
7(sensitivity s0)
8(sensitivity s1)
9(sensitivityalias s0 sens0)
10(dominance (s0 s1))
11
12(category c0)
13(category c1)
14(category c2)
15(categoryalias c0 cat0)
16(categoryset cats01 (c0 c1))
17(categoryorder (c0 c1 c2))
18(categoryrange catrng02 (c0 c2))
19
20(sensitivitycategory s0 (catrng02))
21(sensitivitycategory s1 cats01)
22(sensitivitycategory s1 (c2))
23
24(level low (s0 (c0)))
25(level high (s1 (c0 c1)))
26(levelrange low_high (low high))
27
28(permissionset file_perms (execute_no_trans entrypoint execmod open
29				audit_access))
30(class file (execute_no_trans entrypoint execmod open audit_access))
31(class process (open))
32(common file (ioctl read write create getattr setattr lock relabelfrom
33		relabelto append unlink link rename execute swapon
34		quotaon mounton))
35(classcommon file file)
36
37(classpermissionset file_rw (file (read write getattr setattr lock append)))
38
39(class char (foo transition))
40(classcommon char file)
41
42(classpermissionset char_w (char (write setattr)))
43
44(classmap files (read))
45(classmapping files read
46	(file (open read getattr))
47	char_w)
48
49(type auditadm_t)
50(type console_t)
51(type console_device_t)
52(type user_tty_device_t)
53(type device_t)
54(type getty_t)
55(type exec_t)
56
57(allow console_t console_device_t file_rw)
58(allow console_t console_device_t (files (read)))
59
60(boolean secure_mode false)
61(boolean console_login true)
62
63
64(sid kernel)
65(sid security)
66(sid unlabeled)
67
68(typeattribute exec_type)
69(typeattribute foo_type)
70(typeattribute bar_type)
71(typeattribute baz_type)
72(typeattributeset exec_type (or bin_t kernel_t))
73(typeattributeset foo_type (and exec_type kernel_t))
74(typeattributeset bar_type (xor exec_type foo_type))
75(typeattributeset baz_type (not bin_t))
76(typealias bin_t sbin_t)
77(typepermissive device_t)
78(typebounds device_t bin_t)
79(typemember device_t bin_t file exec_t)
80(typetransition device_t console_t file console_device_t)
81
82(rangetransition device_t console_t file low_high)
83
84(nametypetransition some_file device_t console_t file getty_t)
85
86(allow foo_type self (file (execute)))
87(allow bin_t device_t (file (execute)))
88
89(booleanif secure_mode
90	(true
91		(auditallow device_t exec_t (file (read write)))
92	)
93)
94
95(booleanif console_login
96	(true
97		(typechange auditadm_t console_device_t file user_tty_device_t)
98		(allow getty_t console_device_t (file (getattr open read write append)))
99	)
100	(false
101		(dontaudit getty_t console_device_t (file (getattr open read write append)))
102	)
103)
104
105(booleanif (not (xor (eq secure_mode console_login)
106			(and (or secure_mode console_login) secure_mode ) ) )
107	(true
108		(allow bin_t exec_t (file (execute)))
109	)
110)
111
112(tunable allow_execfile true)
113(tunable allow_userexec false)
114
115(tunableif (not (xor (eq allow_execfile allow_userexec)
116			(and (or allow_execfile allow_userexec)
117				(and allow_execfile allow_userexec) ) ) )
118	(true
119		(allow bin_t exec_t (file (execute)))
120	)
121)
122
123(optional allow_rules
124	(allow user_t exec_t (bins (execute)))
125)
126
127(dontaudit device_t auditadm_t (file (read)))
128(auditallow device_t auditadm_t (file (open)))
129
130(user system_u)
131(user user_u)
132(userprefix user_u user)
133(userprefix system_u user)
134
135(selinuxuser name user_u low_high)
136(selinuxuserdefault user_u low_high)
137
138(role system_r)
139(role user_r)
140
141(roletype system_r bin_t)
142(roletype system_r kernel_t)
143(roletype system_r security_t)
144(roletype system_r unlabeled_t)
145(roleallow system_r user_r)
146(rolebounds system_r user_r)
147(roletransition system_r bin_t process user_r)
148
149(userrole system_u system_r)
150(userlevel system_u low)
151(userrange system_u low_high)
152(userbounds system_u user_u)
153(userrole user_u user_r)
154(userlevel user_u low)
155(userrange user_u (low low))
156
157(sidcontext kernel (system_u system_r kernel_t (low high)))
158(sidcontext security (system_u system_r security_t (low high)))
159(sidcontext unlabeled (system_u system_r unlabeled_t (low high)))
160
161(context system_u_bin_t_l2h (system_u system_r bin_t (low high)))
162
163(ipaddr ip_v4 192.25.35.200)
164(ipaddr netmask 192.168.1.1)
165(ipaddr ip_v6 2001:0DB8:AC10:FE01::)
166(ipaddr netmask_v6 2001:0DE0:DA88:2222::)
167
168(filecon "/usr/bin/" "foo" file system_u_bin_t_l2h)
169(filecon "/usr/bin/" "bar" file ())
170(filecon "/usr/bin/" "baz" any ())
171(nodecon ip_v4 netmask system_u_bin_t_l2h)
172(nodecon ip_v6 netmask_v6 system_u_bin_t_l2h)
173(portcon udp 25 system_u_bin_t_l2h)
174(portcon tcp 22 system_u_bin_t_l2h)
175(genfscon - "/usr/bin" system_u_bin_t_l2h)
176(netifcon eth0 system_u_bin_t_l2h system_u_bin_t_l2h) ;different contexts?
177(fsuse xattr ext3 system_u_bin_t_l2h)
178
179; XEN
180(pirqcon 256 system_u_bin_t_l2h)
181(iomemcon (0 255) system_u_bin_t_l2h)
182(ioportcon (22 22) system_u_bin_t_l2h)
183(pcidevicecon 345 system_u_bin_t_l2h)
184
185(constrain (files (read)) (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 r2))))
186(constrain char_w (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 r2))))
187
188(constrain (file (read)) (or (and (eq t1 exec_t) (neq t2 bin_t) ) (eq u1 u2) ) )
189(constrain (file (open)) (dom r1 r2))
190(constrain (file (open)) (domby r1 r2))
191(constrain (file (open)) (incomp r1 r2))
192
193(validatetrans file (eq t1 exec_t))
194
195(mlsconstrain (file (open)) (not (or (and (eq l1 l2) (eq u1 u2)) (eq r1 r2))))
196(mlsconstrain (file (open)) (or (and (eq l1 l2) (eq u1 u2)) (neq r1 r2)))
197(mlsconstrain (file (open)) (dom h1 l2))
198(mlsconstrain (file (open)) (domby l1 h2))
199(mlsconstrain (file (open)) (incomp l1 l2))
200
201(mlsvalidatetrans file (domby l1 h2))
202
203(macro all ((type x))
204	(allow x bin_t (file (execute)))
205)
206(call all (bin_t))
207
208(type a_t)
209(type b_t)
210(boolean b1 false)
211(tunable tun1 true)
212(macro m ((boolean b))
213	(tunableif tun1
214		(true
215			(allow a_t b_t (file (write))))
216		(false
217			(allow a_t b_t (file (execute)))))
218	(booleanif b
219		(true
220			(allow a_t b_t (file (read))))))
221
222(call m (b1))
223
224