1################################################# 2# MLS policy constraints 3# 4 5# 6# Process constraints 7# 8 9# Process transition: Require equivalence unless the subject is trusted. 10mlsconstrain process { transition dyntransition } 11 ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 12 13# Process read operations: No read up unless trusted. 14mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share } 15 (l1 dom l2 or t1 == mlstrustedsubject); 16 17# Process write operations: Require equivalence unless trusted. 18mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share } 19 (l1 eq l2 or t1 == mlstrustedsubject); 20 21# 22# Socket constraints 23# 24 25# Create/relabel operations: Subject must be equivalent to object unless 26# the subject is trusted. Sockets inherit the range of their creator. 27mlsconstrain socket_class_set { create relabelfrom relabelto } 28 ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 29 30# Datagram send: Sender must be equivalent to the receiver unless one of them 31# is trusted. 32mlsconstrain unix_dgram_socket { sendto } 33 (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 34 35# Stream connect: Client must be equivalent to server unless one of them 36# is trusted. 37mlsconstrain unix_stream_socket { connectto } 38 (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 39 40# 41# Directory/file constraints 42# 43 44# Create/relabel operations: Subject must be equivalent to object unless 45# the subject is trusted. Also, files should always be single-level. 46# Do NOT exempt mlstrustedobject types from this constraint. 47mlsconstrain dir_file_class_set { create relabelfrom relabelto } 48 (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject)); 49 50# 51# Constraints for app data files only. 52# 53 54# Only constrain open, not read/write. 55# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc. 56# Subject must dominate object unless the subject is trusted. 57mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir } 58 (t2 != app_data_file or l1 dom l2 or t1 == mlstrustedsubject); 59mlsconstrain { file lnk_file sock_file } { open setattr unlink link rename } 60 (t2 != app_data_file or l1 dom l2 or t1 == mlstrustedsubject); 61 62# 63# Constraints for file types other than app data files. 64# 65 66# Read operations: Subject must dominate object unless the subject 67# or the object is trusted. 68mlsconstrain dir { read getattr search } 69 (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 70 71mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute } 72 (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 73 74# Write operations: Subject must be equivalent to the object unless the 75# subject or the object is trusted. 76mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir } 77 (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 78 79mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename } 80 (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 81 82# Special case for FIFOs. 83# These can be unnamed pipes, in which case they will be labeled with the 84# creating process' label. Thus we also have an exemption when the "object" 85# is a domain type, so that processes can communicate via unnamed pipes 86# passed by binder or local socket IPC. 87mlsconstrain fifo_file { read getattr } 88 (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain); 89 90mlsconstrain fifo_file { write setattr append unlink link rename } 91 (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain); 92 93# 94# Binder IPC constraints 95# 96# Presently commented out, as apps are expected to call one another. 97# This would only make sense if apps were assigned categories 98# based on allowable communications rather than per-app categories. 99#mlsconstrain binder call 100# (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 101