• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1(type bin_t)
2(type kernel_t)
3(type security_t)
4(type unlabeled_t)
5(handleunknown allow)
6(mls true)
7
8(policycap open_perms)
9
10(category c0)
11(category c1)
12(category c2)
13(category c3)
14(category c4)
15(category c5)
16(categoryalias cat0)
17(categoryaliasactual cat0 c0)
18(categoryset cats01 (c0 c1))
19(categoryset cats02 (c2 c3))
20(categoryset cats03 (range c0 c5))
21(categoryset cats04 (not (range c0 c2)))
22(categoryorder (cat0 c1 c2 c3))
23(categoryorder (c3 c4 c5))
24
25(sensitivity s0)
26(sensitivity s1)
27(sensitivity s2)
28(sensitivity s3)
29(sensitivityalias sens0)
30(sensitivityaliasactual sens0 s0)
31(sensitivityorder (s0 s1 s2 s3))
32
33(sensitivitycategory s0 (cats03))
34(sensitivitycategory s1 cats01)
35(sensitivitycategory s1 (c2))
36(sensitivitycategory s2 (cats01 cats02))
37(sensitivitycategory s2 (range c4 c5))
38(sensitivitycategory s3 (range c0 c5))
39
40(level low (s0))
41(level high (s3 (range c0 c3)))
42(levelrange low_high (low high))
43(levelrange lh1 ((s0 (c0)) (s2 (c0 c3))))
44(levelrange lh2 (low (s2 (c0 c3))))
45(levelrange lh3 ((s0 cats04) (s2 (range c0 c5))))
46(levelrange lh4 ((s0) (s1)))
47
48(block policy
49	(class file (execute_no_trans entrypoint execmod open audit_access a b c d e))
50	; order should be: file char b c a dir d e f
51	(classorder (file char))
52	(classorder (unordered dir))
53	(classorder (unordered c a b d e f))
54	(classorder (char b c a))
55
56	(common file (ioctl read write create getattr setattr lock relabelfrom
57			relabelto append unlink link rename execute swapon
58			quotaon mounton))
59	(classcommon file file)
60
61	(classpermission file_rw)
62	(classpermissionset file_rw (file (read write getattr setattr lock append)))
63
64	;;(classpermission loop1)
65	;;(classpermissionset loop1 ((loop2)))
66	;;(classpermission loop2)
67	;;(classpermissionset loop2 ((loop3)))
68	;;(classpermission loop3)
69	;;(classpermissionset loop3 ((loop1)))
70
71	(class char (foo))
72	(classcommon char file)
73
74	(class dir ())
75	(class a ())
76	(class b ())
77	(class c ())
78	(class d ())
79	(class e ())
80	(class f ())
81	(classcommon dir file)
82
83	(classpermission char_w)
84	(classpermissionset char_w (char (write setattr)))
85	(classpermissionset char_w (file (open read getattr)))
86
87	(classmap files (read))
88	(classmapping files read
89		(file (open read getattr)))
90	(classmapping files read
91		char_w)
92
93	(type auditadm_t)
94	(type console_t)
95	(type console_device_t)
96	(type user_tty_device_t)
97	(type device_t)
98	(type getty_t)
99	(type exec_t)
100	(type bad_t)
101
102	;;(allow console_t console_device_t file_rw)
103	(allow console_t console_device_t (files (read)))
104
105	(permissionx ioctl_test (ioctl files (and (range 0x1600 0x19FF) (not (range 0x1750 0x175F)))))
106	(allowx console_t console_device_t ioctl_test)
107
108	(boolean secure_mode false)
109	(boolean console_login true)
110
111	(sid kernel)
112	(sid security)
113	(sid unlabeled)
114	(sidorder (kernel security))
115	(sidorder (security unlabeled))
116
117	(typeattribute exec_type)
118	(typeattribute foo_type)
119	(typeattribute bar_type)
120	(typeattribute baz_type)
121	(typeattribute not_bad_type)
122	(typeattributeset exec_type (or bin_t kernel_t))
123	(typeattributeset foo_type (and exec_type kernel_t))
124	(typeattributeset bar_type (xor exec_type foo_type))
125	(typeattributeset baz_type (not bin_t))
126	(typeattributeset baz_type (and exec_type (and bar_type bin_t)))
127	(typeattributeset not_bad_type (not bad_t))
128	(typealias sbin_t)
129	(typealiasactual sbin_t bin_t)
130	(typepermissive device_t)
131	(typemember device_t bin_t file exec_t)
132	(typemember exec_type self file exec_t)
133	(typetransition device_t console_t files console_device_t)
134	(typetransition device_t exec_type files console_device_t)
135	(typetransition exec_type self files console_device_t)
136	(typetransition exec_type self files "filename" console_device_t)
137	(typechange console_device_t device_t file user_tty_device_t)
138	(typechange exec_type device_t file user_tty_device_t)
139	(typechange exec_type self file console_device_t)
140
141	(roleattribute exec_role)
142	(roleattribute foo_role)
143	(roleattribute bar_role)
144	(roleattribute baz_role)
145	(roleattribute foo_role_a)
146	(roleattributeset exec_role (or user_r system_r))
147	(roleattributeset foo_role_a (baz_r user_r system_r))
148	(roleattributeset foo_role (and exec_role system_r))
149	(roleattributeset bar_role (xor exec_role foo_role))
150	(roleattributeset baz_role (not user_r))
151
152	(rangetransition device_t console_t file low_high)
153	(rangetransition device_t kernel_t file ((s0) (s3 (not c3))))
154
155	(typetransition device_t console_t file "some_file" getty_t)
156
157	(allow foo_type self (file (execute)))
158	(allow bin_t device_t (file (execute)))
159
160	;; Next two rules violate the neverallow rule that follows
161	;;(allow bad_t not_bad_type (file (execute)))
162	;;(allow bad_t exec_t (file (execute)))
163	(neverallow bad_t not_bad_type (file (execute)))
164
165	(booleanif secure_mode
166		(true
167			(auditallow device_t exec_t (file (read write)))
168		)
169	)
170
171	(booleanif console_login
172		(true
173			(typechange auditadm_t console_device_t file user_tty_device_t)
174			(allow getty_t console_device_t (file (getattr open read write append)))
175		)
176		(false
177			(dontaudit getty_t console_device_t (file (getattr open read write append)))
178		)
179	)
180
181	(booleanif (not (xor (eq secure_mode console_login)
182				(and (or secure_mode console_login) secure_mode ) ) )
183		(true
184			(allow bin_t exec_t (file (execute)))
185		)
186	)
187
188	(tunable allow_execfile true)
189	(tunable allow_userexec false)
190
191	(tunableif (not (xor (eq allow_execfile allow_userexec)
192				(and (or allow_execfile allow_userexec)
193					(and allow_execfile allow_userexec) ) ) )
194		(true
195			(allow bin_t exec_t (file (execute)))
196		)
197	)
198
199	(optional allow_rules
200		(allow user_t exec_t (bins (execute)))
201	)
202
203	(dontaudit device_t auditadm_t (file (read)))
204	(auditallow device_t auditadm_t (file (open)))
205
206	(user system_u)
207	(user user_u)
208	(user foo_u)
209	(userprefix user_u user)
210	(userprefix system_u user)
211
212	(selinuxuser name user_u low_high)
213	(selinuxuserdefault user_u ((s0 (c0)) (s3 (range c0 c3))))
214
215	(role system_r)
216	(role user_r)
217	(role baz_r)
218
219	(roletype system_r bin_t)
220	(roletype system_r kernel_t)
221	(roletype system_r security_t)
222	(roletype system_r unlabeled_t)
223	(roletype system_r exec_type)
224	(roletype exec_role bin_t)
225	(roletype exec_role exec_type)
226	(roleallow system_r user_r)
227	(roletransition system_r bin_t file user_r)
228
229	(userrole foo_u foo_role)
230	(userlevel foo_u low)
231
232	(userattribute ua1)
233	(userattribute ua2)
234	(userattribute ua3)
235	(userattribute ua4)
236	(userattributeset ua1 (user_u system_u))
237	(userattributeset ua2 (foo_u system_u))
238	(userattributeset ua3 (and ua1 ua2))
239	(user u5)
240	(user u6)
241	(userlevel u5 low)
242	(userlevel u6 low)
243	(userrange u5 low_high)
244	(userrange u6 low_high)
245	(userattributeset ua4 (u5 u6))
246	(userrole ua4 foo_role_a)
247
248	(userrange foo_u low_high)
249
250	(userrole system_u system_r)
251	(userlevel system_u low)
252	(userrange system_u low_high)
253
254	(userrole user_u user_r)
255	(userlevel user_u (s0 (range c0 c2)))
256	(userrange user_u (low high))
257
258	(sidcontext kernel (system_u system_r kernel_t ((s0) high)))
259	(sidcontext security (system_u system_r security_t (low (s3 (range c0 c3)))))
260	(sidcontext unlabeled (system_u system_r unlabeled_t (low high)))
261
262	(context system_u_bin_t_l2h (system_u system_r bin_t (low high)))
263
264	(ipaddr ip_v4 192.25.35.200)
265	(ipaddr netmask 192.168.1.1)
266	(ipaddr ip_v6 2001:0DB8:AC10:FE01::)
267	(ipaddr netmask_v6 2001:0DE0:DA88:2222::)
268
269	(filecon "/usr/bin/foo" file system_u_bin_t_l2h)
270	(filecon "/usr/bin/bar" file (system_u system_r kernel_t (low low)))
271	(filecon "/usr/bin/baz" any ())
272	(filecon "/usr/bin/aaa" any (system_u system_r kernel_t ((s0) (s3 (range c0 c2)))))
273	(filecon "/usr/bin/bbb" any (system_u system_r kernel_t ((s0 (c0)) high)))
274	(filecon "/usr/bin/ccc" any (system_u system_r kernel_t (low (s3 (cats01)))))
275	(filecon "/usr/bin/ddd" any (system_u system_r kernel_t (low (s3 (cats01 cats02)))))
276	(nodecon ip_v4 netmask system_u_bin_t_l2h)
277	(nodecon ip_v6 netmask_v6 system_u_bin_t_l2h)
278	(portcon udp 25 system_u_bin_t_l2h)
279	(portcon tcp 22 system_u_bin_t_l2h)
280	(portcon dccp (2048 2096) system_u_bin_t_l2h)
281	(portcon sctp (1024 1035) system_u_bin_t_l2h)
282	(genfscon - "/usr/bin" system_u_bin_t_l2h)
283	(netifcon eth0 system_u_bin_t_l2h system_u_bin_t_l2h) ;different contexts?
284	(fsuse xattr ext3 system_u_bin_t_l2h)
285
286	; XEN
287	(pirqcon 256 system_u_bin_t_l2h)
288	(iomemcon (0 255) system_u_bin_t_l2h)
289	(ioportcon (22 22) system_u_bin_t_l2h)
290	(pcidevicecon 345 system_u_bin_t_l2h)
291	(devicetreecon "/this is/a/path" system_u_bin_t_l2h)
292
293	; InfiniBand
294	(ibpkeycon fe80:: (0 0x10) system_u_bin_t_l2h)
295	(ibpkeycon fe80::7629:afff:fe0f:8e5d (15 25) (system_u system_r kernel_t (low (s3 (cats01 cats02)))))
296	(ibendportcon mlx5_0 1 system_u_bin_t_l2h)
297	(ibendportcon mlx4_3 5 (system_u system_r kernel_t (low (s3 (cats01 cats02)))))
298
299	(constrain (files (read)) (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 r2))))
300	(constrain char_w (not (or (and (eq t1 exec_t) (eq t2 bin_t)) (eq r1 r2))))
301
302	(constrain (file (read)) (or (and (eq t1 exec_t) (neq t2 bin_t) ) (eq u1 ua4) ) )
303	(constrain (file (open)) (dom r1 r2))
304	(constrain (file (open)) (domby r1 r2))
305	(constrain (file (open)) (incomp r1 r2))
306
307	(validatetrans file (eq t1 exec_t))
308
309	(mlsconstrain (file (open)) (not (or (and (eq l1 l2) (eq u1 u2)) (eq r1 r2))))
310	(mlsconstrain (file (open)) (or (and (eq l1 l2) (eq u1 u2)) (neq r1 r2)))
311	(mlsconstrain (file (open)) (dom h1 l2))
312	(mlsconstrain (file (open)) (domby l1 h2))
313	(mlsconstrain (file (open)) (incomp l1 l2))
314
315	(mlsvalidatetrans file (domby l1 h2))
316
317	(macro test_mapping ((classpermission cps))
318	       (allow bin_t auditadm_t cps))
319
320	(call test_mapping ((file (read))))
321	(call test_mapping ((files (read))))
322	(call test_mapping (char_w))
323
324	(defaultuser (file char) source)
325	(defaultrole char target)
326	(defaulttype (files) source)
327	(defaultrange (file) target low)
328	(defaultrange (char) source low-high)
329)
330
331(macro all ((type x))
332	(allow x bin_t (policy.file (execute)))
333	(allowx x bin_t (ioctl policy.file (range 0x1000 0x11FF)))
334)
335(call all (bin_t))
336
337(block z
338    (block ba
339        (roletype r t)
340        (blockabstract z.ba)))
341
342(block test_ba
343    (blockinherit z.ba)
344    (role r)
345    (type t))
346
347(block bb
348	(type t1)
349	(type t2)
350	(boolean b1 false)
351	(tunable tun1 true)
352	(macro m ((boolean b))
353		(tunableif tun1
354			(true
355				(allow t1 t2 (policy.file (write))))
356			(false
357				(allow t1 t2 (policy.file (execute)))))
358		(booleanif b
359			(true
360				(allow t1 t2 (policy.file (read))))))
361
362	(call m (b1))
363)
364
365(in bb
366	(tunableif bb.tun1
367		(true
368			(allow bb.t2 bb.t1 (policy.file (read write execute))))))
369