1 ######################################### 2 # MLS declarations 3 # 4 5 # Generate the desired number of sensitivities and categories. 6 gen_sens(mls_num_sens) 7 gen_cats(mls_num_cats) 8 9 # Generate level definitions for each sensitivity and category. 10 gen_levels(mls_num_sens,mls_num_cats) 11 12 13 ################################################# 14 # MLS policy constraints 15 # 16 17 # 18 # Process constraints 19 # 20 21 # Process transition: Require equivalence unless the subject is trusted. 22 mlsconstrain process { transition dyntransition } 23 ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 24 25 # Process read operations: No read up unless trusted. 26 mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share } 27 (l1 dom l2 or t1 == mlstrustedsubject); 28 29 # Process write operations: Require equivalence unless trusted. 30 mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share } 31 (l1 eq l2 or t1 == mlstrustedsubject); 32 33 # 34 # Socket constraints 35 # 36 37 # Create/relabel operations: Subject must be equivalent to object unless 38 # the subject is trusted. Sockets inherit the range of their creator. 39 mlsconstrain socket_class_set { create relabelfrom relabelto } 40 ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 41 42 # Datagram send: Sender must be equivalent to the receiver unless one of them 43 # is trusted. 44 mlsconstrain unix_dgram_socket { sendto } 45 (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 46 47 # Stream connect: Client must be equivalent to server unless one of them 48 # is trusted. 49 mlsconstrain unix_stream_socket { connectto } 50 (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 51 52 # 53 # Directory/file constraints 54 # 55 56 # Create/relabel operations: Subject must be equivalent to object unless 57 # the subject is trusted. Also, files should always be single-level. 58 # Do NOT exempt mlstrustedobject types from this constraint. 59 mlsconstrain dir_file_class_set { create relabelfrom relabelto } 60 (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject)); 61 62 # 63 # Constraints for app data files only. 64 # 65 66 # Only constrain open, not read/write. 67 # Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc. 68 # Subject must be equivalent to object unless the subject is trusted. 69 mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir } 70 (t2 != app_data_file or l1 eq l2 or t1 == mlstrustedsubject); 71 mlsconstrain { file lnk_file sock_file } { open setattr unlink link rename } 72 (t2 != app_data_file or l1 eq l2 or t1 == mlstrustedsubject); 73 74 # 75 # Constraints for file types other than app data files. 76 # 77 78 # Read operations: Subject must dominate object unless the subject 79 # or the object is trusted. 80 mlsconstrain dir { read getattr search } 81 (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 82 83 mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute } 84 (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 85 86 # Write operations: Subject must be equivalent to the object unless the 87 # subject or the object is trusted. 88 mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir } 89 (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 90 91 mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename } 92 (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 93 94 # Special case for FIFOs. 95 # These can be unnamed pipes, in which case they will be labeled with the 96 # creating process' label. Thus we also have an exemption when the "object" 97 # is a domain type, so that processes can communicate via unnamed pipes 98 # passed by binder or local socket IPC. 99 mlsconstrain fifo_file { read getattr } 100 (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain); 101 102 mlsconstrain fifo_file { write setattr append unlink link rename } 103 (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain); 104 105 # 106 # Binder IPC constraints 107 # 108 # Presently commented out, as apps are expected to call one another. 109 # This would only make sense if apps were assigned categories 110 # based on allowable communications rather than per-app categories. 111 #mlsconstrain binder call 112 # (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 113
