#

# Define the constraints

#

# constrain class_set perm_set expression ;

#

# expression : ( expression )

# | not expression

# | expression and expression

# | expression or expression

# | u1 op u2

# | r1 role_op r2

# | t1 op t2

# | u1 op names

# | u2 op names

# | r1 op names

# | r2 op names

# | t1 op names

# | t2 op names

#

# op : == | !=

# role_op : == | != | eq | dom | domby | incomp

#

# names : name | { name_list }

# name_list : name | name_list name

#

define(`basic_ubac_conditions',`

ifdef(`enable_ubac',`

u1 == u2

or u1 == system_u

or u2 == system_u

or t1 != ubac_constrained_type

or t2 != ubac_constrained_type

')

')

define(`basic_ubac_constraint',`

ifdef(`enable_ubac',`

constrain $1 all_$1_perms

(

basic_ubac_conditions

);

')

')

define(`exempted_ubac_constraint',`

ifdef(`enable_ubac',`

constrain $1 all_$1_perms

(

basic_ubac_conditions

or t1 == $2

);

')

')

########################################

#

# File rules

#

exempted_ubac_constraint(dir, ubacfile)

exempted_ubac_constraint(file, ubacfile)

exempted_ubac_constraint(lnk_file, ubacfile)

exempted_ubac_constraint(fifo_file, ubacfile)

exempted_ubac_constraint(sock_file, ubacfile)

exempted_ubac_constraint(chr_file, ubacfile)

exempted_ubac_constraint(blk_file, ubacfile)

# SELinux object identity change constraint:

constrain dir_file_class_set { create relabelto relabelfrom }

(

u1 == u2

or t1 == can_change_object_identity

);

########################################

#

# Process rules

#

ifdef(`enable_ubac',`

constrain process { sigchld sigkill sigstop signull signal ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setrlimit }

(

basic_ubac_conditions

or t1 == ubacproc

);

')

constrain process { transition dyntransition noatsecure siginh rlimitinh }

(

u1 == u2

or ( t1 == can_change_process_identity and t2 == process_user_target )

or ( t1 == cron_source_domain and ( t2 == cron_job_domain or u2 == system_u ) )

or ( t1 == can_system_change and u2 == system_u )

or ( t1 == process_uncond_exempt )

);

constrain process { transition dyntransition noatsecure siginh rlimitinh }

(

r1 == r2

or ( t1 == can_change_process_role and t2 == process_user_target )

or ( t1 == cron_source_domain and t2 == cron_job_domain )

or ( t1 == can_system_change and r2 == system_r )

or ( t1 == process_uncond_exempt )

);

# These permissions do not have ubac constraints:

# fork

# setexec

# setfscreate

# setcurrent

# execmem

# execstack

# execheap

# setkeycreate

# setsockcreate

########################################

#

# File descriptor rules

#

exempted_ubac_constraint(fd, ubacfd)

########################################

#

# Socket rules

#

exempted_ubac_constraint(socket, ubacsock)

exempted_ubac_constraint(tcp_socket, ubacsock)

exempted_ubac_constraint(sctp_socket, ubacsock)

exempted_ubac_constraint(udp_socket, ubacsock)

exempted_ubac_constraint(rawip_socket, ubacsock)

exempted_ubac_constraint(netlink_socket, ubacsock)

exempted_ubac_constraint(packet_socket, ubacsock)

exempted_ubac_constraint(key_socket, ubacsock)

exempted_ubac_constraint(unix_stream_socket, ubacsock)

exempted_ubac_constraint(unix_dgram_socket, ubacsock)

exempted_ubac_constraint(netlink_route_socket, ubacsock)

exempted_ubac_constraint(netlink_firewall_socket, ubacsock)

exempted_ubac_constraint(netlink_tcpdiag_socket, ubacsock)

exempted_ubac_constraint(netlink_nflog_socket, ubacsock)

exempted_ubac_constraint(netlink_xfrm_socket, ubacsock)

exempted_ubac_constraint(netlink_selinux_socket, ubacsock)

exempted_ubac_constraint(netlink_audit_socket, ubacsock)

exempted_ubac_constraint(netlink_ip6fw_socket, ubacsock)

exempted_ubac_constraint(netlink_dnrt_socket, ubacsock)

exempted_ubac_constraint(netlink_kobject_uevent_socket, ubacsock)

exempted_ubac_constraint(appletalk_socket, ubacsock)

exempted_ubac_constraint(dccp_socket, ubacsock)

exempted_ubac_constraint(tun_socket, ubacsock)

exempted_ubac_constraint(netlink_iscsi_socket, ubacsock)

exempted_ubac_constraint(netlink_fib_lookup_socket, ubacsock)

exempted_ubac_constraint(netlink_connector_socket, ubacsock)

exempted_ubac_constraint(netlink_netfilter_socket, ubacsock)

exempted_ubac_constraint(netlink_generic_socket, ubacsock)

exempted_ubac_constraint(netlink_scsitransport_socket, ubacsock)

exempted_ubac_constraint(netlink_rdma_socket, ubacsock)

exempted_ubac_constraint(netlink_crypto_socket, ubacsock)

constrain socket_class_set { create relabelto relabelfrom }

(

u1 == u2

or t1 == can_change_object_identity

);

########################################

#

# SysV IPC rules

exempted_ubac_constraint(sem, ubacipc)

exempted_ubac_constraint(msg, ubacipc)

exempted_ubac_constraint(msgq, ubacipc)

exempted_ubac_constraint(shm, ubacipc)

exempted_ubac_constraint(ipc, ubacipc)

########################################

#

# SE-X Windows rules

#

exempted_ubac_constraint(x_drawable, ubacxwin)

exempted_ubac_constraint(x_screen, ubacxwin)

exempted_ubac_constraint(x_gc, ubacxwin)

exempted_ubac_constraint(x_font, ubacxwin)

exempted_ubac_constraint(x_colormap, ubacxwin)

exempted_ubac_constraint(x_property, ubacxwin)

exempted_ubac_constraint(x_selection, ubacxwin)

exempted_ubac_constraint(x_cursor, ubacxwin)

exempted_ubac_constraint(x_client, ubacxwin)

exempted_ubac_constraint(x_device, ubacxwin)

exempted_ubac_constraint(x_server, ubacxwin)

exempted_ubac_constraint(x_extension, ubacxwin)

exempted_ubac_constraint(x_resource, ubacxwin)

exempted_ubac_constraint(x_event, ubacxwin)

exempted_ubac_constraint(x_synthetic_event, ubacxwin)

exempted_ubac_constraint(x_application_data, ubacxwin)

########################################

#

# D-BUS rules

#

exempted_ubac_constraint(dbus, ubacdbus)

########################################

#

# Key rules

#

exempted_ubac_constraint(key, ubackey)

########################################

#

# Database rules

#

exempted_ubac_constraint(db_database, ubacdb)

exempted_ubac_constraint(db_table, ubacdb)

exempted_ubac_constraint(db_procedure, ubacdb)

exempted_ubac_constraint(db_column, ubacdb)

exempted_ubac_constraint(db_tuple, ubacdb)

exempted_ubac_constraint(db_blob, ubacdb)

basic_ubac_constraint(association)

basic_ubac_constraint(peer)

# these classes have no UBAC restrictions

#class security

#class system

#class capability

#class memprotect

#class passwd # userspace

#class node

#class netif

#class packet

#class capability2

#class nscd # userspace

#class context # userspace

undefine(`basic_ubac_constraint')

undefine(`basic_ubac_conditions')

undefine(`exempted_ubac_constraint')