githubmirror/setools

tests/checker/roexec.conf
157 строк3 KB
Chris PeBenito
ReadOnlyExecutables: Implement read-only executables assertion check.
10 июн 2020, 18:09
10 июн 2020, 18:099ca7e64
class infoflow
class infoflow2
class infoflow3
class infoflow4
class infoflow5
class infoflow6
class infoflow7
class file

sid kernel
sid security

common infoflow
{
	low_w
	med_w
	hi_w
	low_r
	med_r
	hi_r
}

class infoflow
inherits infoflow

class infoflow2
inherits infoflow
{
	super_w
	super_r
}

class infoflow3
{
	null
}

class infoflow4
inherits infoflow

class infoflow5
inherits infoflow

class infoflow6
inherits infoflow

class infoflow7
inherits infoflow
{
	super_w
	super_r
	super_none
	super_both
	super_unmapped
}

class file
{
    read
    write
    append
    execute
    execute_no_trans
}

sensitivity low_s;
sensitivity medium_s alias med;
sensitivity high_s;

dominance { low_s med high_s }

category here;
category there;
category elsewhere alias lost;

#level decl
level low_s:here.there;
level med:here, elsewhere;
level high_s:here.lost;

#some constraints
mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));

attribute mls_exempt;

type system;
role system;
role system types system;

################################################################################
# Type enforcement declarations and rules

attribute domain;
type domain1, domain;
type domain2, domain;
type unconfined, domain;

attribute empty_source_attr;
attribute empty_target_attr;

attribute files;
attribute exempt_files_attr;
type exempt_file, files;
type execfile1, files, exempt_files_attr;
type execfile2, files, exempt_files_attr;

# Baseline read-only executable:
type roexec, files;
allow domain roexec:file { read execute execute_no_trans };

# Baseline non-executable file (executable due to unconfined):
type nonexec, files;
allow domain nonexec:file read;

# Unconfined
allow unconfined files:file { read write append execute execute_no_trans };

# writer
allow domain1 execfile1:file write;
allow domain2 execfile1:file { read execute execute };

# appender
allow domain2 execfile2:file append;
allow domain1 execfile2:file { read execute execute };

# empty attrs
allow empty_source_attr nonexec:file { read write append execute execute_no_trans };
allow domain1 empty_target_attr:file { read write append execute execute_no_trans };

################################################################################

#users
user system roles system level med range low_s - high_s:here.lost;

#normal constraints
constrain infoflow hi_w (u1 == u2);

#isids
sid kernel system:system:system:medium_s:here
sid security system:system:system:high_s:lost

#fs_use
fs_use_trans devpts system:object_r:system:low_s;
fs_use_xattr ext3 system:object_r:system:low_s;
fs_use_task pipefs system:object_r:system:low_s;

#genfscon
genfscon proc / system:object_r:system:med
genfscon proc /sys system:object_r:system:low_s
genfscon selinuxfs / system:object_r:system:high_s:here.there

portcon tcp 80 system:object_r:system:low_s

netifcon eth0 system:object_r:system:low_s system:object_r:system:low_s

nodecon 127.0.0.1 255.255.255.255 system:object_r:system:low_s:here
nodecon ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:low_s:here