githubmirror/setools

tests/checker/assertte.conf
163 строки3 KB
Chris PeBenito
AssertTE: Implement type enforcement allow rule assertion check.
10 июн 2020, 18:09
10 июн 2020, 18:09e8c172c
class infoflow
class infoflow2
class infoflow3
class infoflow4
class infoflow5
class infoflow6
class infoflow7

sid kernel
sid security

common infoflow
{
	low_w
	med_w
	hi_w
	low_r
	med_r
	hi_r
}

class infoflow
inherits infoflow

class infoflow2
inherits infoflow
{
	super_w
	super_r
}

class infoflow3
{
	null
}

class infoflow4
inherits infoflow

class infoflow5
inherits infoflow

class infoflow6
inherits infoflow

class infoflow7
inherits infoflow
{
	super_w
	super_r
	super_none
	super_both
	super_unmapped
}

sensitivity low_s;
sensitivity medium_s alias med;
sensitivity high_s;

dominance { low_s med high_s }

category here;
category there;
category elsewhere alias lost;

#level decl
level low_s:here.there;
level med:here, elsewhere;
level high_s:here.lost;

#some constraints
mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));

attribute mls_exempt;

type system;
role system;
role system types system;

################################################################################
# Type enforcement declarations and rules

type test1a;
type test1b;
allow test1a test1b:infoflow hi_w;

################################################################################

# Types for config tests:
type src;
type tgt;
type exempt_src1;
type exempt_tgt1;

attribute exempt_src2;
type exempt_source_type, exempt_src2;

attribute exempt_tgt2;
type exempt_target_type, exempt_tgt2;

# Rules for run tests:
attribute all_sources;
type source1, all_sources;
type source2, all_sources;
type source3, all_sources;

attribute all_targets;
type target1, all_targets;
type target2, all_targets;
type target3, all_targets;

attribute empty_source;
attribute empty_target;

# empty attr passing:
allow empty_source target1:infoflow7 super_w;
allow source2 empty_target:infoflow7 super_r;

# pass by exemption, explicit type source
allow source1 target1:infoflow6 hi_w;

# pass by exemption, attribute source
allow source1 target1:infoflow6 hi_r;
allow source2 target2:infoflow6 hi_r;

# pass by exemption, explicit type target
allow source1 target2:infoflow5 low_w;

# pass by exemption, attribute target
allow source1 target1:infoflow5 low_r;
allow source2 target2:infoflow5 low_r;

# fail
allow source1 target1:infoflow4 med_w;
allow source2 target2:infoflow4 med_w;
allow source3 target3:infoflow4 med_w;

#users
user system roles system level med range low_s - high_s:here.lost;

#normal constraints
constrain infoflow hi_w (u1 == u2);

#isids
sid kernel system:system:system:medium_s:here
sid security system:system:system:high_s:lost

#fs_use
fs_use_trans devpts system:object_r:system:low_s;
fs_use_xattr ext3 system:object_r:system:low_s;
fs_use_task pipefs system:object_r:system:low_s;

#genfscon
genfscon proc / system:object_r:system:med
genfscon proc /sys system:object_r:system:low_s
genfscon selinuxfs / system:object_r:system:high_s:here.there

portcon tcp 80 system:object_r:system:low_s

netifcon eth0 system:object_r:system:low_s system:object_r:system:low_s

nodecon 127.0.0.1 255.255.255.255 system:object_r:system:low_s:here
nodecon ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff system:object_r:system:low_s:here