1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
|
module my_module 1.0;
require {
bool allow_ypbind, secure_mode, allow_execstack;
type system_t, sysadm_t;
class file {read write};
attribute attr_check_base_2, attr_check_base_3;
attribute attr_check_base_optional_2;
}
bool module_1_bool true;
if (module_1_bool && allow_ypbind && secure_mode && allow_execstack) {
allow system_t sysadm_t : file { read write };
}
optional {
bool module_1_bool_2 false;
require {
bool optional_bool_1, optional_bool_2;
class file { execute ioctl };
}
if (optional_bool_1 && optional_bool_2 || module_1_bool_2) {
allow system_t sysadm_t : file {execute ioctl};
}
}
# Type - attribute mapping test
type module_t;
attribute attr_check_mod_1;
attribute attr_check_mod_2;
attribute attr_check_mod_3;
attribute attr_check_mod_4;
attribute attr_check_mod_5;
attribute attr_check_mod_6;
attribute attr_check_mod_7;
attribute attr_check_mod_8;
attribute attr_check_mod_9;
attribute attr_check_mod_10;
attribute attr_check_mod_11;
optional {
require {
type base_t;
}
attribute attr_check_mod_optional_1;
attribute attr_check_mod_optional_2;
attribute attr_check_mod_optional_3;
attribute attr_check_mod_optional_4;
attribute attr_check_mod_optional_5;
attribute attr_check_mod_optional_6;
attribute attr_check_mod_optional_7;
}
optional {
require {
type does_not_exist_t;
}
attribute attr_check_mod_optional_disabled_4;
attribute attr_check_mod_optional_disabled_7;
}
type attr_check_base_2_1_t, attr_check_base_2;
type attr_check_base_2_2_t;
typeattribute attr_check_base_2_2_t attr_check_base_2;
type attr_check_base_3_3_t, attr_check_base_3;
type attr_check_base_3_4_t;
typeattribute attr_check_base_3_4_t attr_check_base_3;
optional {
require {
attribute attr_check_base_5;
}
type attr_check_base_5_1_t, attr_check_base_5;
type attr_check_base_5_2_t;
typeattribute attr_check_base_5_2_t attr_check_base_5;
}
optional {
require {
attribute attr_check_base_6;
}
type attr_check_base_6_3_t, attr_check_base_6;
type attr_check_base_6_4_t;
typeattribute attr_check_base_6_4_t attr_check_base_6;
}
optional {
require {
type does_not_exist_t;
attribute attr_check_base_8;
}
type attr_check_base_8_1_t, attr_check_base_8;
type attr_check_base_8_2_t;
typeattribute attr_check_base_8_2_t attr_check_base_8;
}
optional {
require {
type does_not_exist_t;
attribute attr_check_base_9;
}
type attr_check_base_9_3_t, attr_check_base_9;
type attr_check_base_9_4_t;
typeattribute attr_check_base_9_4_t attr_check_base_9;
}
optional {
require {
type does_not_exist_t;
attribute attr_check_base_10;
}
type attr_check_base_10_3_t, attr_check_base_10;
type attr_check_base_10_4_t;
typeattribute attr_check_base_10_4_t attr_check_base_10;
}
optional {
require {
attribute attr_check_base_11;
}
type attr_check_base_11_3_t, attr_check_base_11;
type attr_check_base_11_4_t;
typeattribute attr_check_base_11_4_t attr_check_base_11;
}
type attr_check_base_optional_2_1_t, attr_check_base_optional_2;
type attr_check_base_optional_2_2_t;
typeattribute attr_check_base_optional_2_2_t attr_check_base_optional_2;
optional {
require {
attribute attr_check_base_optional_5;
}
type attr_check_base_optional_5_1_t, attr_check_base_optional_5;
type attr_check_base_optional_5_2_t;
typeattribute attr_check_base_optional_5_2_t attr_check_base_optional_5;
}
#optional {
# require {
# attribute attr_check_base_optional_6;
# }
# type attr_check_base_optional_6_3_t, attr_check_base_optional_6;
# type attr_check_base_optional_6_4_t;
# typeattribute attr_check_base_optional_6_4_t attr_check_base_optional_6;
#}
optional {
require {
type does_not_exist_t;
attribute attr_check_base_optional_8;
}
type attr_check_base_optional_8_1_t, attr_check_base_optional_8;
type attr_check_base_optional_8_2_t;
typeattribute attr_check_base_optional_8_2_t attr_check_base_optional_8;
}
type attr_check_mod_2_1_t, attr_check_mod_2;
type attr_check_mod_2_2_t;
typeattribute attr_check_mod_2_2_t attr_check_mod_2;
optional {
require {
attribute attr_check_mod_5;
}
type attr_check_mod_5_1_t, attr_check_mod_5;
type attr_check_mod_5_2_t;
typeattribute attr_check_mod_5_2_t attr_check_mod_5;
}
optional {
require {
attribute attr_check_mod_6;
}
type attr_check_mod_6_3_t, attr_check_mod_6;
type attr_check_mod_6_4_t;
typeattribute attr_check_mod_6_4_t attr_check_mod_6;
}
optional {
require {
type does_not_exist_t;
}
type attr_check_mod_8_1_t, attr_check_mod_8;
type attr_check_mod_8_2_t;
typeattribute attr_check_mod_8_2_t attr_check_mod_8;
}
optional {
require {
type does_not_exist_t;
}
type attr_check_mod_9_3_t, attr_check_mod_9;
type attr_check_mod_9_4_t;
typeattribute attr_check_mod_9_4_t attr_check_mod_9;
}
optional {
require {
type does_not_exist_t;
}
type attr_check_mod_10_3_t, attr_check_mod_10;
type attr_check_mod_10_4_t;
typeattribute attr_check_mod_10_4_t attr_check_mod_10;
}
optional {
require {
type base_t;
}
type attr_check_mod_11_3_t, attr_check_mod_11;
type attr_check_mod_11_4_t;
typeattribute attr_check_mod_11_4_t attr_check_mod_11;
}
#optional {
# require {
# attribute attr_check_mod_optional_5;
# }
# type attr_check_mod_optional_5_1_t, attr_check_mod_optional_5;
# type attr_check_mod_optional_5_2_t;
# typeattribute attr_check_mod_optional_5_2_t attr_check_mod_optional_5;
#}
#optional {
# require {
# attribute attr_check_mod_optional_6;
# }
# type attr_check_mod_optional_6_3_t, attr_check_mod_optional_6;
# type attr_check_mod_optional_6_4_t;
# typeattribute attr_check_mod_optional_6_4_t attr_check_mod_optional_6;
#}
optional {
require {
attribute attr_check_base_optional_disabled_5;
}
type attr_check_base_optional_disabled_5_1_t, attr_check_base_optional_disabled_5;
type attr_check_base_optional_disabled_5_2_t;
typeattribute attr_check_base_optional_disabled_5_2_t attr_check_base_optional_disabled_5;
}
optional {
require {
type does_not_exist_t;
attribute attr_check_base_optional_disabled_8;
}
type attr_check_base_optional_disabled_8_1_t, attr_check_base_optional_disabled_8;
type attr_check_base_optional_disabled_8_2_t;
typeattribute attr_check_base_optional_disabled_8_2_t attr_check_base_optional_disabled_8;
}
|
