1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
|
;; Minimum stuff
(class CLASS (PERM))
(classorder (CLASS))
(sid SID)
(sidorder (SID))
(user USER)
(role ROLE)
(type TYPE)
(category CAT)
(categoryorder (CAT))
(sensitivity SENS)
(sensitivityorder (SENS))
(sensitivitycategory SENS (CAT))
(allow TYPE self (CLASS (PERM)))
(roletype ROLE TYPE)
(userrole USER ROLE)
(userlevel USER (SENS))
(userrange USER ((SENS)(SENS (CAT))))
(sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))
;; Extra stuff
(common COMMON (PERM1 PERM2 PERM3 PERM4))
(classcommon CLASS COMMON)
;; Check that "in" statements work in blocks
(block b1
(type t1a)
(allow t1b self (CLASS (PERM1)))
)
(in b1
(type t1b)
(allow t1a self (CLASS (PERM1)))
)
(in b1
(allow t1a self (CLASS (PERM2)))
(allow b1.t1a self (CLASS (PERM3)))
(allow .b1.t1a self (CLASS (PERM4)))
(allow t1b self (CLASS (PERM2)))
(allow b1.t1b self (CLASS (PERM3)))
(allow .b1.t1b self (CLASS (PERM4)))
)
;; Check that "in" statements work in optionals
(optional option2
(type t2a)
(allow t2b self (CLASS (PERM1)))
)
(in option2
(type t2b)
(allow t2a self (CLASS (PERM1)))
)
(in option2
(allow t2a self (CLASS (PERM2)))
(allow t2b self (CLASS (PERM2)))
)
(allow t2a self (CLASS (PERM3)))
(allow t2b self (CLASS (PERM3)))
;; Check that "in" statements work in macros
(type t3a)
(type t3b)
(macro m3 ((type t))
(allow t3a self (CLASS (PERM1)))
(allow t self (CLASS (PERM1)))
)
(call m3 (t3b))
(in m3
(allow t3a self (CLASS (PERM2)))
)
(in m3
(allow t self (CLASS (PERM3)))
)
;; Check "in" statements work for nested optionals
(optional o4a
(optional o4b
(type t4b)
(allow t4b self (CLASS (PERM1)))
)
)
(in o4a.o4b
(allow t4b self (CLASS (PERM2)))
)
;; Check "in: statements work for nested optionals and macros
(macro m5 ()
(type t5a)
(type t5b)
(optional o5a
(allow t5a self (CLASS (PERM1)))
(optional o5b
(allow t5b self (CLASS (PERM1)))
)
)
)
(call m5)
(in m5.o5a
(allow t5a self (CLASS (PERM2)))
)
(in m5.o5a.o5b
(allow t5b self (CLASS (PERM2)))
)
;;
;; Expected:
;;
;; Types:
;; b1.t1a, b1.t1b
;; t2a, t2b
;; t3a, t3b
;; t4b
;; t5a, t5b
;;
;; Allow rules:
;; allow b1.t1a b1.t1a : CLASS { PERM1 PERM2 PERM3 PERM4 };
;; allow b1.t1b b1.t1b : CLASS { PERM1 PERM2 PERM3 PERM4 };
;; allow t2a t2a : CLASS { PERM1 PERM2 PERM3 };
;; allow t2b t2b : CLASS { PERM1 PERM2 PERM3 };
;; allow t3a t3a : CLASS { PERM1 PERM2 };
;; allow t3b t3b : CLASS { PERM1 PERM3 };
;; allow t4b t4b : CLASS { PERM1 PERM2 };
;; allow t5a t5a : CLASS { PERM1 PERM2 };
;; allow t5b t5b : CLASS { PERM1 PERM2 };
|
