Changeset 2676

Timestamp:

05/06/08 15:52:46 (7 months ago)

Author:

pebenito

Message:

rbacsep: start adding rbac constraints.

Files:

• branches/rbacsep/Rules.modular (modified) (2 diffs)
• branches/rbacsep/Rules.monolithic (modified) (2 diffs)
• branches/rbacsep/policy/constraints (modified) (1 diff)
• branches/rbacsep/policy/rbac (added)

branches/rbacsep/Rules.modular

@@ -18 +18 @@
-base_pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
-base_te_files := $(base_mods)
-
+ $(poldir)/rbac
-base_fc_files := $(base_mods:.te=.fc)
-
@@ -158 +158 @@
-
-$(tmpdir)/post_te_files.conf: M4PARAM += -D self_contained_policy
-
+tmpdir)/generated_definitions.conf $(
-        @test -d $(tmpdir) || mkdir -p $(tmpdir)
-        $(verbose) $(M4) $(M4PARAM) $^ > $@

branches/rbacsep/Rules.monolithic

@@ -34 +34 @@
-
-pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
-
+ $(poldir)/rbac
-
-policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
@@ -143 +143 @@
-        $(verbose) $(M4) $(M4PARAM) -s $^ > $@
-
-
+tmpdir)/generated_definitions.conf $(
-        @test -d $(tmpdir) || mkdir -p $(tmpdir)
-        $(verbose) $(M4) $(M4PARAM) $^ > $@

branches/rbacsep/policy/constraints

@@ -43 +43 @@
-
-#
-# SELinux process role change constraint:
-#
-constrain process transition 
-(
-        r1 == r2 
-
-        or ( t1 == can_change_process_role and t2 == process_user_target )
-
-        or ( t1 == cron_source_domain and t2 == cron_job_domain )
-
-        or ( t1 == can_system_change and r2 == system_r )
-
-        or ( t1 == process_uncond_exempt )
-);
-
-#
-# SELinux dynamic transition constraint:
-#
-constrain process dyntransition
-(
- and r1 == r2
+
-);
-