Changeset 2678

Show
Ignore:
Timestamp:
05/07/08 13:00:17 (7 months ago)
Author:
pebenito
Message:

rbacsep: add exemptions.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/rbacsep/policy/rbac

    r2677 r2678  
    2727 
    2828define(`basic_rbac_conditions',` 
    29 r1 == r2 
    30 or r1 == system_r 
    31 or r2 == system_r 
    32 or r2 == object_r 
     29       r1 dom r2 
     30       or r1 == system_r 
     31       or r2 == system_r 
     32       or r2 == object_r 
    3333') 
    3434 
    …… 
    4444( 
    4545        basic_rbac_conditions 
    46       or r1 domby $2 
     46#     or r1 domby $2 
    4747        or t1 == $3 
    4848        or t2 == $4 
    …… 
    5555# 
    5656 
    57 basic_rbac_constraint(dir) 
    58 basic_rbac_constraint(file) 
    59 basic_rbac_constraint(lnk_file) 
    60 basic_rbac_constraint(fifo_file) 
    61 basic_rbac_constraint(sock_file) 
    62 basic_rbac_constraint(chr_file) 
    63 basic_rbac_constraint(blk_file) 
     57exempted_rbac_constraint(dir, rbacfilerole, rbacfilesubj, rbacfileobj) 
     58exempted_rbac_constraint(file, rbacfilerole, rbacfilesubj, rbacfileobj) 
     59exempted_rbac_constraint(lnk_file, rbacfilerole, rbacfilesubj, rbacfileobj) 
     60exempted_rbac_constraint(fifo_file, rbacfilerole, rbacfilesubj, rbacfileobj) 
     61exempted_rbac_constraint(sock_file, rbacfilerole, rbacfilesubj, rbacfileobj) 
     62exempted_rbac_constraint(chr_file, rbacfilerole, rbacfilesubj, rbacfileobj) 
     63exempted_rbac_constraint(blk_file, rbacfilerole, rbacfilesubj, rbacfileobj) 
    6464 
    6565######################################## 
    …… 
    7171( 
    7272        basic_rbac_conditions 
     73#       or r1 domby rbacprocrole 
     74        or t1 == rbacprocsubj 
     75        or t2 == rbacprocobj 
    7376); 
    7477 
    …… 
    110113# 
    111114 
    112 basic_rbac_constraint(socket) 
    113 basic_rbac_constraint(tcp_socket) 
    114 basic_rbac_constraint(udp_socket) 
    115 basic_rbac_constraint(rawip_socket) 
    116 basic_rbac_constraint(netlink_socket) 
    117 basic_rbac_constraint(packet_socket) 
    118 basic_rbac_constraint(key_socket) 
    119 basic_rbac_constraint(unix_stream_socket) 
    120 basic_rbac_constraint(unix_dgram_socket) 
    121 basic_rbac_constraint(netlink_route_socket) 
    122 basic_rbac_constraint(netlink_firewall_socket) 
    123 basic_rbac_constraint(netlink_tcpdiag_socket) 
    124 basic_rbac_constraint(netlink_nflog_socket) 
    125 basic_rbac_constraint(netlink_xfrm_socket) 
    126 basic_rbac_constraint(netlink_selinux_socket) 
    127 basic_rbac_constraint(netlink_audit_socket) 
    128 basic_rbac_constraint(netlink_ip6fw_socket) 
    129 basic_rbac_constraint(netlink_dnrt_socket) 
    130 basic_rbac_constraint(netlink_kobject_uevent_socket) 
    131 basic_rbac_constraint(appletalk_socket) 
    132 basic_rbac_constraint(dccp_socket) 
     115exempted_rbac_constraint(socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     116exempted_rbac_constraint(tcp_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     117exempted_rbac_constraint(udp_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     118exempted_rbac_constraint(rawip_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     119exempted_rbac_constraint(netlink_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     120exempted_rbac_constraint(packet_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     121exempted_rbac_constraint(key_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     122exempted_rbac_constraint(unix_stream_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     123exempted_rbac_constraint(unix_dgram_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     124exempted_rbac_constraint(netlink_route_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     125exempted_rbac_constraint(netlink_firewall_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     126exempted_rbac_constraint(netlink_tcpdiag_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     127exempted_rbac_constraint(netlink_nflog_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     128exempted_rbac_constraint(netlink_xfrm_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     129exempted_rbac_constraint(netlink_selinux_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     130exempted_rbac_constraint(netlink_audit_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     131exempted_rbac_constraint(netlink_ip6fw_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     132exempted_rbac_constraint(netlink_dnrt_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     133exempted_rbac_constraint(netlink_kobject_uevent_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     134exempted_rbac_constraint(appletalk_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
     135exempted_rbac_constraint(dccp_socket, rbacsockrole, rbacsocksubj, rbacsockobj) 
    133136 
    134137######################################## 
    …… 
    136139# SysV IPC rules 
    137140 
    138 basic_rbac_constraint(sem) 
    139 basic_rbac_constraint(msg) 
    140 basic_rbac_constraint(msgq) 
    141 basic_rbac_constraint(shm) 
    142 basic_rbac_constraint(ipc) 
     141exempted_rbac_constraint(sem, rbacipcrole, rbacipcsubj, rbacipcobj) 
     142exempted_rbac_constraint(msg, rbacipcrole, rbacipcsubj, rbacipcobj) 
     143exempted_rbac_constraint(msgq, rbacipcrole, rbacipcsubj, rbacipcobj) 
     144exempted_rbac_constraint(shm, rbacipcrole, rbacipcsubj, rbacipcobj) 
     145exempted_rbac_constraint(ipc, rbacipcrole, rbacipcsubj, rbacipcobj) 
    143146 
    144147######################################## 
    …… 
    147150# 
    148151 
    149 basic_rbac_constraint(x_drawable) 
    150 basic_rbac_constraint(x_screen) 
    151 basic_rbac_constraint(x_gc) 
    152 basic_rbac_constraint(x_font) 
    153 basic_rbac_constraint(x_colormap) 
    154 basic_rbac_constraint(x_property) 
    155 basic_rbac_constraint(x_selection) 
    156 basic_rbac_constraint(x_cursor) 
    157 basic_rbac_constraint(x_client) 
    158 basic_rbac_constraint(x_device) 
    159 basic_rbac_constraint(x_server) 
    160 basic_rbac_constraint(x_extension) 
    161 basic_rbac_constraint(x_resource) 
    162 basic_rbac_constraint(x_event) 
    163 basic_rbac_constraint(x_synthetic_event) 
    164 basic_rbac_constraint(x_application_data) 
     152exempted_rbac_constraint(x_drawable, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     153exempted_rbac_constraint(x_screen, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     154exempted_rbac_constraint(x_gc, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     155exempted_rbac_constraint(x_font, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     156exempted_rbac_constraint(x_colormap, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     157exempted_rbac_constraint(x_property, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     158exempted_rbac_constraint(x_selection, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     159exempted_rbac_constraint(x_cursor, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     160exempted_rbac_constraint(x_client, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     161exempted_rbac_constraint(x_device, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     162exempted_rbac_constraint(x_server, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     163exempted_rbac_constraint(x_extension, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     164exempted_rbac_constraint(x_resource, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     165exempted_rbac_constraint(x_event, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     166exempted_rbac_constraint(x_synthetic_event, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
     167exempted_rbac_constraint(x_application_data, rbacxwinrole, rbacxwinsubj, rbacxwinobj) 
    165168 
    166169 
    …… 
    170173# 
    171174 
    172 basic_rbac_constraint(dbus) 
     175exempted_rbac_constraint(dbus, rbacdbusrole, rbacdbussubj, rbacdbusobj) 
    173176 
    174177######################################## 
    …… 
    177180# 
    178181 
    179 basic_rbac_constraint(key) 
     182exempted_rbac_constraint(key, rbackeyrole, rbackeysubj, rbackeyobj) 
    180183 
    181184######################################## 
    …… 
    184187# 
    185188 
    186 basic_rbac_constraint(db_database) 
    187 basic_rbac_constraint(db_table) 
    188 basic_rbac_constraint(db_procedure) 
    189 basic_rbac_constraint(db_column) 
    190 basic_rbac_constraint(db_tuple) 
    191 basic_rbac_constraint(db_blob) 
     189exempted_rbac_constraint(db_database, rbacdbrole, rbacdbsubj, rbacdbobj) 
     190exempted_rbac_constraint(db_table, rbacdbrole, rbacdbsubj, rbacdbobj) 
     191exempted_rbac_constraint(db_procedure, rbacdbrole, rbacdbsubj, rbacdbobj) 
     192exempted_rbac_constraint(db_column, rbacdbrole, rbacdbsubj, rbacdbobj) 
     193exempted_rbac_constraint(db_tuple, rbacdbrole, rbacdbsubj, rbacdbobj) 
     194exempted_rbac_constraint(db_blob, rbacdbrole, rbacdbsubj, rbacdbobj) 
    192195 
    193196