diff --git a/mls b/mls index 9bb40680c3a915d1b37ac822f1e678127aa7df88..a4c214b1ca2374ddea9c2f838f1159926218272b 100644 --- a/mls +++ b/mls @@ -60,21 +60,37 @@ mlsconstrain unix_stream_socket { connectto } mlsconstrain dir_file_class_set { create relabelfrom relabelto } (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject)); +# +# Constraints for app data files only. +# + +# Only constrain open, not read/write. +# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc. +# Subject must be equivalent to object unless the subject is trusted. +mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir } + (t2 != app_data_file or l1 eq l2 or t1 == mlstrustedsubject); +mlsconstrain { file lnk_file sock_file } { open setattr unlink link rename } + (t2 != app_data_file or l1 eq l2 or t1 == mlstrustedsubject); + +# +# Constraints for file types other than app data files. +# + # Read operations: Subject must dominate object unless the subject # or the object is trusted. mlsconstrain dir { read getattr search } - (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); + (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute } - (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); + (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); # Write operations: Subject must be dominated by the object unless the # subject or the object is trusted. mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir } - (l1 domby l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); + (t2 == app_data_file or l1 domby l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename } - (l1 domby l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); + (t2 == app_data_file or l1 domby l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); # Special case for FIFOs. # These can be unnamed pipes, in which case they will be labeled with the