1805824884fbcdc522c2faac10488902bd41192bdDan Cashman################################################# 2805824884fbcdc522c2faac10488902bd41192bdDan Cashman# MLS policy constraints 3805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 4805824884fbcdc522c2faac10488902bd41192bdDan Cashman 5805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 6805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Process constraints 7805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 8805824884fbcdc522c2faac10488902bd41192bdDan Cashman 9805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Process transition: Require equivalence unless the subject is trusted. 10805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain process { transition dyntransition } 11805824884fbcdc522c2faac10488902bd41192bdDan Cashman ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 12805824884fbcdc522c2faac10488902bd41192bdDan Cashman 13805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Process read operations: No read up unless trusted. 14805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain process { getsched getsession getpgid getcap getattr ptrace share } 15805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l1 dom l2 or t1 == mlstrustedsubject); 16805824884fbcdc522c2faac10488902bd41192bdDan Cashman 17805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Process write operations: Require equivalence unless trusted. 18805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share } 19805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l1 eq l2 or t1 == mlstrustedsubject); 20805824884fbcdc522c2faac10488902bd41192bdDan Cashman 21805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 22805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Socket constraints 23805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 24805824884fbcdc522c2faac10488902bd41192bdDan Cashman 25805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Create/relabel operations: Subject must be equivalent to object unless 26805824884fbcdc522c2faac10488902bd41192bdDan Cashman# the subject is trusted. Sockets inherit the range of their creator. 27805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain socket_class_set { create relabelfrom relabelto } 28805824884fbcdc522c2faac10488902bd41192bdDan Cashman ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject); 29805824884fbcdc522c2faac10488902bd41192bdDan Cashman 30805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Datagram send: Sender must be equivalent to the receiver unless one of them 31805824884fbcdc522c2faac10488902bd41192bdDan Cashman# is trusted. 32805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain unix_dgram_socket { sendto } 33805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 34805824884fbcdc522c2faac10488902bd41192bdDan Cashman 35805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Stream connect: Client must be equivalent to server unless one of them 36805824884fbcdc522c2faac10488902bd41192bdDan Cashman# is trusted. 37805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain unix_stream_socket { connectto } 38805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 39805824884fbcdc522c2faac10488902bd41192bdDan Cashman 40805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 41805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Directory/file constraints 42805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 43805824884fbcdc522c2faac10488902bd41192bdDan Cashman 44805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Create/relabel operations: Subject must be equivalent to object unless 45805824884fbcdc522c2faac10488902bd41192bdDan Cashman# the subject is trusted. Also, files should always be single-level. 46805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Do NOT exempt mlstrustedobject types from this constraint. 47805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain dir_file_class_set { create relabelfrom relabelto } 48805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject)); 49805824884fbcdc522c2faac10488902bd41192bdDan Cashman 50805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 51805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Constraints for app data files only. 52805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 53805824884fbcdc522c2faac10488902bd41192bdDan Cashman 54805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Only constrain open, not read/write. 55805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc. 56805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Subject must be equivalent to object unless the subject is trusted. 57805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir } 58805824884fbcdc522c2faac10488902bd41192bdDan Cashman (t2 != app_data_file or l1 eq l2 or t1 == mlstrustedsubject); 59805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain { file lnk_file sock_file } { open setattr unlink link rename } 60805824884fbcdc522c2faac10488902bd41192bdDan Cashman (t2 != app_data_file or l1 eq l2 or t1 == mlstrustedsubject); 61805824884fbcdc522c2faac10488902bd41192bdDan Cashman 62805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 63805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Constraints for file types other than app data files. 64805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 65805824884fbcdc522c2faac10488902bd41192bdDan Cashman 66805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Read operations: Subject must dominate object unless the subject 67805824884fbcdc522c2faac10488902bd41192bdDan Cashman# or the object is trusted. 68805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain dir { read getattr search } 69805824884fbcdc522c2faac10488902bd41192bdDan Cashman (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 70805824884fbcdc522c2faac10488902bd41192bdDan Cashman 71805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute } 72805824884fbcdc522c2faac10488902bd41192bdDan Cashman (t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 73805824884fbcdc522c2faac10488902bd41192bdDan Cashman 74805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Write operations: Subject must be equivalent to the object unless the 75805824884fbcdc522c2faac10488902bd41192bdDan Cashman# subject or the object is trusted. 76805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain dir { write setattr rename add_name remove_name reparent rmdir } 77805824884fbcdc522c2faac10488902bd41192bdDan Cashman (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 78805824884fbcdc522c2faac10488902bd41192bdDan Cashman 79805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename } 80805824884fbcdc522c2faac10488902bd41192bdDan Cashman (t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject); 81805824884fbcdc522c2faac10488902bd41192bdDan Cashman 82805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Special case for FIFOs. 83805824884fbcdc522c2faac10488902bd41192bdDan Cashman# These can be unnamed pipes, in which case they will be labeled with the 84805824884fbcdc522c2faac10488902bd41192bdDan Cashman# creating process' label. Thus we also have an exemption when the "object" 85805824884fbcdc522c2faac10488902bd41192bdDan Cashman# is a domain type, so that processes can communicate via unnamed pipes 86805824884fbcdc522c2faac10488902bd41192bdDan Cashman# passed by binder or local socket IPC. 87805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain fifo_file { read getattr } 88805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain); 89805824884fbcdc522c2faac10488902bd41192bdDan Cashman 90805824884fbcdc522c2faac10488902bd41192bdDan Cashmanmlsconstrain fifo_file { write setattr append unlink link rename } 91805824884fbcdc522c2faac10488902bd41192bdDan Cashman (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain); 92805824884fbcdc522c2faac10488902bd41192bdDan Cashman 93805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 94805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Binder IPC constraints 95805824884fbcdc522c2faac10488902bd41192bdDan Cashman# 96805824884fbcdc522c2faac10488902bd41192bdDan Cashman# Presently commented out, as apps are expected to call one another. 97805824884fbcdc522c2faac10488902bd41192bdDan Cashman# This would only make sense if apps were assigned categories 98805824884fbcdc522c2faac10488902bd41192bdDan Cashman# based on allowable communications rather than per-app categories. 99805824884fbcdc522c2faac10488902bd41192bdDan Cashman#mlsconstrain binder call 100805824884fbcdc522c2faac10488902bd41192bdDan Cashman# (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject); 101