36f62b78f1
Since the secilc compiler is independent of libsepol, move secilc out of libsepol. Linke secilc dynamically rather than statically with libsepol. - Move secilc source, test policies, docs, and secilc manpage to secilc directory. - Remove unneeded Makefile from libsepol/cil. To build secilc, run make in the secilc directory. - Add target to install the secilc binary to /usr/bin/. - Create an Android makefile for secilc and move secilc out of libsepol Android makefile. - Add cil_set_mls to libsepol public API as it is needed by secilc. - Remove policy.conf from testing since it is no longer used. Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
78 lines
1.3 KiB
Text
78 lines
1.3 KiB
Text
;; Minimum stuff
|
|
(class CLASS (PERM))
|
|
(classorder (CLASS))
|
|
(sid SID)
|
|
(sidorder (SID))
|
|
(user USER)
|
|
(role ROLE)
|
|
(type TYPE)
|
|
(category CAT)
|
|
(categoryorder (CAT))
|
|
(sensitivity SENS)
|
|
(sensitivityorder (SENS))
|
|
(sensitivitycategory SENS (CAT))
|
|
(allow TYPE self (CLASS (PERM)))
|
|
(roletype ROLE TYPE)
|
|
(userrole USER ROLE)
|
|
(userlevel USER (SENS))
|
|
(userrange USER ((SENS)(SENS (CAT))))
|
|
(sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))
|
|
;; Extra stuff
|
|
(common COMMON (PERM1 PERM2 PERM3 PERM4))
|
|
(classcommon CLASS COMMON)
|
|
|
|
|
|
;; Check resolution failure handling for optionals
|
|
(type t1)
|
|
(optional o1
|
|
(allow t1 self (CLASS (PERM))) ;; Should not appear in policy
|
|
(allow UNKNOWN self (CLASS (PERM)))
|
|
)
|
|
|
|
|
|
;; These should not cause an error
|
|
(block b2a
|
|
(type t2)
|
|
(allow t2 self (CLASS (PERM1)))
|
|
)
|
|
|
|
(block b2b
|
|
(optional o2b
|
|
(type t2)
|
|
(allow t2 DNE (CLASS (PERM)))
|
|
)
|
|
(blockinherit b2a)
|
|
)
|
|
|
|
(block b2c
|
|
(optional o2c
|
|
(type t2)
|
|
(allow t2 self (CLASS (PERM)))
|
|
)
|
|
(blockinherit b2a)
|
|
)
|
|
|
|
|
|
;; This is not allowed
|
|
;;(block b3
|
|
;; (optional o3
|
|
;; (type t3)
|
|
;; (allow t3 DNE (CLASS (PERM)))
|
|
;; )
|
|
;; (type t3)
|
|
;; (allow t3 self (CLASS (PERM1)))
|
|
;;)
|
|
|
|
|
|
;;
|
|
;; Expected:
|
|
;;
|
|
;; Types:
|
|
;; t1
|
|
;; b2a.t2, b2b.t2, b2c.t2
|
|
;;
|
|
;; Allow rules:
|
|
;; allow b2a.t2 b2a.t2 : CLASS { PERM1 };
|
|
;; allow b2b.t2 b2b.t2 : CLASS { PERM1 };
|
|
;; allow b2c.t2 b2c.t2 : CLASS { PERM PERM1 };
|
|
|