[PATCH 2/7] mcs: restrict create, relabelto on mcs files
Kenton Groombridge <[email protected]>
| Newsgroups | org.kernel.vger.selinux-refpolicy |
|---|---|
| Message-ID | <[email protected]> |
Signed-off-by: Kenton Groombridge <[email protected]> --- policy/mcs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/mcs b/policy/mcs index 44b57e594..d4d984e47 100644 --- a/policy/mcs +++ b/policy/mcs @@ -99,6 +99,9 @@ mlsconstrain file { create relabelto } mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom } (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); +mlsconstrain { file lnk_file fifo_file } { create relabelto } + (( l2 eq h2 ) or ( t1 != mcs_constrained_type )); + mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto } (( h1 dom h2 ) or ( t1 != mcs_constrained_type )); -- 2.33.1