1# Sample SELinux Policy
2
3## <summary>
4##  Sample SELinux Policy
5## </summary>
6## <desc>
7## <p>
8##  This module is not functional,
9##  but only to test the syntax highlighting.
10## </p>
11## </desc>
12## <required val="true">
13##  Depended on by other required modules.
14## </required>
15
16policycap open_perms;
17module myapp 1.0;
18
19require {
20	type httpd_t;
21	type httpd_sys_content_t;
22	type initrc_t;
23	class sock_file write;
24	class unix_stream_socket connectto;
25}
26
27allow httpd_t httpd_sys_content_t:sock_file write;
28allow httpd_t initrc_t:unix_stream_socket connectto;
29
30# Refpolicy
31tunable_policy(`allow_execmem',`
32	/usr/share/holas(/.*)? -- gen_context(system_u:object_r:holas_t,s0,a,b);
33')
34# M4 Macros
35regexp(`GNUs not Unix', `\w\(\w+\)$', `*** \& *** \1 ***')
36ifdef(`distro_ubuntu',`
37	unconfined_domain(chkpwd_t)
38')
39
40dominance { gen_dominance(0,decr($1)) };
41neverallow user=_isolated domain=((?!isolated_app).)*
42
43allow consoletype_t self:capability { sys_admin sys_tty_config };
44allow consoletype_t self:msg { send receive };
45
46# sample for administrative user
47user jadmin roles { staff_r sysadm_r };
48# sample for regular user
49user jdoe roles { user_r };
50
51default_user process source;
52default_range process source low;
53default_range name GLBLUB;
54
55sid devnull;
56sid sysctl;
57
58common file { ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute swapon quotaon mounton };
59class dir inherits file { add_name remove_name reparent search rmdir open audit_access execmod };
60class class;
61
62sensitivity s0 alias sens0;
63category c0 alias cat0;
64
65mlsconstrain dir { search read ioctl lock }
66	(( h1 dom h2 ) or ( t1 == mcsreadall ) or
67	(( t1 != mcs_constrained_type ) and (t2 == domain)));
68
69attribute_role dpkg_roles;
70roleattribute system_r dpkg_roles;
71
72role system_r types system_t;
73role_transition hello init_script_file_type system_r;
74
75level s0:c0;
76user user_u roles role_r level s1:c1 range s1:c1 - s2:c2;
77range_transition initrc_t auditd_exec_t:process s15:c0.c255 - s20;
78range_transition source target:class s1 - s2 dsd;
79range_transition source target:class s1 ;
80
81attribute filesystem_type;
82type dhcp_etc_t;
83typealias dhcp_etc_t ALIAS { etc_dhcp_t etc_dhcpc_t etc_dhcpd_t };
84
85bool le_boolean true;
86TUNABLE allow_java_execstack false;
87
88type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
89AUDITALLOW xserver_t { root_xdrawable_t x_domain }:x_drawable send;
90
91optional {
92	neverallow untrusted_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
93	neverallowxperm shell domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
94};
95
96if le_boolean {
97	DONTAUDIT untrusted_app asec_public_file:file { execute execmod };
98} else {
99	ALLOW untrusted_app perfprofd_data_file:file r_file_perms;
100	allow untrusted_app perfprofd_data_file:dir r_dir_perms;
101};
102
103sid devnull system_u:object_r:null_device_t:s0
104genfscon sysfs /devices/system/cpu/online gen_context(system_u:object_r:cpu_online_t,s0)
105genfscon rootfs / gen_context(system_u:object_r:root_t,s0)
106
107genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
108genfscon selinuxfs / u:object_r:selinuxfs:s0
109fs_use_trans devtmpfs system_u:object_r:device_t:s0;
110fs_use_task pipefs u:object_r:pipefs:s0;
111fs_use_xattr xfs u:object_r:labeledfs:s0;
112fs_use_xattr btrfs u:object_r:labeledfs:s0;
113
114portcon tcp 80 u:object_r:http_port:s0;
115portcon udp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0);
116netifcon $2 gen_context(system_u:object_r:$1,$3) gen_context(system_u:object_r:unlabeled_t,$3);
117
118nodecon 2001:0DB8:AC10:FE01:: 2001:0DE0:DA88:2222:: system_u:object_r:hello_t:s0;
119nodecon ipv4 127.0.0.2 255.255.255.255 system_u:object_r:node_t:s0;
120
121#line 118
122
123# Regular Expressions
124regexp(`Hello(!|\^\^)+', `
125	^\s*(?<hello>\.)
126	(
127		hello[^\s\x12/][1-9]*|  # Hello
128		bye
129	)\s*$
130')
131"aa/aa(?=sdf sdf)ds(aa aa)df[^ a]"
132"open
133"text\"aaa
134"filename\s\w\%(?=aa)aa"
135"/path\s\w(?=aa)aa"
136
137u:role:type:sen:cat:other
138u:role:type:sen:cat - sen:cat:other
139u:role:type:s0.s1:c0 , c1 - s2.s3:c2.c3,c4:other
140u:role:type:s0,other
141