| Tri Vo | bc8dc3a | 2019-05-26 13:17:08 -0700 | [diff] [blame^] | 1 | # |
| 2 | # Common neverallow permissions |
| 3 | define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }') |
| 4 | define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock }') |
| 5 | define(`no_x_file_perms', `{ execute execute_no_trans }') |
| 6 | define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }') |
| 7 | |
| 8 | ##################################### |
| 9 | # neverallow_establish_socket_comms(src, dst) |
| 10 | # neverallow src domain establishing socket connections to dst domain. |
| 11 | # |
| 12 | define(`neverallow_establish_socket_comms', ` |
| 13 | neverallow $1 $2:socket_class_set { connect sendto }; |
| 14 | neverallow $1 $2:unix_stream_socket connectto; |
| 15 | ') |