Skip to content

language feature: constrain attributes assigned to type #42

@cgzones

Description

@cgzones

I'd like suggest a new SELinux policy language feature to constrain attribute assignment.
In the reference policy for example, there are the attributes auth_file_type and non_auth_file_type, which should be contradictory, but can be easily messed up by

type example_t;
files_auth_file(example_t)
files_config_file(example_t)

While on it, a type may also be constrained to hold one attribute of a set:

nevertypeattribute auth_file_type non_auth_file_type; # make these attributes contradictory
nevertypeattribute domain file_type filesystem_type port_type; # make these attributes exclusive

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions