Differential D15089 Diff 40763 autotests/html/test.te.html

Changeset View

Standalone View

View Options

autotests/html/test.te.html

  • This file was added.
1​<!DOCTYPE html>
2​<html><head>
3​<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
4​<title>test.te</title>
5​<meta name="generator" content="KF5::SyntaxHighlighting (SELinux Policy)"/>
6​</head><body style="color:#1f1c1b"><pre>
7​<span style="color:#898887;"># Sample SELinux Policy</span>
8​
9​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;summary&gt;</span>
10​<span style="color:#898887;">## Sample SELinux Policy</span>
11​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;/summary&gt;</span>
12​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;desc&gt;</span>
13​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;p&gt;</span>
14​<span style="color:#898887;">## This module is not functional,</span>
15​<span style="color:#898887;">## but only to test the syntax highlighting.</span>
16​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;/p&gt;</span>
17​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;/desc&gt;</span>
18​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;required</span><span style="color:#0057ae;"> val</span><span style="color:#898887;">=</span><span style="color:#bf0303;">&quot;true&quot;</span><span style="color:#ca60ca;font-weight:bold;">&gt;</span>
19​<span style="color:#898887;">## Depended on by other required modules.</span>
20​<span style="color:#898887;">## </span><span style="color:#ca60ca;font-weight:bold;">&lt;/required&gt;</span>
21​
22​<span style="color:#006e28;font-weight:bold;">policycap</span> <span style="color:#006e28;">open_perms</span>;
23​<span style="font-weight:bold;">module</span> myapp <span style="color:#b08000;">1.0</span>;
24​
25​<span style="font-weight:bold;">require</span> <span style="font-weight:bold;">{</span>
26​ <span style="font-weight:bold;">type</span> httpd_t;
27​ <span style="font-weight:bold;">type</span> httpd_sys_content_t;
28​ <span style="font-weight:bold;">type</span> initrc_t;
29​ <span style="font-weight:bold;">class</span> sock_file <span style="color:#bf0303;">write</span>;
30​ <span style="font-weight:bold;">class</span> unix_stream_socket <span style="color:#bf0303;">connectto</span>;
31​<span style="font-weight:bold;">}</span>
32​
33​<span style="color:#bf0303;font-weight:bold;">allow</span> httpd_t httpd_sys_content_t:<span style="color:#0057ae;">sock_file</span> <span style="color:#bf0303;">write</span>;
34​<span style="color:#bf0303;font-weight:bold;">allow</span> httpd_t initrc_t:<span style="color:#0057ae;">unix_stream_socket</span> <span style="color:#bf0303;">connectto</span>;
35​
36​<span style="color:#898887;"># Refpolicy</span>
37​<span style="color:#644a9b;font-style:italic;">tunable_policy</span>(<span style="color:#bf0303;">`allow_execmem'</span>,<span style="color:#bf0303;font-weight:bold;">`</span>
38​ /usr/share/holas<span style="color:#ff5500;">(</span><span style="color:#ff5500;">/</span><span style="color:#3daee9;">.*</span><span style="color:#ff5500;">)</span><span style="color:#3daee9;">?</span><span style="font-weight:bold;"> --</span> <span style="color:#644a9b;font-style:italic;">gen_context</span>(<span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">holas_t</span>,<span style="color:#006e28;">s0</span>,<span style="color:#006e28;">fdf</span>,<span style="color:#006e28;">df</span>);
39​<span style="color:#bf0303;font-weight:bold;">'</span>)
40​<span style="color:#898887;"># M4 Macros</span>
41​<span style="color:#644a9b;font-weight:bold;">regexp</span>(<span style="color:#bf0303;">`GNUs not Unix'</span>, <span style="color:#bf0303;font-weight:bold;">`</span><span style="color:#924c9d;">\w\(\w</span><span style="color:#3daee9;">+</span><span style="color:#924c9d;">\)</span><span style="color:#3daee9;">$</span><span style="color:#bf0303;font-weight:bold;">'</span>, <span style="color:#bf0303;font-weight:bold;">`</span><span style="color:#3daee9;">***</span> <span style="color:#924c9d;">\&amp;</span> <span style="color:#3daee9;">***</span> <span style="color:#924c9d;">\1</span> <span style="color:#3daee9;">***</span><span style="color:#bf0303;font-weight:bold;">'</span>)
42​<span style="color:#644a9b;font-weight:bold;">ifdef</span>(<span style="color:#bf0303;">`distro_ubuntu'</span>,<span style="color:#bf0303;font-weight:bold;">`</span>
43​ <span style="color:#644a9b;">unconfined_domain</span>(chkpwd_t)
44​<span style="color:#bf0303;font-weight:bold;">'</span>)
45​
46​<span style="font-weight:bold;">dominance</span> <span style="font-weight:bold;">{</span> <span style="color:#644a9b;">gen_dominance</span>(<span style="color:#b08000;">0</span>,<span style="color:#644a9b;font-weight:bold;">decr</span>(<span style="color:#0057ae;">$1</span>)) <span style="font-weight:bold;">}</span>;
47​<span style="color:#bf0303;font-weight:bold;">neverallow</span> <span style="color:#0057ae;">user</span>=_isolated <span style="color:#0057ae;">domain</span>=<span style="color:#ff5500;">((</span><span style="color:#ca60ca;">?!</span><span style="color:#ff5500;">isolated_app</span><span style="color:#ff5500;">)</span><span style="color:#3daee9;">.</span><span style="color:#ff5500;">)</span><span style="color:#3daee9;">*</span>
48​
49​<span style="color:#bf0303;font-weight:bold;">allow</span> consoletype_t <span style="color:#006e28;">self</span>:<span style="color:#0057ae;">capability</span> <span style="font-weight:bold;">{</span> <span style="color:#bf0303;">sys_admin</span> <span style="color:#bf0303;">sys_tty_config</span> <span style="font-weight:bold;">}</span>;
50​<span style="color:#bf0303;font-weight:bold;">allow</span> consoletype_t <span style="color:#006e28;">self</span>:<span style="color:#0057ae;">msg</span> <span style="font-weight:bold;">{</span> <span style="color:#bf0303;">send</span> <span style="color:#bf0303;">receive</span> <span style="font-weight:bold;">}</span>;
51​
52​<span style="color:#898887;"># sample for administrative user</span>
53​<span style="font-weight:bold;">user</span> jadmin <span style="font-weight:bold;">roles</span> <span style="font-weight:bold;">{</span> staff_r sysadm_r <span style="font-weight:bold;">}</span>;
54​<span style="color:#898887;"># sample for regular user</span>
55​<span style="font-weight:bold;">user</span> jdoe <span style="font-weight:bold;">roles</span> <span style="font-weight:bold;">{</span> user_r <span style="font-weight:bold;">}</span>;
56​
57​<span style="font-weight:bold;">default_user</span> process <span style="font-weight:bold;">source</span>;
58​<span style="font-weight:bold;">default_range</span> process <span style="font-weight:bold;">source</span> <span style="color:#b08000;font-weight:bold;">low</span>;
59​
60​<span style="font-weight:bold;">sid</span> devnull;
61​<span style="font-weight:bold;">sid</span> sysctl;
62​
63​<span style="font-weight:bold;">common</span> file <span style="font-weight:bold;">{</span> <span style="color:#bf0303;">ioctl</span> <span style="color:#bf0303;">read</span> <span style="color:#bf0303;">write</span> <span style="color:#bf0303;">create</span> <span style="color:#bf0303;">getattr</span> <span style="color:#bf0303;">setattr</span> <span style="color:#bf0303;">lock</span> <span style="color:#bf0303;">relabelfrom</span> <span style="color:#bf0303;">relabelto</span> <span style="color:#bf0303;">append</span> <span style="color:#bf0303;">map</span> <span style="color:#bf0303;">unlink</span> <span style="color:#bf0303;">link</span> <span style="color:#bf0303;">rename</span> <span style="color:#bf0303;">execute</span> <span style="color:#bf0303;">swapon</span> <span style="color:#bf0303;">quotaon</span> <span style="color:#bf0303;">mounton</span> <span style="font-weight:bold;">}</span>;
64​<span style="font-weight:bold;">class</span> dir <span style="font-weight:bold;">inherits</span> file <span style="font-weight:bold;">{</span> <span style="color:#bf0303;">add_name</span> <span style="color:#bf0303;">remove_name</span> <span style="color:#bf0303;">reparent</span> <span style="color:#bf0303;">search</span> <span style="color:#bf0303;">rmdir</span> <span style="color:#bf0303;">open</span> <span style="color:#bf0303;">audit_access</span> <span style="color:#bf0303;">execmod</span> <span style="font-weight:bold;">}</span>;
65​<span style="font-weight:bold;">class</span> class;
66​
67​<span style="font-weight:bold;">sensitivity</span> s0 <span style="font-weight:bold;">alias</span> sens0;
68​<span style="font-weight:bold;">category</span> c0 <span style="font-weight:bold;">alias</span> cat0;
69​
70​<span style="font-weight:bold;">mlsconstrain</span> dir <span style="font-weight:bold;">{</span> <span style="color:#bf0303;">search</span> <span style="color:#bf0303;">read</span> <span style="color:#bf0303;">ioctl</span> <span style="color:#bf0303;">lock</span> <span style="font-weight:bold;">}</span>
71​ (( <span style="color:#006e28;">h1</span> <span style="color:#0057ae;font-weight:bold;">dom</span> <span style="color:#006e28;">h2</span> ) <span style="color:#0057ae;font-weight:bold;">or</span> ( <span style="color:#006e28;">t1</span> <span style="color:#0057ae;font-weight:bold;">==</span> mcsreadall ) <span style="color:#0057ae;font-weight:bold;">or</span>
72​ (( <span style="color:#006e28;">t1</span> <span style="color:#0057ae;font-weight:bold;">!=</span> mcs_constrained_type ) <span style="color:#0057ae;font-weight:bold;">and</span> (<span style="color:#006e28;">t2</span> <span style="color:#0057ae;font-weight:bold;">==</span> domain)));
73​
74​<span style="font-weight:bold;">attribute_role</span> dpkg_roles;
75​<span style="font-weight:bold;">roleattribute</span> system_r dpkg_roles;
76​
77​<span style="font-weight:bold;">role</span> system_r <span style="font-weight:bold;">types</span> system_t;
78​<span style="font-weight:bold;">role_transition</span> hello init_script_file_type system_r;
79​
80​<span style="font-weight:bold;">level</span> <span style="color:#607880;">s0</span>:<span style="color:#607880;">c0</span>;
81​<span style="font-weight:bold;">user</span> user_u <span style="font-weight:bold;">roles</span> role_r <span style="font-weight:bold;">level</span> <span style="color:#607880;">s1</span>:<span style="color:#607880;">c1</span> <span style="font-weight:bold;">range</span> <span style="color:#607880;">s1</span>:<span style="color:#607880;">c1</span> - <span style="color:#607880;">s2</span>:<span style="color:#607880;">c2</span>;
82​<span style="font-weight:bold;">range_transition</span> initrc_t auditd_exec_t:<span style="color:#0057ae;">process</span> <span style="color:#607880;">s15</span>:<span style="color:#607880;">c0</span>.<span style="color:#607880;">c255</span> - <span style="color:#607880;">s20</span>;
83​<span style="font-weight:bold;">range_transition</span> source target:<span style="color:#0057ae;">class</span> <span style="color:#607880;">s1</span> - <span style="color:#607880;">s2</span> dsd;
84​<span style="font-weight:bold;">range_transition</span> source target:<span style="color:#0057ae;">class</span> <span style="color:#607880;">s1</span> ;
85​
86​<span style="font-weight:bold;">attribute</span> filesystem_type;
87​<span style="font-weight:bold;">type</span> dhcp_etc_t;
88​<span style="font-weight:bold;">typealias</span> dhcp_etc_t <span style="font-weight:bold;">ALIAS</span> <span style="font-weight:bold;">{</span> etc_dhcp_t etc_dhcpc_t etc_dhcpd_t <span style="font-weight:bold;">}</span>;
89​
90​<span style="font-weight:bold;">bool</span> le_boolean <span style="color:#0095ff;font-weight:bold;">true</span>;
91​<span style="font-weight:bold;">TUNABLE</span> allow_java_execstack <span style="color:#0095ff;font-weight:bold;">false</span>;
92​
93​<span style="font-weight:bold;">type_transition</span> root_xdrawable_t input_xevent_t:<span style="color:#0057ae;">x_event</span> root_input_xevent_t;
94​<span style="color:#bf0303;font-weight:bold;">AUDITALLOW</span> xserver_t <span style="font-weight:bold;">{</span> root_xdrawable_t x_domain <span style="font-weight:bold;">}</span>:<span style="color:#0057ae;">x_drawable</span> <span style="color:#bf0303;">send</span>;
95​
96​<span style="font-weight:bold;">optional</span> <span style="font-weight:bold;">{</span>
97​ <span style="color:#bf0303;font-weight:bold;">neverallow</span> untrusted_app <span style="color:#3daee9;">*</span>:<span style="font-weight:bold;">{</span> netlink_route_socket netlink_selinux_socket <span style="font-weight:bold;">}</span> <span style="color:#bf0303;">ioctl</span>;
98​ <span style="color:#bf0303;font-weight:bold;">neverallowxperm</span> shell domain:<span style="font-weight:bold;">{</span> rawip_socket tcp_socket udp_socket <span style="font-weight:bold;">}</span> <span style="color:#bf0303;">ioctl</span> priv_sock_ioctls;
99​<span style="font-weight:bold;">}</span>;
100​
101​<span style="font-weight:bold;">if</span> le_boolean <span style="font-weight:bold;">{</span>
102​ <span style="color:#bf0303;font-weight:bold;">DONTAUDIT</span> untrusted_app asec_public_file:<span style="color:#0057ae;">file</span> <span style="font-weight:bold;">{</span> <span style="color:#bf0303;">execute</span> <span style="color:#bf0303;">execmod</span> <span style="font-weight:bold;">}</span>;
103​<span style="font-weight:bold;">}</span> <span style="font-weight:bold;">else</span> <span style="font-weight:bold;">{</span>
104​ <span style="color:#bf0303;font-weight:bold;">ALLOW</span> untrusted_app perfprofd_data_file:<span style="color:#0057ae;">file</span> r_file_perms;
105​ <span style="color:#bf0303;font-weight:bold;">allow</span> untrusted_app perfprofd_data_file:<span style="color:#0057ae;">dir</span> r_dir_perms;
106​<span style="font-weight:bold;">}</span>;
107​
108​<span style="font-weight:bold;">sid</span> devnull <span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">null_device_t</span>:<span style="color:#006e28;">s0</span>
109​<span style="font-weight:bold;">genfscon</span> <span style="font-style:italic;">sysfs</span> /devices/system/cpu/online <span style="color:#644a9b;font-style:italic;">gen_context</span>(<span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">cpu_online_t</span>,<span style="color:#006e28;">s0</span>)
110​<span style="font-weight:bold;">genfscon</span> <span style="font-style:italic;">rootfs</span> / <span style="color:#644a9b;font-style:italic;">gen_context</span>(<span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">root_t</span>,<span style="color:#006e28;">s0</span>)
111​
112​<span style="font-weight:bold;">genfscon</span> <span style="font-style:italic;">proc</span> /cpuinfo <span style="color:#006e28;">u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">proc_cpuinfo</span>:<span style="color:#006e28;">s0</span>
113​<span style="font-weight:bold;">genfscon</span> <span style="font-style:italic;">selinuxfs</span> / <span style="color:#006e28;">u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">selinuxfs</span>:<span style="color:#006e28;">s0</span>
114​<span style="font-weight:bold;">fs_use_trans</span> <span style="font-style:italic;">devtmpfs</span> <span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">device_t</span>:<span style="color:#006e28;">s0</span>;
115​<span style="font-weight:bold;">fs_use_task</span> <span style="font-style:italic;">pipefs</span> <span style="color:#006e28;">u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">pipefs</span>:<span style="color:#006e28;">s0</span>;
116​<span style="font-weight:bold;">fs_use_xattr</span> <span style="font-style:italic;">xfs</span> <span style="color:#006e28;">u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">labeledfs</span>:<span style="color:#006e28;">s0</span>;
117​<span style="font-weight:bold;">fs_use_xattr</span> <span style="font-style:italic;">btrfs</span> <span style="color:#006e28;">u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">labeledfs</span>:<span style="color:#006e28;">s0</span>;
118​
119​<span style="font-weight:bold;">portcon</span> tcp <span style="color:#b08000;">80</span> <span style="color:#006e28;">u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">http_port</span>:<span style="color:#006e28;">s0</span>;
120​<span style="font-weight:bold;">portcon</span> udp <span style="color:#b08000;">1024</span>-<span style="color:#b08000;">65535</span> <span style="color:#644a9b;font-style:italic;">gen_context</span>(<span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">unreserved_port_t</span>,<span style="color:#006e28;"> s0</span>);
121​<span style="font-weight:bold;">netifcon</span> <span style="color:#0057ae;">$2</span> <span style="color:#644a9b;font-style:italic;">gen_context</span>(<span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#0057ae;">$1</span>,<span style="color:#0057ae;">$3</span>) <span style="color:#644a9b;font-style:italic;">gen_context</span>(<span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">unlabeled_t</span>,<span style="color:#0057ae;">$3</span>);
122​
123​<span style="font-weight:bold;">nodecon</span> <span style="color:#b08000;">2001:0DB8:AC10:FE01::</span> <span style="color:#b08000;">2001:0DE0:DA88:2222::</span> <span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">hello_t</span>:<span style="color:#006e28;">s0</span>;
124​<span style="font-weight:bold;">nodecon</span> ipv4 <span style="color:#b08000;">127.0.0.2</span> <span style="color:#b08000;">255.255.255.255</span> <span style="color:#006e28;">system_u</span>:<span style="color:#006e28;">object_r</span>:<span style="color:#924c9d;">node_t</span>:<span style="color:#006e28;">s0</span>;
125​
126​<span style="color:#006e28;">#line 118</span>
127​
128​<span style="color:#898887;"># Regular Expressions</span>
129​<span style="color:#644a9b;font-weight:bold;">regexp</span>(<span style="color:#bf0303;font-weight:bold;">`</span>Hello<span style="color:#ff5500;">(</span><span style="color:#ff5500;">!</span><span style="color:#ca60ca;">|</span><span style="color:#924c9d;">\^\^</span><span style="color:#ff5500;">)</span><span style="color:#3daee9;">+</span><span style="color:#bf0303;font-weight:bold;">'</span>, <span style="color:#bf0303;font-weight:bold;">`</span>
130​ <span style="color:#3daee9;">^</span><span style="color:#924c9d;">\s</span><span style="color:#3daee9;">*</span><span style="color:#ff5500;">(</span><span style="color:#ca60ca;">?&lt;hello&gt;</span><span style="color:#924c9d;">\.</span><span style="color:#ff5500;">)</span>
131​ <span style="color:#ff5500;">(</span>
132​<span style="color:#ff5500;"> hello</span><span style="color:#ff5500;">[</span><span style="color:#ca60ca;">^</span><span style="color:#924c9d;">\s\x12</span><span style="color:#ff5500;">/</span><span style="color:#ff5500;">][</span><span style="color:#ff5500;">1-9</span><span style="color:#ff5500;">]</span><span style="color:#3daee9;">*</span><span style="color:#ca60ca;">|</span><span style="color:#ff5500;"> </span><span style="color:#898887;"> # Hello</span>
133​<span style="color:#ff5500;"> bye</span>
134​<span style="color:#ff5500;"> </span><span style="color:#ff5500;">)</span><span style="color:#924c9d;">\s</span><span style="color:#3daee9;">*$</span>
135​<span style="color:#bf0303;font-weight:bold;">'</span>)
136​<span style="color:#bf0303;">&quot;aa/aa</span><span style="color:#ff5500;">(</span><span style="color:#ca60ca;">?=</span><span style="color:#ff5500;">sdf sdf</span><span style="color:#ff5500;">)</span><span style="color:#bf0303;">ds</span><span style="color:#ff5500;">(</span><span style="color:#ff5500;">aa aa</span><span style="color:#ff5500;">)</span><span style="color:#bf0303;">df</span><span style="color:#ff5500;">[</span><span style="color:#ca60ca;">^</span><span style="color:#ff5500;"> a</span><span style="color:#ff5500;">]</span><span style="color:#bf0303;">&quot;</span>
137​<span style="color:#bf0303;">&quot;ope</span><span style="color:#bf0303;text-decoration:underline;">n</span>
138​<span style="color:#bf0303;">&quot;text\&quot;</span>aaa
139​<span style="color:#bf0303;">&quot;filename\s\w\%(?=aa)aa&quot;</span>
140​<span style="color:#bf0303;">&quot;/path</span><span style="color:#924c9d;">\s\w</span><span style="color:#ff5500;">(</span><span style="color:#ca60ca;">?=</span><span style="color:#ff5500;">aa</span><span style="color:#ff5500;">)</span><span style="color:#bf0303;">aa&quot;</span>
141​
142​<span style="color:#006e28;">u</span>:<span style="color:#006e28;">role</span>:<span style="color:#924c9d;">type</span>:<span style="color:#006e28;">sen</span>:<span style="color:#006e28;">cat</span>:other
143​<span style="color:#006e28;">u</span>:<span style="color:#006e28;">role</span>:<span style="color:#924c9d;">type</span>:<span style="color:#006e28;">sen</span>:<span style="color:#006e28;">cat</span> - <span style="color:#006e28;">sen</span>:<span style="color:#006e28;">cat</span>:other
144​<span style="color:#006e28;">u</span>:<span style="color:#006e28;">role</span>:<span style="color:#924c9d;">type</span>:<span style="color:#006e28;">s0</span>.<span style="color:#006e28;">s1</span>:<span style="color:#006e28;">c0</span> , <span style="color:#006e28;">c1</span> - <span style="color:#006e28;">s2</span>.<span style="color:#006e28;">s3</span>:<span style="color:#006e28;">c2</span>.<span style="color:#006e28;">c3</span>,<span style="color:#006e28;">c4</span>:other
145​<span style="color:#006e28;">u</span>:<span style="color:#006e28;">role</span>:<span style="color:#924c9d;">type</span>:<span style="color:#006e28;">s0</span>,other
146​</pre></body></html>