[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/

[Jason Zaman]

commit:     7a1357306b6dd8d46b4b8ee2bc1c8cb3f70376b0
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Wed Oct 13 15:27:23 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Nov 20 22:58:24 2021 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7a135730

mcs: restrict create, relabelto on mcs files

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/mcs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 44b57e59..d4d984e4 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -99,6 +99,9 @@ mlsconstrain file { create relabelto }
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { 
relabelfrom }
        (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain { file lnk_file fifo_file } { create relabelto }
+       (( l2 eq h2 ) or ( t1 != mcs_constrained_type ));
+
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { 
create relabelto }
        (( h1 dom h2 ) or ( t1 != mcs_constrained_type ));