[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/

[Jason Zaman]

commit:     e65914649a2dc3fae590c9df612c70b957a6ef5d
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Tue Nov  9 18:59:08 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Nov 20 22:58:24 2021 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=e6591464

mcs: only constrain mcs_constrained_type for db accesses

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/mcs | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/policy/mcs b/policy/mcs
index 023bd149..c9b7e83e 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -133,41 +133,41 @@ mlsconstrain context contains
 # Any database object must be dominated by the relabeling subject
 # clearance, also the objects are single-level.
 mlsconstrain { db_database db_schema db_table db_sequence db_view db_procedure db_language db_column db_blob } { create relabelto }
-	(( h1 dom h2 ) and ( l2 eq h2 ));
+	((( h1 dom h2 ) and ( l2 eq h2 )) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { db_tuple } { insert relabelto }
-	(( h1 dom h2 ) and ( l2 eq h2 ));
+	((( h1 dom h2 ) and ( l2 eq h2 )) or ( t1 != mcs_constrained_type ));
 
 # Access control for any database objects based on MCS rules.
 mlsconstrain db_database { drop getattr setattr relabelfrom access install_module load_module get_param set_param }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_schema { drop getattr setattr relabelfrom search }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_table { drop getattr setattr relabelfrom select update insert delete lock }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_column { drop getattr setattr relabelfrom select update insert }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_tuple { relabelfrom select update delete use }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_sequence { drop getattr setattr relabelfrom get_value next_value set_value }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_view { drop getattr setattr relabelfrom expand }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_procedure { drop getattr setattr relabelfrom execute install entrypoint }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_language { drop getattr setattr relabelfrom execute }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
-	( h1 dom h2 );
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));