• Joshua Brindle's avatar
    selinux: default_range glblub implementation · 42345b68
    Joshua Brindle authored
    A policy developer can now specify glblub as a default_range default and
    the computed transition will be the intersection of the mls range of
    the two contexts.
    
    The glb (greatest lower bound) lub (lowest upper bound) of a range is calculated
    as the greater of the low sensitivities and the lower of the high sensitivities
    and the and of each category bitmap.
    
    This can be used by MLS solution developers to compute a context that satisfies,
    for example, the range of a network interface and the range of a user logging in.
    
    Some examples are:
    
    User Permitted Range | Network Device Label | Computed Label
    ---------------------|----------------------|----------------
    s0-s1:c0.c12         | s0                   | s0
    s0-s1:c0.c12         | s0-s1:c0.c1023       | s0-s1:c0.c12
    s0-s4:c0.c512        | s1-s1:c0.c1023       | s1-s1:c0.c512
    s0-s15:c0,c2         | s4-s6:c0.c128        | s4-s6:c0,c2
    s0-s4                | s2-s6                | s2-s4
    s0-s4                | s5-s8                | INVALID
    s5-s8                | s0-s4                | INVALID
    Signed-off-by: default avatarJoshua Brindle <joshua.brindle@crunchydata.com>
    [PM: subject lines and checkpatch.pl fixes]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    42345b68
mls.c 15.8 KB