Limitations/rules: creating an object

When creating an object, the application applies rules binding the type and role of the creating subject and the type of parent container to the type that is assigned to the new subject.

source_type, source_role and container_type elements

The create_object element can contain multiple rules. Rules are applied sequentially (the order is important) until the first rule that does not conflict with the combination of source_type, source_role, and container values is found. In other words, to apply a rule, the following is required:

• The subject type matches one of the types indicated in source_type.
• One of the subject roles matches one of the roles indicated in source_role.
• The type of container in which the object is being created matches one of the types indicated in container_type.

Options for assigning a type to the subject that initiated creation of the new object (source_type element):

• Specific type: source_type: core
• List of types: source_type: [core, dispatcher]
• Any type: source_type: @any

Options for assigning a role to the subject that initiated creation of the new object (source_role element):

• Specific role: source_role: system
• List of roles: source_role : [system, user]
• Any role: source_role: @any

Options for assigning a type to the container in which the new object is being created (container_type element):

• Specific type: container_type: core
• Type corresponding to the type of initiating entity: container_type : @source_type
• List of types: container_type: [core, dispatcher, @source_type]
• Any type: container_type : @any

target_type and target_type_auto elements

The target_type and target_type_auto elements are used to determine the permissible types for the object being created.

The target_type element is used when the desired type is indicated during object creation, and the target_type_auto element is used when the desired type is not indicated and the policy has to independently determine the permissible type.

Options for assigning permissible types if the type is explicitly indicated (target_type element):

• Specific type: target_type: core
• Type corresponding to the type of initiating entity: target_type: @source_type
• Type corresponding to the type of container object: target_type: @container_type
• List of types: target_type: [core, dispatcher, @container_type]
• Any type: target_type: @any

Assignment of the desired type to the new subject will be allowed if this type matches one of the types indicated in target_type. If the target_type element is not defined, explicit type assignment is denied.

Options for defining an automatically assigned type if the type is not explicitly indicated (target_type_auto element):

• Specific type: target_type_auto: core
• Type corresponding to the type of initiating entity: target_type_auto: @source_type
• Type corresponding to the type of container object: target_type_auto: @container_type

The type indicated in target_type_auto will be assigned to the subject being created. If the target_type_auto field is not defined, implicit type assignment is denied.

target_role and target_role_auto elements

The target_role and target_role_auto elements are used to determine the permissible roles for the subject being created.

The target_role element is used when the desired roles are indicated during subject creation, and the target_role_auto element is used when the desired roles are not indicated and the policy has to independently determine the necessary roles.

Options for assigning permissible roles when roles are explicitly indicated (target_role_ element):

• Specific role: target_role: core
• List of roles: target_role: [core, dispatcher]
• Roles matching the roles of the initiating entity: target_role: @source_role
• Any role: target_role: @any

Assignment of the desired roles to the new subject will be allowed if these roles are a subset of the roles indicated in target_role. If the target_role element is not defined, explicit role assignment is denied.

Options for defining automatically assigned roles if roles are not explicitly indicated (target_role_auto element):

• Specific role: target_role_auto: core
• List of roles: target_role_auto: [core, dispatcher]
• Roles matching the roles of the initiating entity: target_role_auto: @source_roles
• Any role: target_role_auto: @any

The type indicated in target_role_auto will be assigned to the subject being created. If the target_role_auto element is not defined, implicit type assignment is denied.

Example

create_object: {

{ source_type: realm

, source_role: system

, container_type: app_file

, target_type_auto: @container_type

},

{ source_type: realm

, source_role: system

, container_type: @source_type

, target_type: [app_file, secure_file]

},

}

Page top