law file_deny_wins

bend-osdev-apparmor@0.1.0.0 · LAWS.bend:108

import Base
import bend-osdev-apparmor@0.1.0.0/perm.bend as P
import bend-osdev-apparmor@0.1.0.0/options.bend as O
import bend-osdev-apparmor@0.1.0.0/profile.bend as PR
import bend-osdev-apparmor@0.1.0.0/eval.bend as V
import bend-osdev-apparmor@0.1.0.0/rule_file.bend as F

108law file_deny_wins:
109  for opts: O.AaOptions
110  for p: PR.AaProfile
111  for q: F.AaFileQuery
112  for h1: {V.AaEval.deny_applies(opts, PR.AaFlags.mode(PR.AaProfile.flags(p))) == True{} : Bool}
113  for h2: {P.AaPerms.meets(F.AaFileQuery.req(q), V.AaEval.denied(F.AaFileRule.grants(PR.AaRules.files(PR.AaProfile.rules(p)), q))) == True{} : Bool}
114  {V.AaDecision.allowed(V.AaEval.file(opts, p, q)) == False{} : Bool}