[PATCH 2/7] mcs: restrict create, relabelto on mcs files

[Kenton Groombridge <me@xxxxxxxxxx>]

Signed-off-by: Kenton Groombridge <me@xxxxxxxxxx>
---
 policy/mcs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 44b57e594..d4d984e47 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -99,6 +99,9 @@ mlsconstrain file { create relabelto }
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain { file lnk_file fifo_file } { create relabelto }
+	(( l2 eq h2 ) or ( t1 != mcs_constrained_type ));
+
 mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { create relabelto }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
-- 
2.33.1