Constraints overhaul

[pebenito]

Update standard, UBAC, MCS, and MLS constraints based on human and AI review. The changes include new class sets for file-like and socket objects, expanded constraints to cover new object types and permissions, and updated documentation to ensure proper validation practices.

Key changes:

Policy constraint improvements

• Introduced new macro definitions for class sets (mls_file_like_class_set, mls_socket_class_set, mcs_file_class_set, mcs_socket_class_set, ubac_socket_class_set) to simplify and unify constraint expressions across MLS, MCS, and UBAC policies. This allows for easier maintenance and extension as new object classes are added. [1] [2] [3]
• Extended constraints to cover new file/object types such as anon_inode and memfd_file, and added new constraints and permissions for binder, bpf, perf_event, and io_uring classes. [1] [2] [3] [4]
• Expanded socket-related constraints to cover a comprehensive set of socket types, ensuring all relevant socket classes are consistently constrained under MLS, MCS, and UBAC. [1] [2] [3] [4]

Permissions and operations

• Added or extended constraints for new permissions and operations, such as various watch permissions, map, entrypoint, and additional process and database permissions, ensuring fine-grained access control. [1] [2] [3] [4] [5] [6]
• Updated ioctl handling to properly account for both read and write data flows, improving the accuracy of MLS constraints for this operation.

Database and X11 constraints

• Added new database object types (db_schema, db_view, db_sequence, db_language, db_exception, db_datatype) and new X11 types (x_pointer, x_keyboard) to UBAC constraints, ensuring these objects are properly controlled. [1] [2] [3] [4]

[wrabcak]

@pebenito thanks for PR. It's cover all issues we also discovered.