
.. Copyright

   Copyright 2023 United States Government

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.


/opt/maat/
----------------------------------------------

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |bin                                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |etc                                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |include                                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |lib                                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |share                                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/bin
----------------------------------------------

Maat top-level executables. The AM executable, attestmgr, is the only interesting binary here.
It is given the `attestmgr_exe_t` to allow it to enter the special `attestmgr_t` domain.
In common operation, attestmgr should be run as root to allow binding to a privileged port.
After initialization, attestmgr will setuid/setgid to the Maat user (as specified in its
configuration file or on the command line).

.. tabularcolumns:: |L|L|L|\Y{0.4}|l|

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rwxr-xr-x. |root  |root   |system_u:object_r:bin_t:s0                           |am_service                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|A simple DBus service for initiating local attestations AM. (no specific security attributes)                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:attestmgr_exec_t:s0                |attestmgr                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:bin_t:s0                           |graph-shell                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|A command-line utility for navigating a Maat measurement graph.                                                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:bin_t:s0                           |test_client                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|A simple command-line client for Maat to request a measurement and appraisal. (no specific security attributes)           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/etc
----------------------------------------------

System configuration directory.
This is the normal system configuration directory for the Maat install prefix. Maat doesn't touch it
so it has no specific requirements.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |maat                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/etc/maat
----------------------------------------------

Maat package configuration directory.
The Maat configuration files and credentials are installed here. This directory should have type
`attestmgr_conf_dir_t` and any configuration files it contains should have type `attestmgr_conf_t`.
This directory should be readable/executable (not writable) by the Maat user. Configuration files
must be readable by the Maat user.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:attestmgr_conf_t:s0                |attestmgr-config.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |credentials                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:attestmgr_conf_t:s0                |minimal-am-config.xml                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:attestmgr_conf_t:s0                |trusted-third-party-config.xml          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:attestmgr_conf_t:s0                |trusted-sock-am-config.xml              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:maat_places_file_t:s0              |places.xml                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/etc/maat/credentials
----------------------------------------------

Maat credentials directory.
This directory contains certificates and private keys used by Maat. Its contents should have type
`maat_certificate_t` or `maat_private_key_t` respectively. Public key certificates should be owned by
root:root (or root:wheel) but may be readable by anyone (chmod 0644). Private key files should be
readable only by the Maat user, it is suggested that they are owned by root:maat and set to user/group
read only (chmod 0440).

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:maat_certificate_t:s0              |ca.pem                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include
----------------------------------------------

System development headers include directory.
This is the normal system include directory for the Maat install prefix. Maat doesn't touch it
so it has no specific requirements. None of its subdirectories or files are used by the Maat
runtime (header files are used only at compile time) and thus none of them have specific security
requirements. They are included here only for completeness.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |maat-2.0                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0
----------------------------------------------

Maat include headers directory.
This directory contains (subdirectories for) the header files needed to build Maat components.
It is installed only by the libmaat-devel package and is not used by the Maat runtime. It has
no specific security requirements.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |apb                                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |asp                                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |client                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |common                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |graph                                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |measurement_spec                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |sgraph                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |types                                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |util                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/apb
----------------------------------------------

Maat APB include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |apb.h                                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |contracts.h                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/asp
----------------------------------------------

Maat ASP include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |asp-api.h                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/client
----------------------------------------------

Maat Client include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |maat-client.h                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/common
----------------------------------------------

Maat Common include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |apb_info.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |asp.h                                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |asp-errno.h                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |asp_info.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |copland.h                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |exe_sec_ctxt.h                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |measurement_spec.h                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |scenario.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |taint.h                                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/graph
----------------------------------------------

Maat Graph include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |graph-core.h                            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/measurement_spec
----------------------------------------------

Maat Measurement Spec include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |find_types.h                            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |meas_spec-api.h                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/sgraph
----------------------------------------------

Maat Sgraph include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |sgraph.h                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/types
----------------------------------------------

Maat Types include headers directory.

This directory contains (subdirectores for) the header files needed to make use of the basic measurement
type families provided in Maat's libmaat_basetypes.so. It is not used by the Maat runtime. It has no
specific security requirements.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |address_space                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |maat_basetypes.h                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |measurement                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |target                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/types/address_space
----------------------------------------------

Header files for address_spaces defined in the Maat libmaat_basetypes library.

+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                   |
+============+======+=======+=====================================================+===========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |address-spaces.h                           |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |dynamic_measurement_request_address_space.h|
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |file_address_space.h                       |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |file_region_address_space.h                |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |inode_address_space.h                      |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iptables_address_space.h                   |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iptables_chain_address_space.h             |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |kernel_as.h                                |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |measurement_request_address_space.h        |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |package.h                                  |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |pid_as.h                                   |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |pid_mem_range.h                            |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |simple_file.h                              |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |time_delta_address_space.h                 |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |unit_address_space.h                       |
+------------+------+-------+-----------------------------------------------------+-------------------------------------------+


/opt/maat/include/maat-2.0/types/measurement
----------------------------------------------

Header files for measurement types defined in the Maat libmaat_basetypes library.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |blob_measurement_type.h                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |elfheader_measurement_type.h            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |elf_relocs_measurement_type.h           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |enumeration_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |fds_measurement_type.h                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |filedata_measurement_type.h             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |file_metadata_measurement_type.h        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |filename_measurement_type.h             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iflistener_measurement_type.h           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |if_metadata_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |ima_measurement_type.h                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iptables_chain_measurement_type.h       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iptables_measurement_type.h             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |kernel_measurement_type.h               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |kmod_measurement_type.h                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |mappings.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |md5_measurement_type.h                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |measurement-types.h                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |mtab_measurement_type.h                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |namespaces_measurement_type.h           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_raw6_measurement_type.h         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_raw_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_tcp6_measurement_type.h         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_tcp_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_udp6_measurement_type.h         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_udp_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |netstat_unix_measurement_type.h         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |path_list.h                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |pkg_details_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |pkginv_measurement_type.h               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |process_environment_measurement_type.h  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |process_metadata_measurement_type.h     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |process_root_measurement_type.h         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |proc_relocs_measurement_type.h          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |reloc_list.h                            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |report_measurement_type.h               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |sha1hash_measurement_type.h             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |sha256_type.h                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |system_measurement_type.h               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/types/target
----------------------------------------------

Header files for target types defined in the Maat libmaat_basetypes library.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |anon_target_type.h                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |device_target_type.h                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |elf_section_target_type.h               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |file_contents_type.h                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |file_target_type.h                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iptables_chain_target_type.h            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |iptables_target_type.h                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |module.h                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |namespace_target_type.h                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |package_type.h                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |pipe_target_type.h                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |process.h                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |socket_target_type.h                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |system_target_type.h                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |target-types.h                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/include/maat-2.0/util
----------------------------------------------

Maat Util include headers directory.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |base64.h                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |checksum.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |compress.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |crypto.h                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |inet-socket.h                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |keyvalue.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |maat-io.h                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |signfile.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |sign.h                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |tpm.h                                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |unix-socket.h                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |util.h                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |validate.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |xml_util.h                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+



/opt/maat/lib
----------------------------------------------

System library directory.
This is the default system library directory for the Maat prefix. The Maat runtime libraries are
installed directly in this directory, and subdirectories are created for ASP & APB implementations.
Currently these libraries are all installed with the default `lib_t` type. This is reasonable
because allowing other applications to map the Maat libraries is not problematic. However, it
does mean that Maat's various domain types may map any library with this type, which may be
undesirable (e.g., because a malicious local administrator may modify the library search path to cause
Maat to map backdoored versions of these libraries). In the future we may move to a specialized
library type to avoid this, but it would require distributing Maat with all of its own dependencies
(including its own runtime linker/loader stub which seems like a huge pain).

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_apb-2.0.a                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_apb-2.0.la                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_apb-2.0.so                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_apb-2.0.so.0                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_apb-2.0.so.0.1.0                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_asp-2.0.a                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_asp-2.0.la                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_asp-2.0.so                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_asp-2.0.so.0                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_asp-2.0.so.0.1.0                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_basetypes.a                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_basetypes.la                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_basetypes.so                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_basetypes.so.0                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_basetypes.so.0.0.0              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_client-2.0.a                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_client-2.0.la                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_client-2.0.so                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_client-2.0.so.0                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_client-2.0.so.0.1.0             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_graph-2.0.a                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_graph-2.0.la                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_graph-2.0.so                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_graph-2.0.so.0                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_graph-2.0.so.0.0.0              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_sgraph-2.0.a                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_sgraph-2.0.la                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_sgraph-2.0.so                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_sgraph-2.0.so.0                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_sgraph-2.0.so.0.0.0             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_util-2.0.a                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_util-2.0.la                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_util-2.0.so                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|lrwxrwxrwx. |root  |root   |unconfined_u:object_r:usr_t:s0                       |libmaat_util-2.0.so.0                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_util-2.0.so.0.1.0               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |maat                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |pkgconfig                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |pythonX.x                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+

/opt/maat/lib/maat
----------------------------------------------

Maat package library directory.
Contains subdirectories with APB and ASP implementations. This directory has no specific security
requirements. The APB and ASP directories should be marked `apb_dir_t` and `asp_dir_t` respectively
to ensure that they can be properly enumerated/read by Maat components and are inaccessible outside
of Maat.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |apbs                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |asps                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/lib/maat/apbs
----------------------------------------------

APB executable installation directory.
Most APB executables are given a unique SELinux type, the SELinux policy module maat.pp defines
type transition rules to allow these types to enter APB specific domains at runtime.
These domains should be granted access to the exact set of Measurement Specification types
supported by the APB, and to the ASPs used by the APB to fulfill them.

APB executables may be installed with the `default_apb_exe_t` type, in which case they will be run
in the `default_apb_t` domain and given access to only the default set of measurement specifications
and ASPs. Because the default ASPs are not granted any interesting permissions, this is rarely
desirable.

This directory itself should have type `apb_dir_t`

This directory and its contents must be readable/executable (but not writable) by the Maat user to allow
the AM to execute any APB. Because well-behaved APBs do not perform any privileged operations,
unlike ASPS, none of these executables is expected to have its SUID or SGID bits set.

.. tabularcolumns:: |l|l|l|L|l|

+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                                |Filename                        |
+============+======+=======+=============================================================+================================+
|-rwxr-xr-x. |root  |root   |system_u:object_r:appraiser_apb_exe_t:s0                     |appraiser_apb                   |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:complex_attestation_apb_exe_t:s0           |complex_attestation_apb         |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:deleg_meas_skeleton_apb_exe_t:s0           |deleg_meas_skeleton_apb         |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:deleg_meas_appraise_skeleton_apb_exe_t:s0  |deleg_meas_appraise_skeleton_apb|
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:forwarding_apb_exe_t:s0                    |forwarding_apb                  |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:hashdir_apb_exe_t:s0                       |hashdir_apb                     |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:hashfile_apb_exe_t:s0                      |hashfile_apb                    |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:kim_apb_exe_t:s0                           |kim_apb                         |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:layered_att_apb_exe_t:s0                   |layered_att_apb                 |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:layered_appraiser_apb_exe_t:s0             |layered_appraisal_apb           |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:no_op_apb_exe_t:s0                         |no_op_apb                       |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:passport_ret_exe_t:s0                      |passport_ret_apb                |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:passport_storage_exe_t:s0                  |passport_storage_apb            |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:passport_userspace_appraiser_exe_t:s0      |passport_userspace_appraiser_apb|
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:process_measurement_apb_exe_t:s0           |process_measurement_apb         |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:request_passport_apb_exe_t:s0              |request_passport_apb            |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:userspace_apb_exe_t:s0                     |userspace_apb                   |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r: userspace_appraiser_apb_exe_t:s0          |userspace_appraiser_apb         |
+------------+------+-------+-------------------------------------------------------------+--------------------------------+

/opt/maat/lib/maat/asps
----------------------------------------------

ASP executable installation directory.
Most ASP executables are given a unique SELinux type. The SELinux policy module maat.pp defines
type transition rules to allow these types to enter the ASP specific domains at runtime.
The allow_apb_asp(abp_t, asp_exe_t, asp_t) macro defined in libmaat-asp.pp allows APBs in the domain
`apb_t` to execute ASPs installed with file type `asp_exe_t` in the domain `asp_t`.

ASPs that do not require any non-default privileges (see above) may be installed with the
`default_asp_exe_t` and run in the `default_asp_t` domain, and they will be executable by any APB.

This directory and its contents must be readable/executable (but not writable) by the Maat user to allow
the AM and APBs to execute the ASPs. ASPs requiring special permissions (e.g., reading process
state) should be installed with appropriate ownership, and their SUID or SGID bits set.

+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                              |Filename                               |
+============+======+=======+===========================================================+=======================================+
|-rwxr-xr-x. |root  |root   |system_u:object_r:blacklist_asp_exe_t:s0                   |blacklist                              |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:compress_asp_exe_t:s0                    |compress_asp                           |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:create_measurement_contract_asp_exe_t:s0 |create_measurement_contract_asp        |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:decompress_asp_exe_t:s0                  |decompress_asp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:decrypt_asp_exe_t:s0                     |decrypt_asp                            |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:deleg_meas_skeleton_asp_exe_t:s0         |deleg_meas_skeleton_asp                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:deleg_meas_appraise_skeleton_asp_exe_t:s0|deleg_meas_appraise_skeleton_asp       |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:dpkg_check_asp_exe_t:s0                  |dpkg_check_asp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:dpkg_details_asp_exe_t:s0                |dpkg_details_asp                       |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:dpkg_inv_asp_exe_t:s0                    |dpkg_inv_asp                           |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:dummy_appraisal_exe_t:s0                 |dummy_appraisal                        |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:elf_appraise_asp_exe_t:s0                |elf_appraise                           |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:readelf_asp_exe_t:s0                     |elf_reader                             |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:encrypt_asp_exe_t:s0                     |encrypt_asp                            |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:got_measure_asp_exe_t:s0                 |got_measure                            |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:got_appraise_asp_exe_t:s0                |got_appraise                           |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:hash_file_service_asp_exe_t:s0           |hashfileserviceasp                     |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:hash_service_asp_exe_t:s0                |hashserviceasp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:ima_asp_exe_t:s0                         |ima_asp                                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:kernel_msmt_asp_exe_t:s0                 |kernel_msmt_asp                        |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:list_directory_service_asp_exe_t:s0      |listdirectoryserviceasp                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lsmod_asp_exe_t:s0                       |lsmod                                  |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:lsproc_asp_exe_t:s0                      |lsprocasp                              |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:md5_file_service_asp_exe_t:s0            |md5fileserviceasp                      |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:md5_hashcheck_asp_exe_t:s0               |md5_hashcheck_asp                      |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:memory_mapping_asp_exe_t:s0              |memorymappingasp                       |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:memorymapping_appraise_asp_exe_t:s0      |memorymapping_appraise_asp             |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:merge_asp_exe_t:s0                       |merge_asp                              |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:mtab_asp_exe_t:s0                        |mtabasp                                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstatraw6asp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstatrawasp                          |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstattcp6asp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstattcpasp                          |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstatudp6asp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstatudpasp                          |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:netstat_asp_exe_t:s0                     |netstatunixasp                         |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:passport_maker_asp_exe_t:s0              |passport_maker_asp                     |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:proc_env_asp_t:s0                        |procenv                                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:proc_fds_asp_exe_t:s0                    |procfds                                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:proc_mem_asp_exe_t:s0                    |procmem                                |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:proc_namespaces_asp_exe_t:s0             |proc_namespaces_asp                    |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:proc_open_file_asp_exe_t:s0              |procopenfileasp                        |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwsr-xr-x. |root  |root   |system_u:object_r:proc_root_asp_exe_t:s0                   |procrootasp                            |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:receive_asp_exe_t:s0                     |receive_asp                            |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:rpm_details_asp_exe_t:s0                 |rpm_details_asp                        |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:rpm_inv_asp_exe_t:s0                     |rpm_inv_asp                            |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:send_execute_asp_exe_t:s0                |send_execute_asp                       |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:send_execute_tcp_asp_exe_t:s0            |send_execute_tcp_asp                   |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:send_request_asp_exe_t:s0                |send_request_asp                       |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:send_asp_exe_t:s0                        |send_asp                               |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:serialize_graph_exe_t:s0                 |serialize_graph_asp                    |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:sign_send_exe_t:s0                       |sign_send_asp                          |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:split_exe_t:s0                           |split_asp                              |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:system_appraise_asp_exe_t:s0             |system_appraise_asp                    |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:system_asp_exe_t:s0                      |system_asp                             |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:verify_measurement_contract_asp_exe_t:s0 |verify_measurement_contract_asp        |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+
|-rwxr-xr-x. |root  |root   |system_u:object_r:whitelist_asp_exe_t:s0                   |whitelist                              |
+------------+------+-------+-----------------------------------------------------------+---------------------------------------+


/opt/maat/lib/pkgconfig
----------------------------------------------

System pkg-config directory.
The is the default system directory for pkgconfig files within the Maat install prefix. The libmaat
and Maat package config files are installed here to support build-time dependency management via pkgconfig
These files are only installed by the -devel packages and are not used at runtime. They have no specific
security requirements.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_apb.pc                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_asp.pc                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_client.pc                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_graph.pc                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat.pc                              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_sgraph.pc                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_util.pc                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |maat_basetypes.pc                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/lib/pythonX.x
----------------------------------------------

Maat Python library directory. Contains Maat related Python scripts including a Maat client implmentation

The name of this directory will correspond to the default version of Python installed on your system.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |site-packages                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/lib/pythonX.x/site-packages
----------------------------------------------

Maat Python library directory. Contains Maat related Python scripts including a Maat client implmentation

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |libmaat_client.py                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:lib_t:s0                           |mq_client.py                            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+

/opt/maat/share
----------------------------------------------

System data directory.
This is a standard system data directory. Its permissions are not set by Maat.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |dbus-1                                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |maat                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |selinux                                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/dbus-1
----------------------------------------------

System DBus data directory.
This is the standard directory for dbus data files. Its permissions are not set by Maat.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |services                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/dbus-1/services
----------------------------------------------

System DBus service registration directory.
Maat installs the org.AttestationManager.service service file in this directory. Its label is
governed by the existing system policy to allow the DBus daemon to read it.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |org.AttestationManager.service          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/maat
----------------------------------------------

Top-level Maat data directory.
Contains subdirectories for APB and ASP metadata, Measurement Specifications, and Selector Configurations.
These directories and their contents are given Maat specific labels to govern their use.
The `apbs`, `asps`, and `measurement-specifications` directories must be enumerable by both the AM and
by any APB. All files in these directories must be readable by the AM, but specific files could be protected
from access by APBs, although this does not seem terribly valuable as these files should contain only public information.

The Selector Configurations file and its contents should be accessible only to the AM.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |apbs                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |asps                                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |measurement-specifications              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |selector-configurations                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/maat/apbs
----------------------------------------------

APB metadata directory.
All APB metadata files should be installed with the `apb_info_t` type to allow metadata loading
by the AM and any APB.

This directory must be readable/executable (but not writable) by the Maat user, and all files
must be readable. Metadata files are not considered sensitive, therefore it is safe to mark this
directory and its contents world readable (chmod 0755 for the directory, chmod 0644 for files.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |appraiser_apb.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |complex_att_apb.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |forwarding_apb.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |hashdir_apb.xml                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |hashfile_apb.xml                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |kim_apb.xml                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |layered_att_apb.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |layered_appraiser_apb.xml               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |no_op_apb.xml                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |passport_ret_apb.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |passport_appraiser_apb.xml              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |passport_storage_apb.xml                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |passport_userspace_appraiser_apb.xml    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |process_measurement_apb.xml             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |request_passport_apb.xml                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |userspace_apb.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:apb_info_t:s0                      |userspace_appraiser_apb.xml             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+

/opt/maat/share/maat/asps
----------------------------------------------

ASP metadata directory.
All ASP metadata files should be installed with the `asp_info_t` type to allow metadata loading
by the AM and any ASP. **NB** the ability to read these files does not confer the ability to execute
the ASP.

This directory must be readable/executable (but not writable) by the Maat user, and all files
must be readable. Metadata files are not considered sensitive, therefore it is safe to mark this
directory and its contents world readable (chmod 0755 for the directory, chmod 0644 for files.


+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |binary.whitelist                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |blacklist.xml                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |compress_asp.xml                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |create_measurement_contract_asp.xml     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |decrompress_asp.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |decrypt_asp.xml                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |distribution.whitelist                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |memorymapping_appraise_file.whitelist   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |dpkg_check_asp.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |dpkg_details_asp.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |dpkg_inv_asp.xml                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |dummy_appraisal.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |elf_appraise.xml                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |elf_reader.xml                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |got_measure.xml                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |got_appraise.xml                        |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |hashfileserviceasp.xml                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |hashserviceasp.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |ima_asp.xml                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |kernel_msmt_asp.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |listdirectoryserviceasp.xml             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |lsmod.xml                               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |lsprocasp.xml                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |md5fileserviceasp.xml                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |md5_hashcheck.whitelist                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |memorymappingasp.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |memorymapping_appraise_asp.xml          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |merge_asp.xml                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:blacklist_t:s0                     |modules.blacklist                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |modules.whitelist                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |mtabasp.xml                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstatraw6asp.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstatrawasp.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstattcp6asp.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstattcpasp.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstatudp6asp.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstatudpasp.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |netstatunixasp.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:blacklist_t:s0                     |package.blacklist                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |packages.whitelist                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |passport_maker_asp.xml                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |procenv.xml                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:blacklist_t:s0                     |process.blacklist                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:whitelist_t:s0                     |process.whitelist                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |procfds.xml                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |procmem.xml                             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |proc_namespaces_asp.xml                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |procopenfileasp.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |procrootasp.xml                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |rpm_details_asp.xml                     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |rpm_inv_asp.xml                         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |send_asp.xml                            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |send_execute_asp.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |send_execute_tcp_asp.xml                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |send_request_asp.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |serialize_graph_asp.xml                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |sign_send_asp.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |split_asp.xml                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |system_appraise_asp.xml                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |system_asp.xml                          |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |verify_measurement_contract_asp.xml     |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:asp_info_t:s0                      |whitelist.xml                           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/maat/measurement-specifications
-----------------------------------------------

.. tabularcolumns:: |L|L|L|l|l|

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |got_measure_mspec.xml                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |hashdir_mspec.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |instruction_library.xml                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |layered_measurement_mspec.xml           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |mapping_mspec.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |netstat_mspec.xml                       |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |passport_mspec.xml                      |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |proc_open_files_mspec.xml               |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |test_measurement_mspec.xml              |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |userspace_elf_mspec.xml                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |userspace_hashfiles_mspec.xml           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |userspace_measurement_mspec.xml         |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |userspace_mtab_mspec.xml                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |userspace_packages_mspec.xml            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |userspace_processes_mspec.xml           |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:measurement_spec_t:s0              |verified_userspace_mspec.xml            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/maat/selector-configurations
----------------------------------------------

Directory containing Maat AM Selector Configuration Files.
These files define the selection policy that the AM uses to determine which APBs and measurement specifications
to use for a given attestation scenario. The directory and its contents should be accessible only to the AM,
but all configuration files must be readable by the AM.

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |complex-att-selector.xml                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |layered-selector.xml                    |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |master_ui_selector.xml                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |passport-maker-selector.xml             |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |passport-selector.xml                   |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |selector.xml                            |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |userspace-selector.xml                  |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |verified-us-selector.xml                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/selinux
----------------------------------------------

Maat SELinux directory

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|drwxr-xr-x. |root  |root   |unconfined_u:object_r:usr_t:s0                       |targeted                                |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+


/opt/maat/share/selinux/targeted
----------------------------------------------

Maat SELinux policy

+------------+------+-------+-----------------------------------------------------+----------------------------------------+
|UNIX Perms  |User  |Group  |SELinux Label                                        |Filename                                |
+============+======+=======+=====================================================+========================================+
|-rw-r--r--. |root  |root   |system_u:object_r:usr_t:s0                           |maat.pp                                 |
+------------+------+-------+-----------------------------------------------------+----------------------------------------+
