selinux-policy/refpolicy/policy/modules/system/files.if

1127 lines
23 KiB
Plaintext
Raw Normal View History

## <module name="files">
2005-06-13 19:22:00 +00:00
## <summary>
## Basic filesystem types and interfaces.
## </summary>
2005-06-23 16:00:05 +00:00
## <desc>
2005-06-13 19:22:00 +00:00
## <p>
## This module contains basic filesystem types and interfaces. This
## includes:
## <ul>
## <li>The concept of different file types including basic
## files, mount points, tmp files, etc.</li>
## <li>Access to groups of files and all files.</li>
## <li>Types and interfaces for the basic filesystem layout
## (/, /etc, /tmp, /usr, etc.).</li>
## </ul>
## </p>
2005-06-23 16:00:05 +00:00
## </desc>
2005-04-20 19:07:16 +00:00
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_file_type(type)
2005-04-14 20:18:17 +00:00
#
interface(`files_file_type',`
gen_require(`
attribute file_type;
')
2005-06-08 13:12:00 +00:00
fs_associate($1)
2005-06-10 01:01:13 +00:00
fs_associate_noxattr($1)
typeattribute $1 file_type;
2005-04-14 20:18:17 +00:00
')
2005-05-12 20:50:09 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_lock_file(type)
2005-05-12 20:50:09 +00:00
#
interface(`files_lock_file',`
gen_require(`
attribute lockfile;
')
2005-06-13 17:35:46 +00:00
files_file_type($1)
typeattribute $1 lockfile;
2005-05-12 20:50:09 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_mountpoint(type)
#
interface(`files_mountpoint',`
gen_require(`
attribute mountpoint;
')
2005-06-13 17:35:46 +00:00
files_file_type($1)
typeattribute $1 mountpoint;
')
2005-04-28 21:41:09 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_pid_file(type)
2005-04-28 21:41:09 +00:00
#
interface(`files_pid_file',`
gen_require(`
attribute pidfile;
')
2005-06-13 17:35:46 +00:00
files_file_type($1)
typeattribute $1 pidfile;
2005-04-28 21:41:09 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_tmp_file(type)
#
interface(`files_tmp_file',`
gen_require(`
attribute tmpfile;
')
2005-06-13 17:35:46 +00:00
files_file_type($1)
typeattribute $1 tmpfile;
')
2005-05-23 15:49:31 +00:00
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_tmpfs_file">
2005-06-23 16:00:05 +00:00
## <desc>
2005-05-23 15:49:31 +00:00
## Transform the type into a file, for use on a
## virtual memory filesystem (tmpfs).
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="type">
2005-05-23 15:49:31 +00:00
## The type to be transformed.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-23 15:49:31 +00:00
## </interface>
#
interface(`files_tmpfs_file',`
gen_require(`
attribute tmpfsfile;
')
2005-06-13 17:35:46 +00:00
files_file_type($1)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs($1)
typeattribute $1 tmpfsfile;
2005-05-23 15:49:31 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_getattr_all_files(domain)
2005-05-25 20:58:21 +00:00
interface(`files_getattr_all_files',`
gen_require(`
attribute file_type;
class dir { search getattr };
class file getattr;
class lnk_file getattr;
class fifo_file getattr;
class sock_file getattr;
')
allow $1 file_type:dir { search getattr };
allow $1 file_type:file getattr;
allow $1 file_type:lnk_file getattr;
allow $1 file_type:fifo_file getattr;
allow $1 file_type:sock_file getattr;
2005-04-14 20:18:17 +00:00
')
########################################
2005-05-25 20:58:21 +00:00
## <interface name="files_relabel_all_files">
2005-06-23 16:00:05 +00:00
## <desc>
2005-05-25 20:58:21 +00:00
## Relabel all files on the filesystem, except
## the listed exceptions.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
2005-05-25 20:58:21 +00:00
## The type of the domain perfoming this action.
2005-06-23 16:00:05 +00:00
## </param>
## <param name="exception_types" optional="true">
2005-05-25 20:58:21 +00:00
## The types to be excluded. Each type or attribute
## must be negated by the caller.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-25 20:58:21 +00:00
## </interface>
#
interface(`files_relabel_all_files',`
gen_require(`
attribute file_type;
class dir { r_dir_perms relabelfrom relabelto };
class file { relabelfrom relabelto };
class lnk_file { relabelfrom relabelto };
class fifo_file { relabelfrom relabelto };
class sock_file { relabelfrom relabelto };
class blk_file relabelfrom;
class chr_file relabelfrom;
')
allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };
allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };
allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };
allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };
allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };
allow $1 { file_type $2 }:blk_file { getattr relabelfrom };
allow $1 { file_type $2 }:chr_file { getattr relabelfrom };
# satisfy the assertions:
seutil_relabelto_binary_pol($1)
2005-05-25 20:58:21 +00:00
')
########################################
## <interface name="files_manage_all_files">
2005-06-23 16:00:05 +00:00
## <desc>
2005-05-25 20:58:21 +00:00
## Manage all files on the filesystem, except
## the listed exceptions.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
2005-05-25 20:58:21 +00:00
## The type of the domain perfoming this action.
2005-06-23 16:00:05 +00:00
## </param>
## <param name="exception_types" optional="true">
2005-05-25 20:58:21 +00:00
## The types to be excluded. Each type or attribute
## must be negated by the caller.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-25 20:58:21 +00:00
## </interface>
#
interface(`files_manage_all_files',`
gen_require(`
attribute file_type;
class dir create_dir_perms;
class file create_file_perms;
class lnk_file create_lnk_perms;
class fifo_file create_file_perms;
class sock_file create_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 { file_type $2 }:dir create_dir_perms;
allow $1 { file_type $2 }:file create_file_perms;
allow $1 { file_type $2 }:lnk_file create_lnk_perms;
allow $1 { file_type $2 }:fifo_file create_file_perms;
allow $1 { file_type $2 }:sock_file create_file_perms;
# satisfy the assertions:
2005-06-17 17:59:26 +00:00
seutil_create_binary_pol($1)
bootloader_manage_kernel_modules($1)
2005-05-25 20:58:21 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-04-26 21:12:32 +00:00
#
2005-06-13 17:35:46 +00:00
# files_search_all_dirs(domain)
2005-04-26 21:12:32 +00:00
#
interface(`files_search_all_dirs',`
gen_require(`
attribute file_type;
class dir search;
')
allow $1 file_type:dir search;
2005-04-26 21:12:32 +00:00
')
2005-05-11 19:05:15 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_list_all_dirs(domain)
2005-05-11 19:05:15 +00:00
#
interface(`files_list_all_dirs',`
gen_require(`
attribute file_type;
class dir r_dir_perms;
')
allow $1 file_type:dir r_dir_perms;
2005-05-11 19:05:15 +00:00
')
2005-05-02 18:40:42 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_search_all_dirs(domain)
2005-05-02 18:40:42 +00:00
#
interface(`files_dontaudit_search_all_dirs',`
gen_require(`
attribute file_type;
class dir search;
')
dontaudit $1 file_type:dir search;
2005-05-02 18:40:42 +00:00
')
2005-05-24 15:55:57 +00:00
#######################################
#
2005-06-08 13:12:00 +00:00
# files_relabelto_all_file_type_fs(domain)
2005-05-24 15:55:57 +00:00
#
interface(`files_relabelto_all_file_type_fs',`
gen_require(`
attribute file_type;
filesystem relabelto;
')
allow $1 file_type:filesystem relabelto;
2005-05-24 15:55:57 +00:00
')
#######################################
#
2005-06-08 13:12:00 +00:00
# files_mount_all_file_type_fs(domain)
2005-05-24 15:55:57 +00:00
#
interface(`files_mount_all_file_type_fs',`
gen_require(`
attribute file_type;
filesystem mount;
')
allow $1 file_type:filesystem mount;
2005-05-24 15:55:57 +00:00
')
#######################################
#
2005-06-08 13:12:00 +00:00
# files_unmount_all_file_type_fs(domain)
2005-05-24 15:55:57 +00:00
#
interface(`files_unmount_all_file_type_fs',`
gen_require(`
attribute file_type;
filesystem mount;
')
allow $1 file_type:filesystem mount;
2005-05-24 15:55:57 +00:00
')
2005-04-28 21:41:09 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_mounton_all_mountpoints(domain)
2005-04-28 21:41:09 +00:00
#
interface(`files_mounton_all_mountpoints',`
gen_require(`
attribute mountpoint;
class dir { getattr search mounton };
')
allow $1 mountpoint:dir { getattr search mounton };
2005-04-28 21:41:09 +00:00
')
########################################
2005-04-14 20:18:17 +00:00
#
2005-06-13 17:35:46 +00:00
# files_list_root(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_list_root',`
gen_require(`
type root_t;
class dir r_dir_perms;
class lnk_file r_file_perms;
')
allow $1 root_t:dir r_dir_perms;
2005-06-09 14:50:48 +00:00
allow $1 root_t:lnk_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_create_root">
2005-06-23 16:00:05 +00:00
## <desc>
2005-06-13 17:35:46 +00:00
## Create an object in the root directory, with a private
## type. If no object class is specified, the
## default is file.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
2005-06-13 17:35:46 +00:00
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
## <param name="private type" optional="true">
2005-06-13 17:35:46 +00:00
## The type of the object to be created. If no type
## is specified, the type of the root directory will
## be used.
2005-06-23 16:00:05 +00:00
## </param>
## <param name="object" optional="true">
2005-06-13 17:35:46 +00:00
## The object class of the object being created. If
## no class is specified, file will be used.
2005-06-23 16:00:05 +00:00
## </param>
2005-06-13 17:35:46 +00:00
## </interface>
2005-04-14 20:18:17 +00:00
#
interface(`files_create_root',`
gen_require(`
type root_t;
class dir create_dir_perms;
class file create_file_perms;
class lnk_file create_lnk_perms;
class fifo_file create_file_perms;
class sock_file create_file_perms;
class blk_file create_file_perms;
class chr_file create_file_perms;
')
2005-06-13 17:35:46 +00:00
allow $1 root_t:dir rw_dir_perms;
ifelse(`$3',`',`
ifelse(`$2',`',`
allow $1 root_t:file create_file_perms;
',`
type_transition $1 root_t:file $2;
')
',`
ifelse(`$2',`',`
allow $1 root_t:$3 create_file_perms;
',`
type_transition $1 root_t:$3 $2;
')
')
2005-04-14 20:18:17 +00:00
')
2005-05-02 18:40:42 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_read_root_file(domain)
2005-05-02 18:40:42 +00:00
#
interface(`files_dontaudit_read_root_file',`
gen_require(`
type root_t;
class file read;
')
dontaudit $1 root_t:file read;
2005-05-02 18:40:42 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_rw_root_file(domain)
#
interface(`files_dontaudit_rw_root_file',`
gen_require(`
type root_t;
class file { read write };
')
dontaudit $1 root_t:file { read write };
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_rw_root_chr_dev(domain)
#
interface(`files_dontaudit_rw_root_chr_dev',`
gen_require(`
type root_t;
class chr_file { read write };
')
dontaudit $1 root_t:chr_file { read write };
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_delete_root_dir_entry(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_delete_root_dir_entry',`
gen_require(`
type root_t;
class dir rw_dir_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 root_t:dir rw_dir_perms;
2005-04-14 20:18:17 +00:00
')
2005-04-28 21:41:09 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_unmount_rootfs(domain)
2005-04-28 21:41:09 +00:00
#
interface(`files_unmount_rootfs',`
gen_require(`
type root_t;
class filesystem unmount;
')
allow $1 root_t:filesystem unmount;
2005-04-28 21:41:09 +00:00
')
2005-05-11 16:48:10 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_search_etc(domain)
2005-05-11 16:48:10 +00:00
#
interface(`files_search_etc',`
2005-06-17 17:59:26 +00:00
gen_require(`
type etc_t;
class dir search;
')
allow $1 etc_t:dir search;
2005-05-11 16:48:10 +00:00
')
########################################
#
2005-06-17 17:59:26 +00:00
# files_list_etc(domain)
2005-05-11 16:48:10 +00:00
#
interface(`files_list_etc',`
2005-06-17 17:59:26 +00:00
gen_require(`
type etc_t;
class dir r_dir_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir r_dir_perms;
2005-05-11 16:48:10 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-09 17:23:53 +00:00
#
2005-06-13 17:35:46 +00:00
# files_read_generic_etc_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_read_generic_etc_files',`
gen_require(`
type etc_t;
class dir r_dir_perms;
class file r_file_perms;
class lnk_file r_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir r_dir_perms;
allow $1 etc_t:file r_file_perms;
allow $1 etc_t:lnk_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_rw_generic_etc_files(domain)
2005-05-04 19:15:13 +00:00
#
interface(`files_rw_generic_etc_files',`
gen_require(`
type etc_t;
class dir r_dir_perms;
class file rw_file_perms;
class lnk_file r_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir r_dir_perms;
allow $1 etc_t:file rw_file_perms;
allow $1 etc_t:lnk_file r_file_perms;
2005-05-04 19:15:13 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_manage_generic_etc_files(domain)
2005-05-04 19:15:13 +00:00
#
interface(`files_manage_generic_etc_files',`
gen_require(`
type etc_t;
class dir rw_dir_perms;
class file create_file_perms;
class lnk_file r_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir rw_dir_perms;
allow $1 etc_t:file create_file_perms;
allow $1 etc_t:lnk_file r_file_perms;
2005-05-04 19:15:13 +00:00
')
2005-05-23 15:49:31 +00:00
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_delete_generic_etc_files">
2005-06-23 16:00:05 +00:00
## <desc>
2005-05-23 15:49:31 +00:00
## Delete system configuration files in /etc.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
2005-05-23 15:49:31 +00:00
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-23 15:49:31 +00:00
## </interface>
#
interface(`files_delete_generic_etc_files',`
gen_require(`
type etc_t;
class dir rw_dir_perms;
class file unlink;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir rw_dir_perms;
allow $1 etc_t:file unlink;
2005-05-23 15:49:31 +00:00
')
2005-05-04 19:15:13 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_exec_generic_etc_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_exec_generic_etc_files',`
gen_require(`
type etc_t;
class dir r_dir_perms;
class lnk_file r_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir r_dir_perms;
allow $1 etc_t:lnk_file r_file_perms;
can_exec($1,etc_t)
2005-04-14 20:18:17 +00:00
')
########################################
#
# files_create_boot_flag(domain)
2005-04-14 20:18:17 +00:00
#
# /halt, /.autofsck, etc
#
interface(`files_create_boot_flag',`
gen_require(`
type root_t, etc_runtime_t;
class dir rw_dir_perms;
class file { create read write setattr unlink};
')
2005-06-09 14:50:48 +00:00
allow $1 root_t:dir rw_dir_perms;
allow $1 etc_runtime_t:file { create read write setattr unlink };
type_transition $1 root_t:file etc_runtime_t;
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_manage_etc_runtime_files(type)
2005-04-14 20:18:17 +00:00
#
interface(`files_manage_etc_runtime_files',`
gen_require(`
type etc_t, etc_runtime_t;
class dir rw_dir_perms;
class file create_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir rw_dir_perms;
allow $1 etc_runtime_t:file create_file_perms;
type_transition $1 etc_t:file etc_runtime_t;
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_read_etc_runtime_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_read_etc_runtime_files',`
gen_require(`
type etc_t, etc_runtime_t;
class dir r_dir_perms;
class file r_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 etc_t:dir r_dir_perms;
allow $1 etc_runtime_t:file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_create_etc_config(domain,privatetype,[class(es)])
2005-04-14 20:18:17 +00:00
#
interface(`files_create_etc_config',`
gen_require(`
type etc_t;
class dir rw_dir_perms;
')
allow $1 etc_t:dir rw_dir_perms;
ifelse(`$3',`',`
type_transition $1 etc_t:file $2;
',`
type_transition $1 etc_t:$3 $2;
')
2005-04-14 20:18:17 +00:00
')
2005-06-01 13:51:54 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_rw_isid_type_dir(domain)
2005-06-01 13:51:54 +00:00
#
interface(`files_rw_isid_type_dir',`
gen_require(`
type file_t;
class dir rw_dir_perms;
')
allow $1 file_t:dir rw_dir_perms;
2005-06-01 13:51:54 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_getattr_isid_type_dir(domain)
#
interface(`files_dontaudit_getattr_isid_type_dir',`
gen_require(`
type file_t;
class dir search;
')
dontaudit $1 file_t:dir search;
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_search_isid_type_dir(domain)
#
interface(`files_dontaudit_search_isid_type_dir',`
gen_require(`
type file_t;
class dir search;
')
dontaudit $1 file_t:dir search;
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_list_home">
2005-06-23 16:00:05 +00:00
## <desc>
## Get listing home home directories.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
## </interface>
2005-04-14 20:18:17 +00:00
#
interface(`files_list_home',`
gen_require(`
type home_root_t;
class dir r_dir_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 home_root_t:dir r_dir_perms;
2005-04-14 20:18:17 +00:00
')
2005-05-26 20:38:45 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_list_mnt(domain)
2005-05-26 20:38:45 +00:00
#
interface(`files_list_mnt',`
gen_require(`
type mnt_t;
class dir r_dir_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 mnt_t:dir r_dir_perms;
2005-05-26 20:38:45 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_create_tmp_files(domain,private_type,[object class(es)])
2005-04-14 20:18:17 +00:00
#
interface(`files_create_tmp_files',`
gen_require(`
type tmp_t;
class dir rw_dir_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 tmp_t:dir rw_dir_perms;
ifelse(`$3',`',`
type_transition $1 tmp_t:file $2;
',`
type_transition $1 tmp_t:$3 $2;
')
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_delete_all_tmp_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_delete_all_tmp_files',`
gen_require(`
attribute tmpfile;
class dir { getattr search read write add_name remove_name rmdir };
class file { getattr unlink };
class lnk_file { getattr unlink };
class fifo_file { getattr unlink };
class sock_file { getattr unlink };
')
allow $1 tmpfile:dir { getattr search read write add_name remove_name rmdir };
allow $1 tmpfile:file { getattr unlink };
allow $1 tmpfile:lnk_file { getattr unlink };
allow $1 tmpfile:fifo_file { getattr unlink };
allow $1 tmpfile:sock_file { getattr unlink };
2005-04-14 20:18:17 +00:00
')
2005-05-25 20:58:21 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_search_usr(domain)
2005-05-25 20:58:21 +00:00
#
interface(`files_search_usr',`
gen_require(`
type usr_t;
class dir search;
')
allow $1 usr_t:dir search;
2005-05-25 20:58:21 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_read_usr_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_read_usr_files',`
gen_require(`
type usr_t;
class dir r_dir_perms;
class file r_file_perms;
class lnk_file r_file_perms;
')
2005-06-09 14:50:48 +00:00
allow $1 usr_t:dir r_dir_perms;
allow $1 usr_t:{ file lnk_file } r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_exec_usr_files">
2005-06-23 16:00:05 +00:00
## <desc>
## Execute programs in /usr/src in the caller domain.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
## </interface>
#
interface(`files_exec_usr_files',`
gen_require(`
type usr_t, src_t;
class dir r_dir_perms;
class lnk_file r_file_perms;
')
allow $1 usr_t:dir search;
2005-06-09 14:50:48 +00:00
allow $1 src_t:dir r_dir_perms;
allow $1 src_t:lnk_file r_file_perms;
can_exec($1,src_t)
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_read_usr_src(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_read_usr_src',`
gen_require(`
type usr_t, src_t;
class dir r_dir_perms;
class file r_file_perms;
class lnk_file r_file_perms;
')
allow $1 usr_t:dir search;
2005-06-09 14:50:48 +00:00
allow $1 src_t:dir r_dir_perms;
allow $1 src_t:{ file lnk_file } r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_search_var(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_search_var',`
gen_require(`
type var_t;
class dir search;
')
allow $1 var_t:dir search;
2005-04-14 20:18:17 +00:00
')
2005-05-05 17:44:11 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_search_var(domain)
2005-05-05 17:44:11 +00:00
#
interface(`files_dontaudit_search_var',`
gen_require(`
type var_t;
class dir search;
')
dontaudit $1 var_t:dir search;
2005-05-05 17:44:11 +00:00
')
########################################
## <interface name="files_search_var_lib">
2005-06-23 16:00:05 +00:00
## <desc>
## Search the /var/lib directory.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
## </interface>
#
interface(`files_search_var_lib',`
gen_require(`
type var_t, var_lib_t;
class dir search;
')
allow $1 { var_t var_lib_t }:dir search;
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_manage_urandom_seed(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_manage_urandom_seed',`
gen_require(`
type var_t, var_lib_t;
class dir rw_file_perms;
class file { getattr create read write setattr unlink };
')
allow $1 var_t:dir search;
2005-06-10 01:01:13 +00:00
allow $1 var_lib_t:dir rw_dir_perms;
allow $1 var_lib_t:file { getattr create read write setattr unlink };
2005-04-14 20:18:17 +00:00
')
2005-05-24 15:55:57 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_getattr_generic_lock_files(domain)
2005-05-24 15:55:57 +00:00
#
interface(`files_getattr_generic_lock_files',`
gen_require(`
type var_lock_t;
class dir r_dir_perms;
class file getattr;
')
2005-06-09 14:50:48 +00:00
allow $1 var_lock_t:dir r_dir_perms;
allow $1 var_lock_t:file getattr;
2005-05-24 15:55:57 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_manage_generic_lock_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_manage_generic_lock_files',`
gen_require(`
type var_lock_t;
class dir { getattr search create read write setattr add_name remove_name rmdir };
class file { getattr create read write setattr unlink };
')
allow $1 var_lock_t:dir { getattr search create read write setattr add_name remove_name rmdir };
allow $1 var_lock_t:file { getattr create read write setattr unlink };
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_delete_all_lock_files(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_delete_all_lock_files',`
gen_require(`
attribute lockfile;
class dir rw_dir_perms;
class file { getattr unlink };
')
2005-06-10 01:01:13 +00:00
allow $1 lockfile:dir rw_dir_perms;
allow $1 lockfile:file { getattr unlink };
2005-04-14 20:18:17 +00:00
')
2005-05-12 20:50:09 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_create_lock_file(domain,private_type,[object class(es)])
2005-05-12 20:50:09 +00:00
#
interface(`files_create_lock_file',`
gen_require(`
type var_t, var_lock_t;
class dir rw_dir_perms;
')
allow $1 var_t:dir search;
allow $1 var_lock_t:dir rw_dir_perms;
ifelse(`$3',`',`
type_transition $1 var_lock_t:file $2;
',`
type_transition $1 var_lock_t:$3 $2;
')
2005-05-12 20:50:09 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_search_pids(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_search_pids',`
gen_require(`
type var_t, var_run_t;
class dir search;
')
allow $1 var_t:dir search;
allow $1 var_run_t:dir search;
2005-04-14 20:18:17 +00:00
')
2005-05-12 20:50:09 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_dontaudit_search_pids(domain)
2005-05-12 20:50:09 +00:00
#
interface(`files_dontaudit_search_pids',`
gen_require(`
type var_run_t;
class dir search;
')
allow $1 var_run_t:dir search;
2005-05-12 20:50:09 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_list_pids(domain)
2005-04-14 20:18:17 +00:00
#
interface(`files_list_pids',`
gen_require(`
type var_t, var_run_t;
class dir r_dir_perms;
')
allow $1 var_t:dir search;
2005-06-09 14:50:48 +00:00
allow $1 var_run_t:dir r_dir_perms;
2005-04-14 20:18:17 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_create_pid(domain,pidfile,[object class(es)])
#
interface(`files_create_pid',`
gen_require(`
type var_t, var_run_t;
class dir rw_dir_perms;
')
allow $1 var_t:dir search;
allow $1 var_run_t:dir rw_dir_perms;
ifelse(`$3',`',`
type_transition $1 var_run_t:file $2;
',`
type_transition $1 var_run_t:$3 $2;
')
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_rw_generic_pids(domain)
#
interface(`files_rw_generic_pids',`
gen_require(`
type var_t, var_run_t;
class dir r_dir_perms;
class file rw_file_perms;
')
allow $1 var_t:dir search;
2005-06-09 14:50:48 +00:00
allow $1 var_run_t:dir r_dir_perms;
allow $1 var_run_t:file rw_file_perms;
')
2005-05-24 15:55:57 +00:00
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_dontaudit_write_all_pids">
2005-06-23 16:00:05 +00:00
## <desc>
2005-05-24 15:55:57 +00:00
## Do not audit attempts to write to daemon runtime data files.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
2005-05-24 15:55:57 +00:00
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-24 15:55:57 +00:00
## </interface>
#
interface(`files_dontaudit_write_all_pids',`
gen_require(`
attribute pidfile;
class file write;
')
dontaudit $1 pidfile:file write;
2005-05-24 15:55:57 +00:00
')
########################################
2005-06-13 17:35:46 +00:00
## <interface name="files_dontaudit_ioctl_all_pids">
2005-06-23 16:00:05 +00:00
## <desc>
2005-05-24 15:55:57 +00:00
## Do not audit attempts to ioctl daemon runtime data files.
2005-06-23 16:00:05 +00:00
## </desc>
## <param name="domain">
2005-05-24 15:55:57 +00:00
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-24 15:55:57 +00:00
## </interface>
#
interface(`files_dontaudit_ioctl_all_pids',`
gen_require(`
attribute pidfile;
class file ioctl;
')
dontaudit $1 pidfile:file ioctl;
2005-05-24 15:55:57 +00:00
')
2005-05-31 23:02:11 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_read_all_pids(domain)
2005-05-31 23:02:11 +00:00
#
interface(`files_read_all_pids',`
gen_require(`
attribute pidfile;
type var_t;
class dir r_dir_perms;
class file r_file_perms;
')
allow $1 var_t:dir search;
allow $1 pidfile:dir r_dir_perms;
allow $1 pidfile:file r_file_perms;
2005-05-31 23:02:11 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_delete_all_pids(domain)
#
interface(`files_delete_all_pids',`
gen_require(`
attribute pidfile;
type var_t, var_run_t;
class dir rw_dir_perms;
class file { getattr unlink };
class lnk_file { getattr unlink };
class sock_file { getattr unlink };
')
allow $1 var_t:dir search;
allow $1 var_run_t:{ sock_file lnk_file } { getattr unlink };
allow $1 var_run_t:dir rmdir;
allow $1 pidfile:dir rw_dir_perms;
allow $1 pidfile:file { getattr unlink };
allow $1 pidfile:sock_file { getattr unlink };
')
2005-05-13 14:37:13 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_search_spool(domain)
2005-05-13 14:37:13 +00:00
#
interface(`files_search_spool',`
gen_require(`
type var_t, var_spool_t;
class dir search;
')
allow $1 var_t:dir search;
allow $1 var_spool_t:dir search;
2005-05-13 14:37:13 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_list_spool(domain)
2005-05-13 14:37:13 +00:00
#
interface(`files_list_spool',`
gen_require(`
type var_t, var_spool_t;
class dir r_dir_perms;
')
allow $1 var_t:dir search;
2005-06-09 14:50:48 +00:00
allow $1 var_spool_t:dir r_dir_perms;
2005-05-13 14:37:13 +00:00
')
2005-05-25 20:58:21 +00:00
########################################
#
2005-06-13 17:35:46 +00:00
# files_read_spools(domain)
2005-05-25 20:58:21 +00:00
#
interface(`files_read_spools',`
gen_require(`
type var_t, var_spool_t;
class dir r_dir_perms;
class file r_file_perms;
')
allow $1 var_t:dir search;
2005-06-09 14:50:48 +00:00
allow $1 var_spool_t:dir r_dir_perms;
allow $1 var_spool_t:file r_file_perms;
2005-05-25 20:58:21 +00:00
')
########################################
#
2005-06-13 17:35:46 +00:00
# files_manage_spools(domain)
2005-05-25 20:58:21 +00:00
#
interface(`files_manage_spools',`
gen_require(`
type var_t, var_spool_t;
class dir rw_dir_perms;
class file create_file_perms;
')
allow $1 var_t:dir search;
2005-06-10 01:01:13 +00:00
allow $1 var_spool_t:dir rw_dir_perms;
allow $1 var_spool_t:file create_file_perms;
2005-05-25 20:58:21 +00:00
')
2005-05-18 21:00:00 +00:00
## </module>