selinux-policy/policy/modules/system/modutils.te


policy_module(modutils, 1.10.0)

gen_require(`
	bool secure_mode_insmod;
')

########################################
#
# Declarations
#

type depmod_t;
type depmod_exec_t;
init_system_domain(depmod_t, depmod_exec_t)
role system_r types depmod_t;

type insmod_t;
type insmod_exec_t;
application_domain(insmod_t, insmod_exec_t)
mls_file_write_all_levels(insmod_t)
role system_r types insmod_t;

# module loading config
type modules_conf_t;
files_type(modules_conf_t)

# module dependencies
type modules_dep_t;
files_type(modules_dep_t)

type update_modules_t;
type update_modules_exec_t;
init_system_domain(update_modules_t, update_modules_exec_t)
role system_r types update_modules_t;

type update_modules_tmp_t;
files_tmp_file(update_modules_tmp_t)

########################################
#
# depmod local policy
#

can_exec(depmod_t, depmod_exec_t)

# Read conf.modules.
read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)

allow depmod_t modules_dep_t:file manage_file_perms;
files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)

kernel_read_system_state(depmod_t)

corecmd_search_bin(depmod_t)

domain_use_interactive_fds(depmod_t)

files_read_kernel_symbol_table(depmod_t)
files_read_kernel_modules(depmod_t)
files_read_etc_runtime_files(depmod_t)
files_read_etc_files(depmod_t)
files_read_usr_src_files(depmod_t)
files_list_usr(depmod_t)

fs_getattr_xattr_fs(depmod_t)

term_use_console(depmod_t)

init_use_fds(depmod_t)
init_use_script_fds(depmod_t)
init_use_script_ptys(depmod_t)

userdom_use_user_terminals(depmod_t)
# Read System.map from home directories.
files_list_home(depmod_t)
userdom_read_user_home_content_files(depmod_t)

ifdef(`distro_ubuntu',`
	optional_policy(`
		unconfined_domain(depmod_t)
	')
')

tunable_policy(`use_nfs_home_dirs',`
	fs_read_nfs_files(depmod_t)
')

tunable_policy(`use_samba_home_dirs',`
	fs_read_cifs_files(depmod_t)
')

optional_policy(`
	rpm_rw_pipes(depmod_t)
	rpm_manage_script_tmp_files(depmod_t)
')

optional_policy(`
	# Read System.map from home directories.
	unconfined_domain(depmod_t)
')

########################################
#
# insmod local policy
#

allow insmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };

allow insmod_t self:udp_socket create_socket_perms;
allow insmod_t self:rawip_socket create_socket_perms;

# Read module config and dependency information
list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)
read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)
list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)
read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)

can_exec(insmod_t, insmod_exec_t)

kernel_load_module(insmod_t)
kernel_read_system_state(insmod_t)
kernel_read_network_state(insmod_t)
kernel_write_proc_files(insmod_t)
kernel_mount_debugfs(insmod_t)
kernel_mount_kvmfs(insmod_t)
kernel_read_debugfs(insmod_t)
# Rules for /proc/sys/kernel/tainted
kernel_read_kernel_sysctls(insmod_t)
kernel_rw_kernel_sysctl(insmod_t)
kernel_read_hotplug_sysctls(insmod_t)
kernel_setsched(insmod_t)

corecmd_exec_bin(insmod_t)
corecmd_exec_shell(insmod_t)

dev_rw_sysfs(insmod_t)
dev_search_usbfs(insmod_t)
dev_rw_mtrr(insmod_t)
dev_read_urand(insmod_t)
dev_rw_agp(insmod_t)
dev_read_sound(insmod_t)
dev_write_sound(insmod_t)
dev_rw_apm_bios(insmod_t)

domain_signal_all_domains(insmod_t)
domain_use_interactive_fds(insmod_t)

files_read_kernel_modules(insmod_t)
files_read_etc_runtime_files(insmod_t)
files_read_etc_files(insmod_t)
files_read_usr_files(insmod_t)
files_exec_etc_files(insmod_t)
# for nscd:
files_dontaudit_search_pids(insmod_t)
# for when /var is not mounted early in the boot:
files_dontaudit_search_isid_type_dirs(insmod_t)
# for locking: (cjp: ????)
files_write_kernel_modules(insmod_t)

fs_getattr_xattr_fs(insmod_t)
fs_dontaudit_use_tmpfs_chr_dev(insmod_t)

init_rw_initctl(insmod_t)
init_use_fds(insmod_t)
init_use_script_fds(insmod_t)
init_use_script_ptys(insmod_t)

logging_send_syslog_msg(insmod_t)
logging_search_logs(insmod_t)

miscfiles_read_localization(insmod_t)

seutil_read_file_contexts(insmod_t)

userdom_use_user_terminals(insmod_t)

userdom_dontaudit_search_user_home_dirs(insmod_t)

if( ! secure_mode_insmod ) {
	kernel_domtrans_to(insmod_t, insmod_exec_t)
}

optional_policy(`
	alsa_domtrans(insmod_t)
')

optional_policy(`
	firstboot_dontaudit_rw_pipes(insmod_t)
	firstboot_dontaudit_rw_stream_sockets(insmod_t)
')

optional_policy(`
	hal_write_log(insmod_t)
')

optional_policy(`
	hotplug_search_config(insmod_t)
')

optional_policy(`
	mount_domtrans(insmod_t)
')

optional_policy(`
	nis_use_ypbind(insmod_t)
')

optional_policy(`
	nscd_socket_use(insmod_t)
')

optional_policy(`
	fs_manage_ramfs_files(insmod_t)

	rhgb_use_fds(insmod_t)
	rhgb_dontaudit_use_ptys(insmod_t)

	xserver_dontaudit_write_log(insmod_t)
	xserver_stream_connect(insmod_t)
	xserver_dontaudit_rw_stream_sockets(insmod_t)

	ifdef(`hide_broken_symptoms',`
		xserver_dontaudit_rw_tcp_sockets(insmod_t)
	')
')

optional_policy(`
	rpm_rw_pipes(insmod_t)
')

optional_policy(`
	unconfined_domain(insmod_t)
	unconfined_dontaudit_rw_pipes(insmod_t)
')

optional_policy(`
	# cjp: why is this needed:
	dev_rw_xserver_misc(insmod_t)

	xserver_getattr_log(insmod_t)
')

#################################
#
# update-modules local policy
#

allow update_modules_t self:fifo_file rw_fifo_file_perms;

allow update_modules_t modules_dep_t:file rw_file_perms;

can_exec(update_modules_t, insmod_exec_t)
can_exec(update_modules_t, update_modules_exec_t)

# manage module loading configuration
manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)
files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)
files_etc_filetrans(update_modules_t, modules_conf_t, file)

# transition to depmod
domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)
allow update_modules_t depmod_t:fd use;
allow depmod_t update_modules_t:fd use;
allow depmod_t update_modules_t:fifo_file rw_file_perms;
allow depmod_t update_modules_t:process sigchld;

manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)
files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })

kernel_read_kernel_sysctls(update_modules_t)
kernel_read_system_state(update_modules_t)

corecmd_exec_bin(update_modules_t)
corecmd_exec_shell(update_modules_t)

dev_read_urand(update_modules_t)

domain_use_interactive_fds(update_modules_t)

files_read_etc_runtime_files(update_modules_t)
files_read_etc_files(update_modules_t)
files_exec_etc_files(update_modules_t)

fs_getattr_xattr_fs(update_modules_t)

term_use_console(update_modules_t)

init_use_fds(update_modules_t)
init_use_script_fds(update_modules_t)
init_use_script_ptys(update_modules_t)

logging_send_syslog_msg(update_modules_t)

miscfiles_read_localization(update_modules_t)

userdom_use_user_terminals(update_modules_t)
userdom_dontaudit_search_user_home_dirs(update_modules_t)

ifdef(`distro_gentoo',`
	files_search_pids(update_modules_t)
	files_getattr_usr_src_files(update_modules_t)
	files_list_isid_type_dirs(update_modules_t) # /var

	# update-modules on Gentoo throws errors when run because it
	# sources /etc/init.d/functions.sh, which always scans
	# /var/lib/init.d to set SOFTLEVEL environment var.
	# This is never used by update-modules.
	files_dontaudit_search_var_lib(update_modules_t)
	init_dontaudit_read_script_status_files(update_modules_t)

	optional_policy(`
		consoletype_exec(update_modules_t)
	')
')

ifdef(`distro_ubuntu',`
	optional_policy(`
		unconfined_domain(update_modules_t)
	')
')
add copyright statement 2005-04-20 19:07:16 +00:00
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(modutils, 1.10.0)`
add module statement macro and entrypoint executable attribute to replicate can_exec($1,exec_type) 2005-04-26 17:00:25 +00:00
fix several modular build problems 2005-11-29 21:27:15 +00:00			gen_require(`
			`bool secure_mode_insmod;`
			`')`

make a reasonable lib_t interface 2005-05-11 15:46:51 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`type depmod_t;`
			`type depmod_exec_t;`
			`init_system_domain(depmod_t, depmod_exec_t)`
			`role system_r types depmod_t;`
initial commit 2005-04-14 20:18:17 +00:00
add mls privileges 2005-09-26 20:26:32 +00:00			`type insmod_t;`
initial commit 2005-04-14 20:18:17 +00:00			`type insmod_exec_t;`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`application_domain(insmod_t, insmod_exec_t)`
trunk: Deprecate mls_file_write_down() and mls_file_read_up(), replaced with mls_write_all_levels() and mls_read_all_levels(), for consistency. 2007-08-20 18:26:08 +00:00			`mls_file_write_all_levels(insmod_t)`
convert over to system_domain, plus a couple init cleanups 2005-05-05 18:30:00 +00:00			`role system_r types insmod_t;`
initial commit 2005-04-14 20:18:17 +00:00
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`# module loading config`
			`type modules_conf_t;`
			`files_type(modules_conf_t)`

			`# module dependencies`
			`type modules_dep_t;`
			`files_type(modules_dep_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
			`type update_modules_t;`
			`type update_modules_exec_t;`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`init_system_domain(update_modules_t, update_modules_exec_t)`
convert over to system_domain, plus a couple init cleanups 2005-05-05 18:30:00 +00:00			`role system_r types update_modules_t;`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
clean up some filesystem assoc 2005-04-21 22:46:49 +00:00			`type update_modules_tmp_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_tmp_file(update_modules_tmp_t)`
clean up some filesystem assoc 2005-04-21 22:46:49 +00:00
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`########################################`
			`#`
			`# depmod local policy`
			`#`

			`can_exec(depmod_t, depmod_exec_t)`

			`# Read conf.modules.`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`read_files_pattern(depmod_t, modules_conf_t, modules_conf_t)`
fix ordering in modutils. 2009-08-05 14:11:08 +00:00
			`allow depmod_t modules_dep_t:file manage_file_perms;`
			`files_kernel_modules_filetrans(depmod_t, modules_dep_t, file)`

			`kernel_read_system_state(depmod_t)`

			`corecmd_search_bin(depmod_t)`

			`domain_use_interactive_fds(depmod_t)`

			`files_read_kernel_symbol_table(depmod_t)`
			`files_read_kernel_modules(depmod_t)`
			`files_read_etc_runtime_files(depmod_t)`
			`files_read_etc_files(depmod_t)`
			`files_read_usr_src_files(depmod_t)`
			`files_list_usr(depmod_t)`

			`fs_getattr_xattr_fs(depmod_t)`

			`term_use_console(depmod_t)`

			`init_use_fds(depmod_t)`
			`init_use_script_fds(depmod_t)`
			`init_use_script_ptys(depmod_t)`

			`userdom_use_user_terminals(depmod_t)`
			`# Read System.map from home directories.`
			`files_list_home(depmod_t)`
			`userdom_read_user_home_content_files(depmod_t)`

			ifdef(`distro_ubuntu',`
			optional_policy(`
			`unconfined_domain(depmod_t)`
			`')`
			`')`

Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			tunable_policy(`use_nfs_home_dirs',`
			`fs_read_nfs_files(depmod_t)`
			`')`

			tunable_policy(`use_samba_home_dirs',`
			`fs_read_cifs_files(depmod_t)`
			`')`

fix ordering in modutils. 2009-08-05 14:11:08 +00:00			optional_policy(`
			`rpm_rw_pipes(depmod_t)`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`rpm_manage_script_tmp_files(depmod_t)`
			`')`

			optional_policy(`
			`# Read System.map from home directories.`
			`unconfined_domain(depmod_t)`
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`')`

more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00			`########################################`
			`#`
			`# insmod local policy`
			`#`

Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`allow insmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00			`allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };`

Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`allow insmod_t self:udp_socket create_socket_perms;`
			`allow insmod_t self:rawip_socket create_socket_perms;`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
reorder for more consistency 2005-05-11 15:22:28 +00:00			`# Read module config and dependency information`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`list_dirs_pattern(insmod_t, modules_conf_t, modules_conf_t)`
			`read_files_pattern(insmod_t, modules_conf_t, modules_conf_t)`
			`list_dirs_pattern(insmod_t, modules_dep_t, modules_dep_t)`
			`read_files_pattern(insmod_t, modules_dep_t, modules_dep_t)`
reorder for more consistency 2005-05-11 15:22:28 +00:00
aliases 2005-06-09 14:26:05 +00:00			`can_exec(insmod_t, insmod_exec_t)`
reorder for more consistency 2005-05-11 15:22:28 +00:00
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00			`kernel_load_module(insmod_t)`
fixes from cab 2005-05-26 20:38:45 +00:00			`kernel_read_system_state(insmod_t)`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`kernel_read_network_state(insmod_t)`
TODO cleanup 2006-04-03 19:49:47 +00:00			`kernel_write_proc_files(insmod_t)`
final updates from nsa cvs 2005-09-19 21:17:45 +00:00			`kernel_mount_debugfs(insmod_t)`
- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes to handle usage from userhelper. 2007-05-02 17:31:38 +00:00			`kernel_mount_kvmfs(insmod_t)`
more merging from 1.27.1-15 2005-10-14 17:55:40 +00:00			`kernel_read_debugfs(insmod_t)`
initial commit 2005-04-14 20:18:17 +00:00			`# Rules for /proc/sys/kernel/tainted`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(insmod_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`kernel_rw_kernel_sysctl(insmod_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_hotplug_sysctls(insmod_t)`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`kernel_setsched(insmod_t)`
initial commit 2005-04-14 20:18:17 +00:00
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`corecmd_exec_bin(insmod_t)`
			`corecmd_exec_shell(insmod_t)`
move modules_object_t back to bootloader 2005-04-25 21:32:09 +00:00
5 patches from dan. confine insmod and udev on targeted, misc fc fixes, sasl kerberos use, and samba port fixes 2007-04-11 17:56:03 +00:00			`dev_rw_sysfs(insmod_t)`
move constraints interfaces to domain module. move sysfs and usbfs to devices module 2005-06-14 19:56:46 +00:00			`dev_search_usbfs(insmod_t)`
fix up mtrr interfaces. missing the file class on a few interfaces, and read and write cannot be split. 2006-08-01 14:43:10 +00:00			`dev_rw_mtrr(insmod_t)`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_read_urand(insmod_t)`
renaming from 20060131 interface review 2006-01-31 16:08:56 +00:00			`dev_rw_agp(insmod_t)`
			`dev_read_sound(insmod_t)`
			`dev_write_sound(insmod_t)`
clean up more todos 2005-06-29 20:53:53 +00:00			`dev_rw_apm_bios(insmod_t)`
initial commit 2005-04-14 20:18:17 +00:00
many fixes from cab work 2005-05-30 21:17:20 +00:00			`domain_signal_all_domains(insmod_t)`
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(insmod_t)`
many fixes from cab work 2005-05-30 21:17:20 +00:00
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`files_read_kernel_modules(insmod_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_read_etc_runtime_files(insmod_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(insmod_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_read_usr_files(insmod_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_exec_etc_files(insmod_t)`
add some file_t interfaces, and console write 2005-05-31 21:25:45 +00:00			`# for nscd:`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_dontaudit_search_pids(insmod_t)`
add some file_t interfaces, and console write 2005-05-31 21:25:45 +00:00			`# for when /var is not mounted early in the boot:`
renaming from 20060131 interface review, round 3 2006-01-31 19:21:01 +00:00			`files_dontaudit_search_isid_type_dirs(insmod_t)`
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`# for locking: (cjp: ????)`
			`files_write_kernel_modules(insmod_t)`

			`fs_getattr_xattr_fs(insmod_t)`
Modutils patch from Dan Walsh. 2010-03-17 15:59:14 +00:00			`fs_dontaudit_use_tmpfs_chr_dev(insmod_t)`
initial commit 2005-04-14 20:18:17 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_rw_initctl(insmod_t)`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(insmod_t)`
another round of renaming 2006-02-20 21:33:25 +00:00			`init_use_script_fds(insmod_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(insmod_t)`
more conversion due to new interfaces 2005-05-03 20:44:35 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(insmod_t)`
			`logging_search_logs(insmod_t)`
initial commit 2005-04-14 20:18:17 +00:00
			`miscfiles_read_localization(insmod_t)`

patch from dan Fri, 27 Jan 2006 01:37:19 -0500 2006-01-27 20:13:08 +00:00			`seutil_read_file_contexts(insmod_t)`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_use_user_terminals(insmod_t)`

Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`userdom_dontaudit_search_user_home_dirs(insmod_t)`
trunk: add basic ubuntu support 2008-02-05 18:24:43 +00:00
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`if( ! secure_mode_insmod ) {`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`kernel_domtrans_to(insmod_t, insmod_exec_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`}`

Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			optional_policy(`
			`alsa_domtrans(insmod_t)`
			`')`

			optional_policy(`
			`firstboot_dontaudit_rw_pipes(insmod_t)`
			`firstboot_dontaudit_rw_stream_sockets(insmod_t)`
			`')`

			optional_policy(`
			`hal_write_log(insmod_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
more updates 2005-09-15 21:03:29 +00:00			`hotplug_search_config(insmod_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`mount_domtrans(insmod_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00			`')`
initial commit 2005-04-14 20:18:17 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add radvd, plus a few cleanups from sediff 2005-09-23 21:20:03 +00:00			`nis_use_ypbind(insmod_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`nscd_socket_use(insmod_t)`
more updates 2005-09-15 21:03:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add rhgb 2006-03-09 19:02:29 +00:00			`fs_manage_ramfs_files(insmod_t)`

			`rhgb_use_fds(insmod_t)`
patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			`rhgb_dontaudit_use_ptys(insmod_t)`

			`xserver_dontaudit_write_log(insmod_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`xserver_stream_connect(insmod_t)`
			`xserver_dontaudit_rw_stream_sockets(insmod_t)`
add rhgb 2006-03-09 19:02:29 +00:00
			ifdef(`hide_broken_symptoms',`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`xserver_dontaudit_rw_tcp_sockets(insmod_t)`
add rhgb 2006-03-09 19:02:29 +00:00			`')`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`rpm_rw_pipes(insmod_t)`
more cleanup of current TODOs 2005-07-12 20:34:24 +00:00			`')`

- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes to handle usage from userhelper. 2007-05-02 17:31:38 +00:00			optional_policy(`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`unconfined_domain(insmod_t)`
Modutils patch from Dan Walsh. 2010-03-17 15:59:14 +00:00			`unconfined_dontaudit_rw_pipes(insmod_t)`
- Patch to allow insmod to mount kvmfs and dontaudit rw unconfined_t pipes to handle usage from userhelper. 2007-05-02 17:31:38 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
TODO cleanup 2006-04-03 19:49:47 +00:00			`# cjp: why is this needed:`
			`dev_rw_xserver_misc(insmod_t)`

more upstream merging 2005-09-16 21:20:37 +00:00			`xserver_getattr_log(insmod_t)`
			`')`
initial commit 2005-04-14 20:18:17 +00:00
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00			`#################################`
			`#`
			`# update-modules local policy`
			`#`

merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow update_modules_t self:fifo_file rw_fifo_file_perms;`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
aliases 2005-06-09 14:26:05 +00:00			`allow update_modules_t modules_dep_t:file rw_file_perms;`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
aliases 2005-06-09 14:26:05 +00:00			`can_exec(update_modules_t, insmod_exec_t)`
			`can_exec(update_modules_t, update_modules_exec_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
more conversion due to new interfaces 2005-05-03 20:44:35 +00:00			`# manage module loading configuration`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`manage_files_pattern(update_modules_t, modules_conf_t, modules_conf_t)`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`files_kernel_modules_filetrans(update_modules_t, modules_conf_t, file)`
			`files_etc_filetrans(update_modules_t, modules_conf_t, file)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
more conversion due to new interfaces 2005-05-03 20:44:35 +00:00			`# transition to depmod`
aliases 2005-06-09 14:26:05 +00:00			`domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)`
easy fixes 2005-10-25 19:03:15 +00:00			`allow update_modules_t depmod_t:fd use;`
			`allow depmod_t update_modules_t:fd use;`
			`allow depmod_t update_modules_t:fifo_file rw_file_perms;`
			`allow depmod_t update_modules_t:process sigchld;`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`manage_dirs_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)`
			`manage_files_pattern(update_modules_t, update_modules_tmp_t, update_modules_tmp_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(update_modules_t, update_modules_tmp_t, { file dir })`
fix tmp_domain 2005-04-25 21:44:48 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(update_modules_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00			`kernel_read_system_state(update_modules_t)`

fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`corecmd_exec_bin(update_modules_t)`
			`corecmd_exec_shell(update_modules_t)`

Devices rename. 2005-06-13 16:22:32 +00:00			`dev_read_urand(update_modules_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
fix ordering in modutils. 2009-08-05 14:11:08 +00:00			`domain_use_interactive_fds(update_modules_t)`

			`files_read_etc_runtime_files(update_modules_t)`
			`files_read_etc_files(update_modules_t)`
			`files_exec_etc_files(update_modules_t)`

renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_xattr_fs(update_modules_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
renaming insanity 2005-06-10 01:01:13 +00:00			`term_use_console(update_modules_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(update_modules_t)`
another round of renaming 2006-02-20 21:33:25 +00:00			`init_use_script_fds(update_modules_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(update_modules_t)`
more conversion due to new interfaces 2005-05-03 20:44:35 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(update_modules_t)`
more insmod work, bring in depmod and update_modules 2005-04-20 21:00:01 +00:00
			`miscfiles_read_localization(update_modules_t)`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_use_user_terminals(update_modules_t)`
			`userdom_dontaudit_search_user_home_dirs(update_modules_t)`
sediff fixes 2005-10-27 14:52:37 +00:00
more testing fixes 2006-08-23 03:47:39 +00:00			ifdef(`distro_gentoo',`
			`files_search_pids(update_modules_t)`
gentoo testing fixes 2006-09-19 17:02:29 +00:00			`files_getattr_usr_src_files(update_modules_t)`
gentoo testing fixes. 2006-10-13 21:44:02 +00:00			`files_list_isid_type_dirs(update_modules_t) # /var`
Module version bump and extra comments for 194d61f. 2010-04-24 12:09:50 +00:00
			`# update-modules on Gentoo throws errors when run because it`
			`# sources /etc/init.d/functions.sh, which always scans`
			`# /var/lib/init.d to set SOFTLEVEL environment var.`
			`# This is never used by update-modules.`
modutils patch for update-modules update-modules on Gentoo throws errors when run because it sources /etc/init.d/functions.sh, which always scans /var/lib/init.d to set SOFTLEVEL environment var. This is never used by update-modules. Signed-off-by: Chris Richards <gizmo@giz-works.com> Signed-off-by: Chris PeBenito <pebenito@gentoo.org> 2010-04-16 06:29:26 +00:00			`files_dontaudit_search_var_lib(update_modules_t)`
			`init_dontaudit_read_script_status_files(update_modules_t)`
more testing fixes 2006-08-23 03:47:39 +00:00
			optional_policy(`
			`consoletype_exec(update_modules_t)`
			`')`
			`')`
trunk: add basic ubuntu support 2008-02-05 18:24:43 +00:00
			ifdef(`distro_ubuntu',`
			optional_policy(`
			`unconfined_domain(update_modules_t)`
			`')`
			`')`