selinux-policy/refpolicy/policy/modules/admin/dmesg.te


policy_module(dmesg,1.0.0)

########################################
#
# Declarations
#

ifdef(`strict_policy',`
	type dmesg_t;
	type dmesg_exec_t;
	init_system_domain(dmesg_t,dmesg_exec_t)
	role system_r types dmesg_t;
')

ifdef(`targeted_policy',`
	# dmesg domain is disabled in the 
	# targeted policy. for compatibility
	# with strict:
	corecmd_bin_alias(dmesg_exec_t)
')

########################################
#
# Local policy
#

ifdef(`strict_policy',`
	allow dmesg_t self:capability sys_admin;
	dontaudit dmesg_t self:capability sys_tty_config;

	allow dmesg_t self:process signal_perms;

	kernel_read_kernel_sysctls(dmesg_t)
	kernel_read_ring_buffer(dmesg_t)
	kernel_clear_ring_buffer(dmesg_t)
	kernel_change_ring_buffer_level(dmesg_t)
	kernel_list_proc(dmesg_t)
	kernel_read_proc_symlinks(dmesg_t)

	dev_read_sysfs(dmesg_t)

	fs_search_auto_mountpoints(dmesg_t)

	term_dontaudit_use_console(dmesg_t)

	domain_use_interactive_fds(dmesg_t)

	files_list_etc(dmesg_t)
	# for when /usr is not mounted:
	files_dontaudit_search_isid_type_dirs(dmesg_t)

	init_use_fds(dmesg_t)
	init_use_script_ptys(dmesg_t)

	libs_use_ld_so(dmesg_t)
	libs_use_shared_libs(dmesg_t)

	logging_send_syslog_msg(dmesg_t)
	logging_write_generic_logs(dmesg_t)

	miscfiles_read_localization(dmesg_t)

	userdom_use_sysadm_terms(dmesg_t)
	userdom_dontaudit_use_unpriv_user_fds(dmesg_t)

	optional_policy(`selinuxutil',`
		seutil_sigchld_newrole(dmesg_t)
	')

	optional_policy(`udev',`
		udev_read_db(dmesg_t)
	')
')
initial commit 2005-05-26 15:50:53 +00:00
fix module versions 2005-12-09 16:38:39 +00:00			`policy_module(dmesg,1.0.0)`
initial commit 2005-05-26 15:50:53 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

many loadable module build fixes 2005-12-02 22:06:05 +00:00			ifdef(`strict_policy',`
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`type dmesg_t;`
			`type dmesg_exec_t;`
			`init_system_domain(dmesg_t,dmesg_exec_t)`
			`role system_r types dmesg_t;`
			`')`
initial commit 2005-05-26 15:50:53 +00:00
many loadable module build fixes 2005-12-02 22:06:05 +00:00			ifdef(`targeted_policy',`
			`# dmesg domain is disabled in the`
			`# targeted policy. for compatibility`
			`# with strict:`
			`corecmd_bin_alias(dmesg_exec_t)`
			`')`

initial commit 2005-05-26 15:50:53 +00:00			`########################################`
			`#`
			`# Local policy`
			`#`

many loadable module build fixes 2005-12-02 22:06:05 +00:00			ifdef(`strict_policy',`
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`allow dmesg_t self:capability sys_admin;`
			`dontaudit dmesg_t self:capability sys_tty_config;`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`allow dmesg_t self:process signal_perms;`
initial commit 2005-05-26 15:50:53 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(dmesg_t)`
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`kernel_read_ring_buffer(dmesg_t)`
			`kernel_clear_ring_buffer(dmesg_t)`
			`kernel_change_ring_buffer_level(dmesg_t)`
			`kernel_list_proc(dmesg_t)`
			`kernel_read_proc_symlinks(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`dev_read_sysfs(dmesg_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`fs_search_auto_mountpoints(dmesg_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`term_dontaudit_use_console(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`files_list_etc(dmesg_t)`
			`# for when /usr is not mounted:`
renaming from 20060131 interface review, round 3 2006-01-31 19:21:01 +00:00			`files_dontaudit_search_isid_type_dirs(dmesg_t)`
fixes from cab 2005-05-26 20:38:45 +00:00
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(dmesg_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`libs_use_ld_so(dmesg_t)`
			`libs_use_shared_libs(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`logging_send_syslog_msg(dmesg_t)`
			`logging_write_generic_logs(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`miscfiles_read_localization(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`userdom_use_sysadm_terms(dmesg_t)`
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(dmesg_t)`
initial commit 2005-05-26 15:50:53 +00:00
Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`selinuxutil',`
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`seutil_sigchld_newrole(dmesg_t)`
			`')`
initial commit 2005-05-26 15:50:53 +00:00
Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`udev',`
change dmesg and loadkeys behavior to aliasing, and enable modules 2005-11-14 20:26:41 +00:00			`udev_read_db(dmesg_t)`
			`')`
initial commit 2005-05-26 15:50:53 +00:00			`')`