2005-04-20 19:07:16 +00:00
|
|
|
|
2006-02-27 16:23:39 +00:00
|
|
|
policy_module(devices,1.0.5)
|
2005-04-26 17:00:25 +00:00
|
|
|
|
2005-06-30 18:54:08 +00:00
|
|
|
########################################
|
|
|
|
#
|
|
|
|
# Declarations
|
|
|
|
#
|
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
attribute device_node;
|
2005-05-10 20:24:26 +00:00
|
|
|
attribute memory_raw_read;
|
|
|
|
attribute memory_raw_write;
|
2005-04-14 20:18:17 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# device_t is the type of /dev.
|
|
|
|
#
|
2005-04-28 18:59:01 +00:00
|
|
|
type device_t;
|
2005-10-25 18:13:47 +00:00
|
|
|
fs_associate_tmpfs(device_t)
|
2005-06-29 14:26:41 +00:00
|
|
|
files_type(device_t)
|
2005-06-13 17:35:46 +00:00
|
|
|
files_mountpoint(device_t)
|
2005-10-25 18:13:47 +00:00
|
|
|
files_associate_tmp(device_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
|
|
|
# Only directories and symlinks should be labeled device_t.
|
|
|
|
# If there are other files with this type, it is wrong.
|
|
|
|
# Relabelto is allowed for setfiles to function, in case
|
|
|
|
# a device node has no specific type yet, but is for some
|
|
|
|
# reason labeled with a specific type
|
2005-05-02 21:02:14 +00:00
|
|
|
#cjp: want this, but udev policy breaks this
|
2005-06-30 18:54:08 +00:00
|
|
|
#neverallow domain device_t:{ file fifo_file sock_file chr_file blk_file } ~{ getattr setattr relabelfrom relabelto };
|
2005-04-14 20:18:17 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Type for /dev/agpgart
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type agp_device_t;
|
|
|
|
dev_node(agp_device_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Type for /dev/apm_bios
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type apm_bios_t;
|
|
|
|
dev_node(apm_bios_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type cardmgr_dev_t;
|
|
|
|
dev_node(cardmgr_dev_t)
|
2005-10-24 14:15:29 +00:00
|
|
|
files_tmp_file(cardmgr_dev_t)
|
2005-05-10 20:25:20 +00:00
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
#
|
|
|
|
# clock_device_t is the type of
|
|
|
|
# /dev/rtc.
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type clock_device_t;
|
|
|
|
dev_node(clock_device_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# cpu control devices /dev/cpu/0/*
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type cpu_device_t;
|
|
|
|
dev_node(cpu_device_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
2005-09-13 13:06:07 +00:00
|
|
|
# for the IBM zSeries z90crypt hardware ssl accelorator
|
2005-10-25 18:13:47 +00:00
|
|
|
type crypt_device_t;
|
|
|
|
dev_node(crypt_device_t)
|
2005-09-13 13:06:07 +00:00
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type dri_device_t;
|
|
|
|
dev_node(dri_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type event_device_t;
|
|
|
|
dev_node(event_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
#
|
|
|
|
# Type for framebuffer /dev/fb/*
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type framebuf_device_t;
|
|
|
|
dev_node(framebuf_device_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
2005-04-29 20:35:49 +00:00
|
|
|
#
|
|
|
|
# Type for /dev/mapper/control
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type lvm_control_t;
|
|
|
|
dev_node(lvm_control_t)
|
2005-04-29 20:35:49 +00:00
|
|
|
|
2005-05-10 20:24:26 +00:00
|
|
|
#
|
|
|
|
# memory_device_t is the type of /dev/kmem,
|
|
|
|
# /dev/mem and /dev/port.
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type memory_device_t;
|
|
|
|
dev_node(memory_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
|
|
|
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
|
|
|
|
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
|
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type misc_device_t;
|
|
|
|
dev_node(misc_device_t)
|
2005-05-16 21:10:33 +00:00
|
|
|
|
2005-05-10 20:24:26 +00:00
|
|
|
#
|
|
|
|
# A more general type for mouse devices.
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type mouse_device_t;
|
|
|
|
dev_node(mouse_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
#
|
|
|
|
# Type for /dev/cpu/mtrr and /proc/mtrr
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type mtrr_device_t;
|
|
|
|
dev_node(mtrr_device_t)
|
2005-10-06 19:33:06 +00:00
|
|
|
genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
2005-05-10 20:24:26 +00:00
|
|
|
#
|
|
|
|
# null_device_t is the type of /dev/null.
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type null_device_t;
|
|
|
|
dev_node(null_device_t)
|
2005-09-26 20:26:32 +00:00
|
|
|
mls_trusted_object(null_device_t)
|
2005-10-06 19:33:06 +00:00
|
|
|
sid devnull gen_context(system_u:object_r:null_device_t,s0)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
#
|
|
|
|
# Type for /dev/pmu
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type power_device_t;
|
|
|
|
dev_node(power_device_t)
|
2005-04-14 20:18:17 +00:00
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type printer_device_t;
|
|
|
|
dev_node(printer_device_t)
|
2005-05-10 13:59:10 +00:00
|
|
|
|
2005-05-10 20:24:26 +00:00
|
|
|
#
|
|
|
|
# random_device_t is the type of /dev/random
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type random_device_t;
|
|
|
|
dev_node(random_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type scanner_device_t;
|
|
|
|
dev_node(scanner_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-04-14 20:18:17 +00:00
|
|
|
#
|
|
|
|
# Type for sound devices and mixers
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type sound_device_t;
|
|
|
|
dev_node(sound_device_t)
|
2005-04-29 20:35:49 +00:00
|
|
|
|
2005-06-14 19:56:46 +00:00
|
|
|
#
|
|
|
|
# sysfs_t is the type for the /sys pseudofs
|
|
|
|
#
|
|
|
|
type sysfs_t;
|
|
|
|
files_mountpoint(sysfs_t)
|
2005-06-28 17:48:59 +00:00
|
|
|
fs_type(sysfs_t)
|
2005-10-06 19:33:06 +00:00
|
|
|
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
|
2005-06-14 19:56:46 +00:00
|
|
|
|
2005-05-10 20:24:26 +00:00
|
|
|
#
|
|
|
|
# urandom_device_t is the type of /dev/urandom
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type urandom_device_t;
|
|
|
|
dev_node(urandom_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
2005-06-14 19:56:46 +00:00
|
|
|
#
|
|
|
|
# usbfs_t is the type for the /proc/bus/usb pseudofs
|
|
|
|
#
|
|
|
|
type usbfs_t alias usbdevfs_t;
|
|
|
|
files_mountpoint(usbfs_t)
|
2006-01-31 20:29:27 +00:00
|
|
|
fs_noxattr_type(usbfs_t)
|
2005-10-06 19:33:06 +00:00
|
|
|
genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0)
|
|
|
|
genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
|
2005-06-14 19:56:46 +00:00
|
|
|
|
2006-02-13 22:05:08 +00:00
|
|
|
#
|
|
|
|
# usb_device_t is the type for /dev/bus/usb/[0-9]+/[0-9]+
|
|
|
|
#
|
|
|
|
type usb_device_t;
|
|
|
|
dev_node(usb_device_t)
|
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type v4l_device_t;
|
|
|
|
dev_node(v4l_device_t)
|
2005-05-10 14:12:10 +00:00
|
|
|
|
2005-10-25 18:13:47 +00:00
|
|
|
type xserver_misc_device_t;
|
|
|
|
dev_node(xserver_misc_device_t)
|
2005-05-10 20:24:26 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# zero_device_t is the type of /dev/zero.
|
|
|
|
#
|
2005-10-25 18:13:47 +00:00
|
|
|
type zero_device_t;
|
|
|
|
dev_node(zero_device_t)
|
2005-09-26 20:26:32 +00:00
|
|
|
mls_trusted_object(zero_device_t)
|
2005-10-24 03:52:35 +00:00
|
|
|
|
|
|
|
|
|
|
|
# TODO:
|
|
|
|
|
|
|
|
# this is not actually a device
|
|
|
|
# move it to xserver
|
|
|
|
type xconsole_device_t;
|
|
|
|
files_type(xconsole_device_t)
|
2005-10-25 18:13:47 +00:00
|
|
|
fs_associate_tmpfs(xconsole_device_t)
|
|
|
|
files_associate_tmp(xconsole_device_t)
|
2005-10-24 03:52:35 +00:00
|
|
|
|
|
|
|
# devfs is dead on selinux
|
|
|
|
# this should be removed
|
2005-10-25 18:13:47 +00:00
|
|
|
type devfs_control_t;
|
|
|
|
dev_node(devfs_control_t)
|