105 lines
3.2 KiB
Plaintext
105 lines
3.2 KiB
Plaintext
|
#DESC hald - server for device info
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <rcoker@redhat.com>
|
||
|
|
# X-Debian-Packages:
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the hald_t domain.
|
||
|
|
#
|
||
|
|
# hald_exec_t is the type of the hald executable.
|
||
|
|
#
|
||
|
|
daemon_domain(hald, `, fs_domain, nscd_client_domain')
|
||
|
|
|
||
|
|
can_exec_any(hald_t)
|
||
|
|
|
||
|
|
allow hald_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
allow hald_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
||
|
|
allow hald_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
ifdef(`dbusd.te', `
|
||
|
|
allow hald_t system_dbusd_t:dbus { acquire_svc send_msg };
|
||
|
|
dbusd_client(system, hald)
|
||
|
|
allow hald_t self:dbus send_msg;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow hald_t self:file { getattr read };
|
||
|
|
allow hald_t proc_t:file rw_file_perms;
|
||
|
|
|
||
|
|
allow hald_t { bin_t sbin_t }:dir search;
|
||
|
|
allow hald_t self:fifo_file rw_file_perms;
|
||
|
|
allow hald_t usr_t:file { getattr read };
|
||
|
|
allow hald_t bin_t:file getattr;
|
||
|
|
|
||
|
|
# For backwards compatibility with older kernels
|
||
|
|
allow hald_t self:netlink_socket create_socket_perms;
|
||
|
|
|
||
|
|
allow hald_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||
|
|
allow hald_t self:netlink_route_socket r_netlink_socket_perms;
|
||
|
|
allow hald_t self:capability { net_admin sys_admin dac_override dac_read_search mknod sys_rawio };
|
||
|
|
can_network_server(hald_t)
|
||
|
|
can_ypbind(hald_t)
|
||
|
|
|
||
|
|
allow hald_t device_t:lnk_file read;
|
||
|
|
allow hald_t { fixed_disk_device_t removable_device_t }:blk_file { getattr read ioctl };
|
||
|
|
allow hald_t removable_device_t:blk_file write;
|
||
|
|
allow hald_t event_device_t:chr_file { getattr read ioctl };
|
||
|
|
allow hald_t printer_device_t:chr_file rw_file_perms;
|
||
|
|
allow hald_t urandom_device_t:chr_file read;
|
||
|
|
allow hald_t mouse_device_t:chr_file r_file_perms;
|
||
|
|
allow hald_t device_type:chr_file getattr;
|
||
|
|
|
||
|
|
can_getsecurity(hald_t)
|
||
|
|
|
||
|
|
ifdef(`updfstab.te', `
|
||
|
|
domain_auto_trans(hald_t, updfstab_exec_t, updfstab_t)
|
||
|
|
allow updfstab_t hald_t:dbus send_msg;
|
||
|
|
allow hald_t updfstab_t:dbus send_msg;
|
||
|
|
')
|
||
|
|
ifdef(`udev.te', `
|
||
|
|
domain_auto_trans(hald_t, udev_exec_t, udev_t)
|
||
|
|
allow udev_t hald_t:unix_dgram_socket sendto;
|
||
|
|
allow hald_t udev_tbl_t:file { getattr read };
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`hotplug.te', `
|
||
|
|
r_dir_file(hald_t, hotplug_etc_t)
|
||
|
|
')
|
||
|
|
allow hald_t fs_type:dir { search getattr };
|
||
|
|
allow hald_t usbfs_t:dir r_dir_perms;
|
||
|
|
allow hald_t { usbdevfs_t usbfs_t }:file rw_file_perms;
|
||
|
|
allow hald_t bin_t:lnk_file read;
|
||
|
|
r_dir_file(hald_t, { selinux_config_t default_context_t } )
|
||
|
|
allow hald_t initrc_t:dbus send_msg;
|
||
|
|
allow initrc_t hald_t:dbus send_msg;
|
||
|
|
allow hald_t etc_runtime_t:file rw_file_perms;
|
||
|
|
allow hald_t var_lib_t:dir search;
|
||
|
|
allow hald_t device_t:dir create_dir_perms;
|
||
|
|
allow hald_t device_t:chr_file create_file_perms;
|
||
|
|
tmp_domain(hald)
|
||
|
|
allow hald_t mnt_t:dir search;
|
||
|
|
r_dir_file(hald_t, proc_net_t)
|
||
|
|
|
||
|
|
# For /usr/libexec/hald-addon-acpi - writes to /var/run/acpid.socket
|
||
|
|
ifdef(`apmd.te', `
|
||
|
|
allow hald_t apmd_var_run_t:sock_file write;
|
||
|
|
allow hald_t apmd_t:unix_stream_socket connectto;
|
||
|
|
')
|
||
|
|
|
||
|
|
# For /usr/libexec/hald-probe-smbios
|
||
|
|
domain_auto_trans(hald_t, dmidecode_exec_t, dmidecode_t)
|
||
|
|
|
||
|
|
# ??
|
||
|
|
ifdef(`lvm.te', `
|
||
|
|
allow hald_t lvm_control_t:chr_file r_file_perms;
|
||
|
|
')
|
||
|
|
ifdef(`targeted_policy', `
|
||
|
|
allow unconfined_t hald_t:dbus send_msg;
|
||
|
|
allow hald_t unconfined_t:dbus send_msg;
|
||
|
|
')
|
||
|
|
ifdef(`mount.te', `
|
||
|
|
domain_auto_trans(hald_t, mount_exec_t, mount_t)
|
||
|
|
')
|
||
|
|
r_dir_file(hald_t, hwdata_t)
|