selinux-policy/refpolicy/policy/modules/system/selinux.if

# Copyright (C) 2005 Tresys Technology, LLC

#######################################
#
# selinux_checkpolicy_transition(domain)
#
define(`selinux_checkpolicy_transition',`
requires_block_template(`$0'_depend)
allow $1 checkpolicy_exec_t:file { getattr read execute };
allow $1 checkpolicy_t:process transition;
type_transition $1 checkpolicy_exec_t:file checkpolicy_t;
dontaudit $1 checkpolicy_t:process { noatsecure siginh rlimitinh };
')

define(`selinux_checkpolicy_transition_depend',`
type checkpolicy_t, checkpolicy_exec_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh };
')

#######################################
#
# selinux_checkpolicy_execute(domain)
#
define(`selinux_checkpolicy_execute',`
requires_block_template(`$0'_depend)
allow $1 checkpolicy_exec_t:file { getattr read execute execute_no_trans };
')

define(`selinux_checkpolicy_execute_depend',`
type checkpolicy_exec_t;
class file { getattr read execute execute_no_trans };
')

#######################################
#
# selinux_load_policy_transition(domain)
#
define(`selinux_load_policy_transition',`
requires_block_template(`$0'_depend)
allow $1 load_policy_exec_t:file { getattr read execute };
allow $1 load_policy_t:process transition;
type_transition $1 load_policy_exec_t:file load_policy_t;
dontaudit $1 load_policy_t:process { noatsecure siginh rlimitinh };
')

define(`selinux_load_policy_transition_depend',`
type load_policy_t, load_policy_exec_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh };
')

#######################################
#
# selinux_load_policy_execute(domain)
#
define(`selinux_load_policy_execute',`
requires_block_template(`$0'_depend)
allow $1 load_policy_exec_t:file { getattr read execute execute_no_trans };
')

define(`selinux_load_policy_execute_depend',`
type load_policy_exec_t;
class file { getattr read execute execute_no_trans };
')

#######################################
#
# selinux_read_load_policy_binary(domain)
#
define(`selinux_read_load_policy_binary',`
requires_block_template(`$0'_depend)
allow $1 load_policy_exec_t:file { getattr read };
')

define(`selinux_read_load_policy_binary_depend',`
type load_policy_exec_t;
class file { getattr read };
')

#######################################
#
# selinux_newrole_transition(domain)
#
define(`selinux_newrole_transition',`
requires_block_template(`$0'_depend)
allow $1 newrole_exec_t:file { getattr read execute };
allow $1 newrole_t:process transition;
type_transition $1 newrole_exec_t:file newrole_t;
dontaudit $1 newrole_t:process { noatsecure siginh rlimitinh };
')

define(`selinux_newrole_transition_depend',`
type newrole_exec_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh };
')

#######################################
#
# selinux_newrole_execute(domain)
#
define(`selinux_newrole_execute',`
requires_block_template(`$0'_depend)
allow $1 newrole_exec_t:file { getattr read execute execute_no_trans };
')

define(`selinux_newrole_execute_depend',`
type newrole_t, newrole_exec_t;
class file { getattr read execute execute_no_trans };
')

#######################################
#
# selinux_newrole_sigchld(domain)
#
define(`selinux_newrole_sigchld',`
requires_block_template(`$0'_depend)
allow $1 newrole_t:process sigchld;
')

define(`selinux_newrole_sigchld_depend',`
type newrole_t;
class process sigchld;
')

#######################################
#
# selinux_newrole_use_file_descriptors(domain)
#
define(`selinux_newrole_use_file_descriptors',`
requires_block_template(`$0'_depend)
allow $1 newrole_t:fd use;
')

define(`selinux_newrole_use_file_descriptors_depend',`
type newrole_t;
class fd use;
')

#######################################
#
# selinux_restorecon_transition(domain)
#
define(`selinux_restorecon_transition',`
requires_block_template(`$0'_depend)
allow $1 restorecon_exec_t:file { getattr read execute };
allow $1 restorecon_t:process transition;
type_transition $1 restorecon_exec_t:file restorecon_t;
dontaudit $1 restorecon_t:process { noatsecure siginh rlimitinh };
')

define(`selinux_restorecon_transition_depend',`
type restorecon_exec_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh };
')

#######################################
#
# selinux_restorecon_execute(domain)
#
define(`selinux_restorecon_execute',`
requires_block_template(`$0'_depend)
allow $1 restorecon_exec_t:file { getattr read execute execute_no_trans };
')

define(`selinux_restorecon_execute_depend',`
type restorecon_t, restorecon_exec_t;
class file { getattr read execute execute_no_trans };
')

########################################
#
# selinux_run_init_transition(domain)
#
define(`selinux_run_init_transition',`
requires_block_template(`$0'_depend)
allow $1 run_init_exec_t:file { getattr read execute };
allow $1 run_init_t:process transition;
type_transition $1 run_init_exec_t:file run_init_t;
dontaudit $1 run_init_t:process { noatsecure siginh rlimitinh };
')

define(`selinux_run_init_transition_depend',`
type run_init_t, run_init_exec_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh };
')

########################################
#
# selinux_run_init_use_file_descriptors(domain)
#
define(`selinux_run_init_use_file_descriptors',`
requires_block_template(`$0'_depend)
allow $1 run_init_t:fd use;
')

define(`selinux_run_init_use_file_descriptors_depend',`
type run_init_t;
class fd use;
')

#######################################
#
# selinux_setfiles_transition(domain)
#
define(`selinux_setfiles_transition',`
requires_block_template(`$0'_depend)
allow $1 setfiles_exec_t:file { getattr read execute };
allow $1 setfiles_t:process transition;
type_transition $1 setfiles_exec_t:file setfiles_t;
dontaudit $1 setfiles_t:process { noatsecure siginh rlimitinh };
')

define(`selinux_setfiles_transition_depend',`
type setfiles_t, setfiles_exec_t;
class file { getattr read execute };
class process { transition noatsecure siginh rlimitinh };
')

#######################################
#
# selinux_setfiles_execute(domain)
#
define(`selinux_setfiles_execute',`
requires_block_template(`$0'_depend)
allow $1 setfiles_exec_t:file { getattr read execute execute_no_trans };
')

define(`selinux_setfiles_execute_depend',`
type setfiles_exec_t;
class file { getattr read execute execute_no_trans };
')

########################################
#
# selinux_read_config(domain)
#
define(`selinux_read_config',`
requires_block_template(`$0'_depend)
allow $1 selinux_config_t:dir { getattr search read };
allow $1 selinux_config_t:file { getattr read };
')

define(`selinux_read_config_depend',`
type selinux_config_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_read_default_contexts(domain)
#
define(`selinux_read_default_contexts',`
requires_block_template(`$0'_depend)
allow $1 selinux_config_t:dir search;
allow $1 default_context_t:dir { getattr search read };
allow $1 default_context_t:file { getattr read };
')

define(`selinux_read_default_contexts_depend',`
type selinux_config_t, default_context_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_read_file_contexts(domain)
#
define(`selinux_read_file_contexts',`
requires_block_template(`$0'_depend)
allow $1 selinux_config_t:dir search;
allow $1 file_context_t:dir { getattr search read };
allow $1 file_context_t:file { getattr read };
')

define(`selinux_read_file_contexts_depend',`
type selinux_config_t, file_context_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_read_binary_policy(domain)
#
define(`selinux_read_binary_policy',`
requires_block_template(`$0'_depend)
allow $1 policy_config_t:dir { getattr search read };
allow $1 policy_config_t:file { getattr read };
')

define(`selinux_read_binary_policy_depend',`
type policy_config_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_write_binary_policy(domain)
#
define(`selinux_write_binary_policy',`
requires_block_template(`$0'_depend)
allow $1 policy_config_t:dir { getattr search read write add_name remove_name };
allow $1 policy_config_t:file { getattr create write unlink };
typeattribute $1 can_write_binary_policy;
')

define(`selinux_write_binary_policy_depend',`
attribute can_write_binary_policy;
type policy_config_t;
class dir { getattr search read write add_name remove_name };
class file { getattr create write unlink };
')

########################################
#
# selinux_manage_binary_policy(domain)
#
define(`selinux_manage_binary_policy',`
requires_block_template(`$0'_depend)
# FIXME: search etc_t:dir
allow $1 selinux_config_t:dir search;
allow $1 policy_config_t:dir { getattr search read };
allow $1 policy_config_t:file { create ioctl read getattr lock write setattr append link unlink rename };
typeattribute $1 can_write_binary_policy;
')

define(`selinux_manage_binary_policy_depend',`
attribute can_write_binary_policy;
type selinux_config_t, policy_config_t;
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# selinux_read_source_policy(domain)
#
define(`selinux_read_source_policy',`
requires_block_template(`$0'_depend)
# FIXME: search etc_t:dir
allow $1 selinux_config_t:dir search;
allow $1 policy_src_t:dir { getattr search read };
allow $1 policy_src_t:file { getattr read };
')

define(`selinux_read_source_policy_depend',`
type selinux_config_t, policy_src_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_manage_source_policy(domain)
#
define(`selinux_manage_source_policy',`
requires_block_template(`$0'_depend)
# FIXME: search etc_t:dir
allow $1 selinux_config_t:dir search;
allow $1 policy_src_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
allow $1 policy_src_t:file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`selinux_manage_source_policy_depend',`
type selinux_config_t, policy_src_t;
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')