selinux-policy/policy/modules/kernel/filesystem.te


policy_module(filesystem,1.3.13)

########################################
#
# Declarations
#

attribute filesystem_type;
attribute filesystem_unconfined_type;
attribute noxattrfs;

##############################
#
# fs_t is the default type for persistent
# filesystems with extended attributes
#
type fs_t;
fs_type(fs_t)
sid fs gen_context(system_u:object_r:fs_t,s0)

# Use xattrs for the following filesystem types.
# Requires that a security xattr handler exist for the filesystem.
fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0);
fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0);

# Use the allocating task SID to label inodes in the following filesystem
# types, and label the filesystem itself with the specified context.
# This is appropriate for pseudo filesystems that represent objects
# like pipes and sockets, so that these objects are labeled with the same
# type as the creating task.  
fs_use_task eventpollfs gen_context(system_u:object_r:fs_t,s0);
fs_use_task pipefs gen_context(system_u:object_r:fs_t,s0);
fs_use_task sockfs gen_context(system_u:object_r:fs_t,s0);

##############################
#
# Non-persistent/pseudo filesystems
#
type bdev_t;
fs_type(bdev_t)
genfscon bdev / gen_context(system_u:object_r:bdev_t,s0)

type binfmt_misc_fs_t;
fs_type(binfmt_misc_fs_t)
files_mountpoint(binfmt_misc_fs_t)
genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)

type capifs_t;
fs_type(capifs_t)
genfscon capifs / gen_context(system_u:object_r:capifs_t,s0)

type configfs_t;
fs_type(configfs_t)
genfscon configfs / gen_context(system_u:object_r:configfs_t,s0)

type eventpollfs_t;
fs_type(eventpollfs_t)
# change to task SID 20060628
#genfscon eventpollfs / gen_context(system_u:object_r:eventpollfs_t,s0)

type futexfs_t;
fs_type(futexfs_t)
genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)

type hugetlbfs_t;
fs_type(hugetlbfs_t)
files_mountpoint(hugetlbfs_t)
genfscon hugetlbfs / gen_context(system_u:object_r:hugetlbfs_t,s0)

type ibmasmfs_t;
fs_type(ibmasmfs_t)
allow ibmasmfs_t self:filesystem associate;
genfscon ibmasmfs / gen_context(system_u:object_r:ibmasmfs_t,s0)

type inotifyfs_t;
fs_type(inotifyfs_t)
genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)

type nfsd_fs_t;
fs_type(nfsd_fs_t)
genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)

type oprofilefs_t;
fs_type(oprofilefs_t)
genfscon oprofilefs / gen_context(system_u:object_r:oprofilefs_t,s0)

type ramfs_t;
fs_type(ramfs_t)
genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0)

type romfs_t;
fs_type(romfs_t)
genfscon romfs / gen_context(system_u:object_r:romfs_t,s0)
genfscon cramfs / gen_context(system_u:object_r:romfs_t,s0)

type rpc_pipefs_t;
fs_type(rpc_pipefs_t)
genfscon rpc_pipefs / gen_context(system_u:object_r:rpc_pipefs_t,s0)

#
# tmpfs_t is the type for tmpfs filesystems
#
type tmpfs_t;
fs_type(tmpfs_t)
files_type(tmpfs_t)
files_mountpoint(tmpfs_t)

# Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types,
# and label the filesystem itself with the specified context.
# This is appropriate for pseudo filesystems like devpts and tmpfs
# where we want to label objects with a derived type.
fs_use_trans mqueue gen_context(system_u:object_r:tmpfs_t,s0);
fs_use_trans shm gen_context(system_u:object_r:tmpfs_t,s0);
fs_use_trans tmpfs gen_context(system_u:object_r:tmpfs_t,s0);

allow tmpfs_t noxattrfs:filesystem associate;

##############################
#
# Filesystems without extended attribute support
#
type autofs_t;
fs_noxattr_type(autofs_t)
files_mountpoint(autofs_t)
genfscon autofs / gen_context(system_u:object_r:autofs_t,s0)
genfscon automount / gen_context(system_u:object_r:autofs_t,s0)

#
# cifs_t is the type for filesystems and their
# files shared from Windows servers
#
type cifs_t alias sambafs_t;
fs_noxattr_type(cifs_t)
genfscon cifs / gen_context(system_u:object_r:cifs_t,s0)
genfscon smbfs / gen_context(system_u:object_r:cifs_t,s0)

#
# dosfs_t is the type for fat and vfat
# filesystems and their files.
#
type dosfs_t;
fs_noxattr_type(dosfs_t)
allow dosfs_t fs_t:filesystem associate;
genfscon fat / gen_context(system_u:object_r:dosfs_t,s0)
genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0)
genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)

#
# iso9660_t is the type for CD filesystems
# and their files.
#
type iso9660_t;
fs_noxattr_type(iso9660_t)
genfscon iso9660 / gen_context(system_u:object_r:iso9660_t,s0)
genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)

#
# removable_t is the default type of all removable media
#
type removable_t;
allow removable_t noxattrfs:filesystem associate;
fs_noxattr_type(removable_t)
files_type(removable_t)

#
# nfs_t is the default type for NFS file systems
# and their files.
#
type nfs_t;
fs_noxattr_type(nfs_t)
files_mountpoint(nfs_t)
genfscon nfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon nfs4 / gen_context(system_u:object_r:nfs_t,s0)
genfscon afs / gen_context(system_u:object_r:nfs_t,s0)
genfscon hfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon gfs / gen_context(system_u:object_r:nfs_t,s0)

########################################
#
# Rules for all filesystem types
#

allow filesystem_type self:filesystem associate;

########################################
#
# Unconfined access to this module
#

allow filesystem_unconfined_type filesystem_type:filesystem *;

# Create/access other files.  fs_type is to pick up various
# pseudo filesystem types that are applied to both the filesystem
# and its files.
allow filesystem_unconfined_type filesystem_type:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *;
add copyright statement 2005-04-20 19:07:16 +00:00
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`policy_module(filesystem,1.3.13)`
add module statement macro and entrypoint executable attribute to replicate can_exec($1,exec_type) 2005-04-26 17:00:25 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

add lost_found_t manage, rename fs_type attribute to filesystem_type and rename fs_make_fs to fs_type 2005-06-28 17:48:59 +00:00			`attribute filesystem_type;`
move over to attributes for unconfined interfaces. 2006-04-10 21:04:51 +00:00			`attribute filesystem_unconfined_type;`
renaming and xml 2005-06-09 15:20:31 +00:00			`attribute noxattrfs;`
initial commit 2005-04-14 20:18:17 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`##############################`
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# fs_t is the default type for persistent`
			`# filesystems with extended attributes`
			`#`
try to fix associations 2005-10-25 20:06:27 +00:00			`type fs_t;`
			`fs_type(fs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`sid fs gen_context(system_u:object_r:fs_t,s0)`
move fs_use and isids to respective modules 2005-06-02 15:39:10 +00:00
			`# Use xattrs for the following filesystem types.`
			`# Requires that a security xattr handler exist for the filesystem.`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);`
			`fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);`
patch from dan Mon, 12 Jun 2006 15:32:00 -0400 2006-06-12 21:36:38 +00:00			`fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);`
This patch enables to use xattr on jffs2 filesystem. The jffs2 filesystem is a filesystem for memory technology devices (MTD), and xattr supporting on jffs2 is neccesary to use SELinux with a small diskless PDA and so on. This facility is queued for kernel 2.6.18 now, so I hope to merge this small patch into the refpolicy repository. Example of xattr/jffs2: SELinux on OpenZaurus :D http://www.kaigai.gr.jp/pub/sezaurus.jpg Thanks, -- KaiGai Kohei <kaigai@kaigai.gr.jp> 2006-08-25 13:28:57 +00:00			`fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0);`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0);`
			`fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0);`
move fs_use and isids to respective modules 2005-06-02 15:39:10 +00:00
			`# Use the allocating task SID to label inodes in the following filesystem`
			`# types, and label the filesystem itself with the specified context.`
			`# This is appropriate for pseudo filesystems that represent objects`
			`# like pipes and sockets, so that these objects are labeled with the same`
			`# type as the creating task.`
change eventpollfs labeling to task sid 2006-06-28 20:28:09 +00:00			`fs_use_task eventpollfs gen_context(system_u:object_r:fs_t,s0);`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`fs_use_task pipefs gen_context(system_u:object_r:fs_t,s0);`
			`fs_use_task sockfs gen_context(system_u:object_r:fs_t,s0);`
initial commit 2005-04-14 20:18:17 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`##############################`
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# Non-persistent/pseudo filesystems`
			`#`
try to fix associations 2005-10-25 20:06:27 +00:00			`type bdev_t;`
			`fs_type(bdev_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon bdev / gen_context(system_u:object_r:bdev_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type binfmt_misc_fs_t;`
			`fs_type(binfmt_misc_fs_t)`
more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00			`files_mountpoint(binfmt_misc_fs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type capifs_t;`
			`fs_type(capifs_t)`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`genfscon capifs / gen_context(system_u:object_r:capifs_t,s0)`

try to fix associations 2005-10-25 20:06:27 +00:00			`type configfs_t;`
			`fs_type(configfs_t)`
more fixes 2005-10-24 03:21:26 +00:00			`genfscon configfs / gen_context(system_u:object_r:configfs_t,s0)`

try to fix associations 2005-10-25 20:06:27 +00:00			`type eventpollfs_t;`
			`fs_type(eventpollfs_t)`
change eventpollfs labeling to task sid 2006-06-28 20:28:09 +00:00			`# change to task SID 20060628`
			`#genfscon eventpollfs / gen_context(system_u:object_r:eventpollfs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type futexfs_t;`
			`fs_type(futexfs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type hugetlbfs_t;`
			`fs_type(hugetlbfs_t)`
more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00			`files_mountpoint(hugetlbfs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon hugetlbfs / gen_context(system_u:object_r:hugetlbfs_t,s0)`
more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00
patch from Dan Tue, 20 Jun 2006 16:19:13 -0400 2006-06-21 18:25:06 +00:00			`type ibmasmfs_t;`
			`fs_type(ibmasmfs_t)`
			`allow ibmasmfs_t self:filesystem associate;`
			`genfscon ibmasmfs / gen_context(system_u:object_r:ibmasmfs_t,s0)`

try to fix associations 2005-10-25 20:06:27 +00:00			`type inotifyfs_t;`
			`fs_type(inotifyfs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)`
more merging of NSA CVS policy 2005-09-13 13:06:07 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type nfsd_fs_t;`
			`fs_type(nfsd_fs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00			`type oprofilefs_t;`
			`fs_type(oprofilefs_t)`
			`genfscon oprofilefs / gen_context(system_u:object_r:oprofilefs_t,s0)`

try to fix associations 2005-10-25 20:06:27 +00:00			`type ramfs_t;`
			`fs_type(ramfs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type romfs_t;`
			`fs_type(romfs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon romfs / gen_context(system_u:object_r:romfs_t,s0)`
			`genfscon cramfs / gen_context(system_u:object_r:romfs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
try to fix associations 2005-10-25 20:06:27 +00:00			`type rpc_pipefs_t;`
			`fs_type(rpc_pipefs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon rpc_pipefs / gen_context(system_u:object_r:rpc_pipefs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# tmpfs_t is the type for tmpfs filesystems`
			`#`
try to fix associations 2005-10-25 20:06:27 +00:00			`type tmpfs_t;`
			`fs_type(tmpfs_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(tmpfs_t)`
more upstream merging 2005-09-16 19:36:10 +00:00			`files_mountpoint(tmpfs_t)`
many fixes from cab work 2005-05-30 21:17:20 +00:00
move fs_use and isids to respective modules 2005-06-02 15:39:10 +00:00			`# Use a transition SID based on the allocating task SID and the`
			`# filesystem SID to label inodes in the following filesystem types,`
			`# and label the filesystem itself with the specified context.`
			`# This is appropriate for pseudo filesystems like devpts and tmpfs`
			`# where we want to label objects with a derived type.`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`fs_use_trans mqueue gen_context(system_u:object_r:tmpfs_t,s0);`
			`fs_use_trans shm gen_context(system_u:object_r:tmpfs_t,s0);`
			`fs_use_trans tmpfs gen_context(system_u:object_r:tmpfs_t,s0);`
move fs_use and isids to respective modules 2005-06-02 15:39:10 +00:00
renaming and xml 2005-06-09 15:20:31 +00:00			`allow tmpfs_t noxattrfs:filesystem associate;`
initial commit 2005-04-14 20:18:17 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`##############################`
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# Filesystems without extended attribute support`
			`#`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`type autofs_t;`
			`fs_noxattr_type(autofs_t)`
patch from dan 2005-11-23 19:02:40 +00:00			`files_mountpoint(autofs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon autofs / gen_context(system_u:object_r:autofs_t,s0)`
			`genfscon automount / gen_context(system_u:object_r:autofs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# cifs_t is the type for filesystems and their`
			`# files shared from Windows servers`
			`#`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`type cifs_t alias sambafs_t;`
			`fs_noxattr_type(cifs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon cifs / gen_context(system_u:object_r:cifs_t,s0)`
			`genfscon smbfs / gen_context(system_u:object_r:cifs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# dosfs_t is the type for fat and vfat`
			`# filesystems and their files.`
			`#`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`type dosfs_t;`
			`fs_noxattr_type(dosfs_t)`
patch from dan Wed, 01 Feb 2006 08:33:30 -0500 2006-02-06 22:47:46 +00:00			`allow dosfs_t fs_t:filesystem associate;`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon fat / gen_context(system_u:object_r:dosfs_t,s0)`
			`genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0)`
			`genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)`
			`genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
			`# iso9660_t is the type for CD filesystems`
			`# and their files.`
			`#`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`type iso9660_t;`
			`fs_noxattr_type(iso9660_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon iso9660 / gen_context(system_u:object_r:iso9660_t,s0)`
			`genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)`
initial commit 2005-04-14 20:18:17 +00:00
clean up some filesystem assoc 2005-04-21 22:46:49 +00:00			`#`
			`# removable_t is the default type of all removable media`
			`#`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`type removable_t;`
renaming and xml 2005-06-09 15:20:31 +00:00			`allow removable_t noxattrfs:filesystem associate;`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`fs_noxattr_type(removable_t)`
clean up usercanread 2006-06-14 20:52:45 +00:00			`files_type(removable_t)`
clean up some filesystem assoc 2005-04-21 22:46:49 +00:00
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# nfs_t is the default type for NFS file systems`
			`# and their files.`
			`#`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00			`type nfs_t;`
			`fs_noxattr_type(nfs_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_mountpoint(nfs_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`genfscon nfs / gen_context(system_u:object_r:nfs_t,s0)`
			`genfscon nfs4 / gen_context(system_u:object_r:nfs_t,s0)`
			`genfscon afs / gen_context(system_u:object_r:nfs_t,s0)`
patch from dan Fri, 17 Mar 2006 15:22:53 -0500 2006-03-23 19:19:38 +00:00			`genfscon hfs / gen_context(system_u:object_r:nfs_t,s0)`
			`genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0)`
change reiserfs from xattr to genfscon 2006-03-29 14:53:58 +00:00			`genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)`
patch from dan Mon, 12 Jun 2006 15:32:00 -0400 2006-06-12 21:36:38 +00:00			`genfscon gfs / gen_context(system_u:object_r:nfs_t,s0)`
make fs use its own interfaces. 2006-03-29 19:55:30 +00:00
			`########################################`
			`#`
			`# Rules for all filesystem types`
			`#`

			`allow filesystem_type self:filesystem associate;`
move over to attributes for unconfined interfaces. 2006-04-10 21:04:51 +00:00
			`########################################`
			`#`
			`# Unconfined access to this module`
			`#`

			`allow filesystem_unconfined_type filesystem_type:filesystem *;`

			`# Create/access other files. fs_type is to pick up various`
			`# pseudo filesystem types that are applied to both the filesystem`
			`# and its files.`
			`allow filesystem_unconfined_type filesystem_type:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *;`