selinux-policy/refpolicy/policy/modules/system/clock.if

86 lines
1.9 KiB
Plaintext
Raw Normal View History

2005-06-01 14:17:43 +00:00
## <summary>Policy for reading and setting the hardware clock.</summary>
2005-05-05 21:40:32 +00:00
########################################
2005-08-11 17:46:39 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Execute hwclock in the clock domain.
2005-08-11 17:46:39 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## The type of the process performing this action.
## </param>
2005-05-12 20:50:09 +00:00
#
interface(`clock_domtrans',`
2005-06-17 17:59:26 +00:00
gen_require(`
type hwclock_t, hwclock_exec_t;
class fd use;
class fifo_file rw_file_perms;
')
2005-06-08 13:41:05 +00:00
domain_auto_trans($1,hwclock_exec_t,hwclock_t)
allow $1 hwclock_t:fd use;
allow hwclock_t $1:fd use;
allow hwclock_t $1:fifo_file rw_file_perms;
allow hwclock_t $1:process sigchld;
2005-05-12 20:50:09 +00:00
')
########################################
2005-08-11 17:46:39 +00:00
## <summary>
2005-06-23 21:30:57 +00:00
## Execute hwclock in the clock domain, and
## allow the specified role the hwclock domain.
2005-08-11 17:46:39 +00:00
## </summary>
2005-06-23 21:30:57 +00:00
## <param name="domain">
## The type of the process performing this action.
## </param>
## <param name="role">
## The role to be allowed the clock domain.
## </param>
## <param name="terminal">
## The type of the terminal allow the clock domain to use.
## </param>
#
interface(`clock_run',`
2005-06-17 17:59:26 +00:00
gen_require(`
type hwclock_t;
class chr_file { getattr read write ioctl };
')
2005-06-13 17:35:46 +00:00
clock_domtrans($1)
role $2 types hwclock_t;
allow hwclock_t $3:chr_file { getattr read write ioctl };
')
2005-06-07 22:36:07 +00:00
########################################
2005-08-11 17:46:39 +00:00
## <summary>
2005-06-27 20:59:28 +00:00
## Execute hwclock in the caller domain.
2005-08-11 17:46:39 +00:00
## </summary>
2005-06-23 16:00:05 +00:00
## <param name="domain">
2005-06-07 22:36:07 +00:00
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-12 20:50:09 +00:00
#
interface(`clock_exec',`
2005-06-17 17:59:26 +00:00
gen_require(`
type hwclock_exec_t;
')
2005-06-08 13:41:05 +00:00
can_exec($1,hwclock_exec_t)
2005-05-12 20:50:09 +00:00
')
2005-06-07 22:36:07 +00:00
########################################
2005-08-11 17:46:39 +00:00
## <summary>
2005-06-07 22:36:07 +00:00
## Allow executing domain to modify clock drift
2005-08-11 17:46:39 +00:00
## </summary>
2005-06-23 16:00:05 +00:00
## <param name="domain">
2005-06-07 22:36:07 +00:00
## The type of the process performing this action.
2005-06-23 16:00:05 +00:00
## </param>
2005-05-05 21:40:32 +00:00
#
interface(`clock_rw_adjtime',`
2005-06-17 17:59:26 +00:00
gen_require(`
type adjtime_t;
class file rw_file_perms;
')
2005-06-08 13:41:05 +00:00
allow $1 adjtime_t:file rw_file_perms;
2005-06-17 17:59:26 +00:00
files_list_etc($1)
2005-05-05 21:40:32 +00:00
')
2005-06-01 14:17:43 +00:00