selinux-policy/refpolicy/policy/modules/system/selinux.if

# Copyright (C) 2005 Tresys Technology, LLC

########################################
#
# selinux_read_config(domain,[`optional'])
#
define(`selinux_read_config',`
requires_block_template(selinux_read_config_depend,$2)
allow $1 selinux_config_t:dir { getattr search read };
allow $1 selinux_config_t:file { getattr read };
')

define(`selinux_read_config_depend',`
type selinux_config_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_read_default_contexts(domain,[`optional'])
#
define(`selinux_read_default_contexts',`
requires_block_template(selinux_read_default_contexts_depend,$2)
allow $1 selinux_config_t:dir search;
allow $1 default_context_t:dir { getattr search read };
allow $1 default_context_t:file { getattr read };
')

define(`selinux_read_default_contexts_depend',`
type selinux_config_t, default_context_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_read_binary_policy(domain,[`optional'])
#
define(`selinux_read_binary_policy',`
requires_block_template(selinux_read_binary_policy_depend,$2)
allow $1 policy_config_t:dir { getattr search read };
allow $1 policy_config_t:file { getattr read };
')

define(`selinux_read_binary_policy_depend',`
type policy_config_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# selinux_write_binary_policy(domain,[`optional'])
#
define(`selinux_write_binary_policy',`
requires_block_template(selinux_write_binary_policy_depend,$2)
allow $1 policy_config_t:dir { getattr search read write add_name remove_name };
allow $1 policy_config_t:file { getattr create write unlink };
typeattribute $1 can_write_binary_policy;
')

define(`selinux_write_binary_policy_depend',`
type policy_config_t;
attribute can_write_binary_policy;
class dir { getattr search read write add_name remove_name };
class file { getattr create write unlink };
')

#######################################
#
# selinux_read_load_policy_binary(domain,[`optional'])
#
define(`selinux_read_load_policy_binary',`
requires_block_template(selinux_read_load_policy_binary_depend,$2)
allow $1 load_policy_exec_t:file { getattr read };
')

define(`selinux_read_load_policy_binary_depend',`
type load_policy_exec_t;
class file { getattr read };
')