selinux-policy/policy/modules/system/hotplug.te


policy_module(hotplug,1.6.1)

########################################
#
# Declarations
#

type hotplug_t;
type hotplug_exec_t;
kernel_domtrans_to(hotplug_t,hotplug_exec_t)
init_daemon_domain(hotplug_t,hotplug_exec_t)

type hotplug_etc_t;
files_config_file(hotplug_etc_t)
init_daemon_domain(hotplug_t,hotplug_etc_t)

type hotplug_var_run_t;
files_pid_file(hotplug_var_run_t)

########################################
#
# Local policy
#

allow hotplug_t self:capability { net_admin sys_tty_config mknod sys_rawio };
dontaudit hotplug_t self:capability { sys_module sys_admin sys_tty_config };
# for access("/etc/bashrc", X_OK) on Red Hat
dontaudit hotplug_t self:capability { dac_override dac_read_search };
allow hotplug_t self:process { setpgid getsession getattr signal_perms };
allow hotplug_t self:fifo_file rw_file_perms;
allow hotplug_t self:netlink_route_socket r_netlink_socket_perms;
allow hotplug_t self:udp_socket create_socket_perms;
allow hotplug_t self:tcp_socket connected_stream_socket_perms;

read_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)
read_lnk_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)
can_exec(hotplug_t,hotplug_etc_t)
allow hotplug_t hotplug_etc_t:dir list_dir_perms;

can_exec(hotplug_t,hotplug_exec_t)

manage_files_pattern(hotplug_t,hotplug_var_run_t,hotplug_var_run_t)
files_pid_filetrans(hotplug_t,hotplug_var_run_t,file)

kernel_sigchld(hotplug_t)
kernel_setpgid(hotplug_t)
kernel_read_system_state(hotplug_t)
kernel_read_kernel_sysctls(hotplug_t)
kernel_read_net_sysctls(hotplug_t)

files_read_kernel_modules(hotplug_t)

corenet_all_recvfrom_unlabeled(hotplug_t)
corenet_all_recvfrom_netlabel(hotplug_t)
corenet_tcp_sendrecv_all_if(hotplug_t)
corenet_udp_sendrecv_all_if(hotplug_t)
corenet_tcp_sendrecv_all_nodes(hotplug_t)
corenet_udp_sendrecv_all_nodes(hotplug_t)
corenet_tcp_sendrecv_all_ports(hotplug_t)
corenet_udp_sendrecv_all_ports(hotplug_t)

dev_rw_sysfs(hotplug_t)
dev_read_usbfs(hotplug_t)
dev_setattr_printer_dev(hotplug_t)
dev_setattr_sound_dev(hotplug_t)
# for SSP:
dev_read_urand(hotplug_t)

fs_getattr_all_fs(hotplug_t)
fs_search_auto_mountpoints(hotplug_t)

storage_setattr_fixed_disk_dev(hotplug_t)
storage_setattr_removable_dev(hotplug_t)

corecmd_exec_bin(hotplug_t)
corecmd_exec_shell(hotplug_t)

domain_use_interactive_fds(hotplug_t)
# for ps
domain_dontaudit_read_all_domains_state(hotplug_t)
domain_dontaudit_getattr_all_domains(hotplug_t)

files_read_etc_files(hotplug_t)
files_manage_etc_runtime_files(hotplug_t)
files_etc_filetrans_etc_runtime(hotplug_t,file)
files_exec_etc_files(hotplug_t)
# for when filesystems are not mounted early in the boot:
files_dontaudit_search_isid_type_dirs(hotplug_t)

init_read_script_state(hotplug_t)
# Allow hotplug (including /sbin/ifup-local) to start/stop services and
# run sendmail -q
init_domtrans_script(hotplug_t)
# kernel threads inherit from shared descriptor table used by init
init_dontaudit_rw_initctl(hotplug_t)

logging_send_syslog_msg(hotplug_t)
logging_search_logs(hotplug_t)

libs_use_ld_so(hotplug_t)
libs_use_shared_libs(hotplug_t)
# Read /usr/lib/gconv/.*
libs_read_lib_files(hotplug_t)

miscfiles_read_hwdata(hotplug_t)
miscfiles_read_localization(hotplug_t)

modutils_domtrans_insmod(hotplug_t)
modutils_read_module_deps(hotplug_t)

seutil_dontaudit_search_config(hotplug_t)

sysnet_read_config(hotplug_t)

userdom_dontaudit_use_unpriv_user_fds(hotplug_t)
userdom_dontaudit_search_sysadm_home_dirs(hotplug_t)

ifdef(`distro_redhat', `
	optional_policy(`
		# for arping used for static IP addresses on PCMCIA ethernet
		netutils_domtrans(hotplug_t)
		fs_rw_tmpfs_chr_files(hotplug_t)
	')
	files_getattr_generic_locks(hotplug_t)
')

optional_policy(`
	consoletype_exec(hotplug_t)
')

optional_policy(`
	dbus_system_bus_client_template(hotplug,hotplug_t)
')

optional_policy(`
	fstools_domtrans(hotplug_t)
')

optional_policy(`
	hal_dgram_send(hotplug_t)
')

optional_policy(`
	hostname_exec(hotplug_t)
')

optional_policy(`
	iptables_domtrans(hotplug_t)
')

optional_policy(`
	mount_domtrans(hotplug_t)
')

optional_policy(`
	mta_send_mail(hotplug_t)
')

optional_policy(`
	nis_use_ypbind(hotplug_t)
')

optional_policy(`
	nscd_socket_use(hotplug_t)
')

optional_policy(`
	seutil_sigchld_newrole(hotplug_t)
')

optional_policy(`
	sysnet_domtrans_dhcpc(hotplug_t)
	sysnet_signal_dhcpc(hotplug_t)
	sysnet_kill_dhcpc(hotplug_t)
	sysnet_signull_dhcpc(hotplug_t)
	sysnet_sigstop_dhcpc(hotplug_t)
	sysnet_sigchld_dhcpc(hotplug_t)
	sysnet_read_dhcpc_pid(hotplug_t)
	sysnet_rw_dhcp_config(hotplug_t)
	sysnet_domtrans_ifconfig(hotplug_t)
')

optional_policy(`
	udev_domtrans(hotplug_t)
	udev_helper_domtrans(hotplug_t)
	udev_read_db(hotplug_t)
')

optional_policy(`
	updfstab_domtrans(hotplug_t)
')

optional_policy(`
	usbmodules_domtrans(hotplug_t)
')
initial commit 2005-05-02 19:24:29 +00:00
trunk: module version bumps for previous commit. 2007-10-02 17:15:07 +00:00			`policy_module(hotplug,1.6.1)`
initial commit 2005-05-02 19:24:29 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type hotplug_t;`
			`type hotplug_exec_t;`
from today's interface review meeting: s/kernel_use_unlabeled_blk_dev/kernel_rw_unlabeled_blk_dev/g s/kernel_userland_entry/kernel_domtrans_to/g 2006-01-27 19:55:42 +00:00			`kernel_domtrans_to(hotplug_t,hotplug_exec_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`init_daemon_domain(hotplug_t,hotplug_exec_t)`
initial commit 2005-05-02 19:24:29 +00:00
more fix 2005-10-24 18:40:24 +00:00			`type hotplug_etc_t;`
			`files_config_file(hotplug_etc_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`init_daemon_domain(hotplug_t,hotplug_etc_t)`
initial commit 2005-05-02 19:24:29 +00:00
			`type hotplug_var_run_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_pid_file(hotplug_var_run_t)`
initial commit 2005-05-02 19:24:29 +00:00
			`########################################`
			`#`
			`# Local policy`
			`#`

more updates 2005-09-15 21:03:29 +00:00			`allow hotplug_t self:capability { net_admin sys_tty_config mknod sys_rawio };`
initial commit 2005-05-02 19:24:29 +00:00			`dontaudit hotplug_t self:capability { sys_module sys_admin sys_tty_config };`
			`# for access("/etc/bashrc", X_OK) on Red Hat`
			`dontaudit hotplug_t self:capability { dac_override dac_read_search };`
patch from dan Thu, 31 Aug 2006 15:16:30 -0400 2006-09-01 15:52:05 +00:00			`allow hotplug_t self:process { setpgid getsession getattr signal_perms };`
renaming insanity 2005-06-10 01:01:13 +00:00			`allow hotplug_t self:fifo_file rw_file_perms;`
more updates 2005-09-15 21:03:29 +00:00			`allow hotplug_t self:netlink_route_socket r_netlink_socket_perms;`
aliases 2005-06-09 14:50:48 +00:00			`allow hotplug_t self:udp_socket create_socket_perms;`
			`allow hotplug_t self:tcp_socket connected_stream_socket_perms;`
initial commit 2005-05-02 19:24:29 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`read_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)`
			`read_lnk_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)`
more fixes 2005-10-21 21:35:25 +00:00			`can_exec(hotplug_t,hotplug_etc_t)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow hotplug_t hotplug_etc_t:dir list_dir_perms;`
initial commit 2005-05-02 19:24:29 +00:00
more fixes 2005-10-21 21:35:25 +00:00			`can_exec(hotplug_t,hotplug_exec_t)`
initial commit 2005-05-02 19:24:29 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`manage_files_pattern(hotplug_t,hotplug_var_run_t,hotplug_var_run_t)`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_pid_filetrans(hotplug_t,hotplug_var_run_t,file)`
initial commit 2005-05-02 19:24:29 +00:00
more work to clean up and complete current modules 2005-06-20 17:41:29 +00:00			`kernel_sigchld(hotplug_t)`
more updates 2005-09-15 21:03:29 +00:00			`kernel_setpgid(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`kernel_read_system_state(hotplug_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(hotplug_t)`
			`kernel_read_net_sysctls(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_read_kernel_modules(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(hotplug_t)`
			`corenet_all_recvfrom_netlabel(hotplug_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`corenet_tcp_sendrecv_all_if(hotplug_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`corenet_udp_sendrecv_all_if(hotplug_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`corenet_tcp_sendrecv_all_nodes(hotplug_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`corenet_udp_sendrecv_all_nodes(hotplug_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`corenet_tcp_sendrecv_all_ports(hotplug_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`corenet_udp_sendrecv_all_ports(hotplug_t)`
another cleanup pass 2005-05-24 15:55:57 +00:00
more updates 2005-09-15 21:03:29 +00:00			`dev_rw_sysfs(hotplug_t)`
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`dev_read_usbfs(hotplug_t)`
renaming from 20060131 interface review 2006-01-31 16:08:56 +00:00			`dev_setattr_printer_dev(hotplug_t)`
			`dev_setattr_sound_dev(hotplug_t)`
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`# for SSP:`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_read_urand(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_all_fs(hotplug_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`fs_search_auto_mountpoints(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`storage_setattr_fixed_disk_dev(hotplug_t)`
			`storage_setattr_removable_dev(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`corecmd_exec_bin(hotplug_t)`
			`corecmd_exec_shell(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(hotplug_t)`
todo cleanup 2005-09-20 20:48:17 +00:00			`# for ps`
			`domain_dontaudit_read_all_domains_state(hotplug_t)`
work on users 2005-11-29 15:49:18 +00:00			`domain_dontaudit_getattr_all_domains(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(hotplug_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_manage_etc_runtime_files(hotplug_t)`
split out filetrans part of files_manage_etc_runtime_files(), bug 1663 2006-05-02 18:34:35 +00:00			`files_etc_filetrans_etc_runtime(hotplug_t,file)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_exec_etc_files(hotplug_t)`
add some file_t interfaces, and console write 2005-05-31 21:25:45 +00:00			`# for when filesystems are not mounted early in the boot:`
renaming from 20060131 interface review, round 3 2006-01-31 19:21:01 +00:00			`files_dontaudit_search_isid_type_dirs(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_read_script_state(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`# Allow hotplug (including /sbin/ifup-local) to start/stop services and`
			`# run sendmail -q`
renaming insanity 2005-06-13 17:35:46 +00:00			`init_domtrans_script(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`# kernel threads inherit from shared descriptor table used by init`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_dontaudit_rw_initctl(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(hotplug_t)`
			`logging_search_logs(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`libs_use_ld_so(hotplug_t)`
			`libs_use_shared_libs(hotplug_t)`
make a reasonable lib_t interface 2005-05-11 15:46:51 +00:00			`# Read /usr/lib/gconv/.*`
another slew of renaming 2006-02-02 21:08:12 +00:00			`libs_read_lib_files(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`miscfiles_read_hwdata(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`miscfiles_read_localization(hotplug_t)`

more of the same 2005-10-31 22:44:03 +00:00			`modutils_domtrans_insmod(hotplug_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`modutils_read_module_deps(hotplug_t)`
more of the same 2005-10-31 22:44:03 +00:00
more updates 2005-09-15 21:03:29 +00:00			`seutil_dontaudit_search_config(hotplug_t)`

renaming insanity 2005-06-13 17:35:46 +00:00			`sysnet_read_config(hotplug_t)`
another cleanup pass 2005-05-24 15:55:57 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(hotplug_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`userdom_dontaudit_search_sysadm_home_dirs(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00
start switching over to new tunable infrastructure 2005-06-07 18:45:47 +00:00			ifdef(`distro_redhat', `
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`# for arping used for static IP addresses on PCMCIA ethernet`
renaming insanity 2005-06-13 17:35:46 +00:00			`netutils_domtrans(hotplug_t)`
renaming from 20060131 interface review, round 4 2006-01-31 20:29:27 +00:00			`fs_rw_tmpfs_chr_files(hotplug_t)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`')`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_getattr_generic_locks(hotplug_t)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`')`
another cleanup pass 2005-05-24 15:55:57 +00:00
Fixes for RHEL4 from the CLIP project. 2007-04-27 15:08:15 +00:00			optional_policy(`
			`consoletype_exec(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add dbus 2005-08-31 20:58:12 +00:00			`dbus_system_bus_client_template(hotplug,hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add fstools, and more cleanup 2005-06-27 20:59:28 +00:00			`fstools_domtrans(hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`hal_dgram_send(hotplug_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`hostname_exec(hotplug_t)`
more authlogin handling 2005-05-09 21:07:53 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`iptables_domtrans(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
begin merging in upstream NSA CVS changes 2005-09-12 21:40:56 +00:00			`mount_domtrans(hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`mta_send_mail(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`nis_use_ypbind(hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`nscd_socket_use(hotplug_t)`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`seutil_sigchld_newrole(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
clean up more todos 2005-06-29 20:53:53 +00:00			`sysnet_domtrans_dhcpc(hotplug_t)`
			`sysnet_signal_dhcpc(hotplug_t)`
			`sysnet_kill_dhcpc(hotplug_t)`
			`sysnet_signull_dhcpc(hotplug_t)`
			`sysnet_sigstop_dhcpc(hotplug_t)`
			`sysnet_sigchld_dhcpc(hotplug_t)`
			`sysnet_read_dhcpc_pid(hotplug_t)`
			`sysnet_rw_dhcp_config(hotplug_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`sysnet_domtrans_ifconfig(hotplug_t)`
more authlogin handling 2005-05-09 21:07:53 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`udev_domtrans(hotplug_t)`
* fixes uncovered by sediff * fix disable_trans support so the daemon can be both init and inet services, and not get dup bool decl 2005-10-31 20:32:53 +00:00			`udev_helper_domtrans(hotplug_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`udev_read_db(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add updfstab 2005-08-08 15:51:15 +00:00			`updfstab_domtrans(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`
add usbmodules 2006-01-11 18:28:57 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add usbmodules 2006-01-11 18:28:57 +00:00			`usbmodules_domtrans(hotplug_t)`
			`')`