selinux-policy/policy/modules/apps/uml.if

## <summary>Policy for UML</summary>

########################################
## <summary>
##	Role access for uml
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	User domain for the role
##	</summary>
## </param>
#
interface(`uml_role',`
	gen_require(`
		type uml_t, uml_exec_t;
		type uml_ro_t, uml_rw_t, uml_tmp_t;
		type uml_devpts_t, uml_tmpfs_t;
	')

	role $1 types uml_t;

	# Transition from the user domain to this domain.
	domtrans_pattern($2, uml_exec_t, uml_t)

	# for mconsole
	allow $2 uml_t:unix_dgram_socket sendto;
	allow uml_t $2:unix_dgram_socket sendto;

	# allow ps, ptrace, signal
	ps_process_pattern($2, uml_t)
	allow $2 uml_t:process { ptrace signal_perms };

	allow $2 uml_ro_t:dir list_dir_perms;
	read_files_pattern($2, uml_ro_t, uml_ro_t)
	read_lnk_files_pattern($2, uml_ro_t, uml_ro_t)

	manage_dirs_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	manage_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	manage_lnk_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	manage_fifo_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	manage_sock_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	relabel_dirs_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	relabel_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	relabel_lnk_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	relabel_fifo_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })
	relabel_sock_files_pattern($2, { uml_ro_t uml_rw_t }, { uml_ro_t uml_rw_t })

	manage_dirs_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
	manage_files_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
	relabel_dirs_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })
	relabel_files_pattern($2, { uml_ro_t uml_rw_t uml_exec_t }, { uml_ro_t uml_rw_t uml_exec_t })

	manage_dirs_pattern($2, uml_tmp_t, uml_tmp_t)
	manage_files_pattern($2, uml_tmp_t, uml_tmp_t)
	manage_lnk_files_pattern($2, uml_tmp_t, uml_tmp_t)
	manage_sock_files_pattern($2, uml_tmp_t, uml_tmp_t)
')

########################################
## <summary>
##	Set attributes on uml utility socket files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`uml_setattr_util_sockets',`
	gen_require(`
		type uml_switch_var_run_t;
	')

	allow $1 uml_switch_var_run_t:sock_file setattr;
')

########################################
## <summary>
##	Manage uml utility files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`uml_manage_util_files',`
	gen_require(`
		type uml_switch_var_run_t;
	')

	manage_files_pattern($1, uml_switch_var_run_t, uml_switch_var_run_t)
	manage_lnk_files_pattern($1, uml_switch_var_run_t, uml_switch_var_run_t)
')