selinux-policy/policy/modules/admin/vbetool.te

policy_module(vbetool, 1.5.2)

########################################
#
# Declarations
#

## <desc>
## <p>
##	Ignore vbetool mmap_zero errors.
## </p>
## </desc>
gen_tunable(vbetool_mmap_zero_ignore, false)

type vbetool_t;
type vbetool_exec_t;
init_system_domain(vbetool_t, vbetool_exec_t)

########################################
#
# Local policy
#

allow vbetool_t self:capability { dac_override sys_tty_config sys_admin };
allow vbetool_t self:process execmem;

dev_wx_raw_memory(vbetool_t)
dev_read_raw_memory(vbetool_t)
dev_rwx_zero(vbetool_t)
dev_rw_sysfs(vbetool_t)
dev_rw_xserver_misc(vbetool_t)
dev_rw_mtrr(vbetool_t)

domain_mmap_low(vbetool_t)

mls_file_read_all_levels(vbetool_t)
mls_file_write_all_levels(vbetool_t)

term_use_unallocated_ttys(vbetool_t)

miscfiles_read_localization(vbetool_t)

tunable_policy(`vbetool_mmap_zero_ignore',`
	dontaudit vbetool_t self:memprotect mmap_zero;
')

optional_policy(`
	hal_rw_pid_files(vbetool_t)
	hal_write_log(vbetool_t)
	hal_dontaudit_append_lib_files(vbetool_t)
')
Module version bump and changelog entry for conditional mmap_zero patch. 2010-09-01 14:08:09 +00:00			`policy_module(vbetool, 1.5.2)`
policy-20051208.patch 2005-12-13 20:38:19 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

1/1] Make the ability to mmap zero conditional where this is fapplicable. Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low() : Inspired by similar implementation in Fedora. Wine and vbetool do not always actually need the ability to mmap a low area of the address space. In some cases this can be silently denied. Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean. Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space. Rename domain_mmap_low interface to domain_mmap_low_uncond. Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-01 13:32:55 +00:00			`## <desc>`
			`## <p>`
			`## Ignore vbetool mmap_zero errors.`
			`## </p>`
			`## </desc>`
			`gen_tunable(vbetool_mmap_zero_ignore, false)`

policy-20051208.patch 2005-12-13 20:38:19 +00:00			`type vbetool_t;`
			`type vbetool_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_system_domain(vbetool_t, vbetool_exec_t)`
policy-20051208.patch 2005-12-13 20:38:19 +00:00
			`########################################`
			`#`
			`# Local policy`
			`#`

Vbetool patch from Dan Walsh. 2010-02-19 16:34:28 +00:00			`allow vbetool_t self:capability { dac_override sys_tty_config sys_admin };`
policy-20051208.patch 2005-12-13 20:38:19 +00:00			`allow vbetool_t self:process execmem;`

			`dev_wx_raw_memory(vbetool_t)`
			`dev_read_raw_memory(vbetool_t)`
renaming from 20060131 interface review 2006-01-31 16:08:56 +00:00			`dev_rwx_zero(vbetool_t)`
Vbetool patch from Dan Walsh. 2010-02-19 16:34:28 +00:00			`dev_rw_sysfs(vbetool_t)`
			`dev_rw_xserver_misc(vbetool_t)`
			`dev_rw_mtrr(vbetool_t)`
policy-20051208.patch 2005-12-13 20:38:19 +00:00
cleanup mmap_low merge with upstream 2010-09-01 18:55:04 +00:00			`domain_mmap_low(vbetool_t)`
trunk: 5 patches from dan. 2009-03-10 19:32:04 +00:00
Vbetool patch from Dan Walsh. vbetool needs mls overrides 2010-06-18 18:56:27 +00:00			`mls_file_read_all_levels(vbetool_t)`
			`mls_file_write_all_levels(vbetool_t)`

patch from dan Fri, 17 Mar 2006 15:22:53 -0500 2006-03-23 19:19:38 +00:00			`term_use_unallocated_ttys(vbetool_t)`

			`miscfiles_read_localization(vbetool_t)`

1/1] Make the ability to mmap zero conditional where this is fapplicable. Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low() : Inspired by similar implementation in Fedora. Wine and vbetool do not always actually need the ability to mmap a low area of the address space. In some cases this can be silently denied. Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean. Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space. Rename domain_mmap_low interface to domain_mmap_low_uncond. Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-01 13:32:55 +00:00			tunable_policy(`vbetool_mmap_zero_ignore',`
			`dontaudit vbetool_t self:memprotect mmap_zero;`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from dan Fri, 17 Mar 2006 15:22:53 -0500 2006-03-23 19:19:38 +00:00			`hal_rw_pid_files(vbetool_t)`
trunk: 4 patches from dan. 2007-09-05 14:48:21 +00:00			`hal_write_log(vbetool_t)`
trunk: 8 patches from dan. 2007-11-15 16:54:18 +00:00			`hal_dontaudit_append_lib_files(vbetool_t)`
patch from dan Fri, 17 Mar 2006 15:22:53 -0500 2006-03-23 19:19:38 +00:00			`')`