selinux-policy/refpolicy/policy/modules/kernel/devices.if

1798 lines
41 KiB
Plaintext
Raw Normal View History

## <module name="devices" layer="kernel">
2005-06-13 19:22:00 +00:00
## <summary>
## Device nodes and interfaces for many basic system devices.
## </summary>
2005-06-13 16:22:32 +00:00
## <description>
## <p>
## This module creates the device node concept and provides
## the policy for many of the device files. Notable exceptions are
## the mass storage and terminal devices that are covered by other
## modules.
## </p>
## <p>
## This module creates the concept of a device node. That is a
## char or block device file, usually in /dev. All types that
## are used to label device nodes should use the dev_node macro.
## </p>
## <p>
## Additionally, this module controls access to three things:
## <ul>
## <li>the device directories containing device nodes</li>
## <li>device nodes as a group</li>
## <li>individual access to specific device nodes covered by
## this module.</li>
## </ul>
## </p>
## </description>
########################################
## <interface name="dev_node">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Make the passed in type a type appropriate for
## use on device nodes (usually files in /dev).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="object_type">
## The object type that will be used on device nodes.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_node',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
typeattribute $1 device_node;
2005-06-08 13:12:00 +00:00
fs_associate($1)
2005-06-02 20:26:48 +00:00
optional_policy(`distro_redhat',`
2005-06-14 17:36:21 +00:00
fs_associate_tmpfs($1)
2005-06-02 20:26:48 +00:00
')
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_node_depend',`
2005-06-02 20:26:48 +00:00
attribute device_node;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_relabel_all_dev_nodes">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Allow full relabeling (to and from) of all device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed to relabel.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_relabel_all_dev_nodes',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
allow $1 device_node:dir { getattr relabelfrom };
allow $1 device_node:file { getattr relabelfrom };
allow $1 device_node:lnk_file { getattr relabelfrom };
allow $1 device_node:fifo_file { getattr relabelfrom };
allow $1 device_node:sock_file { getattr relabelfrom };
allow $1 { device_t device_node }:blk_file { getattr relabelfrom relabelto };
allow $1 { device_t device_node }:chr_file { getattr relabelfrom relabelto };
')
2005-06-13 16:22:32 +00:00
define(`dev_relabel_all_dev_nodes_depend',`
2005-06-02 20:26:48 +00:00
attribute device_node;
type device_t;
class dir { getattr relabelfrom };
class file { getattr relabelfrom };
class lnk_file { getattr relabelfrom };
class fifo_file { getattr relabelfrom };
class sock_file { getattr relabelfrom };
class blk_file { getattr relabelfrom relabelto };
class chr_file { getattr relabelfrom relabelto };
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_list_all_dev_nodes">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## List all of the device nodes in a device directory.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed to list device nodes.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_list_all_dev_nodes',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
allow $1 device_t:dir r_dir_perms;
2005-06-13 16:22:32 +00:00
allow $1 device_t:lnk_file { getattr read };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_list_all_dev_nodes_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class dir r_dir_perms;
2005-06-13 16:22:32 +00:00
class lnk_file { getattr read };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_list_all_dev_nodes">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit attempts to list all device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit listing of device nodes.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_list_all_dev_nodes',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
dontaudit $1 device_t:dir r_dir_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_list_all_dev_nodes_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class dir r_dir_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-01 13:51:54 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_create_dir">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Create a directory in the device directory.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed to create the directory.
## </parameter>
## </interface>
2005-06-01 13:51:54 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_create_dir',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
allow $1 device_t:dir { ra_dir_perms create };
2005-06-01 13:51:54 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_create_dir_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class dir { ra_dir_perms create };
2005-06-01 13:51:54 +00:00
')
2005-06-13 17:35:46 +00:00
########################################
## <interface name="dev_relabel_dev_dirs">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 17:35:46 +00:00
## Allow full relabeling (to and from) of directories in /dev.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 17:35:46 +00:00
## <parameter name="domain">
## Domain allowed to relabel.
## </parameter>
## </interface>
#
define(`dev_relabel_dev_dirs',`
gen_require(`$0'_depend)
2005-06-13 17:35:46 +00:00
allow $1 device_t:dir { r_dir_perms relabelfrom relabelto };
')
define(`dev_relabel_dev_dirs_depend',`
type device_t;
class dir { r_dir_perms relabelfrom relabelto };
')
2005-06-10 01:01:13 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_getattr_generic_pipe">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit getattr on generic pipes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit.
## </parameter>
## </interface>
2005-06-10 01:01:13 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_generic_pipe',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
dontaudit $1 device_t:fifo_file getattr;
2005-05-30 21:17:20 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_generic_pipe_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class fifo_file getattr;
2005-05-30 21:17:20 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_getattr_generic_blk_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Allow getattr on generic block devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_getattr_generic_blk_file',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
allow $1 device_t:dir r_dir_perms;
allow $1 device_t:blk_file getattr;
')
2005-06-13 16:22:32 +00:00
define(`ddev_getattr_generic_blk_file_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class dir r_dir_perms;
class blk_file getattr;
')
2005-05-13 14:37:13 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_getattr_generic_blk_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit getattr on generic block devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit access.
## </parameter>
## </interface>
2005-05-13 14:37:13 +00:00
#
2005-06-13 17:35:46 +00:00
define(`dev_dontaudit_getattr_generic_blk_file',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
dontaudit $1 device_t:blk_file getattr;
2005-05-13 14:37:13 +00:00
')
2005-06-13 17:35:46 +00:00
define(`dev_dontaudit_getattr_generic_blk_file_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class blk_file getattr;
2005-05-13 14:37:13 +00:00
')
2005-05-31 23:02:11 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_manage_generic_blk_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Allow read, write, create, and delete for generic
## block files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-31 23:02:11 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_blk_file',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
allow $1 device_t:dir rw_dir_perms;
allow $1 device_t:blk_file create_file_perms;
2005-05-31 23:02:11 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_blk_file_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class blk_file create_file_perms;
2005-05-31 23:02:11 +00:00
')
2005-05-30 21:17:20 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_create_generic_chr_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Allow read, write, and create for generic character device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-30 21:17:20 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_create_generic_chr_file',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
2005-06-13 17:35:46 +00:00
allow $1 device_t:dir ra_dir_perms;
2005-06-02 20:26:48 +00:00
allow $1 device_t:chr_file create;
allow $1 self:capability mknod;
2005-05-30 21:17:20 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_create_generic_chr_file_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
2005-06-13 17:35:46 +00:00
class dir ra_dir_perms;
2005-06-02 20:26:48 +00:00
class chr_file create;
class capability mknod;
2005-05-30 21:17:20 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_getattr_generic_chr_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Allow getattr for generic character device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_getattr_generic_chr_file',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
allow $1 device_t:dir r_dir_perms;
allow $1 device_t:chr_file getattr;
')
2005-06-13 16:22:32 +00:00
define(`dev_getattr_generic_chr_file_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class dir r_dir_perms;
class chr_file getattr;
')
2005-05-13 14:37:13 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_getattr_generic_chr_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit getattr for generic character device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit access.
## </parameter>
## </interface>
2005-05-13 14:37:13 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_generic_chr_file',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
dontaudit $1 device_t:chr_file getattr;
2005-05-13 14:37:13 +00:00
')
2005-06-13 17:35:46 +00:00
define(`dev_dontaudit_getattr_generic_chr_file_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
class chr_file getattr;
2005-05-13 14:37:13 +00:00
')
2005-05-24 15:55:57 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_del_generic_symlinks">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Delete symbolic links in device directories.
2005-06-13 19:22:00 +00:00
## </summary>
2005-05-24 15:55:57 +00:00
## <parameter name="domain">
2005-06-13 16:22:32 +00:00
## Domain allowed access.
2005-05-24 15:55:57 +00:00
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_del_generic_symlinks',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
2005-06-13 16:22:32 +00:00
allow $1 device_t:dir { getattr read write remove_name };
2005-06-02 20:26:48 +00:00
allow $1 device_t:lnk_file unlink;
2005-05-24 15:55:57 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_del_generic_symlinks_depend',`
2005-06-02 20:26:48 +00:00
attribute device_node, memory_raw_read, memory_raw_write;
type device_t;
2005-06-13 16:22:32 +00:00
class dir { getattr read write remove_name };
2005-06-02 20:26:48 +00:00
class lnk_file unlink;
2005-05-24 15:55:57 +00:00
')
2005-05-13 14:37:13 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_manage_generic_symlinks">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Create, delete, read, and write symbolic links in device directories.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-13 14:37:13 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_symlinks',`
gen_require(`$0'_depend)
2005-06-02 20:26:48 +00:00
2005-06-13 16:22:32 +00:00
allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };
2005-05-13 14:37:13 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_symlinks_depend',`
2005-06-02 20:26:48 +00:00
type device_t;
2005-06-13 16:22:32 +00:00
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
class lnk_file { create read getattr setattr link unlink rename };
2005-05-13 14:37:13 +00:00
')
########################################
2005-06-13 17:35:46 +00:00
## <interface name="dev_manage_dev_nodes">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Create, delete, read, and write device nodes in device directories.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 17:35:46 +00:00
define(`dev_manage_dev_nodes',`
gen_require(`$0'_depend)
2005-06-13 16:22:32 +00:00
allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
allow $1 device_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };
allow $1 device_t:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
allow $1 device_node:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
# these next rules are to satisfy assertions broken by the above lines.
# the permissions hopefully can be cut back a lot
storage_raw_read_fixed_disk($1)
storage_raw_write_fixed_disk($1)
storage_read_scsi_generic($1)
storage_write_scsi_generic($1)
typeattribute $1 memory_raw_read;
typeattribute $1 memory_raw_write;
')
2005-06-13 17:35:46 +00:00
define(`dev_manage_dev_nodes_depend',`
attribute device_node, memory_raw_read, memory_raw_write;
type device_t;
2005-06-13 16:22:32 +00:00
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
class lnk_file { create read getattr setattr link unlink rename };
class chr_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
class blk_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_rw_generic_dev_nodes">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit getattr for generic device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_rw_generic_dev_nodes',`
gen_require(`$0'_depend)
dontaudit $1 device_t:{ chr_file blk_file } { getattr read write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_rw_generic_dev_nodes_depend',`
type device_t;
class chr_file { getattr read write ioctl };
class blk_file { getattr read write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-05-27 21:56:01 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_manage_generic_blk_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Create, delete, read, and write block device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-27 21:56:01 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_blk_file',`
gen_require(`$0'_depend)
allow $1 device_t:dir rw_dir_perms;
allow $1 device_t:blk_file create_file_perms;
2005-05-27 21:56:01 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_blk_file_depend',`
type device_t;
class dir rw_dir_perms;
class blk_file create_file_perms;
2005-05-27 21:56:01 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_manage_generic_chr_file">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Create, delete, read, and write character device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-27 21:56:01 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_chr_file',`
gen_require(`$0'_depend)
allow $1 device_t:dir rw_dir_perms;
allow $1 device_t:chr_file create_file_perms;
2005-05-27 21:56:01 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_manage_generic_chr_file_depend',`
type device_t;
class dir rw_dir_perms;
class chr_file create_file_perms;
2005-05-27 21:56:01 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_create_dev_node">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Create, read, and write device nodes. The node
## will be transitioned to the type provided.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## <parameter name="file">
## Type to which the created node will be transitioned.
## </parameter>
## <parameter name="objectclass(es)">
## Object class(es) (single or set including {}) for which this
## the transition will occur.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_create_dev_node',`
gen_require(`$0'_depend)
allow $1 device_t:dir rw_dir_perms;
type_transition $1 device_t:$3 $2;
optional_policy(`distro_redhat',`
2005-06-14 17:36:21 +00:00
fs_associate_tmpfs($2)
')
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_create_dev_node_depend',`
type device_t;
class dir rw_dir_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_getattr_all_blk_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Getattr on all block file device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_getattr_all_blk_files',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 device_node:blk_file getattr;
')
2005-06-13 16:22:32 +00:00
define(`dev_getattr_all_blk_files_depend',`
attribute device_node;
class blk_file getattr;
class dir r_dir_perms;
2005-05-13 14:37:13 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_getattr_all_blk_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit getattr on all block file device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit access.
## </parameter>
## </interface>
2005-05-13 14:37:13 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_all_blk_files',`
gen_require(`$0'_depend)
allow $1 device_node:blk_file getattr;
2005-05-13 14:37:13 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_all_blk_files_depend',`
attribute device_node;
class blk_file getattr;
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_getattr_all_chr_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Getattr on all character file device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_getattr_all_chr_files',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 device_node:chr_file getattr;
')
2005-06-13 16:22:32 +00:00
define(`dev_getattr_all_chr_files_depend',`
attribute device_node;
class chr_file getattr;
class dir r_dir_perms;
2005-05-13 14:37:13 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_getattr_all_chr_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit getattr on all character file device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit access.
## </parameter>
## </interface>
2005-05-13 14:37:13 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_all_chr_files',`
gen_require(`$0'_depend)
dontaudit $1 device_node:chr_file getattr;
2005-05-13 14:37:13 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_getattr_all_chr_files_depend',`
attribute device_node;
class chr_file getattr;
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_setattr_all_blk_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Setattr on all block file device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_setattr_all_blk_files',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 device_node:blk_file setattr;
')
2005-06-13 16:22:32 +00:00
define(`dev_setattr_all_blk_files_depend',`
attribute device_node;
class dir r_dir_perms;
class blk_file setattr;
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_setattr_all_chr_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Setattr on all character file device nodes.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_setattr_all_chr_files',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 device_node:chr_file setattr;
')
2005-06-13 16:22:32 +00:00
define(`dev_setattr_all_chr_files_depend',`
attribute device_node;
class dir r_dir_perms;
class chr_file setattr;
')
2005-05-27 21:56:01 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_manage_all_blk_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read, write, create, and delete all block device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-27 21:56:01 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_manage_all_blk_files',`
gen_require(`$0'_depend)
allow $1 device_t:dir rw_dir_perms;
allow $1 device_node:blk_file create_file_perms;
# these next rules are to satisfy assertions broken by the above lines.
storage_raw_read_fixed_disk($1)
storage_raw_write_fixed_disk($1)
storage_read_scsi_generic($1)
storage_write_scsi_generic($1)
2005-05-27 21:56:01 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_manage_all_blk_files_depend',`
attribute device_node;
class dir rw_dir_perms;
class blk_file create_file_perms;
2005-05-27 21:56:01 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_manage_all_chr_files">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read, write, create, and delete all character device files.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-27 21:56:01 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_manage_all_chr_files',`
gen_require(`$0'_depend)
allow $1 device_t:dir rw_dir_perms;
allow $1 device_node:chr_file create_file_perms;
typeattribute $1 memory_raw_read, memory_raw_write;
2005-05-27 21:56:01 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_manage_all_chr_files_depend',`
attribute device_node, memory_raw_read, memory_raw_write;
class dir rw_dir_perms;
class chr_file create_file_perms;
2005-05-27 21:56:01 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_raw_memory">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read raw memory devices (e.g. /dev/mem).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_raw_memory',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 memory_device_t:chr_file r_file_perms;
allow $1 self:capability sys_rawio;
typeattribute $1 memory_raw_read;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_raw_memory_depend',`
type device_t, memory_device_t;
attribute memory_raw_read;
class dir r_dir_perms;
class chr_file r_file_perms;
class capability sys_rawio;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_raw_memory">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write raw memory devices (e.g. /dev/mem).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_raw_memory',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 memory_device_t:chr_file write;
allow $1 self:capability sys_rawio;
typeattribute $1 memory_raw_write;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_raw_memory_depend',`
type device_t, memory_device_t;
attribute memory_raw_write;
class dir r_dir_perms;
class chr_file write;
class capability sys_rawio;
2005-04-14 20:18:17 +00:00
')
2005-05-30 21:17:20 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rx_raw_memory">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and execute raw memory devices (e.g. /dev/mem).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-30 21:17:20 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rx_raw_memory',`
gen_require(`$0'_depend)
2005-06-13 16:22:32 +00:00
dev_read_raw_memory($1)
allow $1 memory_device_t:chr_file execute;
2005-05-30 21:17:20 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rx_raw_memory_depend',`
type device_t, memory_device_t;
class chr_file execute;
2005-05-30 21:17:20 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_wx_raw_memory">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write and execute raw memory devices (e.g. /dev/mem).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-30 21:17:20 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_wx_raw_memory',`
gen_require(`$0'_depend)
2005-06-13 16:22:32 +00:00
dev_write_raw_memory($1)
allow $1 memory_device_t:chr_file execute;
2005-05-30 21:17:20 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_wx_raw_memory_depend',`
type device_t, memory_device_t;
class chr_file execute;
2005-05-30 21:17:20 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_rand">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read from random devices (e.g., /dev/random)
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_rand',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 random_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_rand_depend',`
type device_t, random_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_urand">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read from pseudo random devices (e.g., /dev/urandom)
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_urand',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 urandom_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_urand_depend',`
type device_t, urandom_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_rand">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write to the random device (e.g., /dev/random). This adds
## entropy used to generate the random data read from the
## random device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_rand',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 random_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_rand_depend',`
type device_t, random_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_urand">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write to the pseudo random device (e.g., /dev/urandom). This
## sets the random number generator seed.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_urand',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 urandom_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_urand_depend',`
type device_t, urandom_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_null_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write to the null device (/dev/null).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_null_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 null_device_t:chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_null_dev_depend',`
type device_t, null_device_t;
class device_t:dir r_dir_perms;
class chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_zero_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write to the zero device (/dev/zero).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_zero_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 zero_device_t:chr_file rw_file_perms;
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_zero_dev_depend',`
type device_t, zero_device_t;
class device_t:dir r_dir_perms;
class chr_file r_file_perms;
')
2005-05-30 21:17:20 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rwx_zero_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read, write, and execute the zero device (/dev/zero).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-30 21:17:20 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rwx_zero_dev',`
gen_require(`$0'_depend)
2005-06-13 16:22:32 +00:00
dev_rw_zero_dev($1)
allow $1 zero_device_t:chr_file execute;
2005-05-30 21:17:20 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rwx_zero_dev_depend',`
type zero_device_t;
class chr_file execute;
2005-05-30 21:17:20 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_realtime_clock">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the realtime clock (/dev/rtc).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_realtime_clock',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 clock_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_realtime_clock_depend',`
2005-04-14 20:18:17 +00:00
type device_t, clock_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-05-05 21:19:18 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_realtime_clock">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the realtime clock (/dev/rtc).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-05 21:19:18 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_realtime_clock',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 clock_device_t:chr_file { setattr lock write append ioctl };
2005-05-05 21:19:18 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_realtime_clock_depend',`
type device_t, clock_device_t;
class dir r_dir_perms;
class chr_file { setattr lock write append ioctl };
2005-05-05 21:19:18 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_realtime_clock">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the realtime clock (/dev/rtc).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-05 21:19:18 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_realtime_clock',`
dev_read_realtime_clock($1)
dev_write_realtime_clock($1)
2005-05-05 21:19:18 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_snd_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the sound devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_snd_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 sound_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_snd_dev_depend',`
type device_t, sound_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_snd_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write the sound devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_snd_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 sound_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_snd_dev_depend',`
type device_t, sound_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_snd_mixer_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the sound mixer devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_snd_mixer_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
2005-06-13 16:22:32 +00:00
allow $1 sound_device_t:chr_file { getattr read ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_snd_mixer_dev_depend',`
type device_t, sound_device_t;
class dir r_dir_perms;
2005-06-13 16:22:32 +00:00
class chr_file { getattr read ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_snd_mixer_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write the sound mixer devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_snd_mixer_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 sound_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_snd_mixer_dev_depend',`
type device_t, sound_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_agp_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write the agp devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_agp_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 agp_device_t:chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_agp_dev_depend',`
type device_t, agp_device_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_getattr_agp_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Getattr the agp devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_getattr_agp_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 dri_device_t:chr_file getattr;
')
2005-06-13 16:22:32 +00:00
define(`dev_getattr_agp_dev_depend',`
type device_t, dri_device_t;
class dir r_dir_perms;
class chr_file getattr;
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_dri_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write the dri devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_dri_dev',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 dri_device_t:chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_dri_dev_depend',`
type device_t, dri_device_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_dontaudit_rw_dri_dev">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Dontaudit read and write on the dri devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain to dontaudit access.
## </parameter>
## </interface>
#
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_rw_dri_dev',`
gen_require(`$0'_depend)
dontaudit $1 dri_device_t:chr_file { getattr read write ioctl };
')
2005-06-13 16:22:32 +00:00
define(`dev_dontaudit_rw_dri_dev_depend',`
type dri_device_t;
class chr_file { getattr read write ioctl };
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_mtrr">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the mtrr device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_mtrr',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 mtrr_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_mtrr_depend',`
type device_t, mtrr_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_mtrr">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write the mtrr device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_mtrr',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 mtrr_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_mtrr_depend',`
type device_t, mtrr_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_framebuffer">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the framebuffer device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_framebuffer',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 framebuf_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_framebuffer_depend',`
type framebuf_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_framebuffer">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write the framebuffer device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_framebuffer',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 framebuf_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_framebuffer_depend',`
type device_t, framebuf_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-05-26 20:38:45 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_lvm_control">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the lvm comtrol device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-26 20:38:45 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_lvm_control',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 lvm_control_t:chr_file r_file_perms;
2005-05-26 20:38:45 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_lvm_control_depend',`
type device_t, lvm_control_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-05-26 20:38:45 +00:00
')
2005-05-13 14:37:13 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_lvm_control">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write the lvm control device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-13 14:37:13 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_lvm_control',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 lvm_control_t:chr_file rw_file_perms;
2005-05-13 14:37:13 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_lvm_control_depend',`
type device_t, lvm_control_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
2005-05-13 14:37:13 +00:00
')
2005-05-26 20:38:45 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_delete_lvm_control">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Delete the lvm control device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-05-26 20:38:45 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_delete_lvm_control',`
gen_require(`$0'_depend)
2005-06-13 16:22:32 +00:00
allow $1 device_t:dir { getattr search read write remove_name };
allow $1 lvm_control_t:chr_file unlink;
2005-05-26 20:38:45 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_delete_lvm_control_depend',`
type device_t, lvm_control_t;
2005-06-13 16:22:32 +00:00
class dir { getattr search read write remove_name };
class chr_file unlink;
2005-05-26 20:38:45 +00:00
')
2005-04-14 20:18:17 +00:00
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_misc">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read miscellaneous devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_misc',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 misc_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_misc_depend',`
type device_t, misc_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_write_misc">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Write miscellaneous devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_write_misc',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 misc_device_t:chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_write_misc_depend',`
type device_t, misc_device_t;
class dir r_dir_perms;
class chr_file { getattr write ioctl };
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_mouse">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the mouse devices.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_mouse',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 mouse_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_mouse_depend',`
type device_t, mouse_device_t;
allow $1 device_t:dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_input">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the multiplexed input device (/dev/input).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_input',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 event_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_input_depend',`
type device_t, event_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_read_cpuid">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read the multiplexed input device (/dev/input).
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_read_cpuid',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 cpu_device_t:chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_read_cpuid_depend',`
type device_t, cpu_device_t;
class dir r_dir_perms;
class chr_file r_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_cpu_microcode">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write the the cpu microcode device. This
## is required to load cpu microcode.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_cpu_microcode',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 cpu_device_t:chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_cpu_microcode_depend',`
type device_t, cpu_device_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_scanner">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write the the scanner device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_scanner',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 scanner_device_t:chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_scanner_depend',`
type device_t, scanner_device_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
2005-06-13 16:22:32 +00:00
## <interface name="dev_rw_power_management">
2005-06-13 19:22:00 +00:00
## <summary>
2005-06-13 16:22:32 +00:00
## Read and write the the power management device.
2005-06-13 19:22:00 +00:00
## </summary>
2005-06-13 16:22:32 +00:00
## <parameter name="domain">
## Domain allowed access.
## </parameter>
## </interface>
2005-04-14 20:18:17 +00:00
#
2005-06-13 16:22:32 +00:00
define(`dev_rw_power_management',`
gen_require(`$0'_depend)
allow $1 device_t:dir r_dir_perms;
allow $1 power_device_t:chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
2005-06-13 16:22:32 +00:00
define(`dev_rw_power_management_depend',`
type device_t, power_device_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
2005-04-14 20:18:17 +00:00
')
########################################
## <interface name="dev_search_sysfs">
## <description>
## Search the directory containing hardware information.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`dev_search_sysfs',`
gen_require(`$0'_depend)
allow $1 sysfs_t:dir search;
')
define(`dev_search_sysfs_depend',`
type sysfs_t;
class dir search;
')
########################################
## <interface name="dev_read_sysfs">
## <description>
## Allow caller to read hardware state information.
## </description>
## <parameter name="domain">
## The process type reading hardware state information.
## </parameter>
## </interface>
#
define(`dev_read_sysfs',`
gen_require(`$0'_depend)
allow $1 sysfs_t:dir r_dir_perms;
allow $1 sysfs_t:{ file lnk_file } r_file_perms;
')
define(`dev_read_sysfs_depend',`
type sysfs_t;
class dir r_dir_perms;
class file r_file_perms;
class lnk_file r_file_perms;
')
########################################
## <interface name="dev_rw_sysfs">
## <description>
## Allow caller to modify hardware state information.
## </description>
## <parameter name="domain">
## The process type modifying hardware state information.
## </parameter>
## </interface>
#
define(`dev_rw_sysfs',`
gen_require(`$0'_depend)
allow $1 sysfs_t:dir r_dir_perms;
allow $1 sysfs_t:lnk_file r_file_perms;
allow $1 sysfs_t:file rw_file_perms;
')
define(`dev_rw_sysfs_depend',`
type sysfs_t;
class dir r_dir_perms;
class file rw_file_perms;
class lnk_file r_file_perms;
')
########################################
## <interface name="dev_search_usbfs">
## <description>
## Search the directory containing USB hardware information.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`dev_search_usbfs',`
gen_require(`$0'_depend)
allow $1 usbfs_t:dir search;
')
define(`dev_search_usbfs_depend',`
type usbfs_t;
class dir search;
')
########################################
## <interface name="dev_list_usbfs">
## <description>
## Allow caller to get a list of usb hardware.
## </description>
## <parameter name="domain">
## The process type getting the list.
## </parameter>
## </interface>
#
define(`dev_list_usbfs',`
gen_require(`$0'_depend)
allow $1 usbfs_t:dir r_dir_perms;
allow $1 usbfs_t:lnk_file r_file_perms;
allow $1 usbfs_t:file getattr;
')
define(`dev_list_usbfs_depend',`
type usbfs_t;
class dir r_dir_perms;
class file getattr;
class lnk_file r_file_perms;
')
########################################
## <interface name="dev_read_usbfs">
## <description>
## Read USB hardware information using
## the usbfs filesystem interface.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`dev_read_usbfs',`
gen_require(`$0'_depend)
allow $1 usbfs_t:dir r_dir_perms;
allow $1 usbfs_t:{ file lnk_file } r_file_perms;
')
define(`dev_read_usbfs_depend',`
type usbfs_t;
class dir r_dir_perms;
class file r_file_perms;
class lnk_file r_file_perms;
')
########################################
## <interface name="dev_rw_usbfs">
## <description>
## Allow caller to modify usb hardware configuration files.
## </description>
## <parameter name="domain">
## The process type modifying the options.
## </parameter>
## </interface>
#
define(`dev_rw_usbfs',`
gen_require(`$0'_depend)
allow $1 usbfs_t:dir r_dir_perms;
allow $1 usbfs_t:lnk_file r_file_perms;
allow $1 usbfs_t:file rw_file_perms;
')
define(`dev_rw_usbfs_depend',`
type usbfs_t;
class dir r_dir_perms;
class file rw_file_perms;
class lnk_file r_file_perms;
')
## </module>