selinux-policy/refpolicy/policy/modules/kernel/filesystem.if

## <module name="filesystem">
## <summary>Policy for filesystems.</summary>

########################################
## <interface name="fs_make_fs">
##	<description>
##		Transform specified type into a filesystem type.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_make_fs',`
	gen_require(`
		attribute fs_type;
	')

	typeattribute $1 fs_type;
')

########################################
## <interface name="fs_make_noxattr_fs">
##	<description>
##		Transform specified type into a filesystem
##		type which does not have extended attribute
##		support.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_make_noxattr_fs',`
	gen_require(`
		attribute noxattrfs;
	')

	fs_make_fs($1)

	typeattribute $1 noxattrfs;
')

########################################
## <interface name="fs_associate">
##	<description>
##		Associate the specified file type to persistent
##		filesystems with extended attributes.  This
##		allows a file of this type to be created on
##		a filesystem such as ext3, JFS, and XFS.
##	</description>
##	<parameter name="file_type">
##		The type of the to be associated.
##	</parameter>
## </interface>
#
interface(`fs_associate',`
	gen_require(`
		type fs_t;
		class filesystem associate;
	')

	allow $1 fs_t:filesystem associate;
')

########################################
## <interface name="fs_associate_noxattr">
##	<description>
##		Associate the specified file type to
##		filesystems which lack extended attributes
##		support.  This allows a file of this type
##		to be created on a filesystem such as
##		FAT32, and NFS.
##	</description>
##	<parameter name="file_type">
##		The type of the to be associated.
##	</parameter>
## </interface>
#
interface(`fs_associate_noxattr',`
	gen_require(`
		attribute noxattrfs;
		class filesystem associate;
	')

	allow $1 noxattrfs:filesystem associate;
')

########################################
## <interface name="fs_mount_xattr_fs">
##	<description>
##		Mount a persistent filesystem which
##		has extended attributes, such as
##		ext3, JFS, or XFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_xattr_fs',`
	gen_require(`
		type fs_t;
		class filesystem mount;
	')

	allow $1 fs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_xattr_fs">
##	<description>
##		Remount a persistent filesystem which
##		has extended attributes, such as
##		ext3, JFS, or XFS.  This allows
##		some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_xattr_fs',`
	gen_require(`
		type fs_t;
		class filesystem remount;
	')

	allow $1 fs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_xattr_fs">
##	<description>
##		Unmount a persistent filesystem which
##		has extended attributes, such as
##		ext3, JFS, or XFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_xattr_fs',`
	gen_require(`
		type fs_t;
		class filesystem unmount;
	')

	allow $1 fs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_xattr_fs">
##	<description>
##		Get the attributes of a persistent
##		filesystem which has extended
##		attributes, such as ext3, JFS, or XFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_xattr_fs',`
	gen_require(`
		type fs_t;
		class filesystem getattr;
	')

	allow $1 fs_t:filesystem getattr;
')

########################################
## <interface name="fs_dontaudit_getattr_xattr_fs">
##	<description>
##		Do not audit attempts to
##		get the attributes of a persistent
##		filesystem which has extended
##		attributes, such as ext3, JFS, or XFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain to not audit.
##	</parameter>
## </interface>
#
interface(`fs_dontaudit_getattr_xattr_fs',`
	gen_require(`
		type fs_t;
		class filesystem getattr;
	')

	dontaudit $1 fs_t:filesystem getattr;
')

########################################
## <interface name="fs_relabelfrom_xattr_fs">
##	<description>
##		Allow changing of the label of a
##		filesystem with extended attributes
##		using the context= mount option.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_relabelfrom_xattr_fs',`
	gen_require(`
		type fs_t;
		class filesystem relabelfrom;
	')

	allow $1 fs_t:filesystem relabelfrom;
')

########################################
## <interface name="fs_mount_autofs">
##	<description>
##		Mount an automount pseudo filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_autofs',`
	gen_require(`
		type autofs_t;
		class filesystem mount;
	')

	allow $1 autofs_t:filesystem mount;
')


########################################
## <interface name="fs_remount_autofs">
##	<description>
##		Remount an automount pseudo filesystem
##		This allows some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_autofs',`
	gen_require(`
		type autofs_t;
		class filesystem remount;
	')

	allow $1 autofs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_autofs">
##	<description>
##		Unmount an automount pseudo filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_autofs',`
	gen_require(`
		type autofs_t;
		class filesystem unmount;
	')

	allow $1 autofs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_autofs">
##	<description>
##		Get the attributes of an automount
##		pseudo filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_autofs',`
	gen_require(`
		type autofs_t;
		class filesystem getattr;
	')

	allow $1 autofs_t:filesystem getattr;
')

########################################
## <interface name="fs_register_binary_executable_type">
##	<description>
##		Register an interpreter for new binary
##		file types, using the kernel binfmt_misc
##		support.  A common use for this is to
##		register a JVM as an interpreter for
##		Java byte code.  Registered binaries
##		can be directly executed on a command line
##		without specifying the interpreter.
##	</description>
##	<parameter name="domain">
##		The type of the domain registering
##		the interpreter.
##	</parameter>
## </interface>
#
interface(`fs_register_binary_executable_type',`
	gen_require(`
		type binfmt_misc_fs_t;
		class dir { getattr search };
		class file { getattr ioctl write };
	')

	allow $1 binfmt_misc_fs_t:dir { getattr search };
	allow $1 binfmt_misc_fs_t:file { getattr ioctl write };
')

########################################
## <interface name="fs_mount_cifs">
##	<description>
##		Mount a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_cifs',`
	gen_require(`
		type cifs_t;
		class filesystem mount;
	')

	allow $1 cifs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_cifs">
##	<description>
##		Remount a CIFS or SMB network filesystem.
##		This allows some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_cifs',`
	gen_require(`
		type cifs_t;
		class filesystem remount;
	')

	allow $1 cifs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_cifs">
##	<description>
##		Unmount a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_cifs',`
	gen_require(`
		type cifs_t;
		class filesystem unmount;
	')

	allow $1 cifs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_cifs">
##	<description>
##		Get the attributes of a CIFS or
##		SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_cifs',`
	gen_require(`
		type cifs_t;
		class filesystem getattr;
	')

	allow $1 cifs_t:filesystem getattr;
')

########################################
## <interface name="fs_read_cifs_files">
##	<description>
##		Read files on a CIFS or SMB filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain reading the files.
##	</parameter>
## </interface>
#
interface(`fs_read_cifs_files',`
	gen_require(`
		type cifs_t;
		class dir r_dir_perms;
		class file r_file_perms;
	')

	allow $1 cifs_t:dir r_dir_perms;
	allow $1 cifs_t:file r_file_perms;
')

########################################
## <interface name="fs_dontaudit_rw_cifs_files">
##	<description>
##		Do not audit attempts to read or
##		write files on a CIFS or SMB filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain to not audit.
##	</parameter>
## </interface>
#
interface(`fs_dontaudit_rw_cifs_files',`
	gen_require(`
		type cifs_t;
		class file { read write };
	')

	dontaudit $1 cifs_t:file { read write };
')

########################################
## <interface name="fs_read_cifs_symlinks">
##	<description>
##		Read symbolic links on a CIFS or SMB filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain reading the symbolic links.
##	</parameter>
## </interface>
#
interface(`fs_read_cifs_symlinks',`
	gen_require(`
		type cifs_t;
		class dir r_dir_perms;
		class lnk_file r_file_perms;
	')

	allow $1 cifs_t:dir r_dir_perms;
	allow $1 cifs_t:lnk_file r_file_perms;
')

########################################
## <interface name="fs_execute_cifs_files">
##	<description>
##		Execute files on a CIFS or SMB
##		network filesystem, in the caller
##		domain.
##	</description>
##	<parameter name="domain">
##		The type of the domain executing the files.
##	</parameter>
## </interface>
#
interface(`fs_execute_cifs_files',`
	gen_require(`
		type cifs_t;
		class dir r_dir_perms;
	')

	allow $1 cifs_t:dir r_dir_perms;
	can_exec($1, cifs_t)
')

########################################
## <interface name="fs_dontaudit_rw_cifs_files">
##	<description>
##		Do not audit attempts to read or
##		write files on a CIFS or SMB filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain to not audit.
##	</parameter>
## </interface>
#
interface(`fs_read_cifs_files',`
	gen_require(`
		type cifs_t;
		class file { read write };
	')

	dontaudit $1 cifs_t:file { read write };
')

########################################
## <interface name="fs_manage_cifs_dirs">
##	<description>
##		Create, read, write, and delete directories
##		on a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the directories.
##	</parameter>
## </interface>
#
interface(`fs_manage_cifs_dirs',`
	gen_require(`
		type cifs_t;
		class dir create_dir_perms;
	')

	allow $1 cifs_t:dir create_file_perms;
')

########################################
## <interface name="fs_manage_cifs_files">
##	<description>
##		Create, read, write, and delete files
##		on a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the files.
##	</parameter>
## </interface>
#
interface(`fs_manage_cifs_files',`
	gen_require(`
		type cifs_t;
		class dir rw_dir_perms;
		class file create_file_perms;
	')

	allow $1 cifs_t:dir rw_dir_perms;
	allow $1 cifs_t:file create_file_perms;
')

########################################
## <interface name="fs_manage_cifs_symlinks">
##	<description>
##		Create, read, write, and delete symbolic links
##		on a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the symbolic links.
##	</parameter>
## </interface>
#
interface(`fs_manage_cifs_symlinks',`
	gen_require(`
		type cifs_t;
		class dir rw_dir_perms;
		class lnk_file create_lnk_perms;
	')

	allow $1 cifs_t:dir rw_dir_perms;
	allow $1 cifs_t:lnk_file create_lnk_perms;
')

########################################
## <interface name="fs_manage_cifs_named_pipes">
##	<description>
##		Create, read, write, and delete named pipes
##		on a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the pipes.
##	</parameter>
## </interface>
#
interface(`fs_manage_cifs_named_pipes',`
	gen_require(`
		type cifs_t;
		class dir rw_dir_perms;
		class fifo_file create_file_perms;
	')

	allow $1 cifs_t:dir rw_dir_perms;
	allow $1 cifs_t:fifo_file create_file_perms;
')

########################################
## <interface name="fs_manage_cifs_named_sockets">
##	<description>
##		Create, read, write, and delete named sockets
##		on a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the sockets.
##	</parameter>
## </interface>
#
interface(`fs_manage_cifs_named_sockets',`
	gen_require(`
		type cifs_t;
		class dir rw_dir_perms;
		class sock_file create_file_perms;
	')

	allow $1 cifs_t:dir rw_file_perms;
	allow $1 cifs_t:sock_file create_file_perms;
')

########################################
## <interface name="fs_mount_dos_fs">
##	<description>
##		Mount a DOS filesystem, such as
##		FAT32 or NTFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_dos_fs',`
	gen_require(`
		type dosfs_t;
		class filesystem mount;
	')

	allow $1 dosfs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_dos_fs">
##	<description>
##		Remount a DOS filesystem, such as
##		FAT32 or NTFS.  This allows
##		some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_dos_fs',`
	gen_require(`
		type dosfs_t;
		class filesystem remount;
	')

	allow $1 dosfs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_dos_fs">
##	<description>
##		Unmount a DOS filesystem, such as
##		FAT32 or NTFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_dos_fs',`
	gen_require(`
		type dosfs_t;
		class filesystem unmount;
	')

	allow $1 dosfs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_dos_fs">
##	<description>
##		Get the attributes of a DOS
##		filesystem, such as FAT32 or NTFS.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_dos_fs',`
	gen_require(`
		type dosfs_t;
		class filesystem getattr;
	')

	allow $1 dosfs_t:filesystem getattr;
')

########################################
## <interface name="fs_relabelfrom_dos_fs">
##	<description>
##		Allow changing of the label of a
##		DOS filesystem using the context= mount option.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_relabelfrom_dos_fs',`
	gen_require(`
		type dosfs_t;
		class filesystem relabelfrom;
	')

	allow $1 dosfs_t:filesystem relabelfrom;
')

########################################
## <interface name="fs_mount_iso9660_fs">
##	<description>
##		Mount an iso9660 filesystem, which
##		is usually used on CDs.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_iso9660_fs',`
	gen_require(`
		type iso9660_t;
		class filesystem mount;
	')

	allow $1 iso9660_t:filesystem mount;
')

########################################
## <interface name="fs_remount_iso9660_fs">
##	<description>
##		Remount an iso9660 filesystem, which
##		is usually used on CDs.  This allows
##		some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_iso9660_fs',`
	gen_require(`
		type iso9660_t;
		class filesystem remount;
	')

	allow $1 iso9660_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_iso9660_fs">
##	<description>
##		Unmount an iso9660 filesystem, which
##		is usually used on CDs.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_iso9660_fs',`
	gen_require(`
		type iso9660_t;
		class filesystem unmount;
	')

	allow $1 iso9660_t:filesystem mount;
')

########################################
## <interface name="fs_mount_iso9660_fs">
##	<description>
##		Get the attributes of an iso9660
##		filesystem, which is usually used on CDs.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_iso9660_fs',`
	gen_require(`
		type iso9660_t;
		class filesystem getattr;
	')

	allow $1 iso9660_t:filesystem getattr;
')

########################################
## <interface name="fs_mount_nfs">
##	<description>
##		Mount a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_nfs',`
	gen_require(`
		type nfs_t;
		class filesystem mount;
	')

	allow $1 nfs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_nfs">
##	<description>
##		Remount a NFS filesystem.  This allows
##		some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_nfs',`
	gen_require(`
		type nfs_t;
		class filesystem remount;
	')

	allow $1 nfs_t:filesystem remount;
')

########################################
## <interface name="fs_mount_nfs">
##	<description>
##		Unmount a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_nfs',`
	gen_require(`
		type nfs_t;
		class filesystem unmount;
	')

	allow $1 nfs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_nfs">
##	<description>
##		Get the attributes of a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_nfs',`
	gen_require(`
		type nfs_t;
		class filesystem getattr;
	')

	allow $1 nfs_t:filesystem getattr;
')

########################################
## <interface name="fs_read_nfs_files">
##	<description>
##		Read files on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain reading the files.
##	</parameter>
## </interface>
#
interface(`fs_read_nfs_files',`
	gen_require(`
		type nfs_t;
		class dir r_dir_perms;
		class file r_file_perms;
	')

	allow $1 nfs_t:dir r_dir_perms;
	allow $1 nfs_t:file r_file_perms;
')

########################################
## <interface name="fs_execute_nfs_files">
##	<description>
##		Execute files on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain executing the files.
##	</parameter>
## </interface>
#
interface(`fs_execute_nfs_files',`
	gen_require(`
		type nfs_t;
		class dir r_dir_perms;
	')

	allow $1 nfs_t:dir r_dir_perms;
	can_exec($1, nfs_t)
')

########################################
## <interface name="fs_dontaudit_rw_nfs_files">
##	<description>
##		Do not audit attempts to read or
##		write files on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain to not audit.
##	</parameter>
## </interface>
#
interface(`fs_dontaudit_rw_nfs_files',`
	gen_require(`
		type nfs_t;
		class file { read write };
	')

	dontaudit $1 nfs_t:file { read write };
')

########################################
## <interface name="fs_read_nfs_symlinks">
##	<description>
##		Read symbolic links on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain reading the symbolic links.
##	</parameter>
## </interface>
#
interface(`fs_read_nfs_symlinks',`
	gen_require(`
		type nfs_t;
		class dir r_dir_perms;
		class lnk_file r_file_perms;
	')

	allow $1 nfs_t:dir r_dir_perms;
	allow $1 nfs_t:lnk_file r_file_perms;
')

########################################
## <interface name="fs_manage_nfs_dirs">
##	<description>
##		Create, read, write, and delete directories
##		on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the directories.
##	</parameter>
## </interface>
#
interface(`fs_manage_nfs_dirs',`
	gen_require(`
		type nfs_t;
		class dir create_dir_perms;
	')

	allow $1 nfs_t:dir create_dir_perms;
')

########################################
## <interface name="fs_manage_nfs_files">
##	<description>
##		Create, read, write, and delete files
##		on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the files.
##	</parameter>
## </interface>
#
interface(`fs_manage_nfs_files',`
	gen_require(`
		type nfs_t;
		class dir rw_dir_perms;
		class file create_file_perms;
	')

	allow $1 nfs_t:dir rw_dir_perms;
	allow $1 nfs_t:file create_file_perms;
')

#########################################
## <interface name="fs_manage_nfs_symlinks">
##	<description>
##		Create, read, write, and delete symbolic links
##		on a CIFS or SMB network filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the symbolic links.
##	</parameter>
## </interface>
#
interface(`fs_manage_nfs_symlinks',`
	gen_require(`
		type nfs_t;
		class dir r_dir_perms;
		class lnk_file create_lnk_perms;
	')

	allow $1 nfs_t:dir rw_dir_perms;
	allow $1 nfs_t:lnk_file create_lnk_perms;
')

#########################################
## <interface name="fs_manage_nfs_named_pipes">
##	<description>
##		Create, read, write, and delete named pipes
##		on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the pipes.
##	</parameter>
## </interface>
#
interface(`fs_manage_nfs_named_pipes',`
	gen_require(`
		type nfs_t;
		class dir rw_dir_perms;
		class fifo_file create_file_perms;
	')

	allow $1 nfs_t:dir rw_dir_perms;
	allow $1 nfs_t:fifo_file create_file_perms;
')

#########################################
## <interface name="fs_manage_nfs_named_sockets">
##	<description>
##		Create, read, write, and delete named sockets
##		on a NFS filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain managing the sockets.
##	</parameter>
## </interface>
#
interface(`fs_manage_nfs_named_sockets',`
	gen_require(`
		type nfs_t;
		class dir rw_dir_perms;
		class sock_file create_file_perms;
	')

	allow $1 nfs_t:dir rw_dir_perms;
	allow $1 nfs_t:sock_file create_file_perms;
')

########################################
## <interface name="fs_mount_nfsd_fs">
##	<description>
##		Mount a NFS server pseudo filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_nfsd_fs',`
	gen_require(`
		type nfsd_fs_t;
		class filesystem mount;
	')

	allow $1 nfsd_fs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_nfsd_fs">
##	<description>
##		Mount a NFS server pseudo filesystem.
##		This allows some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_nfsd_fs',`
	gen_require(`
		type nfsd_fs_t;
		class filesystem remount;
	')

	allow $1 nfsd_fs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_nfsd_fs">
##	<description>
##		Unmount a NFS server pseudo filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_nfsd_fs',`
	gen_require(`
		type nfsd_fs_t;
		class filesystem unmount;
	')

	allow $1 nfsd_fs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_nfsd_fs">
##	<description>
##		Get the attributes of a NFS server
##		pseudo filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_nfsd_fs',`
	gen_require(`
		type nfsd_fs_t;
		class filesystem getattr;
	')

	allow $1 nfsd_fs_t:filesystem getattr;
')

########################################
## <interface name="fs_mount_ramfs">
##	<description>
##		Mount a RAM filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_ramfs',`
	gen_require(`
		type ramfs_t;
		class filesystem mount;
	')

	allow $1 ramfs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_ramfs">
##	<description>
##		Remount a RAM filesystem.  This allows
##		some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_ramfs',`
	gen_require(`
		type ramfs_t;
		class filesystem remount;
	')

	allow $1 ramfs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_ramfs">
##	<description>
##		Unmount a RAM filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_ramfs',`
	gen_require(`
		type ramfs_t;
		class filesystem unmount;
	')

	allow $1 ramfs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_ramfs">
##	<description>
##		Get the attributes of a RAM filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_ramfs',`
	gen_require(`
		type ramfs_t;
		class filesystem getattr;
	')

	allow $1 ramfs_t:filesystem getattr;
')

########################################
## <interface name="fs_mount_romfs">
##	<description>
##		Mount a ROM filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_romfs',`
	gen_require(`
		type romfs_t;
		class filesystem mount;
	')

	allow $1 romfs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_romfs">
##	<description>
##		Remount a ROM filesystem.  This allows
##		some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_romfs',`
	gen_require(`
		type romfs_t;
		class filesystem remount;
	')

	allow $1 romfs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_romfs">
##	<description>
##		Unmount a ROM filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_romfs',`
	gen_require(`
		type romfs_t;
		class filesystem unmount;
	')

	allow $1 romfs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_romfs">
##	<description>
##		Get the attributes of a ROM
##		filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_romfs',`
	gen_require(`
		type romfs_t;
		class filesystem getattr;
	')

	allow $1 romfs_t:filesystem getattr;
')

########################################
## <interface name="fs_mount_rpc_pipefs">
##	<description>
##		Mount a RPC pipe filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_rpc_pipefs',`
	gen_require(`
		type rpc_pipefs_t;
		class filesystem mount;
	')

	allow $1 rpc_pipefs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_rpc_pipefs">
##	<description>
##		Remount a RPC pipe filesystem.  This
##		allows some mount option to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_rpc_pipefs',`
	gen_require(`
		type rpc_pipefs_t;
		class filesystem remount;
	')

	allow $1 rpc_pipefs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_rpc_pipefs">
##	<description>
##		Unmount a RPC pipe filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_rpc_pipefs',`
	gen_require(`
		type rpc_pipefs_t;
		class filesystem unmount;
	')

	allow $1 rpc_pipefs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_rpc_pipefs">
##	<description>
##		Get the attributes of a RPC pipe
##		filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_rpc_pipefs',`
	gen_require(`
		type rpc_pipefs_t;
		class filesystem getattr;
	')

	allow $1 rpc_pipefs_t:filesystem getattr;
')

########################################
## <interface name="fs_mount_tmpfs">
##	<description>
##		Mount a tmpfs filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_tmpfs',`
	gen_require(`
		type tmpfs_t;
		class filesystem mount;
	')

	allow $1 tmpfs_t:filesystem mount;
')

########################################
## <interface name="fs_remount_tmpfs">
##	<description>
##		Remount a tmpfs filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain remounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_tmpfs',`
	gen_require(`
		type tmpfs_t;
		class filesystem remount;
	')

	allow $1 tmpfs_t:filesystem remount;
')

########################################
## <interface name="fs_unmount_tmpfs">
##	<description>
##		Unmount a tmpfs filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_tmpfs',`
	gen_require(`
		type tmpfs_t;
		class filesystem unmount;
	')

	allow $1 tmpfs_t:filesystem mount;
')

########################################
## <interface name="fs_getattr_tmpfs">
##	<description>
##		Get the attributes of a tmpfs
##		filesystem.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_tmpfs',`
	gen_require(`
		type tmpfs_t;
		class filesystem getattr;
	')

	allow $1 tmpfs_t:filesystem getattr;
')

########################################
## <interface name="fs_associate_tmpfs">
##	<description>
##		Allow the type to associate to tmpfs filesystems.
##	</description>
##	<parameter name="type">
##		The type of the object to be associated.
##	</parameter>
## </interface>
#
interface(`fs_associate_tmpfs',`
	gen_require(`
		type tmpfs_t;
		class filesystem associate;
	')

	allow $1 tmpfs_t:filesystem associate;
')

########################################
#
# fs_create_tmpfs_data(domain,derivedtype,[class])
#
interface(`fs_create_tmpfs_data',`
	gen_require(`
		type tmpfs_t;
		class filesystem associate;
		class dir rw_dir_perms; 
	')

	allow $2 tmpfs_t:filesystem associate;
	allow $1 tmpfs_t:dir rw_dir_perms;

	ifelse(`$3',`',`
		type_transition $1 tmpfs_t:file $2;
	',`
		type_transition $1 tmpfs_t:$3 $2;
	')
')

########################################
## <interface name="fs_use_tmpfs_character_devices">
##	<description>
##		Read and write character nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_use_tmpfs_character_devices',`
	gen_require(`
		type tmpfs_t;
		class dir r_dir_perms; 
		class chr_file rw_file_perms;
	')

	allow $1 tmpfs_t:dir r_dir_perms;
	allow $1 tmpfs_t:chr_file rw_file_perms;
')

########################################
## <interface name="fs_relabel_tmpfs_character_devices">
##	<description>
##		Relabel character nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_relabel_tmpfs_character_devices',`
	gen_require(`
		type tmpfs_t;
		class dir r_dir_perms;
		class chr_file { getattr relabelfrom relabelto };
	')

	allow $1 tmpfs_t:dir r_dir_perms;
	allow $1 tmpfs_t:chr_file { getattr relabelfrom relabelto };
')

########################################
## <interface name="fs_use_tmpfs_block_devices">
##	<description>
##		Read and write block nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_use_tmpfs_block_devices',`
	gen_require(`
		type tmpfs_t;
		class dir r_dir_perms; 
		class blk_file rw_file_perms;
	')

	allow $1 tmpfs_t:dir r_dir_perms;
	allow $1 tmpfs_t:blk_file rw_file_perms;
')

########################################
## <interface name="fs_relabel_tmpfs_block_devices">
##	<description>
##		Relabel block nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_relabel_tmpfs_block_devices',`
	gen_require(`
		type tmpfs_t;
		class dir r_dir_perms;
		class blk_file { getattr relabelfrom relabelto };
	')

	allow $1 tmpfs_t:dir r_dir_perms;
	allow $1 tmpfs_t:blk_file { getattr relabelfrom relabelto };
')

########################################
## <interface name="fs_manage_tmpfs_character_devices">
##	<description>
##		Read and write, create and delete character
##		nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_manage_tmpfs_character_devices',`
	gen_require(`
		type tmpfs_t;
		class dir rw_dir_perms;
		class chr_file create_file_perms;
	')

	allow $1 tmpfs_t:dir rw_dir_perms;
	allow $1 tmpfs_t:chr_file create_file_perms;
')

########################################
## <interface name="fs_manage_tmpfs_block_devices">
##	<description>
##		Read and write, create and delete block nodes
##		on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
## </interface>
#
interface(`fs_manage_tmpfs_block_devices',`
	gen_require(`
		type tmpfs_t;
		class dir rw_dir_perms;
		class blk_file create_file_perms;
	')

	allow $1 tmpfs_t:dir rw_dir_perms;
	allow $1 tmpfs_t:blk_file create_file_perms;
')

########################################
## <interface name="fs_mount_all_fs">
##	<description>
##		Mount all filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_mount_all_fs',`
	gen_require(`
		attribute fs_type;
		class filesystem mount;
	')

	allow $1 fs_type:filesystem mount;
')

########################################
## <interface name="fs_remount_all_fs">
##	<description>
##		Remount all filesystems.  This
##		allows some mount options to be changed.
##	</description>
##	<parameter name="domain">
##		The type of the domain mounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_remount_all_fs',`
	gen_require(`
		attribute fs_type;
		class filesystem remount;
	')

	allow $1 fs_type:filesystem remount;
')

########################################
## <interface name="fs_unmount_all_fs">
##	<description>
##		Unmount all filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain unmounting the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_unmount_all_fs',`
	gen_require(`
		attribute fs_type;
		class filesystem unmount;
	')

	allow $1 fs_type:filesystem unmount;
')

########################################
## <interface name="fs_getattr_all_fs">
##	<description>
##		Get the attributes of all persistent
##		filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain doing the
##		getattr on the filesystem.
##	</parameter>
## </interface>
#
interface(`fs_getattr_all_fs',`
	gen_require(`
		attribute fs_type;
		class filesystem getattr;
	')

	allow $1 fs_type:filesystem getattr;
')

########################################
## <interface name="fs_dontaudit_getattr_all_fs">
##	<description>
##		Do not audit attempts to get the attributes 
##		all filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain to not audit.
##	</parameter>
## </interface>
#
interface(`fs_dontaudit_getattr_all_fs',`
	gen_require(`
		attribute fs_type;
		class filesystem getattr;
	')

	dontaudit $1 fs_type:filesystem getattr;
')

########################################
## <interface name="fs_get_all_fs_quotas">
##	<description>
##		Get the quotas of all filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain getting quotas.
##	</parameter>
## </interface>
#
interface(`fs_get_all_fs_quotas',`
	gen_require(`
		attribute fs_type;
		class filesystem quotaget;
	')

	allow $1 fs_type:filesystem quotaget;
')

########################################
## <interface name="fs_set_all_quotas">
##	<description>
##		Set the quotas of all filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the domain setting quotas.
##	</parameter>
## </interface>
#
interface(`fs_set_all_quotas',`
	gen_require(`
		attribute fs_type;
		class filesystem quotamod;
	')

	allow $1 fs_type:filesystem quotamod;
')

########################################
#
# fs_getattr_all_files(type)
#
interface(`fs_getattr_all_files',`
	gen_require(`
		attribute fs_type;
		class dir { search getattr };
		class file getattr;
		class lnk_file getattr;
		class fifo_file getattr;
		class sock_file getattr;
	')

	allow $1 fs_type:dir { search getattr };
	allow $1 fs_type:file getattr;
	allow $1 fs_type:lnk_file getattr;
	allow $1 fs_type:fifo_file getattr;
	allow $1 fs_type:sock_file getattr;
')

## </module>