selinux-policy/policy/modules/system/raid.te

policy_module(raid, 1.10.0)

########################################
#
# Declarations
#

type mdadm_t;
type mdadm_exec_t;
init_daemon_domain(mdadm_t, mdadm_exec_t)
role system_r types mdadm_t;

type mdadm_map_t;
files_type(mdadm_map_t)

type mdadm_var_run_t;
files_pid_file(mdadm_var_run_t)
dev_associate(mdadm_var_run_t)

########################################
#
# Local policy
#

allow mdadm_t self:capability { dac_override sys_admin ipc_lock };
dontaudit mdadm_t self:capability sys_tty_config;
allow mdadm_t self:process { sigchld sigkill sigstop signull signal };
allow mdadm_t self:fifo_file rw_fifo_file_perms;

# create .mdadm files in /dev
allow mdadm_t mdadm_map_t:file manage_file_perms;
dev_filetrans(mdadm_t, mdadm_map_t, file)

manage_dirs_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
manage_sock_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)
files_pid_filetrans(mdadm_t, mdadm_var_run_t, { file dir })
dev_filetrans(mdadm_t, mdadm_var_run_t, { file dir sock_file })

kernel_read_system_state(mdadm_t)
kernel_read_kernel_sysctls(mdadm_t)
kernel_rw_software_raid_state(mdadm_t)
kernel_getattr_core_if(mdadm_t)

# Helper program access
corecmd_exec_bin(mdadm_t)
corecmd_exec_shell(mdadm_t)

dev_read_sysfs(mdadm_t)
# Ignore attempts to read every device file
dev_dontaudit_getattr_all_blk_files(mdadm_t)
dev_dontaudit_getattr_all_chr_files(mdadm_t)
dev_dontaudit_getattr_generic_files(mdadm_t)
dev_dontaudit_getattr_generic_chr_files(mdadm_t)
dev_dontaudit_getattr_generic_blk_files(mdadm_t)
dev_read_realtime_clock(mdadm_t)
# unfortunately needed for DMI decoding:
dev_read_raw_memory(mdadm_t)
dev_read_generic_files(mdadm_t)

domain_use_interactive_fds(mdadm_t)

files_read_etc_files(mdadm_t)
files_read_etc_runtime_files(mdadm_t)
files_dontaudit_getattr_tmpfs_files(mdadm_t)

fs_list_hugetlbfs(mdadm_t)
fs_list_auto_mountpoints(mdadm_t)
fs_dontaudit_list_tmpfs(mdadm_t)

mls_file_read_all_levels(mdadm_t)
mls_file_write_all_levels(mdadm_t)

# RAID block device access
storage_manage_fixed_disk(mdadm_t)
storage_dev_filetrans_fixed_disk(mdadm_t)
storage_read_scsi_generic(mdadm_t)

term_dontaudit_list_ptys(mdadm_t)

init_dontaudit_getattr_initctl(mdadm_t)

logging_send_syslog_msg(mdadm_t)

miscfiles_read_localization(mdadm_t)

userdom_dontaudit_use_unpriv_user_fds(mdadm_t)
userdom_dontaudit_search_user_home_content(mdadm_t)
userdom_dontaudit_use_user_terminals(mdadm_t)

mta_send_mail(mdadm_t)

optional_policy(`
	gpm_dontaudit_getattr_gpmctl(mdadm_t)
')

optional_policy(`
	seutil_sigchld_newrole(mdadm_t)
')

optional_policy(`
	udev_read_db(mdadm_t)
')

optional_policy(`
	unconfined_domain(mdadm_t)
')
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(raid, 1.10.0)`
more cleanup in system 2005-07-18 18:31:49 +00:00
			`########################################`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`#`
more cleanup in system 2005-07-18 18:31:49 +00:00			`# Declarations`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`#`

todo cleanup 2005-09-20 20:48:17 +00:00			`type mdadm_t;`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`type mdadm_exec_t;`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`init_daemon_domain(mdadm_t, mdadm_exec_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`role system_r types mdadm_t;`

RAID patch from Dan Walsh. 2009-11-25 16:17:19 +00:00			`type mdadm_map_t;`
			`files_type(mdadm_map_t)`

add raid (mdadm) 2005-07-15 20:45:26 +00:00			`type mdadm_var_run_t;`
			`files_pid_file(mdadm_var_run_t)`
raid tools now store pid file and sock_file in /dev/md for early boot. 2010-09-09 18:26:32 +00:00			`dev_associate(mdadm_var_run_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
more cleanup in system 2005-07-18 18:31:49 +00:00			`########################################`
			`#`
			`# Local policy`
			`#`

add raid (mdadm) 2005-07-15 20:45:26 +00:00			`allow mdadm_t self:capability { dac_override sys_admin ipc_lock };`
			`dontaudit mdadm_t self:capability sys_tty_config;`
			`allow mdadm_t self:process { sigchld sigkill sigstop signull signal };`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow mdadm_t self:fifo_file rw_fifo_file_perms;`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
RAID patch from Dan Walsh. 2009-11-25 16:17:19 +00:00			`# create .mdadm files in /dev`
			`allow mdadm_t mdadm_map_t:file manage_file_perms;`
			`dev_filetrans(mdadm_t, mdadm_map_t, file)`

UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`manage_dirs_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`manage_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)`
raid tools now store pid file and sock_file in /dev/md for early boot. 2010-09-09 18:26:32 +00:00			`manage_sock_files_pattern(mdadm_t, mdadm_var_run_t, mdadm_var_run_t)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`files_pid_filetrans(mdadm_t, mdadm_var_run_t, { file dir })`
raid tools now store pid file and sock_file in /dev/md for early boot. 2010-09-09 18:26:32 +00:00			`dev_filetrans(mdadm_t, mdadm_var_run_t, { file dir sock_file })`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
			`kernel_read_system_state(mdadm_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(mdadm_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`kernel_rw_software_raid_state(mdadm_t)`
patch from dan Mon, 25 Sep 2006 15:46:40 -0400 2006-09-28 14:37:29 +00:00			`kernel_getattr_core_if(mdadm_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
fix ordering in raid. 2009-08-05 14:19:28 +00:00			`# Helper program access`
			`corecmd_exec_bin(mdadm_t)`
			`corecmd_exec_shell(mdadm_t)`

add raid (mdadm) 2005-07-15 20:45:26 +00:00			`dev_read_sysfs(mdadm_t)`
			`# Ignore attempts to read every device file`
			`dev_dontaudit_getattr_all_blk_files(mdadm_t)`
			`dev_dontaudit_getattr_all_chr_files(mdadm_t)`
patch from dan Mon, 25 Sep 2006 15:46:40 -0400 2006-09-28 14:37:29 +00:00			`dev_dontaudit_getattr_generic_files(mdadm_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`dev_dontaudit_getattr_generic_chr_files(mdadm_t)`
			`dev_dontaudit_getattr_generic_blk_files(mdadm_t)`
trunk: 3 patches from dan. 2009-03-20 13:58:15 +00:00			`dev_read_realtime_clock(mdadm_t)`
Raid patch from Dan Walsh. 2010-03-09 20:33:29 +00:00			`# unfortunately needed for DMI decoding:`
			`dev_read_raw_memory(mdadm_t)`
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port 2010-09-07 20:23:09 +00:00			`dev_read_generic_files(mdadm_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
fix ordering in raid. 2009-08-05 14:19:28 +00:00			`domain_use_interactive_fds(mdadm_t)`

			`files_read_etc_files(mdadm_t)`
			`files_read_etc_runtime_files(mdadm_t)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`files_dontaudit_getattr_tmpfs_files(mdadm_t)`
fix ordering in raid. 2009-08-05 14:19:28 +00:00
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port 2010-09-07 20:23:09 +00:00			`fs_list_hugetlbfs(mdadm_t)`
			`fs_list_auto_mountpoints(mdadm_t)`
more cleanup in system 2005-07-18 18:31:49 +00:00			`fs_dontaudit_list_tmpfs(mdadm_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
fix ordering in raid. 2009-08-05 14:19:28 +00:00			`mls_file_read_all_levels(mdadm_t)`
			`mls_file_write_all_levels(mdadm_t)`

add raid (mdadm) 2005-07-15 20:45:26 +00:00			`# RAID block device access`
			`storage_manage_fixed_disk(mdadm_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`storage_dev_filetrans_fixed_disk(mdadm_t)`
trunk: 5 patches from dan 2007-06-11 15:01:10 +00:00			`storage_read_scsi_generic(mdadm_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
			`term_dontaudit_list_ptys(mdadm_t)`

			`init_dontaudit_getattr_initctl(mdadm_t)`

			`logging_send_syslog_msg(mdadm_t)`

			`miscfiles_read_localization(mdadm_t)`

another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(mdadm_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_dontaudit_search_user_home_content(mdadm_t)`
			`userdom_dontaudit_use_user_terminals(mdadm_t)`
add raid (mdadm) 2005-07-15 20:45:26 +00:00
todo cleanup 2005-09-20 20:48:17 +00:00			`mta_send_mail(mdadm_t)`

patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			optional_policy(`
			`gpm_dontaudit_getattr_gpmctl(mdadm_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`seutil_sigchld_newrole(mdadm_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add raid (mdadm) 2005-07-15 20:45:26 +00:00			`udev_read_db(mdadm_t)`
			`')`
trunk: 3 more cherry picked Fedora fixes from David Hrdeman. 2008-07-25 12:11:14 +00:00
			optional_policy(`
			`unconfined_domain(mdadm_t)`
			`')`