selinux-policy/policy/modules/system/hotplug.te


policy_module(hotplug,1.4.1)

########################################
#
# Declarations
#

type hotplug_t;
type hotplug_exec_t;
kernel_domtrans_to(hotplug_t,hotplug_exec_t)
init_daemon_domain(hotplug_t,hotplug_exec_t)

type hotplug_etc_t;
files_config_file(hotplug_etc_t)
init_daemon_domain(hotplug_t,hotplug_etc_t)

type hotplug_var_run_t;
files_pid_file(hotplug_var_run_t)

########################################
#
# Local policy
#

allow hotplug_t self:capability { net_admin sys_tty_config mknod sys_rawio };
dontaudit hotplug_t self:capability { sys_module sys_admin sys_tty_config };
# for access("/etc/bashrc", X_OK) on Red Hat
dontaudit hotplug_t self:capability { dac_override dac_read_search };
allow hotplug_t self:process { setpgid getsession getattr signal_perms };
allow hotplug_t self:fifo_file rw_file_perms;
allow hotplug_t self:netlink_route_socket r_netlink_socket_perms;
allow hotplug_t self:udp_socket create_socket_perms;
allow hotplug_t self:tcp_socket connected_stream_socket_perms;

read_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)
read_lnk_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)
can_exec(hotplug_t,hotplug_etc_t)
allow hotplug_t hotplug_etc_t:dir list_dir_perms;

can_exec(hotplug_t,hotplug_exec_t)

manage_files_pattern(hotplug_t,hotplug_var_run_t,hotplug_var_run_t)
files_pid_filetrans(hotplug_t,hotplug_var_run_t,file)

kernel_sigchld(hotplug_t)
kernel_setpgid(hotplug_t)
kernel_read_system_state(hotplug_t)
kernel_read_kernel_sysctls(hotplug_t)
kernel_read_net_sysctls(hotplug_t)

files_read_kernel_modules(hotplug_t)

corenet_non_ipsec_sendrecv(hotplug_t)
corenet_tcp_sendrecv_all_if(hotplug_t)
corenet_udp_sendrecv_all_if(hotplug_t)
corenet_tcp_sendrecv_all_nodes(hotplug_t)
corenet_udp_sendrecv_all_nodes(hotplug_t)
corenet_tcp_sendrecv_all_ports(hotplug_t)
corenet_udp_sendrecv_all_ports(hotplug_t)

dev_rw_sysfs(hotplug_t)
dev_read_usbfs(hotplug_t)
dev_setattr_printer_dev(hotplug_t)
dev_setattr_sound_dev(hotplug_t)
# for SSP:
dev_read_urand(hotplug_t)

fs_getattr_all_fs(hotplug_t)
fs_search_auto_mountpoints(hotplug_t)

storage_setattr_fixed_disk_dev(hotplug_t)
storage_setattr_removable_dev(hotplug_t)

corecmd_exec_bin(hotplug_t)
corecmd_exec_shell(hotplug_t)

domain_use_interactive_fds(hotplug_t)
# for ps
domain_dontaudit_read_all_domains_state(hotplug_t)
domain_dontaudit_getattr_all_domains(hotplug_t)

files_read_etc_files(hotplug_t)
files_manage_etc_runtime_files(hotplug_t)
files_etc_filetrans_etc_runtime(hotplug_t,file)
files_exec_etc_files(hotplug_t)
# for when filesystems are not mounted early in the boot:
files_dontaudit_search_isid_type_dirs(hotplug_t)

init_read_script_state(hotplug_t)
# Allow hotplug (including /sbin/ifup-local) to start/stop services and
# run sendmail -q
init_domtrans_script(hotplug_t)
# kernel threads inherit from shared descriptor table used by init
init_dontaudit_rw_initctl(hotplug_t)

logging_send_syslog_msg(hotplug_t)
logging_search_logs(hotplug_t)

libs_use_ld_so(hotplug_t)
libs_use_shared_libs(hotplug_t)
# Read /usr/lib/gconv/.*
libs_read_lib_files(hotplug_t)

miscfiles_read_hwdata(hotplug_t)
miscfiles_read_localization(hotplug_t)

modutils_domtrans_insmod(hotplug_t)
modutils_read_module_deps(hotplug_t)

seutil_dontaudit_search_config(hotplug_t)

sysnet_read_config(hotplug_t)

userdom_dontaudit_use_unpriv_user_fds(hotplug_t)
userdom_dontaudit_search_sysadm_home_dirs(hotplug_t)

ifdef(`distro_redhat', `
	optional_policy(`
		# for arping used for static IP addresses on PCMCIA ethernet
		netutils_domtrans(hotplug_t)
		fs_rw_tmpfs_chr_files(hotplug_t)
	')
	files_getattr_generic_locks(hotplug_t)
')

ifdef(`targeted_policy', `
	term_dontaudit_use_unallocated_ttys(hotplug_t)
	term_dontaudit_use_generic_ptys(hotplug_t)

	optional_policy(`
		consoletype_exec(hotplug_t)
	')
')

optional_policy(`
	dbus_system_bus_client_template(hotplug,hotplug_t)
')

optional_policy(`
	fstools_domtrans(hotplug_t)
')

optional_policy(`
	hal_dgram_send(hotplug_t)
')

optional_policy(`
	hostname_exec(hotplug_t)
')

optional_policy(`
	iptables_domtrans(hotplug_t)
')

optional_policy(`
	mount_domtrans(hotplug_t)
')

optional_policy(`
	mta_send_mail(hotplug_t)
')

optional_policy(`
	nis_use_ypbind(hotplug_t)
')

optional_policy(`
	nscd_socket_use(hotplug_t)
')

optional_policy(`
	seutil_sigchld_newrole(hotplug_t)
')

optional_policy(`
	sysnet_domtrans_dhcpc(hotplug_t)
	sysnet_signal_dhcpc(hotplug_t)
	sysnet_kill_dhcpc(hotplug_t)
	sysnet_signull_dhcpc(hotplug_t)
	sysnet_sigstop_dhcpc(hotplug_t)
	sysnet_sigchld_dhcpc(hotplug_t)
	sysnet_read_dhcpc_pid(hotplug_t)
	sysnet_rw_dhcp_config(hotplug_t)
	sysnet_domtrans_ifconfig(hotplug_t)
')

optional_policy(`
	udev_domtrans(hotplug_t)
	udev_helper_domtrans(hotplug_t)
	udev_read_db(hotplug_t)
')

optional_policy(`
	updfstab_domtrans(hotplug_t)
')

optional_policy(`
	usbmodules_domtrans(hotplug_t)
')
initial commit 2005-05-02 19:24:29 +00:00
Add dontaudits for init fds and console to init_daemon_domain(). 2007-03-20 18:47:18 +00:00			`policy_module(hotplug,1.4.1)`
initial commit 2005-05-02 19:24:29 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type hotplug_t;`
			`type hotplug_exec_t;`
from today's interface review meeting: s/kernel_use_unlabeled_blk_dev/kernel_rw_unlabeled_blk_dev/g s/kernel_userland_entry/kernel_domtrans_to/g 2006-01-27 19:55:42 +00:00			`kernel_domtrans_to(hotplug_t,hotplug_exec_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`init_daemon_domain(hotplug_t,hotplug_exec_t)`
initial commit 2005-05-02 19:24:29 +00:00
more fix 2005-10-24 18:40:24 +00:00			`type hotplug_etc_t;`
			`files_config_file(hotplug_etc_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`init_daemon_domain(hotplug_t,hotplug_etc_t)`
initial commit 2005-05-02 19:24:29 +00:00
			`type hotplug_var_run_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_pid_file(hotplug_var_run_t)`
initial commit 2005-05-02 19:24:29 +00:00
			`########################################`
			`#`
			`# Local policy`
			`#`

more updates 2005-09-15 21:03:29 +00:00			`allow hotplug_t self:capability { net_admin sys_tty_config mknod sys_rawio };`
initial commit 2005-05-02 19:24:29 +00:00			`dontaudit hotplug_t self:capability { sys_module sys_admin sys_tty_config };`
			`# for access("/etc/bashrc", X_OK) on Red Hat`
			`dontaudit hotplug_t self:capability { dac_override dac_read_search };`
patch from dan Thu, 31 Aug 2006 15:16:30 -0400 2006-09-01 15:52:05 +00:00			`allow hotplug_t self:process { setpgid getsession getattr signal_perms };`
renaming insanity 2005-06-10 01:01:13 +00:00			`allow hotplug_t self:fifo_file rw_file_perms;`
more updates 2005-09-15 21:03:29 +00:00			`allow hotplug_t self:netlink_route_socket r_netlink_socket_perms;`
aliases 2005-06-09 14:50:48 +00:00			`allow hotplug_t self:udp_socket create_socket_perms;`
			`allow hotplug_t self:tcp_socket connected_stream_socket_perms;`
initial commit 2005-05-02 19:24:29 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`read_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)`
			`read_lnk_files_pattern(hotplug_t,hotplug_etc_t,hotplug_etc_t)`
more fixes 2005-10-21 21:35:25 +00:00			`can_exec(hotplug_t,hotplug_etc_t)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow hotplug_t hotplug_etc_t:dir list_dir_perms;`
initial commit 2005-05-02 19:24:29 +00:00
more fixes 2005-10-21 21:35:25 +00:00			`can_exec(hotplug_t,hotplug_exec_t)`
initial commit 2005-05-02 19:24:29 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`manage_files_pattern(hotplug_t,hotplug_var_run_t,hotplug_var_run_t)`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_pid_filetrans(hotplug_t,hotplug_var_run_t,file)`
initial commit 2005-05-02 19:24:29 +00:00
more work to clean up and complete current modules 2005-06-20 17:41:29 +00:00			`kernel_sigchld(hotplug_t)`
more updates 2005-09-15 21:03:29 +00:00			`kernel_setpgid(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`kernel_read_system_state(hotplug_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(hotplug_t)`
			`kernel_read_net_sysctls(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_read_kernel_modules(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
break packet_t into server_packet_t client_packet_t, and cover add packets to system modules where they make sense. 2006-05-29 15:04:49 +00:00			`corenet_non_ipsec_sendrecv(hotplug_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`corenet_tcp_sendrecv_all_if(hotplug_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`corenet_udp_sendrecv_all_if(hotplug_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`corenet_tcp_sendrecv_all_nodes(hotplug_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`corenet_udp_sendrecv_all_nodes(hotplug_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`corenet_tcp_sendrecv_all_ports(hotplug_t)`
testing fixes 2005-09-22 15:32:53 +00:00			`corenet_udp_sendrecv_all_ports(hotplug_t)`
another cleanup pass 2005-05-24 15:55:57 +00:00
more updates 2005-09-15 21:03:29 +00:00			`dev_rw_sysfs(hotplug_t)`
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`dev_read_usbfs(hotplug_t)`
renaming from 20060131 interface review 2006-01-31 16:08:56 +00:00			`dev_setattr_printer_dev(hotplug_t)`
			`dev_setattr_sound_dev(hotplug_t)`
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`# for SSP:`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_read_urand(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_all_fs(hotplug_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`fs_search_auto_mountpoints(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`storage_setattr_fixed_disk_dev(hotplug_t)`
			`storage_setattr_removable_dev(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`corecmd_exec_bin(hotplug_t)`
			`corecmd_exec_shell(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(hotplug_t)`
todo cleanup 2005-09-20 20:48:17 +00:00			`# for ps`
			`domain_dontaudit_read_all_domains_state(hotplug_t)`
work on users 2005-11-29 15:49:18 +00:00			`domain_dontaudit_getattr_all_domains(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(hotplug_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_manage_etc_runtime_files(hotplug_t)`
split out filetrans part of files_manage_etc_runtime_files(), bug 1663 2006-05-02 18:34:35 +00:00			`files_etc_filetrans_etc_runtime(hotplug_t,file)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_exec_etc_files(hotplug_t)`
add some file_t interfaces, and console write 2005-05-31 21:25:45 +00:00			`# for when filesystems are not mounted early in the boot:`
renaming from 20060131 interface review, round 3 2006-01-31 19:21:01 +00:00			`files_dontaudit_search_isid_type_dirs(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_read_script_state(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`# Allow hotplug (including /sbin/ifup-local) to start/stop services and`
			`# run sendmail -q`
renaming insanity 2005-06-13 17:35:46 +00:00			`init_domtrans_script(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`# kernel threads inherit from shared descriptor table used by init`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_dontaudit_rw_initctl(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(hotplug_t)`
			`logging_search_logs(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`libs_use_ld_so(hotplug_t)`
			`libs_use_shared_libs(hotplug_t)`
make a reasonable lib_t interface 2005-05-11 15:46:51 +00:00			`# Read /usr/lib/gconv/.*`
another slew of renaming 2006-02-02 21:08:12 +00:00			`libs_read_lib_files(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`miscfiles_read_hwdata(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`miscfiles_read_localization(hotplug_t)`

more of the same 2005-10-31 22:44:03 +00:00			`modutils_domtrans_insmod(hotplug_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`modutils_read_module_deps(hotplug_t)`
more of the same 2005-10-31 22:44:03 +00:00
more updates 2005-09-15 21:03:29 +00:00			`seutil_dontaudit_search_config(hotplug_t)`

renaming insanity 2005-06-13 17:35:46 +00:00			`sysnet_read_config(hotplug_t)`
another cleanup pass 2005-05-24 15:55:57 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(hotplug_t)`
another round of renaming 2006-02-21 18:40:44 +00:00			`userdom_dontaudit_search_sysadm_home_dirs(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00
start switching over to new tunable infrastructure 2005-06-07 18:45:47 +00:00			ifdef(`distro_redhat', `
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`# for arping used for static IP addresses on PCMCIA ethernet`
renaming insanity 2005-06-13 17:35:46 +00:00			`netutils_domtrans(hotplug_t)`
renaming from 20060131 interface review, round 4 2006-01-31 20:29:27 +00:00			`fs_rw_tmpfs_chr_files(hotplug_t)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`')`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_getattr_generic_locks(hotplug_t)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`')`
another cleanup pass 2005-05-24 15:55:57 +00:00
start switching over to new tunable infrastructure 2005-06-07 18:45:47 +00:00			ifdef(`targeted_policy', `
another slew of renaming 2006-02-02 21:08:12 +00:00			`term_dontaudit_use_unallocated_ttys(hotplug_t)`
			`term_dontaudit_use_generic_ptys(hotplug_t)`
misc sediff fixes 2005-10-31 20:54:33 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
patch from dan Wed, 26 Jul 2006 14:42:46 -0400 2006-07-28 15:13:58 +00:00			`consoletype_exec(hotplug_t)`
more merging from nsa cvs 2005-09-15 15:34:31 +00:00			`')`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add dbus 2005-08-31 20:58:12 +00:00			`dbus_system_bus_client_template(hotplug,hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add fstools, and more cleanup 2005-06-27 20:59:28 +00:00			`fstools_domtrans(hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`hal_dgram_send(hotplug_t)`
pile of sediff fixes 2005-11-08 22:00:30 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`hostname_exec(hotplug_t)`
more authlogin handling 2005-05-09 21:07:53 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`iptables_domtrans(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
begin merging in upstream NSA CVS changes 2005-09-12 21:40:56 +00:00			`mount_domtrans(hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`mta_send_mail(hotplug_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`nis_use_ypbind(hotplug_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another slew of renaming 2006-02-02 21:08:12 +00:00			`nscd_socket_use(hotplug_t)`
partial (most of it) merge of selinux-policy-strict-sources-1.27.1-15 2005-10-13 20:59:36 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`seutil_sigchld_newrole(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
clean up more todos 2005-06-29 20:53:53 +00:00			`sysnet_domtrans_dhcpc(hotplug_t)`
			`sysnet_signal_dhcpc(hotplug_t)`
			`sysnet_kill_dhcpc(hotplug_t)`
			`sysnet_signull_dhcpc(hotplug_t)`
			`sysnet_sigstop_dhcpc(hotplug_t)`
			`sysnet_sigchld_dhcpc(hotplug_t)`
			`sysnet_read_dhcpc_pid(hotplug_t)`
			`sysnet_rw_dhcp_config(hotplug_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`sysnet_domtrans_ifconfig(hotplug_t)`
more authlogin handling 2005-05-09 21:07:53 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`udev_domtrans(hotplug_t)`
* fixes uncovered by sediff * fix disable_trans support so the daemon can be both init and inet services, and not get dup bool decl 2005-10-31 20:32:53 +00:00			`udev_helper_domtrans(hotplug_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`udev_read_db(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add updfstab 2005-08-08 15:51:15 +00:00			`updfstab_domtrans(hotplug_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`
add usbmodules 2006-01-11 18:28:57 +00:00
deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
add usbmodules 2006-01-11 18:28:57 +00:00			`usbmodules_domtrans(hotplug_t)`
			`')`