selinux-policy/targeted/attrib.te

#
# Declarations for type attributes.
# 

# A type attribute can be used to identify a set of types with a similar
# property.  Each type can have any number of attributes, and each
# attribute can be associated with any number of types.  Attributes are
# explicitly declared here, and can then be associated with particular
# types in type declarations.  Attribute names can then be used throughout 
# the configuration to express the set of types that are associated with 
# the attribute.  Attributes have no implicit meaning to SELinux.  The
# meaning of all attributes are completely defined through their
# usage within the configuration, but should be documented here as
# comments preceding the attribute declaration.  

#####################
# Attributes for MLS:
#

# Common Terminology
# 	MLS Range: low-high
#		low referred to as "Effective Sensitivity Label (SL)"
#		high referred to as "Clearance SL"


#
# File System MLS attributes/privileges
#
# Grant MLS read access to files not dominated by the process Effective SL
attribute mlsfileread;
# Grant MLS read access to files which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsfilereadtoclr;
# Grant MLS write access to files not equal to the Effective SL
attribute mlsfilewrite;
# Grant MLS write access to files which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsfilewritetoclr;
# Grant MLS ability to change file label to a new label which dominates
# the old label  
attribute mlsfileupgrade;
# Grant MLS ability to change file label to a new label which is
# dominated by or incomparable to the old label
attribute mlsfiledowngrade;

#
# Network MLS attributes/privileges
#
# Grant MLS read access to packets not dominated by the process Effective SL
attribute mlsnetread;
# Grant MLS read access to packets which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsnetreadtoclr;
# Grant MLS write access to packets not equal to the Effective SL
attribute mlsnetwrite;
# Grant MLS write access to packets which dominate the Effective SL
# and are dominated by the process Clearance SL
attribute mlsnetwritetoclr;
# Grant MLS read access to packets from hosts or interfaces which dominate
# or incomparable to the process Effective SL
attribute mlsnetrecvall;
# Grant MLS ability to change socket label to a new label which dominates
# the old label  
attribute mlsnetupgrade;
# Grant MLS ability to change socket label to a new label which is
# dominated by or incomparable to the old label
attribute mlsnetdowngrade;

#
# IPC MLS attributes/privileges
#
# Grant MLS read access to IPC objects not dominated by the process Effective SL
attribute mlsipcread;
# Grant MLS read access to IPC objects which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsipcreadtoclr;
# Grant MLS write access to IPC objects not equal to the process Effective SL
attribute mlsipcwrite;
# Grant MLS write access to IPC objects which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsipcwritetoclr;

#
# Process MLS attributes/privileges
#
# Grant MLS read access to processes not dominated by the process Effective SL
attribute mlsprocread;
# Grant MLS read access to processes which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsprocreadtoclr;
# Grant MLS write access to processes not equal to the Effective SL
attribute mlsprocwrite;
# Grant MLS write access to processes which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsprocwritetoclr;
# Grant MLS ability to change Effective SL or Clearance SL of process to a
# label dominated by the Clearance SL
attribute mlsprocsetsl;

#
# X Window MLS attributes/privileges
#
# Grant MLS read access to X objects not dominated by the process Effective SL
attribute mlsxwinread;
# Grant MLS read access to X objects which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsxwinreadtoclr;
# Grant MLS write access to X objects not equal to the process Effective SL
attribute mlsxwinwrite;
# Grant MLS write access to X objects which dominate the process Effective SL
# and are dominated by the process Clearance SL
attribute mlsxwinwritetoclr;
# Grant MLS read access to X properties not dominated by
# the process Effective SL
attribute mlsxwinreadproperty;
# Grant MLS write access to X properties not equal to the process Effective SL
attribute mlsxwinwriteproperty;
# Grant MLS read access to X colormaps not dominated by
# the process Effective SL
attribute mlsxwinreadcolormap;
# Grant MLS write access to X colormaps not equal to the process Effective SL
attribute mlsxwinwritecolormap;
# Grant MLS write access to X xinputs not equal to the process Effective SL
attribute mlsxwinwritexinput;

# Grant MLS read/write access to objects which internally arbitrate MLS
attribute mlstrustedobject;

#
# Both of the following attributes are needed for a range transition to succeed
#
# Grant ability for the current domain to change SL upon process transition
attribute privrangetrans;
# Grant ability for the new process domain to change SL upon process transition
attribute mlsrangetrans;

#########################
# Attributes for domains:
#

# The domain attribute identifies every type that can be 
# assigned to a process.  This attribute is used in TE rules 
# that should be applied to all domains, e.g. permitting 
# init to kill all processes.
attribute domain;

# The daemon attribute identifies domains for system processes created via
# the daemon_domain, daemon_base_domain, and init_service_domain macros.
attribute daemon;

# The privuser attribute identifies every domain that can 
# change its SELinux user identity.  This attribute is used 
# in the constraints configuration.  NOTE:  This attribute
# is not required for domains that merely change the Linux
# uid attributes, only for domains that must change the
# SELinux user identity.  Also note that this attribute makes
# no sense without the privrole attribute.
attribute privuser;

# The privrole attribute identifies every domain that can 
# change its SELinux role.  This attribute is used in the 
# constraints configuration.
attribute privrole;

# The userspace_objmgr attribute identifies every domain
# which enforces its own policy.
attribute userspace_objmgr;

# The priv_system_role attribute identifies every domain that can
# change role from a user role to system_r role, and identity from a user
# identity to system_u.  It is used in the constraints configuration.
attribute priv_system_role;

# The privowner attribute identifies every domain that can 
# assign a different SELinux user identity to a file, or that
# can create a file with an identity that is not the same as the
# process identity.  This attribute is used in the constraints
# configuration.
attribute privowner;

# The privlog attribute identifies every domain that can 
# communicate with syslogd through its Unix domain socket.
# There is an assertion that other domains can not do it,
# and an allow rule to permit it
attribute privlog;

# The privmodule attribute identifies every domain that can run
# modprobe, there is an assertion that other domains can not do it,
# and an allow rule to permit it
attribute privmodule;

# The privsysmod attribute identifies every domain that can have the
# sys_module capability
attribute privsysmod;

# The privmem attribute identifies every domain that can 
# access kernel memory devices.
# This attribute is used in the TE assertions to verify
# that such access is limited to domains that are explicitly
# tagged with this attribute.
attribute privmem;

# The privkmsg attribute identifies every domain that can 
# read kernel messages (/proc/kmsg)
# This attribute is used in the TE assertions to verify
# that such access is limited to domains that are explicitly
# tagged with this attribute.
attribute privkmsg;

# The privfd attribute identifies every domain that should have
# file handles inherited widely (IE sshd_t and getty_t).
attribute privfd;

# The privhome attribute identifies every domain that can create files under
# regular user home directories in the regular context (IE act on behalf of
# a user in writing regular files)
attribute privhome;

# The auth attribute identifies every domain that needs
# to read /etc/shadow, and grants the permission.
attribute auth;

# The auth_bool attribute identifies every domain that can 
# read /etc/shadow if its boolean is set;
attribute auth_bool;

# The auth_write attribute identifies every domain that can have write or
# relabel access to /etc/shadow, but does not grant it.
attribute auth_write;

# The auth_chkpwd attribute identifies every system domain that can
# authenticate users by running unix_chkpwd
attribute auth_chkpwd;

# The change_context attribute identifies setfiles_t, restorecon_t, and other
# system domains that change the context of most/all files on the system
attribute change_context;

# The etc_writer attribute identifies every domain that can write to etc_t
attribute etc_writer;

# The sysctl_kernel_writer attribute identifies domains that can write to
# sysctl_kernel_t, in addition the admin attribute is permitted write access
attribute sysctl_kernel_writer;

# the sysctl_net_writer attribute identifies domains that can write to
# sysctl_net_t files.
attribute sysctl_net_writer;

# The sysctl_type attribute identifies every type that is assigned
# to a sysctl entry.  This can be used in allow rules to grant
# permissions to all sysctl entries without enumerating each individual
# type, but should be used with care.
attribute sysctl_type;

# The admin attribute identifies every administrator domain.
# It is used in TE assertions when verifying that only administrator 
# domains have certain permissions.  
# This attribute is presently associated with sysadm_t and 
# certain administrator utility domains.  
# XXX The use of this attribute should be reviewed for consistency.
# XXX Might want to partition into several finer-grained attributes 
# XXX used in different assertions within assert.te.
attribute admin;

# The secadmin attribute identifies every security administrator domain.
# It is used in TE assertions when verifying that only administrator 
# domains have certain permissions.  
# This attribute is presently associated with sysadm_t and secadm_t
attribute secadmin;

# The userdomain attribute identifies every user domain, presently
# user_t and sysadm_t.  It is used in TE rules that should be applied
# to all user domains.
attribute userdomain;

# for a small domain that can only be used for newrole
attribute user_mini_domain;

# pty for the mini domain
attribute mini_pty_type;

# pty created by a server such as sshd
attribute server_pty;

# attribute for all non-administrative devpts types
attribute userpty_type;

# The user_tty_type identifies every type for a tty or pty owned by an
# unpriviledged user
attribute user_tty_type;

# The admin_tty_type identifies every type for a tty or pty owned by a
# priviledged user
attribute admin_tty_type;

# The user_crond_domain attribute identifies every user_crond domain, presently
# user_crond_t and sysadm_crond_t.  It is used in TE rules that should be
# applied to all user domains.
attribute user_crond_domain;

# The unpriv_userdomain identifies non-administrative users (default user_t)
attribute unpriv_userdomain;

# This attribute is for the main user home directory for unpriv users
attribute user_home_dir_type;

# The gphdomain attribute identifies every gnome-pty-helper derived
# domain.  It is used in TE rules to permit inheritance and use of
# descriptors created by these domains.
attribute gphdomain;

# The fs_domain identifies every domain that may directly access a fixed disk
attribute fs_domain;

# This attribute is for all domains for the userhelper program.
attribute userhelperdomain;

############################
# Attributes for file types:
#

# The file_type attribute identifies all types assigned to files 
# in persistent filesystems.  It is used in TE rules to permit
# the association of all such file types with persistent filesystem
# types, and to permit certain domains to access all such types as 
# appropriate.
attribute file_type;

# The secure_file_type attribute identifies files 
# which will be treated with a higer level of security.
# Most domains will be prevented from manipulating files in this domain
attribute secure_file_type;

# The device_type attribute identifies all types assigned to device nodes
attribute device_type;

# The proc_fs attribute identifies all types that may be assigned to
# files under /proc.
attribute proc_fs;

# The dev_fs attribute identifies all types that may be assigned to
# files, sockets, or pipes under /dev.
attribute dev_fs;

# The sysadmfile attribute identifies all types assigned to files 
# that should be completely accessible to administrators.  It is used
# in TE rules to grant such access for administrator domains.
attribute sysadmfile;

# The secadmfile attribute identifies all types assigned to files 
# that should be only accessible to security administrators.  It is used
# in TE rules to grant such access for security administrator domains.
attribute secadmfile;

# The fs_type attribute identifies all types assigned to filesystems
# (not limited to persistent filesystems).
# It is used in TE rules to permit certain domains to mount
# any filesystem and to permit most domains to obtain the
# overall filesystem statistics.
attribute fs_type;

# The mount_point attribute identifies all types that can serve
# as a mount point (for the mount binary). It is used in the mount 
# policy to grant mounton permission, and in other domains to grant 
# getattr permission over all the mount points.
attribute mount_point;

# The exec_type attribute identifies all types assigned
# to entrypoint executables for domains.  This attribute is 
# used in TE rules and assertions that should be applied to all 
# such executables.
attribute exec_type;

# The tmpfile attribute identifies all types assigned to temporary 
# files.  This attribute is used in TE rules to grant certain 
# domains the ability to remove all such files (e.g. init, crond).
attribute tmpfile;

# The user_tmpfile attribute identifies all types associated with temporary
# files for unpriv_userdomain domains.
attribute user_tmpfile;

# for the user_xserver_tmp_t etc
attribute xserver_tmpfile;

# The tmpfsfile attribute identifies all types defined for tmpfs 
# type transitions. 
# It is used in TE rules to grant certain domains the ability to
# access all such files.
attribute tmpfsfile;

# The home_type attribute identifies all types assigned to home
# directories.  This attribute is used in TE rules to grant certain
# domains the ability to access all home directory types.
attribute home_type;

# This attribute is for the main user home directory /home/user, to
# distinguish it from sub-dirs.  Often you want a process to be able to
# read the user home directory but not read the regular directories under it.
attribute home_dir_type;

# The ttyfile attribute identifies all types assigned to ttys.
# It is used in TE rules to grant certain domains the ability to
# access all ttys.
attribute ttyfile;

# The ptyfile attribute identifies all types assigned to ptys.
# It is used in TE rules to grant certain domains the ability to
# access all ptys.
attribute ptyfile;

# The pidfile attribute identifies all types assigned to pid files.
# It is used in TE rules to grant certain domains the ability to
# access all such files.
attribute pidfile;


############################
# Attributes for network types:
#

# The socket_type attribute identifies all types assigned to 
# kernel-created sockets.  Ordinary sockets are assigned the 
# domain of the creating process.
# XXX This attribute is unused.  Remove?
attribute socket_type;

# Identifies all types assigned to port numbers to control binding.
attribute port_type;

# Identifies all types assigned to reserved port (<1024) numbers to control binding.
attribute reserved_port_type;

# Identifies all types assigned to network interfaces to control
# operations on the interface (XXX obsolete, not supported via LSM) 
# and to control traffic sent or received on the interface.
attribute netif_type;

# Identifies all default types assigned to packets received 
# on network interfaces.  
attribute netmsg_type;

# Identifies all types assigned to network nodes/hosts to control
# traffic sent to or received from the node.
attribute node_type;

# Identifier for log files or directories that only exist for log files.
attribute logfile;

# Identifier for lock files (/var/lock/*) or directories that only exist for
# lock files.
attribute lockfile;



##############################
# Attributes for security policy types:
#

# The login_contexts attribute idenitifies the files used
# to define default contexts for login types (e.g., login, cron).
attribute login_contexts;

# Identifier for a domain used by "sendmail -t" (IE user_mail_t,
# sysadm_mail_t, etc)
attribute user_mail_domain;

# Identifies domains that can transition to system_mail_t
attribute privmail;

# Type for non-sysadm home directory
attribute user_home_type;

# For domains that are part of a mail server and need to read user files and
# fifos, and inherit file handles to enable user email to get to the mail
# spool
attribute mta_user_agent;

# For domains that are part of a mail server for delivering messages to the
# user
attribute mta_delivery_agent;

# For domains that make outbound TCP port 25 connections to send mail from the
# mail server.
attribute mail_server_sender;

# For a mail server process that takes TCP connections on port 25
attribute mail_server_domain;

# For web clients such as netscape and squid
attribute web_client_domain;

# For X Window System server domains
attribute xserver;

# For X Window System client domains
attribute xclient;

# For X Window System protocol extensions
attribute xextension;

# For X Window System property types
attribute xproperty;

#
# For file systems that do not have extended attributes but need to be
# r/w by users
#
attribute noexattrfile;

#
# For filetypes that the usercan read
#
attribute usercanread;

#
# For serial devices
#
attribute serial_device;

# Attribute to designate unrestricted access
attribute unrestricted;

# Attribute to designate can transition to unconfined_t
attribute unconfinedtrans;

# For clients of nscd.
attribute nscd_client_domain;

# For clients of nscd that can use shmem interface.
attribute nscd_shmem_domain;

# For labeling of content for httpd.  This attribute is only used by
# the httpd_unified domain, which says treat all httpdcontent the
# same.  If you want content to be served in a "non-unified" system
# you must specifically add "r_dir_file(httpd_t, your_content_t)" to
# your policy.
attribute httpdcontent;

# For labeling of domains whos transition can be disabled
attribute transitionbool;

# For labeling of file_context domains which users can change files to rather
# then the default file context.  These file_context can survive a relabeling
# of the file system.
attribute customizable;

##############################
# Attributes for polyinstatiation support:
#

# For labeling types that are to be polyinstantiated
attribute polydir;

# And for labeling the parent directories of those polyinstantiated directories
# This is necessary for remounting the original in the parent to give
# security aware apps access
attribute polyparent;

# And labeling for the member directories
attribute polymember;