rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

use our own interface to make maintenance easier

Browse Source
This commit is contained in:
Chris PeBenito 2005-10-25 18:13:47 +00:00
parent 7eec657c86
commit 2aec1461b4
1 changed files with 54 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

130
refpolicy/policy/modules/kernel/devices.te
View File

@ -14,9 +14,10 @@ attribute memory_raw_write;
# device_t is the type of /dev.
#
type device_t;
fs_associate_tmpfs(device_t)
files_type(device_t)
files_mountpoint(device_t)
fs_associate_tmpfs(device_t)
files_associate_tmp(device_t)
# Only directories and symlinks should be labeled device_t.
# If there are other files with this type, it is wrong.
@ -29,131 +30,111 @@ fs_associate_tmpfs(device_t)
#
# Type for /dev/agpgart
#
type agp_device_t, device_node;
fs_associate(agp_device_t)
fs_associate_tmpfs(agp_device_t)
type agp_device_t;
dev_node(agp_device_t)
#
# Type for /dev/apm_bios
#
type apm_bios_t, device_node;
fs_associate(apm_bios_t)
fs_associate_tmpfs(apm_bios_t)
type apm_bios_t;
dev_node(apm_bios_t)
type cardmgr_dev_t, device_node;
fs_associate(cardmgr_dev_t)
fs_associate_tmpfs(cardmgr_dev_t)
type cardmgr_dev_t;
dev_node(cardmgr_dev_t)
files_tmp_file(cardmgr_dev_t)
#
# clock_device_t is the type of
# /dev/rtc.
#
type clock_device_t, device_node;
fs_associate(clock_device_t)
fs_associate_tmpfs(clock_device_t)
type clock_device_t;
dev_node(clock_device_t)
#
# cpu control devices /dev/cpu/0/*
#
type cpu_device_t, device_node;
fs_associate(cpu_device_t)
fs_associate_tmpfs(cpu_device_t)
type cpu_device_t;
dev_node(cpu_device_t)
# for the IBM zSeries z90crypt hardware ssl accelorator
type crypt_device_t, device_node;
fs_associate(crypt_device_t)
fs_associate_tmpfs(crypt_device_t)
type crypt_device_t;
dev_node(crypt_device_t)
type dri_device_t, device_node;
fs_associate(dri_device_t)
fs_associate_tmpfs(dri_device_t)
type dri_device_t;
dev_node(dri_device_t)
type event_device_t, device_node;
fs_associate(event_device_t)
fs_associate_tmpfs(event_device_t)
type event_device_t;
dev_node(event_device_t)
#
# Type for framebuffer /dev/fb/*
#
type framebuf_device_t, device_node;
fs_associate(framebuf_device_t)
fs_associate_tmpfs(framebuf_device_t)
type framebuf_device_t;
dev_node(framebuf_device_t)
#
# Type for /dev/mapper/control
#
type lvm_control_t, device_node;
fs_associate(lvm_control_t)
fs_associate_tmpfs(lvm_control_t)
type lvm_control_t;
dev_node(lvm_control_t)
#
# memory_device_t is the type of /dev/kmem,
# /dev/mem and /dev/port.
#
type memory_device_t, device_node;
fs_associate(memory_device_t)
fs_associate_tmpfs(memory_device_t)
type memory_device_t;
dev_node(memory_device_t)
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
type misc_device_t, device_node;
fs_associate(misc_device_t)
fs_associate_tmpfs(misc_device_t)
type misc_device_t;
dev_node(misc_device_t)
#
# A more general type for mouse devices.
#
type mouse_device_t, device_node;
fs_associate(mouse_device_t)
fs_associate_tmpfs(mouse_device_t)
type mouse_device_t;
dev_node(mouse_device_t)
#
# Type for /dev/cpu/mtrr and /proc/mtrr
#
type mtrr_device_t, device_node;
fs_associate(mtrr_device_t)
fs_associate_tmpfs(mtrr_device_t)
type mtrr_device_t;
dev_node(mtrr_device_t)
genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
#
# null_device_t is the type of /dev/null.
#
type null_device_t, device_node;
fs_associate(null_device_t)
fs_associate_tmpfs(null_device_t)
type null_device_t;
dev_node(null_device_t)
mls_trusted_object(null_device_t)
sid devnull gen_context(system_u:object_r:null_device_t,s0)
#
# Type for /dev/pmu
#
type power_device_t, device_node;
fs_associate(power_device_t)
fs_associate_tmpfs(power_device_t)
type power_device_t;
dev_node(power_device_t)
type printer_device_t, device_node;
fs_associate(printer_device_t)
fs_associate_tmpfs(printer_device_t)
type printer_device_t;
dev_node(printer_device_t)
#
# random_device_t is the type of /dev/random
#
type random_device_t, device_node;
fs_associate(random_device_t)
fs_associate_tmpfs(random_device_t)
type random_device_t;
dev_node(random_device_t)
type scanner_device_t, device_node;
fs_associate(scanner_device_t)
fs_associate_tmpfs(scanner_device_t)
type scanner_device_t;
dev_node(scanner_device_t)
#
# Type for sound devices and mixers
#
type sound_device_t, device_node;
fs_associate(sound_device_t)
fs_associate_tmpfs(sound_device_t)
type sound_device_t;
dev_node(sound_device_t)
#
# sysfs_t is the type for the /sys pseudofs
@ -166,9 +147,8 @@ genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
#
# urandom_device_t is the type of /dev/urandom
#
type urandom_device_t, device_node;
fs_associate(urandom_device_t)
fs_associate_tmpfs(urandom_device_t)
type urandom_device_t;
dev_node(urandom_device_t)
#
# usbfs_t is the type for the /proc/bus/usb pseudofs
@ -179,20 +159,17 @@ fs_make_noxattr_fs(usbfs_t)
genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0)
genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
type v4l_device_t, device_node;
fs_associate(v4l_device_t)
fs_associate_tmpfs(v4l_device_t)
type v4l_device_t;
dev_node(v4l_device_t)
type xserver_misc_device_t, device_node;
fs_associate(xserver_misc_device_t)
fs_associate_tmpfs(xserver_misc_device_t)
type xserver_misc_device_t;
dev_node(xserver_misc_device_t)
#
# zero_device_t is the type of /dev/zero.
#
type zero_device_t, device_node;
fs_associate(zero_device_t)
fs_associate_tmpfs(zero_device_t)
type zero_device_t;
dev_node(zero_device_t)
mls_trusted_object(zero_device_t)
@ -202,9 +179,10 @@ mls_trusted_object(zero_device_t)
# move it to xserver
type xconsole_device_t;
files_type(xconsole_device_t)
fs_associate_tmpfs(xconsole_device_t)
files_associate_tmp(xconsole_device_t)
# devfs is dead on selinux
# this should be removed
type devfs_control_t, device_node;
fs_associate(devfs_control_t)
fs_associate_tmpfs(devfs_control_t)
type devfs_control_t;
dev_node(devfs_control_t)