use our own interface to make maintenance easier

refpolicy/policy/modules/kernel/devices.te

@@ -14,9 +14,10 @@ attribute memory_raw_write;
 # device_t is the type of /dev.
 #
 type device_t;
+fs_associate_tmpfs(device_t)
 files_type(device_t)
 files_mountpoint(device_t)
-fs_associate_tmpfs(device_t)
+files_associate_tmp(device_t)
 
 # Only directories and symlinks should be labeled device_t.
 # If there are other files with this type, it is wrong.
@@ -29,131 +30,111 @@ fs_associate_tmpfs(device_t)
 #
 # Type for /dev/agpgart
 #
-type agp_device_t, device_node;
+type agp_device_t;
-fs_associate(agp_device_t)
+dev_node(agp_device_t)
-fs_associate_tmpfs(agp_device_t)
 
 #
 # Type for /dev/apm_bios
 #
-type apm_bios_t, device_node;
+type apm_bios_t;
-fs_associate(apm_bios_t)
+dev_node(apm_bios_t)
-fs_associate_tmpfs(apm_bios_t)
 
-type cardmgr_dev_t, device_node;
+type cardmgr_dev_t;
-fs_associate(cardmgr_dev_t)
+dev_node(cardmgr_dev_t)
-fs_associate_tmpfs(cardmgr_dev_t)
 files_tmp_file(cardmgr_dev_t)
 
 #
 # clock_device_t is the type of
 # /dev/rtc.
 #
-type clock_device_t, device_node;
+type clock_device_t;
-fs_associate(clock_device_t)
+dev_node(clock_device_t)
-fs_associate_tmpfs(clock_device_t)
 
 #
 # cpu control devices /dev/cpu/0/*
 #
-type cpu_device_t, device_node;
+type cpu_device_t;
-fs_associate(cpu_device_t)
+dev_node(cpu_device_t)
-fs_associate_tmpfs(cpu_device_t)
 
 # for the IBM zSeries z90crypt hardware ssl accelorator
-type crypt_device_t, device_node;
+type crypt_device_t;
-fs_associate(crypt_device_t)
+dev_node(crypt_device_t)
-fs_associate_tmpfs(crypt_device_t)
 
-type dri_device_t, device_node;
+type dri_device_t;
-fs_associate(dri_device_t)
+dev_node(dri_device_t)
-fs_associate_tmpfs(dri_device_t)
 
-type event_device_t, device_node;
+type event_device_t;
-fs_associate(event_device_t)
+dev_node(event_device_t)
-fs_associate_tmpfs(event_device_t)
 
 #
 # Type for framebuffer /dev/fb/*
 #
-type framebuf_device_t, device_node;
+type framebuf_device_t;
-fs_associate(framebuf_device_t)
+dev_node(framebuf_device_t)
-fs_associate_tmpfs(framebuf_device_t)
 
 #
 # Type for /dev/mapper/control
 #
-type lvm_control_t, device_node;
+type lvm_control_t;
-fs_associate(lvm_control_t)
+dev_node(lvm_control_t)
-fs_associate_tmpfs(lvm_control_t)
 
 #
 # memory_device_t is the type of /dev/kmem,
 # /dev/mem and /dev/port.
 #
-type memory_device_t, device_node;
+type memory_device_t;
-fs_associate(memory_device_t)
+dev_node(memory_device_t)
-fs_associate_tmpfs(memory_device_t)
 
 neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
 neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
 
-type misc_device_t, device_node;
+type misc_device_t;
-fs_associate(misc_device_t)
+dev_node(misc_device_t)
-fs_associate_tmpfs(misc_device_t)
 
 #
 # A more general type for mouse devices.
 #
-type mouse_device_t, device_node;
+type mouse_device_t;
-fs_associate(mouse_device_t)
+dev_node(mouse_device_t)
-fs_associate_tmpfs(mouse_device_t)
 
 #
 # Type for /dev/cpu/mtrr and /proc/mtrr
 #
-type mtrr_device_t, device_node;
+type mtrr_device_t;
-fs_associate(mtrr_device_t)
+dev_node(mtrr_device_t)
-fs_associate_tmpfs(mtrr_device_t)
 genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
 
 #
 # null_device_t is the type of /dev/null.
 #
-type null_device_t, device_node;
+type null_device_t;
-fs_associate(null_device_t)
+dev_node(null_device_t)
-fs_associate_tmpfs(null_device_t)
 mls_trusted_object(null_device_t)
 sid devnull gen_context(system_u:object_r:null_device_t,s0)
 
 #
 # Type for /dev/pmu 
 #
-type power_device_t, device_node;
+type power_device_t;
-fs_associate(power_device_t)
+dev_node(power_device_t)
-fs_associate_tmpfs(power_device_t)
 
-type printer_device_t, device_node;
+type printer_device_t;
-fs_associate(printer_device_t)
+dev_node(printer_device_t)
-fs_associate_tmpfs(printer_device_t)
 
 #
 # random_device_t is the type of /dev/random
 #
-type random_device_t, device_node;
+type random_device_t;
-fs_associate(random_device_t)
+dev_node(random_device_t)
-fs_associate_tmpfs(random_device_t)
 
-type scanner_device_t, device_node;
+type scanner_device_t;
-fs_associate(scanner_device_t)
+dev_node(scanner_device_t)
-fs_associate_tmpfs(scanner_device_t)
 
 #
 # Type for sound devices and mixers
 #
-type sound_device_t, device_node;
+type sound_device_t;
-fs_associate(sound_device_t)
+dev_node(sound_device_t)
-fs_associate_tmpfs(sound_device_t)
 
 #
 # sysfs_t is the type for the /sys pseudofs
@@ -166,9 +147,8 @@ genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
 #
 # urandom_device_t is the type of /dev/urandom
 #
-type urandom_device_t, device_node;
+type urandom_device_t;
-fs_associate(urandom_device_t)
+dev_node(urandom_device_t)
-fs_associate_tmpfs(urandom_device_t)
 
 #
 # usbfs_t is the type for the /proc/bus/usb pseudofs
@@ -179,20 +159,17 @@ fs_make_noxattr_fs(usbfs_t)
 genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0)
 genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
 
-type v4l_device_t, device_node;
+type v4l_device_t;
-fs_associate(v4l_device_t)
+dev_node(v4l_device_t)
-fs_associate_tmpfs(v4l_device_t)
 
-type xserver_misc_device_t, device_node;
+type xserver_misc_device_t;
-fs_associate(xserver_misc_device_t)
+dev_node(xserver_misc_device_t)
-fs_associate_tmpfs(xserver_misc_device_t)
 
 #
 # zero_device_t is the type of /dev/zero.
 #
-type zero_device_t, device_node;
+type zero_device_t;
-fs_associate(zero_device_t)
+dev_node(zero_device_t)
-fs_associate_tmpfs(zero_device_t)
 mls_trusted_object(zero_device_t)
 
 
@@ -202,9 +179,10 @@ mls_trusted_object(zero_device_t)
 # move it to xserver
 type xconsole_device_t;
 files_type(xconsole_device_t)
+fs_associate_tmpfs(xconsole_device_t)
+files_associate_tmp(xconsole_device_t)
 
 # devfs is dead on selinux
 # this should be removed
-type devfs_control_t, device_node;
+type devfs_control_t;
-fs_associate(devfs_control_t)
+dev_node(devfs_control_t)
-fs_associate_tmpfs(devfs_control_t)