diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 704dec7e..3e97ca8f 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -38,6 +38,27 @@ interface(`files_type',` typeattribute $1 file_type, non_security_file_type; ') +######################################## +## +## Make the specified type a file that +## should not be dontaudited from +## browsing from user domains. +## +## +## +## Type of the file to be used as a +## member directory. +## +## +# +interface(`files_security_file',` + gen_require(` + attribute file_type, security_file_type; + ') + + typeattribute $1 file_type, security_file_type; +') + ######################################## ## ## Make the specified type usable for @@ -78,6 +99,26 @@ interface(`files_mountpoint',` typeattribute $1 mountpoint; ') +######################################## +## +## Make the specified type usable for +## security file filesystem mount points. +## +## +## +## Type to be used for mount points. +## +## +# +interface(`files_security_mountpoint',` + gen_require(` + attribute mountpoint; + ') + + files_security_file($1) + typeattribute $1 mountpoint; +') + ######################################## ## ## Make the specified type usable for @@ -206,47 +247,6 @@ interface(`files_poly_member_tmp',` type_member $1 tmp_t:dir $2; ') -######################################## -## -## Make the specified type a file that -## should not be dontaudited from -## browsing from user domains. -## -## -## -## Type of the file to be used as a -## member directory. -## -## -# -interface(`files_security_file',` - gen_require(` - attribute file_type, security_file_type; - ') - - typeattribute $1 file_type, security_file_type; -') - -######################################## -## -## Make the specified type usable for -## security file filesystem mount points. -## -## -## -## Type to be used for mount points. -## -## -# -interface(`files_security_mountpoint',` - gen_require(` - attribute mountpoint; - ') - - files_security_file($1) - typeattribute $1 mountpoint; -') - ######################################## ## ## Make the specified type a file