initial commit

refpolicy/policy/modules/system/mount.fc

@@ -0,0 +1,8 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+
+########################################
+#
+# mount file contexts
+#
+/bin/mount.*			--	system_u:object_r:mount_exec_t
+/bin/umount.*			--	system_u:object_r:mount_exec_t

refpolicy/policy/modules/system/mount.if

@@ -0,0 +1,47 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+
+#######################################
+#
+# mount_transition(domain,[`optional'])
+#
+define(`mount_transition',`
+requires_block_template(mount_transition_depend,$2)
+allow $1 mount_exec_t:file { getattr read execute };
+allow $1 mount_t:process transition;
+type_transition $1 mount_exec_t:file mount_t;
+dontaudit $1 mount_t:process { noatsecure siginh rlimitinh };
+')
+
+define(`mount_transition_depend',`
+type mount_t, mount_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh };
+')
+
+#######################################
+#
+# mount_use_file_descriptors(domain,[`optional'])
+#
+define(`mount_use_file_descriptors',`
+requires_block_template(mount_use_file_descriptors_depend,$2)
+allow $1 mount_t:fd use; 
+')
+
+define(`mount_use_file_descriptors_depend',`
+type mount_t;
+class fd use;
+')
+
+#######################################
+#
+# mount_send_nfs_client_request(domain,[`optional'])
+#
+define(`mount_send_nfs_client_request',`
+requires_block_template(mount_send_nfs_client_request_depend,$2)
+allow $1 mount_t:udp_socket ioctl read getattr write setattr append bind connect getopt setopt shutdown;
+')
+
+define(`mount_send_nfs_client_request_depend',`
+type mount_t;
+class udp_socket { ioctl read getattr write setattr append bind connect getopt setopt shutdown };
+')