From b5ab18b3f1cd7fe58f148c7ea5c9ba495dd3a4d8 Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Thu, 28 Apr 2005 13:41:37 +0000
Subject: [PATCH] initial commit

---
 refpolicy/policy/modules/system/mount.fc |  8 ++++
 refpolicy/policy/modules/system/mount.if | 47 ++++++++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 refpolicy/policy/modules/system/mount.fc
 create mode 100644 refpolicy/policy/modules/system/mount.if

diff --git a/refpolicy/policy/modules/system/mount.fc b/refpolicy/policy/modules/system/mount.fc
new file mode 100644
index 00000000..f1a7684c
--- /dev/null
+++ b/refpolicy/policy/modules/system/mount.fc
@@ -0,0 +1,8 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+
+########################################
+#
+# mount file contexts
+#
+/bin/mount.*			--	system_u:object_r:mount_exec_t
+/bin/umount.*			--	system_u:object_r:mount_exec_t
diff --git a/refpolicy/policy/modules/system/mount.if b/refpolicy/policy/modules/system/mount.if
new file mode 100644
index 00000000..201f9137
--- /dev/null
+++ b/refpolicy/policy/modules/system/mount.if
@@ -0,0 +1,47 @@
+# Copyright (C) 2005 Tresys Technology, LLC
+
+#######################################
+#
+# mount_transition(domain,[`optional'])
+#
+define(`mount_transition',`
+requires_block_template(mount_transition_depend,$2)
+allow $1 mount_exec_t:file { getattr read execute };
+allow $1 mount_t:process transition;
+type_transition $1 mount_exec_t:file mount_t;
+dontaudit $1 mount_t:process { noatsecure siginh rlimitinh };
+')
+
+define(`mount_transition_depend',`
+type mount_t, mount_exec_t;
+class file { getattr read execute };
+class process { transition noatsecure siginh rlimitinh };
+')
+
+#######################################
+#
+# mount_use_file_descriptors(domain,[`optional'])
+#
+define(`mount_use_file_descriptors',`
+requires_block_template(mount_use_file_descriptors_depend,$2)
+allow $1 mount_t:fd use; 
+')
+
+define(`mount_use_file_descriptors_depend',`
+type mount_t;
+class fd use;
+')
+
+#######################################
+#
+# mount_send_nfs_client_request(domain,[`optional'])
+#
+define(`mount_send_nfs_client_request',`
+requires_block_template(mount_send_nfs_client_request_depend,$2)
+allow $1 mount_t:udp_socket ioctl read getattr write setattr append bind connect getopt setopt shutdown;
+')
+
+define(`mount_send_nfs_client_request_depend',`
+type mount_t;
+class udp_socket { ioctl read getattr write setattr append bind connect getopt setopt shutdown };
+')