rename

refpolicy/policy/modules/kernel/bootloader.if

@@ -34,9 +34,8 @@ define(`bootloader_domtrans_depend',`
 ########################################
 ## <interface name="bootloader_run">
 ##	<description>
-##		Execute bootloader in the bootloader domain, and
+##		Execute bootloader interactively and do
-##		allow the specified role the bootloader domain,
+##		a domain transition to the bootloader domain.
-##		and use the caller's terminal.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -64,49 +63,68 @@ define(`bootloader_run_depend',`
 ')
 
 ########################################
+## <interface name="bootloader_search_boot_dir">
+##	<description>
+##		Search the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_search_bootloader_data_directory(domain)
+define(`bootloader_search_boot_dir',`
-#
-define(`bootloader_search_bootloader_data_directory',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir search;
 ')
 
-define(`bootloader_search_bootloader_data_directory_depend',`
+define(`bootloader_search_boot_dir_depend',`
 	type boot_t;
 
 	class dir search;
 ')
 
 ########################################
+## <interface name="bootloader_dontaudit_search_boot_dir">
+##	<description>
+##		Do not audit attempts to search the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_ignore_search_bootloader_data_directory(domain)
+define(`bootloader_dontaudit_search_boot_dir',`
-#
-define(`bootloader_ignore_search_bootloader_data_directory',`
 	requires_block_template(`$0'_depend)
 
 	dontaudit $1 boot_t:dir search;
 ')
 
-define(`bootloader_ignore_search_bootloader_data_directory_depend',`
+define(`bootloader_dontaudit_search_boot_dir_depend',`
 	type boot_t;
 
 	class dir search;
 ')
 
 ########################################
+## <interface name="bootloader_rw_boot_symlinks">
+##	<description>
+##		Read and write symbolic links
+##		in the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_modify_bootloader_data_directory_symbolic_links(domain)
+define(`bootloader_rw_boot_symlinks',`
-#
-define(`bootloader_modify_bootloader_data_directory_symbolic_links',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir r_dir_perms;
 	allow $1 boot_t:lnk_file rw_file_perms;
 ')
 
-define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',`
+define(`bootloader_rw_boot_symlinks_depend',`
 	type boot_t;
 
 	class dir r_dir_perms;
@@ -114,10 +132,16 @@ define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',`
 ')
 
 ########################################
+## <interface name="bootloader_create_kernel">
+##	<description>
+##		Install a kernel into the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_install_kernel(domain)
+define(`bootloader_create_kernel',`
-#
-define(`bootloader_install_kernel',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir ra_dir_perms;
@@ -125,7 +149,7 @@ define(`bootloader_install_kernel',`
 	allow $1 boot_t:lnk_file { getattr read create unlink };
 ')
 
-define(`bootloader_install_kernel_depend',`
+define(`bootloader_create_kernel_depend',`
 	type boot_t;
 
 	class dir ra_dir_perms;
@@ -134,37 +158,23 @@ define(`bootloader_install_kernel_depend',`
 ')
 
 ########################################
+## <interface name="bootloader_create_kernel_symbol_table">
+##	<description>
+##		Install a system.map into the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_install_initrd(domain)
+define(`bootloader_create_kernel_symbol_table',`
-#
-define(`bootloader_install_initrd',`
-	requires_block_template(`$0'_depend)
-
-	allow $1 boot_t:dir ra_dir_perms;
-	allow $1 boot_t:file { getattr read write create };
-	allow $1 boot_t:lnk_file { getattr read create unlink };
-')
-
-define(`bootloader_install_initrd_depend',`
-	type boot_t;
-
-	class dir ra_dir_perms;
-	class file { getattr read write create };
-	class lnk_file { getattr read create unlink };
-')
-
-########################################
-#
-# bootloader_install_kernel_symbol_table(domain)
-#
-define(`bootloader_install_kernel_symbol_table',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir ra_dir_perms;
 	allow $1 system_map_t:file { rw_file_perms create };
 ')
 
-define(`bootloader_install_kernel_symbol_table_depend',`
+define(`bootloader_create_kernel_symbol_table_depend',`
 	type boot_t, system_map_t;
 
 	class dir ra_dir_perms;
@@ -172,8 +182,14 @@ define(`bootloader_install_kernel_symbol_table_depend',`
 ')
 
 ########################################
-#
+## <interface name="bootloader_read_kernel_symbol_table">
-# bootloader_read_kernel_symbol_table(domain)
+##	<description>
+##		Read system.map in the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`bootloader_read_kernel_symbol_table',`
 	requires_block_template(`$0'_depend)
@@ -190,17 +206,23 @@ define(`bootloader_read_kernel_symbol_table_depend',`
 ')
 
 ########################################
+## <interface name="bootloader_delete_kernel">
+##	<description>
+##		Delete a kernel from /boot.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_remove_kernel(domain)
+define(`bootloader_delete_kernel',`
-#
-define(`bootloader_remove_kernel',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir { r_dir_perms write remove_name };
 	allow $1 boot_t:file { getattr unlink };
 ')
 
-define(`bootloader_remove_kernel_depend',`
+define(`bootloader_delete_kernel_depend',`
 	type boot_t;
 
 	class dir { r_dir_perms write remove_name };
@@ -208,17 +230,23 @@ define(`bootloader_remove_kernel_depend',`
 ')
 
 ########################################
+## <interface name="bootloader_delete_kernel_symbol_table">
+##	<description>
+##		Delete a system.map in the /boot directory.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_remove_kernel_symbol_table(domain)
+define(`bootloader_delete_kernel_symbol_table',`
-#
-define(`bootloader_remove_kernel_symbol_table',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir { r_dir_perms write remove_name };
 	allow $1 system_map_t:file { getattr unlink };
 ')
 
-define(`bootloader_remove_kernel_symbol_table_depend',`
+define(`bootloader_delete_kernel_symbol_table_depend',`
 	type boot_t, system_map_t;
 
 	class dir { r_dir_perms write remove_name };
@@ -226,8 +254,14 @@ define(`bootloader_remove_kernel_symbol_table_depend',`
 ')
 
 ########################################
-#
+## <interface name="bootloader_read_config">
-# bootloader_read_config(domain)
+##	<description>
+##		Read the bootloader configuration file.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`bootloader_read_config',`
 	requires_block_template(`$0'_depend)
@@ -242,43 +276,64 @@ define(`bootloader_read_config_depend',`
 ')
 
 ########################################
+## <interface name="bootloader_rw_config">
+##	<description>
+##		Read and write the bootloader
+##		configuration file.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_rw_config(domain)
+define(`bootloader_rw_config',`
-#
-define(`bootloader_rw_bootloader_config',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 bootloader_etc_t:file rw_file_perms;
 ')
 
-define(`bootloader_rw_bootloader_config_depend',`
+define(`bootloader_rw_config_depend',`
 	type bootloader_etc_t;
 
 	class file rw_file_perms;
 ')
 
 ########################################
+## <interface name="bootloader_rw_tmp_file">
+##	<description>
+##		Read and write the bootloader
+##		temporary data in /tmp.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_rw_temp_data(domain)
+define(`bootloader_rw_tmp_file',`
-#
-define(`bootloader_rw_temp_data',`
 	requires_block_template(`$0'_depend)
 
 	# FIXME: read tmp_t
 	allow $1 bootloader_tmp_t:file rw_file_perms;
 ')
 
-define(`bootloader_rw_temp_data_depend',`
+define(`bootloader_rw_tmp_file_depend',`
 	type bootloader_tmp_t;
 
 	class file rw_file_perms;
 ')
 
 ########################################
+## <interface name="bootloader_create_runtime_file">
+##	<description>
+##		Read and write the bootloader
+##		temporary data in /tmp.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# bootloader_create_runtime_data(domain)
+define(`bootloader_create_runtime_file',`
-#
-define(`bootloader_create_runtime_data',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 boot_t:dir rw_dir_perms;
@@ -286,7 +341,7 @@ define(`bootloader_create_runtime_data',`
 	type_transition $1 boot_t:file boot_runtime_t;
 ')
 
-define(`bootloader_create_runtime_data_depend',`
+define(`bootloader_create_runtime_file_depend',`
 	type boot_t, boot_runtime_t;
 
 	class dir rw_dir_perms;
@@ -294,8 +349,14 @@ define(`bootloader_create_runtime_data_depend',`
 ')
 
 ########################################
-#
+## <interface name="bootloader_list_kernel_modules">
-# bootloader_list_kernel_modules(domain)
+##	<description>
+##		List the contents of the kernel module directories.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`bootloader_list_kernel_modules',`
 	requires_block_template(`$0'_depend)
@@ -310,8 +371,14 @@ define(`bootloader_list_kernel_modules_depend',`
 ')
 
 ########################################
-#
+## <interface name="bootloader_read_kernel_modules">
-# bootloader_read_kernel_modules(domain)
+##	<description>
+##		Read kernel module files.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`bootloader_read_kernel_modules',`
 	requires_block_template(`$0'_depend)
@@ -330,14 +397,20 @@ define(`bootloader_read_kernel_modules_depend',`
 ')
 
 ########################################
-#
+## <interface name="bootloader_write_kernel_modules">
-# bootloader_write_kernel_modules(domain)
+##	<description>
+##		Write kernel module files.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`bootloader_write_kernel_modules',`
 	requires_block_template(`$0'_depend)
 
 	allow $1 modules_object_t:dir r_dir_perms;
-	allow $1 modules_object_t:file write;
+	allow $1 modules_object_t:file { write append };
 
 	typeattribute $1 can_modify_kernel_modules;
 ')
@@ -348,12 +421,19 @@ define(`bootloader_write_kernel_modules_depend',`
 	type modules_object_t;
 
 	class dir r_dir_perms;
-	class file write;
+	class file { write append };
 ')
 
 ########################################
-#
+## <interface name="bootloader_manage_kernel_modules">
-# bootloader_manage_kernel_modules(domain)
+##	<description>
+##		Create, read, write, and delete
+##		kernel module files.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`bootloader_manage_kernel_modules',`
 	requires_block_template(`$0'_depend)