rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Devices rename.

Browse Source
This commit is contained in:
Karl MacMillan 2005-06-13 16:22:32 +00:00
parent 12b559a402
commit f0c985ca80
33 changed files with 900 additions and 495 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
refpolicy/Makefile
View File

@ -434,6 +434,9 @@ clean:
rm -f $(FC)
bare: clean
find . -name *~ -exec rm -f {} \;
find . -name "*#*" -exec rm -f {} \;
find . -name ".*#*" -exec rm -f {} \;
rm -f $(POLXML)
rm -f $(SUPPORT)/*.pyc
rm -f $(FCSORT)

4
refpolicy/policy/modules/admin/netutils.te
View File

@ -188,8 +188,8 @@ logging_send_system_log_message(traceroute_t)
miscfiles_read_localization(traceroute_t)
#rules needed for nmap
devices_get_random_data(traceroute_t)
devices_get_pseudorandom_data(traceroute_t)
dev_read_rand(traceroute_t)
dev_read_urand(traceroute_t)
files_read_general_application_resources(traceroute_t)
if (user_ping) {

2
refpolicy/policy/modules/admin/rpm.if
View File

@ -1,4 +1,4 @@
## <module name="rpm" layer="system">
## <module name="rpm" layer="admin">
## <summary>Policy for the RPM package manager.</summary>
########################################

10
refpolicy/policy/modules/admin/rpm.te
View File

@ -113,7 +113,7 @@ corenet_udp_sendrecv_all_ports(rpm_t)
corenet_tcp_bind_all_nodes(rpm_t)
corenet_udp_bind_all_nodes(rpm_t)
devices_get_pseudorandom_data(rpm_t)
dev_read_urand(rpm_t)
#devices_manage_all_device_types(rpm_t)
#fs_manage_nfs_dir(rpm_t)
@ -254,10 +254,10 @@ kernel_compute_reachable_user_contexts(rpm_script_t)
kernel_read_system_state(rpm_script_t)
# ideally we would not need this
devices_manage_generic_block_devices(rpm_script_t)
devices_manage_generic_character_devices(rpm_script_t)
devices_manage_all_block_devices(rpm_script_t)
devices_manage_all_character_devices(rpm_script_t)
dev_manage_generic_blk_file(rpm_script_t)
dev_manage_generic_chr_file(rpm_script_t)
dev_manage_all_blk_files(rpm_script_t)
dev_manage_all_chr_files(rpm_script_t)
fs_manage_nfs_files(rpm_script_t)
fs_getattr_nfs(rpm_script_t)

2
refpolicy/policy/modules/admin/usermanage.if
View File

@ -1,4 +1,4 @@
## <module name="usermanage" layer="system">
## <module name="usermanage" layer="admin">
## <summary>Policy for managing user accounts.</summary>
########################################

8
refpolicy/policy/modules/admin/usermanage.te
View File

@ -90,7 +90,7 @@ term_use_all_user_ptys(chfn_t)
fs_getattr_xattr_fs(chfn_t)
# for SSP
devices_get_pseudorandom_data(chfn_t)
dev_read_urand(chfn_t)
# /usr/bin/passwd asks for w access to utmp, but it will operate
# correctly without it. Do not audit write denials to utmp.
@ -161,7 +161,7 @@ files_create_private_tmp_data(crack_t, crack_tmp_t, { file dir })
kernel_read_system_state(crack_t)
# for SSP
devices_get_pseudorandom_data(crack_t)
dev_read_urand(crack_t)
fs_getattr_xattr_fs(crack_t)
@ -293,7 +293,7 @@ kernel_compute_relabel_context(passwd_t)
kernel_compute_reachable_user_contexts(passwd_t)
# for SSP
devices_get_pseudorandom_data(passwd_t)
dev_read_urand(passwd_t)
fs_getattr_xattr_fs(passwd_t)
@ -392,7 +392,7 @@ kernel_compute_reachable_user_contexts(sysadm_passwd_t)
kernel_read_system_state(sysadm_passwd_t)
# for SSP
devices_get_pseudorandom_data(sysadm_passwd_t)
dev_read_urand(sysadm_passwd_t)
fs_getattr_xattr_fs(sysadm_passwd_t)

6
refpolicy/policy/modules/apps/gpg.if
View File

@ -76,8 +76,8 @@ define(`gpg_per_userdomain_template',`
corenet_tcp_bind_all_nodes($1_gpg_t)
corenet_udp_bind_all_nodes($1_gpg_t)
devices_get_random_data($1_gpg_t)
devices_get_pseudorandom_data($1_gpg_t)
dev_read_rand($1_gpg_t)
dev_read_urand($1_gpg_t)
fs_getattr_xattr_fs($1_gpg_t)
@ -186,7 +186,7 @@ define(`gpg_per_userdomain_template',`
corenet_tcp_bind_all_nodes($1_gpg_helper_t)
corenet_udp_bind_all_nodes($1_gpg_helper_t)
devices_get_pseudorandom_data($1_gpg_helper_t)
dev_read_urand($1_gpg_helper_t)
files_read_general_system_config($1_gpg_helper_t)
# for nscd

16
refpolicy/policy/modules/kernel/bootloader.te
View File

@ -43,7 +43,7 @@ files_make_file(bootloader_etc_t)
#
type bootloader_tmp_t;
files_make_temporary_file(bootloader_tmp_t)
devices_make_device_node(bootloader_tmp_t)
dev_node(bootloader_tmp_t)
# kernel modules
type modules_object_t;
@ -98,13 +98,13 @@ storage_raw_write_fixed_disk(bootloader_t)
storage_raw_read_removable_device(bootloader_t)
storage_raw_write_removable_device(bootloader_t)
devices_get_all_character_device_attributes(bootloader_t)
devices_set_all_block_device_attributes(bootloader_t)
devices_ignore_modify_generic_devices(bootloader_t)
devices_get_random_data(bootloader_t)
devices_get_pseudorandom_data(bootloader_t)
dev_getattr_all_chr_files(bootloader_t)
dev_setattr_all_blk_files(bootloader_t)
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
dev_read_rand(bootloader_t)
dev_read_urand(bootloader_t)
# for reading BIOS data
devices_raw_read_memory(bootloader_t)
dev_read_raw_memory(bootloader_t)
fs_getattr_xattr_fs(bootloader_t)
@ -166,7 +166,7 @@ optional_policy(`filesystemtools.te', `
# LVM2 / Device Mapper's /dev/mapper/control
# maybe we should change the labeling for this
optional_policy(`lvm.te', `
devices_use_lvm_control_channel(bootloader_t)
dev_rw_lvm_control(bootloader_t)
lvm_transition(bootloader_t)
lvm_read_config(bootloader_t)

1077
refpolicy/policy/modules/kernel/devices.if
View File

File diff suppressed because it is too large Load Diff

40
refpolicy/policy/modules/kernel/storage.if
View File

@ -15,7 +15,7 @@
define(`storage_getattr_fixed_disk',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file getattr;
')
@ -62,7 +62,7 @@ define(`storage_dontaudit_getattr_fixed_disk_depend',`
define(`storage_setattr_fixed_disk',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file setattr;
')
@ -88,7 +88,7 @@ define(`storage_setattr_fixed_disk_depend',`
define(`storage_raw_read_fixed_disk',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file r_file_perms;
typeattribute $1 fixed_disk_raw_read;
')
@ -117,7 +117,7 @@ define(`storage_raw_read_fixed_disk_depend',`
define(`storage_raw_write_fixed_disk',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file { getattr write ioctl };
typeattribute $1 fixed_disk_raw_write;
')
@ -144,7 +144,7 @@ define(`storage_create_fixed_disk_dev_entry',`
requires_block_template(`$0'_depend)
allow $1 fixed_disk_device_t:blk_file create_file_perms;
devices_create_dev_entry($1,fixed_disk_device_t,blk_file)
dev_create_dev_node($1,fixed_disk_device_t,blk_file)
typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write;
')
@ -167,7 +167,7 @@ define(`storage_create_fixed_disk_dev_entry_depend',`
define(`storage_manage_fixed_disk',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file create_file_perms;
typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write;
')
@ -196,7 +196,7 @@ define(`storage_manage_fixed_disk_depend',`
define(`storage_raw_read_lvm_volume',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 lvm_vg_t:blk_file r_file_perms;
typeattribute $1 fixed_disk_raw_read;
')
@ -225,7 +225,7 @@ define(`storage_raw_read_lvm_volume_depend',`
define(`storage_raw_write_lvm_volume',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 lvm_vg_t:blk_file { getattr write ioctl };
typeattribute $1 fixed_disk_raw_write;
')
@ -255,7 +255,7 @@ define(`storage_raw_write_lvm_volume_depend',`
define(`storage_read_scsi_generic',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file r_file_perms;
typeattribute $1 scsi_generic_read;
')
@ -285,7 +285,7 @@ define(`storage_read_scsi_generic_depend',`
define(`storage_write_scsi_generic',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file { getattr write ioctl };
typeattribute $1 scsi_generic_write;
')
@ -312,7 +312,7 @@ define(`storage_write_scsi_generic_depend',`
define(`storage_getattr_scsi_generic',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file getattr;
')
@ -336,7 +336,7 @@ define(`storage_getattr_scsi_generic_depend',`
define(`storage_set_scsi_generic_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 scsi_generic_device_t:blk_file setattr;
')
@ -360,7 +360,7 @@ define(`storage_set_scsi_generic_attributes_depend',`
define(`storage_getattr_removable_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file getattr;
')
@ -407,7 +407,7 @@ define(`storage_dontaudit_getattr_removable_device_depend',`
define(`storage_set_removable_device_attributes',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file setattr;
')
@ -434,7 +434,7 @@ define(`storage_set_removable_device_attributes_depend',`
define(`storage_raw_read_removable_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file r_file_perms;
')
@ -461,7 +461,7 @@ define(`storage_raw_read_removable_device_depend',`
define(`storage_raw_write_removable_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 removable_device_t:blk_file { getattr write ioctl };
')
@ -485,7 +485,7 @@ define(`storage_raw_write_removable_device_depend',`
define(`storage_read_tape_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file r_file_perms;
')
@ -509,7 +509,7 @@ define(`storage_read_tape_device_depend',`
define(`storage_write_tape_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file { getattr write ioctl };
')
@ -533,7 +533,7 @@ define(`storage_write_tape_device_depend',`
define(`storage_getattr_tape_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file getattr;
')
@ -557,7 +557,7 @@ define(`storage_getattr_tape_device_depend',`
define(`storage_setattr_tape_device',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tape_device_t:blk_file setattr;
')

10
refpolicy/policy/modules/kernel/storage.te
View File

@ -11,7 +11,7 @@ attribute scsi_generic_write;
# /dev/hd* and /dev/sd*.
#
type fixed_disk_device_t;
devices_make_device_node(fixed_disk_device_t)
dev_node(fixed_disk_device_t)
neverallow ~fixed_disk_raw_read fixed_disk_device_t:{ chr_file blk_file } read;
neverallow ~fixed_disk_raw_write fixed_disk_device_t:{ chr_file blk_file } { append write };
@ -20,7 +20,7 @@ neverallow ~fixed_disk_raw_write fixed_disk_device_t:{ chr_file blk_file } { app
# lvm_vg_t is the type of logical volume groups
#
type lvm_vg_t;
devices_make_device_node(lvm_vg_t)
dev_node(lvm_vg_t)
# from the subject's point of view, same as read/writing a regular
# fixed disk, so use the same assertions as above
@ -32,7 +32,7 @@ neverallow ~fixed_disk_raw_write lvm_vg_t:{ chr_file blk_file } { append write }
# it gives access to ALL SCSI devices (both fixed and removable)
#
type scsi_generic_device_t;
devices_make_device_node(scsi_generic_device_t)
dev_node(scsi_generic_device_t)
neverallow ~scsi_generic_read scsi_generic_device_t:{ chr_file blk_file } read;
neverallow ~scsi_generic_write scsi_generic_device_t:{ chr_file blk_file } { append write };
@ -42,10 +42,10 @@ neverallow ~scsi_generic_write scsi_generic_device_t:{ chr_file blk_file } { app
# /dev/scd* and /dev/fd*.
#
type removable_device_t;
devices_make_device_node(removable_device_t)
dev_node(removable_device_t)
#
# tape_device_t is the type of
#
type tape_device_t;
devices_make_device_node(tape_device_t)
dev_node(tape_device_t)

43
refpolicy/policy/modules/kernel/terminal.if
View File

@ -98,8 +98,10 @@ define(`term_tty_depend',`
define(`term_create_pty',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 ptmx_t:chr_file rw_file_perms;
allow $1 devpts_t:dir r_dir_perms;
allow $1 devpts_t:filesystem getattr;
dontaudit $1 bsdpty_device_t:chr_file { getattr read write };
@ -128,7 +130,7 @@ define(`term_create_pty_depend',`
define(`term_use_all_terms',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 devpts_t:dir r_dir_perms;
allow $1 { console_device_t tty_device_t ttynode ptynode }:chr_file rw_file_perms;
')
@ -155,7 +157,7 @@ define(`term_use_all_terms_depend',`
define(`term_write_console',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 console_device_t:chr_file write;
')
@ -177,7 +179,7 @@ define(`term_use_console_depend',`
define(`term_use_console',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 console_device_t:chr_file rw_file_perms;
')
@ -224,7 +226,7 @@ define(`term_dontaudit_use_console_depend',`
define(`term_setattr_console',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 console_device_t:chr_file setattr;
')
@ -248,7 +250,7 @@ define(`term_setattr_console_depend',`
define(`term_list_ptys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 devpts_t:dir r_dir_perms;
')
@ -296,7 +298,7 @@ define(`term_dontaudit_list_ptys_depend',`
define(`term_use_generic_pty',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 devpts_t:chr_file { read write };
')
@ -344,7 +346,7 @@ define(`term_dontaudit_use_generic_pty_depend',`
define(`term_use_controlling_term',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 devtty_t:chr_file { getattr read write ioctl };
')
@ -391,7 +393,7 @@ define(`term_dontaudit_use_ptmx_depend',`
define(`term_getattr_all_user_ptys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 devpts_t:dir r_dir_perms;
allow $1 ptynode:chr_file getattr;
')
@ -416,7 +418,7 @@ define(`term_getattr_all_ptys_depend',`
define(`term_use_all_user_ptys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 devpts_t:dir r_dir_perms;
allow $1 ptynode:chr_file { getattr read write ioctl };
')
@ -465,7 +467,7 @@ define(`term_dontaudit_use_all_user_ptys_depend',`
define(`term_getattr_unallocated_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tty_device_t:chr_file getattr;
')
@ -489,7 +491,7 @@ define(`term_getattr_unallocated_ttys_depend',`
define(`term_setattr_unallocated_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tty_device_t:chr_file setattr;
')
@ -513,7 +515,7 @@ define(`term_setattr_unallocated_ttys_depend',`
define(`term_relabel_unallocated_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tty_device_t:chr_file { relabelfrom relabelto };
')
@ -537,7 +539,7 @@ define(`term_relabel_unallocated_ttys_depend',`
define(`term_reset_tty_labels',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 ttynode:chr_file relabelfrom;
allow $1 tty_device_t:chr_file relabelto;
')
@ -562,7 +564,7 @@ define(`term_reset_tty_labels_depend',`
define(`term_write_unallocated_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tty_device_t:chr_file { getattr write };
')
@ -585,7 +587,7 @@ define(`term_write_unallocated_ttys_depend',`
define(`term_use_unallocated_tty',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 tty_device_t:chr_file { getattr read write ioctl };
')
@ -632,7 +634,7 @@ define(`term_dontaudit_use_unallocated_tty_depend',`
define(`term_getattr_all_user_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 ttynode:chr_file getattr;
')
@ -657,6 +659,7 @@ define(`term_getattr_all_user_ttys_depend',`
define(`term_dontaudit_getattr_all_user_ttys',`
requires_block_template(`$0'_depend)
dev_list_all_dev_nodes($1)
dontaudit $1 ttynode:chr_file getattr;
')
@ -704,7 +707,7 @@ define(`term_setattr_all_user_ttys_depend',`
define(`term_relabel_all_user_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 ttynode:chr_file { relabelfrom relabelto };
')
@ -727,7 +730,7 @@ define(`term_relabel_all_user_ttys_depend',`
define(`term_write_all_user_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 ttynode:chr_file { getattr write };
')
@ -750,7 +753,7 @@ define(`term_write_all_user_ttys_depend',`
define(`term_use_all_user_ttys',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 ttynode:chr_file { getattr read write ioctl };
')

12
refpolicy/policy/modules/kernel/terminal.te
View File

@ -8,13 +8,13 @@ attribute server_ptynode;
#
# bsdpty_device_t is the type of /dev/[tp]ty[abcdepqrstuvwxyz][0-9a-f]
type bsdpty_device_t;
devices_make_device_node(bsdpty_device_t)
dev_node(bsdpty_device_t)
#
# console_device_t is the type of /dev/console.
#
type console_device_t;
devices_make_device_node(console_device_t)
dev_node(console_device_t)
#
# devpts_t is the type of the devpts file system and
@ -29,22 +29,22 @@ fs_use_trans devpts context_template(system_u:object_r:devpts_t,s0);
# devtty_t is the type of /dev/tty.
#
type devtty_t;
devices_make_device_node(devtty_t)
dev_node(devtty_t)
#
# ptmx_t is the type for /dev/ptmx.
#
type ptmx_t;
devices_make_device_node(ptmx_t)
dev_node(ptmx_t)
#
# tty_device_t is the type of /dev/*tty*
#
type tty_device_t;
devices_make_device_node(tty_device_t)
dev_node(tty_device_t)
#
# usbtty_device_t is the type of /dev/usr/tty*
#
type usbtty_device_t;
devices_make_device_node(usbtty_device_t)
dev_node(usbtty_device_t)

2
refpolicy/policy/modules/services/cron.if
View File

@ -68,7 +68,7 @@ define(`cron_per_userdomain_template',`
corenet_tcp_bind_all_nodes($1_crond_t)
corenet_udp_bind_all_nodes($1_crond_t)
devices_get_pseudorandom_data($1_crond_t)
dev_read_urand($1_crond_t)
fs_getattr_all_fs($1_crond_t)

8
refpolicy/policy/modules/services/cron.te
View File

@ -87,7 +87,7 @@ kernel_compute_create_context(crond_t)
kernel_compute_relabel_context(crond_t)
kernel_compute_reachable_user_contexts(crond_t)
devices_get_pseudorandom_data(crond_t)
dev_read_urand(crond_t)
fs_getattr_all_fs(crond_t)
@ -248,9 +248,9 @@ corenet_udp_sendrecv_all_ports(system_crond_t)
corenet_tcp_bind_all_nodes(system_crond_t)
corenet_udp_bind_all_nodes(system_crond_t)
devices_get_all_block_device_attributes(system_crond_t)
devices_get_all_character_device_attributes(system_crond_t)
devices_get_pseudorandom_data(system_crond_t)
dev_getattr_all_blk_files(system_crond_t)
dev_getattr_all_chr_files(system_crond_t)
dev_read_urand(system_crond_t)
fs_getattr_all_fs(system_crond_t)
fs_getattr_all_files(system_crond_t)

2
refpolicy/policy/modules/services/mta.te
View File

@ -60,7 +60,7 @@ corenet_raw_sendrecv_all_nodes(system_mail_t)
corenet_tcp_bind_all_nodes(system_mail_t)
corenet_tcp_sendrecv_all_ports(system_mail_t)
devices_get_pseudorandom_data(system_mail_t)
dev_read_urand(system_mail_t)
fs_getattr_xattr_fs(system_mail_t)

2
refpolicy/policy/modules/services/remotelogin.te
View File

@ -51,7 +51,7 @@ kernel_compute_relabel_context(remote_login_t)
kernel_compute_reachable_user_contexts(remote_login_t)
# for SSP/ProPolice
devices_get_pseudorandom_data(remote_login_t)
dev_read_urand(remote_login_t)
fs_getattr_xattr_fs(remote_login_t)

2
refpolicy/policy/modules/services/sendmail.te
View File

@ -54,7 +54,7 @@ corenet_tcp_bind_all_nodes(sendmail_t)
corenet_udp_bind_all_nodes(sendmail_t)
corenet_tcp_bind_smtp_port(sendmail_t)
devices_get_pseudorandom_data(sendmail_t)
dev_read_urand(sendmail_t)
fs_getattr_all_fs(sendmail_t)

2
refpolicy/policy/modules/system/clock.te
View File

@ -32,7 +32,7 @@ allow hwclock_t adjtime_t:file { setattr ioctl read getattr lock write append };
kernel_read_kernel_sysctl(hwclock_t)
kernel_read_hardware_state(hwclock_t)
devices_modify_realtime_clock(hwclock_t)
dev_rw_realtime_clock(hwclock_t)
fs_getattr_xattr_fs(hwclock_t)

4
refpolicy/policy/modules/system/domain.if
View File

@ -36,8 +36,8 @@ define(`domain_make_domain',`
domain_make_base_domain($1)
# Use trusted objects in /dev
devices_use_dev_null($1)
devices_use_dev_zero($1)
dev_rw_null_dev($1)
dev_rw_zero_dev($1)
term_use_controlling_term($1)
# read the root directory

2
refpolicy/policy/modules/system/hotplug.te
View File

@ -59,7 +59,7 @@ corenet_tcp_sendrecv_all_ports(hotplug_t)
corenet_tcp_bind_all_nodes(hotplug_t)
# for SSP
devices_get_pseudorandom_data(hotplug_t)
dev_read_urand(hotplug_t)
fs_getattr_all_fs(hotplug_t)

2
refpolicy/policy/modules/system/init.if
View File

@ -203,7 +203,7 @@ define(`init_get_control_channel_attributes_depend',`
define(`init_use_control_channel',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
allow $1 initctl_t:fifo_file rw_file_perms;
')

38
refpolicy/policy/modules/system/init.te
View File

@ -80,7 +80,7 @@ files_create_daemon_runtime_data(init_t,init_var_run_t)
allow init_t initctl_t:fifo_file { create getattr read append write setattr unlink };
fs_associate_tmpfs(initctl_t)
devices_create_dev_entry(init_t,initctl_t,fifo_file)
dev_create_dev_node(init_t,initctl_t,fifo_file)
# Modify utmp.
allow init_t initrc_var_run_t:file { rw_file_perms setattr };
@ -202,19 +202,19 @@ corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_bind_all_nodes(initrc_t)
corenet_udp_bind_all_nodes(initrc_t)
devices_get_random_data(initrc_t)
devices_get_pseudorandom_data(initrc_t)
devices_add_entropy(initrc_t)
devices_set_pseudorandom_seed(initrc_t)
devices_read_framebuffer(initrc_t)
devices_read_realtime_clock(initrc_t)
devices_read_sound_mixer_levels(initrc_t)
devices_write_sound_mixer_levels(initrc_t)
devices_set_all_character_device_attributes(initrc_t)
devices_read_lvm_control_channel(initrc_t)
devices_remove_lvm_control_channel(initrc_t)
dev_read_rand(initrc_t)
dev_read_urand(initrc_t)
dev_write_rand(initrc_t)
dev_write_urand(initrc_t)
dev_read_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t)
dev_read_snd_mixer_dev(initrc_t)
dev_write_snd_mixer_dev(initrc_t)
dev_setattr_all_chr_files(initrc_t)
dev_read_lvm_control(initrc_t)
dev_delete_lvm_control(initrc_t)
# Wants to remove udev.tbl:
devices_remove_dev_symbolic_links(initrc_t)
dev_del_generic_symlinks(initrc_t)
fs_register_binary_executable_type(initrc_t)
# cjp: not sure why these are here; should use mount policy
@ -317,10 +317,10 @@ ifdef(`distro_redhat',`
# These seem to be from the initrd
# during device initialization:
devices_add_dev_dir(initrc_t)
devices_legacy_use_dev_zero(initrc_t)
devices_legacy_raw_read_memory(initrc_t)
devices_legacy_raw_write_memory(initrc_t)
dev_create_dir(initrc_t)
dev_rwx_zero_dev(initrc_t)
dev_rx_raw_memory(initrc_t)
dev_wx_raw_memory(initrc_t)
storage_raw_read_fixed_disk(initrc_t)
storage_raw_write_fixed_disk(initrc_t)
@ -344,8 +344,8 @@ optional_policy(`hotplug.te',`
optional_policy(`lvm.te',`
#allow initrc_t lvm_control_t:chr_file unlink;
devices_read_lvm_control_channel(initrc_t)
devices_add_generic_character_device(initrc_t)
dev_read_lvm_control(initrc_t)
dev_create_generic_chr_file(initrc_t)
')
optional_policy(`rhgb.te',`

2
refpolicy/policy/modules/system/locallogin.te
View File

@ -61,7 +61,7 @@ kernel_compute_relabel_context(local_login_t)
kernel_compute_reachable_user_contexts(local_login_t)
# for SSP/ProPolice
devices_get_pseudorandom_data(local_login_t)
dev_read_urand(local_login_t)
term_use_all_user_ttys(local_login_t)
term_use_unallocated_tty(local_login_t)

4
refpolicy/policy/modules/system/logging.te
View File

@ -130,7 +130,7 @@ kernel_change_ring_buffer_level(klogd_t)
bootloader_read_kernel_symbol_table(klogd_t)
devices_raw_read_memory(klogd_t)
dev_read_raw_memory(klogd_t)
fs_getattr_all_fs(klogd_t)
@ -189,7 +189,7 @@ files_create_daemon_runtime_data(syslogd_t,syslogd_var_run_t)
kernel_read_hardware_state(syslogd_t)
kernel_read_kernel_sysctl(syslogd_t)
devices_create_dev_entry(syslogd_t,devlog_t,sock_file)
dev_create_dev_node(syslogd_t,devlog_t,sock_file)
term_dontaudit_use_console(syslogd_t)
# Allow syslog to a terminal

20
refpolicy/policy/modules/system/lvm.te
View File

@ -84,20 +84,20 @@ kernel_read_kernel_sysctl(lvm_t)
# it has no reason to need this
kernel_dontaudit_getattr_core(lvm_t)
devices_add_generic_character_device(lvm_t)
devices_get_random_data(lvm_t)
devices_get_pseudorandom_data(lvm_t)
devices_use_lvm_control_channel(lvm_t)
devices_manage_dev_symbolic_links(lvm_t)
dev_create_generic_chr_file(lvm_t)
dev_read_rand(lvm_t)
dev_read_urand(lvm_t)
dev_rw_lvm_control(lvm_t)
dev_manage_generic_symlinks(lvm_t)
devices_relabel_dev_dirs(lvm_t)
devices_manage_generic_block_device(lvm_t)
# LVM (vgscan) scans for devices by stating every file in /dev and applying a regex...
devices_ignore_get_all_character_device_attributes(lvm_t)
devices_ignore_get_all_block_device_attributes(lvm_t)
devices_ignore_get_generic_character_device_attributes(lvm_t)
devices_ignore_get_generic_block_device_attributes(lvm_t)
devices_ignore_get_generic_pipe_attributes(lvm_t)
dev_dontaudit_getattr_all_chr_files(lvm_t)
dev_dontaudit_getattr_all_blk_files(lvm_t)
dev_dontaudit_getattr_generic_chr_file(lvm_t)
dev_dontaudit_getattr_generic_blk_file(lvm_t)
dev_dontaudit_getattr_generic_pipe(lvm_t)
term_dontaudit_getattr_all_user_ttys(lvm_t)
fs_getattr_xattr_fs(lvm_t)

8
refpolicy/policy/modules/system/modutils.te
View File

@ -62,9 +62,9 @@ bootloader_read_kernel_modules(insmod_t)
# for locking: (cjp: ????)
bootloader_write_kernel_modules(insmod_t)
devices_write_mtrr(insmod_t)
devices_get_pseudorandom_data(insmod_t)
devices_direct_agp_access(insmod_t)
dev_write_mtrr(insmod_t)
dev_read_urand(insmod_t)
dev_rw_agp_dev(insmod_t)
fs_getattr_xattr_fs(insmod_t)
@ -189,7 +189,7 @@ files_create_private_tmp_data(update_modules_t, update_modules_tmp_t, { file dir
kernel_read_kernel_sysctl(update_modules_t)
kernel_read_system_state(update_modules_t)
devices_get_pseudorandom_data(update_modules_t)
dev_read_urand(update_modules_t)
fs_getattr_xattr_fs(update_modules_t)

4
refpolicy/policy/modules/system/mount.te
View File

@ -24,8 +24,8 @@ kernel_dontaudit_use_fd(mount_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(mount_t)
corenet_dontaudit_udp_bind_all_reserved_ports(mount_t)
devices_get_all_block_device_attributes(mount_t)
devices_list_device_nodes(mount_t)
dev_getattr_all_blk_files(mount_t)
dev_list_all_dev_nodes(mount_t)
storage_raw_read_fixed_disk(mount_t)
storage_raw_write_fixed_disk(mount_t)

10
refpolicy/policy/modules/system/selinux.te
View File

@ -203,7 +203,7 @@ kernel_compute_create_context(newrole_t)
kernel_compute_relabel_context(newrole_t)
kernel_compute_reachable_user_contexts(newrole_t)
devices_get_pseudorandom_data(newrole_t)
dev_read_urand(newrole_t)
fs_getattr_xattr_fs(newrole_t)
@ -312,7 +312,8 @@ optional_policy(`hotplug.te',`
# relabeling rules
kernel_relabel_unlabeled(restorecon_t)
devices_manage_all_devices_labels(restorecon_t)
dev_relabel_all_dev_nodes(restorecon_t)
files_relabel_all_files(restorecon_t)
files_read_all_directories(restorecon_t)
# this is to satisfy the assertion:
@ -362,7 +363,7 @@ ifdef(`targeted_policy',`',`
fs_getattr_xattr_fs(run_init_t)
devices_ignore_list_device_nodes(run_init_t)
dev_dontaudit_list_all_nodes(run_init_t)
term_dontaudit_list_ptys(run_init_t)
@ -448,7 +449,8 @@ userdomain_read_all_users_data(setfiles_t)
# relabeling rules
kernel_relabel_unlabeled(setfiles_t)
devices_manage_all_devices_labels(setfiles_t)
dev_relabel_all_dev_nodes(setfiles_t)
files_read_all_directories(setfiles_t)
files_relabel_all_files(setfiles_t)
# this is to satisfy the assertion:

10
refpolicy/policy/modules/system/selinuxutil.te
View File

@ -203,7 +203,7 @@ kernel_compute_create_context(newrole_t)
kernel_compute_relabel_context(newrole_t)
kernel_compute_reachable_user_contexts(newrole_t)
devices_get_pseudorandom_data(newrole_t)
dev_read_urand(newrole_t)
fs_getattr_xattr_fs(newrole_t)
@ -312,7 +312,8 @@ optional_policy(`hotplug.te',`
# relabeling rules
kernel_relabel_unlabeled(restorecon_t)
devices_manage_all_devices_labels(restorecon_t)
dev_relabel_all_dev_nodes(restorecon_t)
files_relabel_all_files(restorecon_t)
files_read_all_directories(restorecon_t)
# this is to satisfy the assertion:
@ -362,7 +363,7 @@ ifdef(`targeted_policy',`',`
fs_getattr_xattr_fs(run_init_t)
devices_ignore_list_device_nodes(run_init_t)
dev_dontaudit_list_all_nodes(run_init_t)
term_dontaudit_list_ptys(run_init_t)
@ -448,7 +449,8 @@ userdomain_read_all_users_data(setfiles_t)
# relabeling rules
kernel_relabel_unlabeled(setfiles_t)
devices_manage_all_devices_labels(setfiles_t)
dev_relabel_all_dev_nodes(setfiles_t)
files_read_all_directories(setfiles_t)
files_relabel_all_files(setfiles_t)
# this is to satisfy the assertion:

2
refpolicy/policy/modules/system/sysnetwork.te
View File

@ -102,7 +102,7 @@ corenet_udp_bind_all_nodes(dhcpc_t)
corenet_udp_bind_dhcpc_port(dhcpc_t)
# for SSP
devices_get_pseudorandom_data(dhcpc_t)
dev_read_urand(dhcpc_t)
fs_getattr_all_fs(dhcpc_t)

4
refpolicy/policy/modules/system/udev.te
View File

@ -58,7 +58,7 @@ allow udev_t udev_etc_t:file r_file_perms;
# create udev database in /dev/.udevdb
allow udev_t udev_tbl_t:file create_file_perms;
devices_create_dev_entry(udev_t,udev_tbl_t,file)
dev_create_dev_node(udev_t,udev_tbl_t,file)
allow udev_t udev_var_run_t:dir rw_dir_perms;
allow udev_t udev_var_run_t:file create_file_perms;
@ -78,7 +78,7 @@ kernel_compute_create_context(udev_t)
kernel_compute_relabel_context(udev_t)
kernel_compute_reachable_user_contexts(udev_t)
devices_manage_device_nodes(udev_t)
dev_manage_dev_nodes(udev_t)
fs_getattr_all_fs(udev_t)

34
refpolicy/policy/modules/system/userdomain.if
View File

@ -123,18 +123,18 @@ define(`base_user_domain',`
# allow port_t name binding for UDP because it is not very usable otherwise
corenet_udp_bind_generic_port($1_t)
devices_get_input_event($1_t)
devices_read_misc($1_t)
devices_write_misc($1_t)
devices_play_sound($1_t)
devices_record_sound_input($1_t)
devices_read_sound_mixer_levels($1_t)
devices_write_sound_mixer_levels($1_t)
devices_get_random_data($1_t)
devices_get_pseudorandom_data($1_t)
dev_read_input($1_t)
dev_read_misc($1_t)
dev_write_misc($1_t)
dev_write_snd_dev($1_t)
dev_read_snd_dev($1_t)
dev_read_snd_mixer_dev($1_t)
dev_write_snd_mixer_dev($1_t)
dev_read_rand($1_t)
dev_read_urand($1_t)
# open office is looking for the following
devices_get_direct_rendering_interface_attributes($1_t)
devices_ignore_use_direct_rendering_interface($1_t)
dev_getattr_agp_dev($1_t)
dev_dontaudit_rw_dri_dev($1_t)
fs_get_all_fs_quotas($1_t)
fs_getattr_all_fs($1_t)
@ -198,7 +198,7 @@ define(`base_user_domain',`
}
if (user_direct_mouse) {
devices_get_mouse_input($1_t)
dev_read_mouse($1_t)
}
if (user_ttyfile_stat) {
@ -681,10 +681,10 @@ define(`admin_domain_template',`
corenet_tcp_bind_generic_port($1_t)
devices_get_generic_block_device_attributes($1_t)
devices_get_generic_character_device_attributes($1_t)
devices_get_all_block_device_attributes($1_t)
devices_get_all_character_device_attributes($1_t)
dev_getattr_generic_blk_file($1_t)
dev_getattr_generic_chr_file($1_t)
dev_getattr_all_blk_files($1_t)
dev_getattr_all_chr_files($1_t)
fs_getattr_all_fs($1_t)
fs_set_all_quotas($1_t)
@ -861,7 +861,7 @@ define(`userdomain_sysadm_shell_transition_depend',`
define(`userdomain_use_admin_terminals',`
requires_block_template(`$0'_depend)
devices_list_device_nodes($1)
dev_list_all_dev_nodes($1)
term_list_ptys($1)
allow $1 admin_terminal:chr_file { getattr read write ioctl };
')