move security_t to selinux module

refpolicy/policy/modules/kernel/kernel.if

@@ -1,7 +1,7 @@
 ## <module name="kernel" layer="kernel">
 ## <summary>
-##	Policy for kernel threads, security interface (selinuxfs),
+##	Policy for kernel threads, proc filesystem, 
-##	proc filesystem, sysfs filesystem, and usb device filesystem.
+##	and unlabeled processes and objects.
 ## </summary>
 
 ########################################
@@ -152,290 +152,6 @@ define(`kernel_load_module_depend',`
 	class capability sys_module;
 ')
 
-########################################
-## <interface name="kernel_get_selinux_enforcement_mode">
-##	<description>
-## 		Allows the caller to get the mode of policy enforcement
-## 		(enforcing or permissive mode).
-##	</description>
-##	<parameter name="domain">
-##		The process type to allow to get the enforcing mode.
-##	</parameter>
-## </interface>
-#
-define(`kernel_get_selinux_enforcement_mode',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read };
-')
-
-define(`kernel_get_selinux_enforcement_mode_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read };
-')
-
-########################################
-## <interface name="kernel_set_enforcement_mode">
-##	<description>
-## 		Allow caller to set the mode of policy enforcement
-## 		(enforcing or permissive mode).
-##	</description>
-##	<parameter name="domain">
-##		The process type to allow to set the enforcement mode.
-##	</parameter>
-## </interface>
-#
-define(`kernel_set_enforcement_mode',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security setenforce;
-	auditallow $1 security_t:security setenforce;
-	typeattribute $1 can_setenforce;
-')
-
-define(`kernel_set_enforcement_mode_depend',`
-	type security_t;
-
-	attribute can_setenforce;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security setenforce;
-')
-
-########################################
-## <interface name="kernel_load_policy">
-##	<description>
-## 		Allow caller to load the policy into the kernel.
-##	</description>
-##	<parameter name="domain">
-##		The process type that will load the policy.
-##	</parameter>
-## </interface>
-#
-define(`kernel_load_policy',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security load_policy;
-	auditallow $1 security_t:security load_policy;
-	typeattribute $1 can_load_policy;
-')
-
-define(`kernel_load_policy_depend',`
-	type security_t;
-
-	attribute can_load_policy;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security load_policy;
-')
-
-########################################
-## <interface name="kernel_set_boolean">
-##	<description>
-## 		Allow caller to set the state of Booleans to
-## 		enable or disable conditional portions of the policy.
-##	</description>
-##	<parameter name="domain">
-##		The process type allowed to set the Boolean.
-##	</parameter>
-##	<parameter name="booltype" optional="true">
-##		The type of Booleans the caller is allowed to set.
-##	</parameter>
-## </interface>
-#
-define(`kernel_set_boolean',`
-	gen_require(`$0'_depend)
-
-	ifelse(`$2',`',`
-		allow $1 security_t:dir { getattr search read };
-		allow $1 security_t:file { getattr read write };
-	',`
-		allow $1 $2:dir { getattr search read };
-		allow $1 $2:file { getattr read write };
-	')
-
-	allow $1 security_t:dir search;
-	allow $1 security_t:security setbool;
-	auditallow $1 security_t:security setbool;
-')
-
-define(`kernel_set_boolean_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security setbool;
-')
-
-########################################
-## <interface name="kernel_set_security_parameters">
-##	<description>
-## 		Allow caller to set selinux security parameters.
-##	</description>
-##	<parameter name="domain">
-##		The process type to allow to set security parameters.
-##	</parameter>
-## </interface>
-#
-define(`kernel_set_security_parameters',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security setsecparam;
-	auditallow $1 security_t:security setsecparam;
-	typeattribute $1 can_setsecparam;
-')
-
-define(`kernel_set_security_parameters_depend',`
-	type security_t;
-
-	attribute can_setsecparam;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security setsecparam;
-')
-
-########################################
-## <interface name="kernel_validate_context">
-##	<description>
-## 		Allows caller to validate security contexts.
-##	</description>
-##	<parameter name="domain">
-##		The process type permitted to validate contexts.
-##	</parameter>
-## </interface>
-#
-define(`kernel_validate_context',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security check_context;
-')
-
-define(`kernel_validate_context_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security check_context;
-')
-
-########################################
-## <interface name="kernel_compute_access_vector">
-##	<description>
-## 		Allows caller to compute an access vector.
-##	</description>
-##	<parameter name="domain">
-##		The process type allowed to compute an access vector.
-##	</parameter>
-## </interface>
-#
-define(`kernel_compute_access_vector',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security compute_av;
-')
-
-define(`kernel_compute_access_vector_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security compute_av;
-')
-
-########################################
-## <interface name="kernel_compute_create_context">
-##	<description>
-## 		
-##	</description>
-##	<parameter name="domain">
-##		
-##	</parameter>
-## </interface>
-#
-define(`kernel_compute_create_context',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security compute_create;
-')
-
-define(`kernel_compute_create_context_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security compute_create;
-')
-
-########################################
-## <interface name="kernel_compute_relabel_context">
-##	<description>
-## 		
-##	</description>
-##	<parameter name="domain">
-##		The process type to 
-##	</parameter>
-## </interface>
-#
-define(`kernel_compute_relabel_context',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security compute_relabel;
-')
-
-define(`kernel_compute_relabel_context_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security compute_relabel;
-')
-
-########################################
-## <interface name="kernel_compute_reachable_user_contexts">
-##	<description>
-## 		Allows caller to compute possible contexts for a user.
-##	</description>
-##	<parameter name="domain">
-##		The process type allowed to compute user contexts.
-##	</parameter>
-## </interface>
-#
-define(`kernel_compute_reachable_user_contexts',`
-	gen_require(`$0'_depend)
-
-	allow $1 security_t:dir { read search getattr };
-	allow $1 security_t:file { getattr read write };
-	allow $1 security_t:security compute_user;
-')
-
-define(`kernel_compute_reachable_user_contexts_depend',`
-	type security_t;
-
-	class dir { read search getattr };
-	class file { getattr read write };
-	class security compute_user;
-')
-
 ########################################
 ## <interface name="kernel_read_ring_buffer">
 ##	<description>
@@ -546,33 +262,6 @@ define(`kernel_get_sysvipc_info_depend',`
 	class system ipc_info;
 ')
 
-########################################
-## <interface name="kernel_get_selinuxfs_mount_point">
-##	<description>
-## 		Gets the caller the mountpoint of the selinuxfs filesystem.
-##	</description>
-##	<parameter name="domain">
-##		The process type requesting the selinuxfs mountpoint.
-##	</parameter>
-## </interface>
-#
-define(`kernel_get_selinuxfs_mount_point',`
-	gen_require(`$0'_depend)
-
-	allow $1 proc_t:dir search;
-	allow $1 proc_t:{ file lnk_file } read;
-	allow $1 self:dir search;
-	allow $1 self:file { getattr read };
-')
-
-define(`kernel_get_selinuxfs_mount_point_depend',`
-	type proc_t;
-
-	class dir search;
-	class lnk_file read;
-	class file { getattr read };
-')
-
 ########################################
 ## <interface name="kernel_read_system_state">
 ##	<description>

refpolicy/policy/modules/kernel/kernel.te

@@ -1,6 +1,11 @@
 
 policy_module(kernel,1.0)
 
+########################################
+#
+# Declarations
+#
+
 # assertion related attributes
 attribute can_load_policy;
 attribute can_setenforce;
@@ -44,16 +49,6 @@ sid sysctl_vm		context_template(system_u:object_r:unlabeled_t,s0)
 sid sysctl_dev		context_template(system_u:object_r:unlabeled_t,s0)
 sid tcp_socket		context_template(system_u:object_r:unlabeled_t,s0)
 
-# 
-# security_t is the target type when checking
-# the permissions in the security class.  It is also
-# applied to selinuxfs inodes.
-#
-type security_t;
-fs_make_fs(security_t)
-sid security context_template(system_u:object_r:security_t,s0)
-genfscon selinuxfs / context_template(system_u:object_r:security_t,s0)
-
 #
 # Procfs types
 #
@@ -202,8 +197,8 @@ libs_use_shared_libs(kernel_t)
 
 logging_send_syslog_msg(kernel_t)
 
-selinux_read_config(kernel_t)
+seutil_read_config(kernel_t)
-selinux_read_binary_pol(kernel_t)
+seutil_read_binary_pol(kernel_t)
 
 neverallow ~can_load_policy security_t:security load_policy;
 neverallow ~can_setenforce security_t:security setenforce;

refpolicy/policy/modules/kernel/selinux.if

@@ -0,0 +1,306 @@
+## <module name="selinux" layer="kernel">
+## <summary>
+##	Policy for kernel security interface, in particular, selinuxfs.
+## </summary>
+
+########################################
+## <interface name="selinux_get_fs_mount">
+##	<description>
+## 		Gets the caller the mountpoint of the selinuxfs filesystem.
+##	</description>
+##	<parameter name="domain">
+##		The process type requesting the selinuxfs mountpoint.
+##	</parameter>
+## </interface>
+#
+define(`selinux_get_fs_mount',`
+	# read /proc/filesystems to see if selinuxfs is supported
+	# then read /proc/self/mount to see where selinuxfs is mounted
+	kernel_read_system_state($1)
+')
+
+########################################
+## <interface name="selinux_get_enforce_mode">
+##	<description>
+## 		Allows the caller to get the mode of policy enforcement
+## 		(enforcing or permissive mode).
+##	</description>
+##	<parameter name="domain">
+##		The process type to allow to get the enforcing mode.
+##	</parameter>
+## </interface>
+#
+define(`selinux_get_enforce_mode',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read };
+')
+
+define(`selinux_get_enforce_mode_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read };
+')
+
+########################################
+## <interface name="selinux_set_enforce_mode">
+##	<description>
+## 		Allow caller to set the mode of policy enforcement
+## 		(enforcing or permissive mode).
+##	</description>
+##	<parameter name="domain">
+##		The process type to allow to set the enforcement mode.
+##	</parameter>
+## </interface>
+#
+define(`selinux_set_enforce_mode',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security setenforce;
+	auditallow $1 security_t:security setenforce;
+	typeattribute $1 can_setenforce;
+')
+
+define(`selinux_set_enforce_mode_depend',`
+	type security_t;
+
+	attribute can_setenforce;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security setenforce;
+')
+
+########################################
+## <interface name="selinux_load_policy">
+##	<description>
+## 		Allow caller to load the policy into the kernel.
+##	</description>
+##	<parameter name="domain">
+##		The process type that will load the policy.
+##	</parameter>
+## </interface>
+#
+define(`selinux_load_policy',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security load_policy;
+	auditallow $1 security_t:security load_policy;
+	typeattribute $1 can_load_policy;
+')
+
+define(`selinux_load_policy_depend',`
+	type security_t;
+
+	attribute can_load_policy;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security load_policy;
+')
+
+########################################
+## <interface name="selinux_set_boolean">
+##	<description>
+## 		Allow caller to set the state of Booleans to
+## 		enable or disable conditional portions of the policy.
+##	</description>
+##	<parameter name="domain">
+##		The process type allowed to set the Boolean.
+##	</parameter>
+##	<parameter name="booltype" optional="true">
+##		The type of Booleans the caller is allowed to set.
+##	</parameter>
+## </interface>
+#
+define(`selinux_set_boolean',`
+	gen_require(`$0'_depend)
+
+	ifelse(`$2',`',`
+		allow $1 security_t:dir { getattr search read };
+		allow $1 security_t:file { getattr read write };
+	',`
+		allow $1 $2:dir { getattr search read };
+		allow $1 $2:file { getattr read write };
+	')
+
+	allow $1 security_t:dir search;
+	allow $1 security_t:security setbool;
+	auditallow $1 security_t:security setbool;
+')
+
+define(`selinux_set_boolean_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security setbool;
+')
+
+########################################
+## <interface name="selinux_set_parameters">
+##	<description>
+## 		Allow caller to set selinux security parameters.
+##	</description>
+##	<parameter name="domain">
+##		The process type to allow to set security parameters.
+##	</parameter>
+## </interface>
+#
+define(`selinux_set_parameters',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security setsecparam;
+	auditallow $1 security_t:security setsecparam;
+	typeattribute $1 can_setsecparam;
+')
+
+define(`selinux_set_parameters_depend',`
+	type security_t;
+
+	attribute can_setsecparam;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security setsecparam;
+')
+
+########################################
+## <interface name="selinux_validate_context">
+##	<description>
+## 		Allows caller to validate security contexts.
+##	</description>
+##	<parameter name="domain">
+##		The process type permitted to validate contexts.
+##	</parameter>
+## </interface>
+#
+define(`selinux_validate_context',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security check_context;
+')
+
+define(`selinux_validate_context_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security check_context;
+')
+
+########################################
+## <interface name="selinux_compute_access_vector">
+##	<description>
+## 		Allows caller to compute an access vector.
+##	</description>
+##	<parameter name="domain">
+##		The process type allowed to compute an access vector.
+##	</parameter>
+## </interface>
+#
+define(`selinux_compute_access_vector',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security compute_av;
+')
+
+define(`selinux_compute_access_vector_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security compute_av;
+')
+
+########################################
+## <interface name="selinux_compute_create_context">
+##	<description>
+## 		
+##	</description>
+##	<parameter name="domain">
+##		
+##	</parameter>
+## </interface>
+#
+define(`selinux_compute_create_context',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security compute_create;
+')
+
+define(`selinux_compute_create_context_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security compute_create;
+')
+
+########################################
+## <interface name="selinux_compute_relabel_context">
+##	<description>
+## 		
+##	</description>
+##	<parameter name="domain">
+##		The process type to 
+##	</parameter>
+## </interface>
+#
+define(`selinux_compute_relabel_context',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security compute_relabel;
+')
+
+define(`selinux_compute_relabel_context_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security compute_relabel;
+')
+
+########################################
+## <interface name="selinux_compute_user_contexts">
+##	<description>
+## 		Allows caller to compute possible contexts for a user.
+##	</description>
+##	<parameter name="domain">
+##		The process type allowed to compute user contexts.
+##	</parameter>
+## </interface>
+#
+define(`selinux_compute_user_contexts',`
+	gen_require(`$0'_depend)
+
+	allow $1 security_t:dir { read search getattr };
+	allow $1 security_t:file { getattr read write };
+	allow $1 security_t:security compute_user;
+')
+
+define(`selinux_compute_user_contexts_depend',`
+	type security_t;
+
+	class dir { read search getattr };
+	class file { getattr read write };
+	class security compute_user;
+')
+
+## </module>

refpolicy/policy/modules/kernel/selinux.te

@@ -0,0 +1,17 @@
+
+policy_module(selinux,1.0)
+
+########################################
+#
+# Declarations
+#
+
+# 
+# security_t is the target type when checking
+# the permissions in the security class.  It is also
+# applied to selinuxfs inodes.
+#
+type security_t;
+fs_make_fs(security_t)
+sid security context_template(system_u:object_r:security_t,s0)
+genfscon selinuxfs / context_template(system_u:object_r:security_t,s0)