## device locking policy for lockdev ####################################### ## ## The per role template for the lockdev module. ## ## ##

## This template creates derived domains which are used ## for lockdev. A derived type is also created to protect ## the user's device locks. ##

##

## This template is invoked automatically for each user, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## ## ## ## The role associated with the user domain. ## ## # template(`lockdev_per_role_template',` gen_require(` type lockdev_exec_t; ') ######################################## # # Declarations # type $1_lockdev_t; application_domain($1_lockdev_t,lockdev_exec_t) role $3 types $1_lockdev_t; type $1_lockdev_lock_t; files_lock_file($1_lockdev_lock_t) ######################################## # # Local policy # # Use capabilities. allow $1_lockdev_t self:capability setgid; allow $1_lockdev_t $2:process signull; # Transition from the user domain to the derived domain. domtrans_pattern($2, lockdev_exec_t, $1_lockdev_t) allow $1_lockdev_t $1_lockdev_lock_t:file manage_file_perms; files_lock_filetrans($1_lockdev_t,$1_lockdev_lock_t,file) files_read_all_locks($1_lockdev_t) fs_getattr_xattr_fs($1_lockdev_t) libs_use_ld_so($1_lockdev_t) libs_use_shared_libs($1_lockdev_t) logging_send_syslog_msg($1_lockdev_t) userdom_use_user_terminals($1, $1_lockdev_t) optional_policy(` logging_send_syslog_msg($1_t) ') ')