Layer: kernel

Module: kernel

Description:

Policy for kernel threads, proc filesystem,and unlabeled processes and objects.

This module is required to be included in all policies.

Interfaces:

kernel_change_ring_buffer_level(
	
		domain
		
	)

Summary

Change the level of kernel messages logged to the console.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_clear_ring_buffer(
	
		domain
		
	)

Summary

Allows the caller to clear the ring buffer.

Parameters

Parameter:	Description:	Optional:
domain	The process type clearing the buffer.	No

kernel_dontaudit_getattr_core(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of core kernel interfaces.

Parameters

Parameter:	Description:	Optional:
domain	The process type to not audit.	No

kernel_dontaudit_getattr_message_if(
	
		domain
		
	)

Summary

Do not audit attempts by caller to get the attributes of kernel message interfaces.

Parameters

Parameter:	Description:	Optional:
domain	The process type not to audit.	No

kernel_dontaudit_getattr_unlabeled_blk_dev(
	
		domain
		
	)

Summary

Do not audit attempts by caller to get attributes for unlabeled block devices.

Parameters

Parameter:	Description:	Optional:
domain	The process type not to audit.	No

kernel_dontaudit_read_ring_buffer(
	
		domain
		
	)

Summary

Do not audit attempts to read the ring buffer.

Parameters

Parameter:	Description:	Optional:
domain	The domain to not audit.	No

kernel_dontaudit_read_system_state(
	
		domain
		
	)

Summary

Do not audit attempts by caller to read system state information in proc.

Parameters

Parameter:	Description:	Optional:
domain	The process type not to audit.	No

kernel_dontaudit_search_network_state(
	
		domain
		
	)

Summary

Do not audit attempts to search the network state directory.

Parameters

Parameter:	Description:	Optional:
domain	The process type reading the state.	No

kernel_dontaudit_search_network_sysctl_dir(
	
		domain
		
	)

Summary

Do not audit attempts by caller to search sysctl network directories.

Parameters

Parameter:	Description:	Optional:
domain	The process type not to audit.	No

kernel_dontaudit_search_sysctl_dir(
	
		domain
		
	)

Summary

Do not audit attempts by caller to search the sysctl directory.

Parameters

Parameter:	Description:	Optional:
domain	The process type not to audit.	No

kernel_dontaudit_use_fd(
	
		domain
		
	)

Summary

Do not audit attempts to use kernel file descriptors.

Parameters

Parameter:	Description:	Optional:
domain	The type of process not to audit.	No

kernel_dontaudit_write_kernel_sysctl(
	
		domain
		
	)

Summary

Do not audit attempts to write generic kernel sysctls.

Parameters

Parameter:	Description:	Optional:
domain	Domain to not audit.	No

kernel_get_sysvipc_info(
	
		domain
		
	)

Summary

Get information on all System V IPC objects.

Parameters

Parameter:	Description:	Optional:
domain		No

kernel_getattr_core(
	
		domain
		
	)

Summary

Allows caller to get attribues of core kernel interface.

Parameters

Parameter:	Description:	Optional:
domain	The process type getting the attibutes.	No

kernel_getattr_debugfs(
	
		domain
		
	)

Summary

Get the attributes of a kernel debugging filesystem.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_getattr_message_if(
	
		domain
		
	)

Summary

Allow caller to get the attributes of kernel message interface (/proc/kmsg).

Parameters

Parameter:	Description:	Optional:
domain	The process type getting the attributes.	No

kernel_getattr_proc(
	
		domain
		
	)

Summary

Get the attributes of the proc filesystem.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_kill_unlabeled(
	
		domain
		
	)

Summary

Send a kill signal to unlabeled processes.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_list_from(
	
		dir_type
		
	)

Summary

Allow the kernel to read the contents of the specified directory.

Parameters

Parameter:	Description:	Optional:
dir_type	Directory type to list.	No

kernel_list_proc(
	
		domain
		
	)

Summary

List the contents of directories in /proc.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_list_unlabeled(
	
		domain
		
	)

Summary

List unlabeled directories.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_load_module(
	
		domain
		
	)

Summary

Allows caller to load kernel modules

Parameters

Parameter:	Description:	Optional:
domain	The process type to allow to load kernel modules.	No

kernel_mount_debugfs(
	
		domain
		
	)

Summary

Mount a kernel debugging filesystem.

Parameters

Parameter:	Description:	Optional:
domain	The type of the domain mounting the filesystem.	No

kernel_read_all_sysctl(
	
		domain
		
	)

Summary

Allow caller to read all sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_device_sysctl(
	
		domain
		
	)

Summary

Allow caller to read the device sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The process type to allow to read the device sysctls.	No

kernel_read_file_from(
	
		dir_type
		
	)

Summary

Allow the kernel to read the specified file.

Parameters

Parameter:	Description:	Optional:
dir_type	Directory type to list.	No

kernel_read_fs_sysctl(
	
		domain
		
	)

Summary

Read filesystem sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_hotplug_sysctl(
	
		domain
		
	)

Summary

Read the hotplug sysctl.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_irq_sysctl(
	
		domain
		
	)

Summary

Read IRQ sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_kernel_sysctl(
	
		domain
		
	)

Summary

Read generic kernel sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_messages(
	
		domain
		
	)

Summary

Allow caller to read kernel messages using the /proc/kmsg interface.

Parameters

Parameter:	Description:	Optional:
domain	The process type reading the messages.	No

kernel_read_modprobe_sysctl(
	
		domain
		
	)

Summary

Read the modprobe sysctl.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_net_sysctl(
	
		domain
		
	)

Summary

Allow caller to read network sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_network_state(
	
		domain
		
	)

Summary

Allow caller to read the network state information.

Parameters

Parameter:	Description:	Optional:
domain	The process type reading the state.	No

kernel_read_proc_symlinks(
	
		domain
		
	)

Summary

Read symbolic links in /proc.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_read_ring_buffer(
	
		domain
		
	)

Summary

Allows caller to read the ring buffer.

Parameters

Parameter:	Description:	Optional:
domain	The process type allowed to read the ring buffer.	No

kernel_read_rpc_sysctl(
	
		?
		
	)

Summary

Summary is missing!

Parameters

Parameter:	Description:	Optional:
?	Parameter descriptions are missing!	No

kernel_read_software_raid_state(
	
		domain
		
	)

Summary

Allow caller to read the state information for software raid.

Parameters

Parameter:	Description:	Optional:
domain	The process type reading software raid state.	No

kernel_read_system_state(
	
		domain
		
	)

Summary

Allows caller to read system state information in proc.

Parameters

Parameter:	Description:	Optional:
domain	The process type reading the system state information.	No

kernel_read_unix_sysctl(
	
		domain
		
	)

Summary

Allow caller to read unix domain socket sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_read_vm_sysctl(
	
		domain
		
	)

Summary

Allow caller to read virtual memory sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_relabel_unlabeled(
	
		domain
		
	)

Summary

Allow caller to relabel unlabeled objects.

Parameters

Parameter:	Description:	Optional:
domain	The process type relabeling the objects.	No

kernel_remount_debugfs(
	
		domain
		
	)

Summary

Remount a kernel debugging filesystem.

Parameters

Parameter:	Description:	Optional:
domain	The type of the domain remounting the filesystem.	No

kernel_rootfs_mountpoint(
	
		directory_type
		
	)

Summary

Allows the kernel to mount filesystems on the specified directory type.

Parameters

Parameter:	Description:	Optional:
directory_type	The type of the directory to use as a mountpoint.	No

kernel_rw_all_sysctl(
	
		domain
		
	)

Summary

Read and write all sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_device_sysctl(
	
		domain
		
	)

Summary

Read and write device sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_fs_sysctl(
	
		domain
		
	)

Summary

Read and write fileystem sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_hotplug_sysctl(
	
		domain
		
	)

Summary

Read and write the hotplug sysctl.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_irq_sysctl(
	
		domain
		
	)

Summary

Read and write IRQ sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_kernel_sysctl(
	
		domain
		
	)

Summary

Read and write generic kernel sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_modprobe_sysctl(
	
		domain
		
	)

Summary

Read and write the modprobe sysctl.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_net_sysctl(
	
		domain
		
	)

Summary

Allow caller to modiry contents of sysctl network files.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_pipe(
	
		domain
		
	)

Summary

Read and write kernel unnamed pipes.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_rw_rpc_sysctl(
	
		?
		
	)

Summary

Summary is missing!

Parameters

Parameter:	Description:	Optional:
?	Parameter descriptions are missing!	No

kernel_rw_software_raid_state(
	
		domain
		
	)

Summary

Allow caller to read and set the state information for software raid.

Parameters

Parameter:	Description:	Optional:
domain	The process type reading software raid state.	No

kernel_rw_unix_dgram_socket(
	
		domain
		
	)

Summary

Read and write kernel unix datagram sockets.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_rw_unix_sysctl(
	
		domain
		
	)

Summary

Read and write unix domain socket sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_rw_unlabeled_dir(
	
		domain
		
	)

Summary

Read and write unlabeled directories.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_rw_vm_sysctl(
	
		domain
		
	)

Summary

Read and write virtual memory sysctls.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_search_debugfs(
	
		domain
		
	)

Summary

Search the contents of a kernel debugging filesystem.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_search_from(
	
		dir_type
		
	)

Summary

Allow the kernel to search the specified directory.

Parameters

Parameter:	Description:	Optional:
dir_type	Directory type to search.	No

kernel_search_from(
	
		dir_type
		
	)

Summary

Allow the kernel to search the specified directory.

Parameters

Parameter:	Description:	Optional:
dir_type	Directory type to search.	No

kernel_search_proc(
	
		domain
		
	)

Summary

Search directories in /proc.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_send_syslog_msg_from(
	
		socket
		
			,
		
		syslog_type
		
	)

Summary

Allow the kernel to send a syslog message to the specified domain, connecting over the specified named socket.

Parameters

Parameter:	Description:	Optional:
socket	The type of the named socket file.	No
syslog_type	The domain of the syslog daemon.	No

kernel_sendto_unix_dgram_socket(
	
		domain
		
	)

Summary

Send messages to kernel unix datagram sockets.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_setpgid(
	
		domain
		
	)

Summary

Set the process group of kernel threads.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_share_state(
	
		domain
		
	)

Summary

Allows the kernel to share state information with the caller.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process with which to share state information.	No

kernel_sigchld(
	
		domain
		
	)

Summary

Send a SIGCHLD signal to kernel threads.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process sending the signal.	No

kernel_sigchld_from(
	
		domain
		
	)

Summary

Allow the kernel to send a SIGCHLD signal to the specified domain.

Parameters

Parameter:	Description:	Optional:
domain	Domain receiving the SIGCHLD.	No

kernel_sigchld_from_unlabeled(
	
		domain
		
	)

Summary

Allow unlabeled processes to send a SIGCHLD signal to the specified domain.

Parameters

Parameter:	Description:	Optional:
domain	Domain receiving the SIGCHLD.	No

kernel_sigchld_unlabeled(
	
		domain
		
	)

Summary

Send a child terminated signal to unlabeled processes.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_signal(
	
		domain
		
	)

Summary

Send a generic signal to kernel threads.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process sending the signal.	No

kernel_signal_unlabeled(
	
		domain
		
	)

Summary

Send general signals to unlabeled processes.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_signull_unlabeled(
	
		domain
		
	)

Summary

Send a null signal to unlabeled processes.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_sigstop_unlabeled(
	
		domain
		
	)

Summary

Send a stop signal to unlabeled processes.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process performing this action.	No

kernel_tcp_recvfrom(
	
		domain
		
	)

Summary

Receive messages from kernel TCP sockets.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_udp_recvfrom(
	
		domain
		
	)

Summary

Receive messages from kernel UDP sockets.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_udp_sendfrom(
	
		domain
		
	)

Summary

Allow the kernel to send UDP network traffic the specified domain.

Parameters

Parameter:	Description:	Optional:
domain	The type of the receiving domain.	No

kernel_unconfined(
	
		domain
		
	)

Summary

Unconfined access to the kernel.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_unmount_debugfs(
	
		domain
		
	)

Summary

Unmount a kernel debugging filesystem.

Parameters

Parameter:	Description:	Optional:
domain	The type of the domain unmounting the filesystem.	No

kernel_use_fd(
	
		domain
		
	)

Summary

Permits caller to use kernel file descriptors.

Parameters

Parameter:	Description:	Optional:
domain	The type of the process using the descriptors.	No

kernel_use_ld_so_from(
	
		lib_type
		
			,
		
		ld_type
		
			,
		
		cache_type
		
	)

Summary

Use the specified types for /lib directory and use the dynamic link/loader for automatic loading of shared libraries, and the link/loader cache.

Parameters

Parameter:	Description:	Optional:
lib_type	The type of the lib directories.	No
ld_type	The type of the dynamic link/loader.	No
cache_type	The type of the dynamic link/loader cache.	No

kernel_use_shared_libs_from(
	
		lib_dir_type
		
			,
		
		shlib_type
		
	)

Summary

Allow the kernel to load and execute functions from the specified shared libraries.

Parameters

Parameter:	Description:	Optional:
lib_dir_type	The type of the lib directories.	No
shlib_type	Shared library type.	No

kernel_use_unlabeled_blk_dev(
	
		domain
		
	)

Summary

Read and write unlabeled block device nodes.

Parameters

Parameter:	Description:	Optional:
domain	Domain allowed access.	No

kernel_userland_entry(
	
		domain
		
			,
		
		entrypoint
		
	)

Summary

Allows to start userland processes by transitioning to the specified domain.

Parameters

Parameter:	Description:	Optional:
domain	The process type entered by kernel.	No
entrypoint	The executable type for the entrypoint.	No

Return