## ## ## Basic filesystem types and interfaces. ## ## ##

## This module contains basic filesystem types and interfaces. This ## includes: ##

##

##
######################################## # # files_file_type(type) # define(`files_file_type',` requires_block_template(`$0'_depend) fs_associate($1) fs_associate_noxattr($1) typeattribute $1 file_type; ') define(`files_file_type_depend',` attribute file_type; ') ######################################## # # files_lock_file(type) # define(`files_lock_file',` requires_block_template(`$0'_depend) files_file_type($1) typeattribute $1 lockfile; ') define(`files_lock_file_depend',` attribute lockfile; ') ######################################## # # files_mountpoint(type) # define(`files_mountpoint',` requires_block_template(`$0'_depend) files_file_type($1) typeattribute $1 mountpoint; ') define(`files_mountpoint_depend',` attribute mountpoint; ') ######################################## # # files_pid_file(type) # define(`files_pid_file',` requires_block_template(`$0'_depend) files_file_type($1) typeattribute $1 pidfile; ') define(`files_pid_file_depend',` attribute pidfile; ') ######################################## # # files_tmp_file(type) # define(`files_tmp_file',` requires_block_template(`$0'_depend) files_file_type($1) typeattribute $1 tmpfile; ') define(`files_tmp_file_depend',` attribute tmpfile; ') ######################################## ## ## ## Transform the type into a file, for use on a ## virtual memory filesystem (tmpfs). ## ## ## The type to be transformed. ## ## # define(`files_tmpfs_file',` requires_block_template(`$0'_depend) files_file_type($1) fs_associate_tmpfs($1) typeattribute $1 tmpfsfile; ') define(`files_tmpfs_file_depend',` attribute tmpfsfile; ') ######################################## # # files_getattr_all_files(domain) define(`files_getattr_all_files',` requires_block_template(`$0'_depend) allow $1 file_type:dir { search getattr }; allow $1 file_type:file getattr; allow $1 file_type:lnk_file getattr; allow $1 file_type:fifo_file getattr; allow $1 file_type:sock_file getattr; ') define(`files_getattr_all_files_depend',` attribute file_type; class dir { search getattr }; class file getattr; class lnk_file getattr; class fifo_file getattr; class sock_file getattr; ') ######################################## ## ## ## Relabel all files on the filesystem, except ## the listed exceptions. ## ## ## The type of the domain perfoming this action. ## ## ## The types to be excluded. Each type or attribute ## must be negated by the caller. ## ## # define(`files_relabel_all_files',` requires_block_template(`$0'_depend) allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto }; allow $1 { file_type $2 }:file { getattr relabelfrom relabelto }; allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto }; allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto }; allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto }; allow $1 { file_type $2 }:blk_file { getattr relabelfrom }; allow $1 { file_type $2 }:chr_file { getattr relabelfrom }; # satisfy the assertions: selinux_relabelto_binary_pol($1) ') define(`files_relabel_all_files_depend',` attribute file_type; class dir { r_dir_perms relabelfrom relabelto }; class file { relabelfrom relabelto }; class lnk_file { relabelfrom relabelto }; class fifo_file { relabelfrom relabelto }; class sock_file { relabelfrom relabelto }; class blk_file relabelfrom; class chr_file relabelfrom; ') ######################################## ## ## ## Manage all files on the filesystem, except ## the listed exceptions. ## ## ## The type of the domain perfoming this action. ## ## ## The types to be excluded. Each type or attribute ## must be negated by the caller. ## ## # define(`files_manage_all_files',` requires_block_template(`$0'_depend) allow $1 { file_type $2 }:dir create_dir_perms; allow $1 { file_type $2 }:file create_file_perms; allow $1 { file_type $2 }:lnk_file create_lnk_perms; allow $1 { file_type $2 }:fifo_file create_file_perms; allow $1 { file_type $2 }:sock_file create_file_perms; # satisfy the assertions: selinux_write_binary_pol($1) bootloader_manage_kernel_modules($1) ') define(`files_manage_all_files_depend',` attribute file_type; class dir create_dir_perms; class file create_file_perms; class lnk_file create_lnk_perms; class fifo_file create_file_perms; class sock_file create_file_perms; ') ######################################## # # files_search_all_dirs(domain) # define(`files_search_all_dirs',` requires_block_template(`$0'_depend) allow $1 file_type:dir search; ') define(`files_search_all_dirs_depend',` attribute file_type; class dir search; ') ######################################## # # files_list_all_dirs(domain) # define(`files_list_all_dirs',` requires_block_template(`$0'_depend) allow $1 file_type:dir r_dir_perms; ') define(`files_list_all_dirs_depend',` attribute file_type; class dir r_dir_perms; ') ######################################## # # files_dontaudit_search_all_dirs(domain) # define(`files_dontaudit_search_all_dirs',` requires_block_template(`$0'_depend) dontaudit $1 file_type:dir search; ') define(`files_dontaudit_search_all_dirs_depend',` attribute file_type; class dir search; ') ####################################### # # files_relabelto_all_file_type_fs(domain) # define(`files_relabelto_all_file_type_fs',` requires_block_template(`$0'_depend) allow $1 file_type:filesystem relabelto; ') define(`files_relabelto_all_file_type_fs_depend',` attribute file_type; filesystem relabelto; ') ####################################### # # files_mount_all_file_type_fs(domain) # define(`files_mount_all_file_type_fs',` requires_block_template(`$0'_depend) allow $1 file_type:filesystem mount; ') define(`files_mount_all_file_type_fs_depend',` attribute file_type; filesystem mount; ') ####################################### # # files_unmount_all_file_type_fs(domain) # define(`files_unmount_all_file_type_fs',` requires_block_template(`$0'_depend) allow $1 file_type:filesystem mount; ') define(`files_unmount_all_file_type_fs_depend',` attribute file_type; filesystem mount; ') ######################################## # # files_mounton_all_mountpoints(domain) # define(`files_mounton_all_mountpoints',` requires_block_template(`$0'_depend) allow $1 mountpoint:dir { getattr search mounton }; ') define(`files_mounton_all_mountpoints_depend',` attribute mountpoint; class dir { getattr search mounton }; ') ######################################## # # files_list_root(domain) # define(`files_list_root',` requires_block_template(`$0'_depend) allow $1 root_t:dir r_dir_perms; allow $1 root_t:lnk_file r_file_perms; ') define(`files_list_root_depend',` type root_t; class dir r_dir_perms; class lnk_file r_file_perms; ') ######################################## ## ## ## Create an object in the root directory, with a private ## type. If no object class is specified, the ## default is file. ## ## ## The type of the process performing this action. ## ## ## The type of the object to be created. If no type ## is specified, the type of the root directory will ## be used. ## ## ## The object class of the object being created. If ## no class is specified, file will be used. ## ## # define(`files_create_root',` requires_block_template(`$0'_depend) allow $1 root_t:dir rw_dir_perms; ifelse(`$3',`',` ifelse(`$2',`',` allow $1 root_t:file create_file_perms; ',` type_transition $1 root_t:file $2; ') ',` ifelse(`$2',`',` allow $1 root_t:$3 create_file_perms; ',` type_transition $1 root_t:$3 $2; ') ') ') define(`files_create_root_depend',` type root_t; class dir create_dir_perms; class file create_file_perms; class lnk_file create_lnk_perms; class fifo_file create_file_perms; class sock_file create_file_perms; class blk_file create_file_perms; class chr_file create_file_perms; ') ######################################## # # files_dontaudit_read_root_file(domain) # define(`files_dontaudit_read_root_file',` requires_block_template(`$0'_depend) dontaudit $1 root_t:file read; ') define(`files_dontaudit_read_root_file_depend',` type root_t; class file read; ') ######################################## # # files_dontaudit_rw_root_file(domain) # define(`files_dontaudit_rw_root_file',` requires_block_template(`$0'_depend) dontaudit $1 root_t:file { read write }; ') define(`files_dontaudit_rw_root_file_depend',` type root_t; class file { read write }; ') ######################################## # # files_dontaudit_rw_root_chr_dev(domain) # define(`files_dontaudit_rw_root_chr_dev',` requires_block_template(`$0'_depend) dontaudit $1 root_t:chr_file { read write }; ') define(`files_dontaudit_rw_root_chr_dev_depend',` type root_t; class chr_file { read write }; ') ######################################## # # files_delete_root_dir_entry(domain) # define(`files_delete_root_dir_entry',` requires_block_template(`$0'_depend) allow $1 root_t:dir rw_dir_perms; ') define(`files_delete_root_dir_entry_depend',` type root_t; class dir rw_dir_perms; ') ######################################## # # files_unmount_rootfs(domain) # define(`files_unmount_rootfs',` requires_block_template(`$0'_depend) allow $1 root_t:filesystem unmount; ') define(`files_unmount_rootfs_depend',` type root_t; class filesystem unmount; ') ######################################## # # files_search_etc(domain) # define(`files_search_etc',` requires_block_template(`$0'_depend) allow $1 etc_t:dir search; ') define(`files_search_etc_depend',` type etc_t; class dir search; ') ######################################## # # files_read_generic_etc_files_directory(domain) # define(`files_read_generic_etc_files_directory',` requires_block_template(`$0'_depend) allow $1 etc_t:dir r_dir_perms; ') define(`files_read_generic_etc_files_directory_depend',` type etc_t; class dir r_dir_perms; ') ######################################## # # files_read_generic_etc_files(domain) # define(`files_read_generic_etc_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir r_dir_perms; allow $1 etc_t:file r_file_perms; allow $1 etc_t:lnk_file r_file_perms; ') define(`files_read_generic_etc_files_depend',` type etc_t; class dir r_dir_perms; class file r_file_perms; class lnk_file r_file_perms; ') ######################################## # # files_rw_generic_etc_files(domain) # define(`files_rw_generic_etc_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir r_dir_perms; allow $1 etc_t:file rw_file_perms; allow $1 etc_t:lnk_file r_file_perms; ') define(`files_rw_generic_etc_files_depend',` type etc_t; class dir r_dir_perms; class file rw_file_perms; class lnk_file r_file_perms; ') ######################################## # # files_manage_generic_etc_files(domain) # define(`files_manage_generic_etc_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir rw_dir_perms; allow $1 etc_t:file create_file_perms; allow $1 etc_t:lnk_file r_file_perms; ') define(`files_manage_generic_etc_files_depend',` type etc_t; class dir rw_dir_perms; class file create_file_perms; class lnk_file r_file_perms; ') ######################################## ## ## ## Delete system configuration files in /etc. ## ## ## The type of the process performing this action. ## ## # define(`files_delete_generic_etc_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir rw_dir_perms; allow $1 etc_t:file unlink; ') define(`files_delete_generic_etc_files_depend',` type etc_t; class dir rw_dir_perms; class file unlink; ') ######################################## # # files_exec_generic_etc_files(domain) # define(`files_exec_generic_etc_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir r_dir_perms; allow $1 etc_t:lnk_file r_file_perms; can_exec($1,etc_t) ') define(`files_exec_generic_etc_files_depend',` type etc_t; class dir r_dir_perms; class lnk_file r_file_perms; class file { getattr read execute execute_no_trans }; ') ######################################## # # files_create_boot_flag(domain) # # /halt, /.autofsck, etc # define(`files_create_boot_flag',` requires_block_template(`$0'_depend) allow $1 root_t:dir rw_dir_perms; allow $1 etc_runtime_t:file { create read write setattr unlink }; type_transition $1 root_t:file etc_runtime_t; ') define(`files_create_boot_flag_depend',` type root_t, etc_runtime_t; class dir rw_dir_perms; class file { create read write setattr unlink}; ') ######################################## # # files_manage_etc_runtime_files(type) # define(`files_manage_etc_runtime_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir rw_dir_perms; allow $1 etc_runtime_t:file create_file_perms; type_transition $1 etc_t:file etc_runtime_t; ') define(`files_manage_etc_runtime_files_depend',` type etc_t, etc_runtime_t; class dir rw_dir_perms; class file create_file_perms; ') ######################################## # # files_read_etc_runtime_files(domain) # define(`files_read_etc_runtime_files',` requires_block_template(`$0'_depend) allow $1 etc_t:dir r_dir_perms; allow $1 etc_runtime_t:file r_file_perms; ') define(`files_read_etc_runtime_files_depend',` type etc_t, etc_runtime_t; class dir r_dir_perms; class file r_file_perms; ') ######################################## # # files_create_etc_config(domain,privatetype,[class(es)]) # define(`files_create_etc_config',` requires_block_template(`$0'_depend) allow $1 etc_t:dir rw_dir_perms; ifelse(`$3',`',` type_transition $1 etc_t:file $2; ',` type_transition $1 etc_t:$3 $2; ') ') define(`files_create_etc_config_depend',` type etc_t; class dir rw_dir_perms; ') ######################################## # # files_rw_isid_type_dir(domain) # define(`files_rw_isid_type_dir',` requires_block_template(`$0'_depend) allow $1 file_t:dir rw_dir_perms; ') define(`files_rw_isid_type_dir_depend',` type file_t; class dir rw_dir_perms; ') ######################################## # # files_dontaudit_getattr_isid_type_dir(domain) # define(`files_dontaudit_getattr_isid_type_dir',` requires_block_template(`$0'_depend) dontaudit $1 file_t:dir search; ') define(`files_dontaudit_getattr_isid_type_dir_depend',` type file_t; class dir search; ') ######################################## # # files_dontaudit_search_isid_type_dir(domain) # define(`files_dontaudit_search_isid_type_dir',` requires_block_template(`$0'_depend) dontaudit $1 file_t:dir search; ') define(`files_dontaudit_search_isid_type_dir_depend',` type file_t; class dir search; ') ######################################## ## ## ## Get listing home home directories. ## ## ## The type of the process performing this action. ## ## # define(`files_list_home',` requires_block_template(`$0'_depend) allow $1 home_root_t:dir r_dir_perms; ') define(`files_list_home_depend',` type home_root_t; class dir r_dir_perms; ') ######################################## # # files_list_mnt(domain) # define(`files_list_mnt',` requires_block_template(`$0'_depend) allow $1 mnt_t:dir r_dir_perms; ') define(`files_read_etc_runtime_files_depend',` type mnt_t; class dir r_dir_perms; ') ######################################## # # files_create_tmp_files(domain,private_type,[object class(es)]) # define(`files_create_tmp_files',` requires_block_template(`$0'_depend) allow $1 tmp_t:dir rw_dir_perms; ifelse(`$3',`',` type_transition $1 tmp_t:file $2; ',` type_transition $1 tmp_t:$3 $2; ') ') define(`files_create_tmp_files_depend',` type tmp_t; class dir rw_dir_perms; ') ######################################## # # files_delete_all_tmp_files(domain) # define(`files_delete_all_tmp_files',` requires_block_template(`$0'_depend) allow $1 tmpfile:dir { getattr search read write add_name remove_name rmdir }; allow $1 tmpfile:file { getattr unlink }; allow $1 tmpfile:lnk_file { getattr unlink }; allow $1 tmpfile:fifo_file { getattr unlink }; allow $1 tmpfile:sock_file { getattr unlink }; ') define(`files_delete_all_tmp_files_depend',` attribute tmpfile; class dir { getattr search read write add_name remove_name rmdir }; class file { getattr unlink }; class lnk_file { getattr unlink }; class fifo_file { getattr unlink }; class sock_file { getattr unlink }; ') ######################################## # # files_search_usr(domain) # define(`files_search_usr',` requires_block_template(`$0'_depend) allow $1 usr_t:dir search; ') define(`files_search_usr_depend',` type usr_t; class dir search; ') ######################################## # # files_read_usr_files(domain) # define(`files_read_usr_files',` requires_block_template(`$0'_depend) allow $1 usr_t:dir r_dir_perms; allow $1 usr_t:{ file lnk_file } r_file_perms; ') define(`files_read_usr_files_depend',` type usr_t; class dir r_dir_perms; class file r_file_perms; class lnk_file r_file_perms; ') ######################################## ## ## ## Execute programs in /usr/src in the caller domain. ## ## ## The type of the process performing this action. ## ## # define(`files_exec_usr_files',` requires_block_template(`$0'_depend) allow $1 usr_t:dir search; allow $1 src_t:dir r_dir_perms; allow $1 src_t:lnk_file r_file_perms; can_exec($1,src_t) ') define(`files_read_usr_src_depend',` type usr_t, src_t; class dir r_dir_perms; class file { getattr read execute execute_no_trans }; class lnk_file r_file_perms; ') ######################################## # # files_read_usr_src(domain) # define(`files_read_usr_src',` requires_block_template(`$0'_depend) allow $1 usr_t:dir search; allow $1 src_t:dir r_dir_perms; allow $1 src_t:{ file lnk_file } r_file_perms; ') define(`files_read_usr_src_depend',` type usr_t, src_t; class dir r_dir_perms; class file r_file_perms; class lnk_file r_file_perms; ') ######################################## # # files_search_var(domain) # define(`files_search_var',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; ') define(`files_search_var_depend',` type var_t; class dir search; ') ######################################## # # files_dontaudit_search_var(domain) # define(`files_dontaudit_search_var',` requires_block_template(`$0'_depend) dontaudit $1 var_t:dir search; ') define(`files_dontaudit_search_var_depend',` type var_t; class dir search; ') ######################################## # # files_manage_urandom_seed(domain) # define(`files_manage_urandom_seed',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_lib_t:dir rw_dir_perms; allow $1 var_lib_t:file { getattr create read write setattr unlink }; ') define(`files_manage_urandom_seed_depend',` type var_t, var_lib_t; class dir rw_file_perms; class file { getattr create read write setattr unlink }; ') ######################################## # # files_getattr_generic_lock_files(domain) # define(`files_getattr_generic_lock_files',` requires_block_template(`$0'_depend) allow $1 var_lock_t:dir r_dir_perms; allow $1 var_lock_t:file getattr; ') define(`files_getattr_generic_lock_files_depend',` type var_lock_t; class dir r_dir_perms; class file getattr; ') ######################################## # # files_manage_generic_lock_files(domain) # define(`files_manage_generic_lock_files',` requires_block_template(`$0'_depend) allow $1 var_lock_t:dir { getattr search create read write setattr add_name remove_name rmdir }; allow $1 var_lock_t:file { getattr create read write setattr unlink }; ') define(`files_manage_generic_lock_files_depend',` type var_lock_t; class dir { getattr search create read write setattr add_name remove_name rmdir }; class file { getattr create read write setattr unlink }; ') ######################################## # # files_delete_all_lock_files(domain) # define(`files_delete_all_lock_files',` requires_block_template(`$0'_depend) allow $1 lockfile:dir rw_dir_perms; allow $1 lockfile:file { getattr unlink }; ') define(`files_delete_all_lock_files_depend',` attribute lockfile; class dir rw_dir_perms; class file { getattr unlink }; ') ######################################## # # files_create_lock_file(domain,private_type,[object class(es)]) # define(`files_create_lock_file',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_lock_t:dir rw_dir_perms; ifelse(`$3',`',` type_transition $1 var_lock_t:file $2; ',` type_transition $1 var_lock_t:$3 $2; ') ') define(`files_create_lock_file_depend',` type var_t, var_lock_t; class dir rw_dir_perms; ') ######################################## # # files_search_pids(domain) # define(`files_search_pids',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_run_t:dir search; ') define(`files_search_pids_depend',` type var_t, var_run_t; class dir search; ') ######################################## # # files_dontaudit_search_pids(domain) # define(`files_dontaudit_search_pids',` requires_block_template(`$0'_depend) allow $1 var_run_t:dir search; ') define(`files_dontaudit_search_pids_depend',` type var_run_t; class dir search; ') ######################################## # # files_list_pids(domain) # define(`files_list_pids',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_run_t:dir r_dir_perms; ') define(`files_list_pids_depend',` type var_t, var_run_t; class dir r_dir_perms; ') ######################################## # # files_create_pid(domain,pidfile,[object class(es)]) # define(`files_create_pid',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_run_t:dir rw_dir_perms; ifelse(`$3',`',` type_transition $1 var_run_t:file $2; ',` type_transition $1 var_run_t:$3 $2; ') ') define(`files_create_pid_depend',` type var_t, var_run_t; class dir rw_dir_perms; ') ######################################## # # files_rw_generic_pids(domain) # define(`files_rw_generic_pids',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_run_t:dir r_dir_perms; allow $1 var_run_t:file rw_file_perms; ') define(`files_rw_generic_pids_depend',` type var_t, var_run_t; class dir r_dir_perms; class file rw_file_perms; ') ######################################## ## ## ## Do not audit attempts to write to daemon runtime data files. ## ## ## The type of the process performing this action. ## ## # define(`files_dontaudit_write_all_pids',` requires_block_template(`$0'_depend) dontaudit $1 pidfile:file write; ') define(`files_dontaudit_write_all_pids_depend',` attribute pidfile; class file write; ') ######################################## ## ## ## Do not audit attempts to ioctl daemon runtime data files. ## ## ## The type of the process performing this action. ## ## # define(`files_dontaudit_ioctl_all_pids',` requires_block_template(`$0'_depend) dontaudit $1 pidfile:file ioctl; ') define(`files_dontaudit_ioctl_all_pids_depend',` attribute pidfile; class file ioctl; ') ######################################## # # files_read_all_pids(domain) # define(`files_read_all_pids',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 pidfile:dir r_dir_perms; allow $1 pidfile:file r_file_perms; ') define(`files_read_all_pids_depend',` attribute pidfile; type var_t; class dir r_dir_perms; class file r_file_perms; ') ######################################## # # files_delete_all_pids(domain) # define(`files_delete_all_pids',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_run_t:{ sock_file lnk_file } { getattr unlink }; allow $1 var_run_t:dir rmdir; allow $1 pidfile:dir rw_dir_perms; allow $1 pidfile:file { getattr unlink }; allow $1 pidfile:sock_file { getattr unlink }; ') define(`files_delete_all_pids_depend',` attribute pidfile; type var_t, var_run_t; class dir rw_dir_perms; class file { getattr unlink }; class lnk_file { getattr unlink }; class sock_file { getattr unlink }; ') ######################################## # # files_search_spool(domain) # define(`files_search_spool',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_spool_t:dir search; ') define(`files_search_spool_depend',` type var_t, var_spool_t; class dir search; ') ######################################## # # files_list_spool(domain) # define(`files_list_spool',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_spool_t:dir r_dir_perms; ') define(`files_list_spool_depend',` type var_t, var_spool_t; class dir r_dir_perms; ') ######################################## # # files_read_spools(domain) # define(`files_read_spools',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_spool_t:dir r_dir_perms; allow $1 var_spool_t:file r_file_perms; ') define(`files_read_spools_depend',` type var_t, var_spool_t; class dir r_dir_perms; class file r_file_perms; ') ######################################## # # files_manage_spools(domain) # define(`files_manage_spools',` requires_block_template(`$0'_depend) allow $1 var_t:dir search; allow $1 var_spool_t:dir rw_dir_perms; allow $1 var_spool_t:file create_file_perms; ') define(`files_manage_spools_depend',` type var_t, var_spool_t; class dir rw_dir_perms; class file create_file_perms; ') ##