## Policy for filesystems. ## ## Contains the initial SID for the filesystems. ## ######################################## ## ## Transform specified type into a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_type',` gen_require(` attribute filesystem_type; ') typeattribute $1 filesystem_type; ') ######################################## ## ## Transform specified type into a filesystem ## type which does not have extended attribute ## support. ## ## ## ## Domain allowed access. ## ## # interface(`fs_noxattr_type',` gen_require(` attribute noxattrfs; ') fs_type($1) typeattribute $1 noxattrfs; ') ######################################## ## ## Associate the specified file type to persistent ## filesystems with extended attributes. This ## allows a file of this type to be created on ## a filesystem such as ext3, JFS, and XFS. ## ## ## ## The type of the to be associated. ## ## # interface(`fs_associate',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem associate; ') ######################################## ## ## Associate the specified file type to ## filesystems which lack extended attributes ## support. This allows a file of this type ## to be created on a filesystem such as ## FAT32, and NFS. ## ## ## ## The type of the to be associated. ## ## # interface(`fs_associate_noxattr',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:filesystem associate; ') ######################################## ## ## Execute files on a filesystem that does ## not support extended attributes. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_noxattr',` gen_require(` attribute noxattrfs; ') can_exec($1,noxattrfs) ') ######################################## ## ## Mount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem mount; ') ######################################## ## ## Remount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem remount; ') ######################################## ## ## Unmount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a persistent ## filesystem which has extended ## attributes, such as ext3, JFS, or XFS. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem getattr; ') ######################################## ## ## Do not audit attempts to ## get the attributes of a persistent ## filesystem which has extended ## attributes, such as ext3, JFS, or XFS. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_xattr_fs',` gen_require(` type fs_t; ') dontaudit $1 fs_t:filesystem getattr; ') ######################################## ## ## Allow changing of the label of a ## filesystem with extended attributes ## using the context= mount option. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem relabelfrom; ') ######################################## ## ## Get the filesystem quotas of a filesystem ## with extended attributes. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_get_xattr_fs_quotas',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem quotaget; ') ######################################## ## ## Set the filesystem quotas of a filesystem ## with extended attributes. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_set_xattr_fs_quotas',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem quotamod; ') ######################################## ## ## Read files on anon_inodefs file systems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_anon_inodefs_files',` gen_require(` type anon_inodefs_t; ') read_files_pattern($1, anon_inodefs_t, anon_inodefs_t) ') ######################################## ## ## Read and write files on anon_inodefs ## file systems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_anon_inodefs_files',` gen_require(` type anon_inodefs_t; ') rw_files_pattern($1, anon_inodefs_t, anon_inodefs_t) ') ######################################## ## ## Mount an automount pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem mount; ') ######################################## ## ## Remount an automount pseudo filesystem ## This allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem remount; ') ######################################## ## ## Unmount an automount pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of an automount ## pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem getattr; ') ######################################## ## ## Search automount filesystem to use automatically ## mounted filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir search_dir_perms; ') ######################################## ## ## Read directories of automatically ## mounted filesystems. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_list_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list directories of automatically ## mounted filesystems. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_auto_mountpoints',` gen_require(` type autofs_t; ') dontaudit $1 autofs_t:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete symbolic links ## on an autofs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_autofs_symlinks',` gen_require(` type autofs_t; ') manage_lnk_files_pattern($1, autofs_t, autofs_t) ') ######################################## ## ## Get the attributes of directories on ## binfmt_misc filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_binfmt_misc_dirs',` gen_require(` type binfmt_misc_fs_t; ') allow $1 binfmt_misc_fs_t:dir getattr; ') ######################################## ## ## Register an interpreter for new binary ## file types, using the kernel binfmt_misc ## support. ## ## ##

## Register an interpreter for new binary ## file types, using the kernel binfmt_misc ## support. ##

##

## A common use for this is to ## register a JVM as an interpreter for ## Java byte code. Registered binaries ## can be directly executed on a command line ## without specifying the interpreter. ##

##
## ## ## Domain allowed access. ## ## ## # interface(`fs_register_binary_executable_type',` gen_require(` type binfmt_misc_fs_t; ') rw_files_pattern($1, binfmt_misc_fs_t, binfmt_misc_fs_t) ') ######################################## ## ## Mount a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem mount; ') ######################################## ## ## Remount a CIFS or SMB network filesystem. ## This allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem remount; ') ######################################## ## ## Unmount a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a CIFS or ## SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem getattr; ') ######################################## ## ## Search directories on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir search_dir_perms; ') ######################################## ## ## List the contents of directories on a ## CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_cifs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir list_dir_perms; ') ######################################## ## ## Read files on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; read_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Get the attributes of filesystems that ## do not have extended attribute support. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:filesystem getattr; ') ######################################## ## ## Read all noxattrfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete all noxattrfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_noxattr_fs_dirs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir manage_dir_perms; ') ######################################## ## ## Read all noxattrfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') read_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Create, read, write, and delete all noxattrfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') manage_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Read all noxattrfs symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_noxattr_fs_symlinks',` gen_require(` attribute noxattrfs; ') read_lnk_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Do not audit attempts to read ## files on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file read_file_perms; ') ######################################## ## ## Do not audit attempts to read or ## write files on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file { read write }; ') ######################################## ## ## Read symbolic links on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_symlinks',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; read_lnk_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Read named pipes ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_named_pipes',` gen_require(` type cifs_t; ') read_fifo_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Read named pipes ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_named_sockets',` gen_require(` type cifs_t; ') read_sock_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Execute files on a CIFS or SMB ## network filesystem, in the caller ## domain. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; exec_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Create, read, write, and delete directories ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_cifs_dirs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_manage_cifs_dirs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir manage_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_cifs_files',` gen_require(` type cifs_t; ') manage_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete files ## on a CIFS or SMB network filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file manage_file_perms; ') ######################################## ## ## Create, read, write, and delete symbolic links ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cifs_symlinks',` gen_require(` type cifs_t; ') manage_lnk_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Create, read, write, and delete named pipes ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cifs_named_pipes',` gen_require(` type cifs_t; ') manage_fifo_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Create, read, write, and delete named sockets ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cifs_named_sockets',` gen_require(` type cifs_t; ') manage_sock_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Execute a file on a CIFS or SMB filesystem ## in the specified domain. ## ## ##

## Execute a file on a CIFS or SMB filesystem ## in the specified domain. This allows ## the specified domain to execute any file ## on these filesystems in the specified ## domain. This is not suggested. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##

## This interface was added to handle ## home directories on CIFS/SMB filesystems, ## in particular used by the ssh-agent policy. ##

##
## ## ## Domain allowed access. ## ## ## ## ## The type of the new process. ## ## # interface(`fs_cifs_domtrans',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir search_dir_perms; domain_auto_transition_pattern($1, cifs_t, $2) ') ######################################## ## ## Mount a DOS filesystem, such as ## FAT32 or NTFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem mount; ') ######################################## ## ## Remount a DOS filesystem, such as ## FAT32 or NTFS. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem remount; ') ######################################## ## ## Unmount a DOS filesystem, such as ## FAT32 or NTFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a DOS ## filesystem, such as FAT32 or NTFS. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem getattr; ') ######################################## ## ## Allow changing of the label of a ## DOS filesystem using the context= mount option. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem relabelfrom; ') ######################################## ## ## Search dosfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_dos',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:dir search_dir_perms; ') ######################################## ## ## Read files on a DOS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_dos_files',` gen_require(` type dosfs_t; ') read_files_pattern($1, dosfs_t, dosfs_t) ') ######################################## ## ## Create, read, write, and delete files ## on a DOS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_dos_files',` gen_require(` type dosfs_t; ') manage_files_pattern($1, dosfs_t, dosfs_t) ') ######################################## ## ## Read eventpollfs files. ## ## ##

## Read eventpollfs files ##

##

## This interface has been deprecated, and will ## be removed in the future. ##

##
## ## ## Domain allowed access. ## ## # interface(`fs_read_eventpollfs',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Mount a FUSE filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:filesystem mount; ') ######################################## ## ## Unmount a FUSE filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:filesystem unmount; ') ######################################## ## ## Read and write hugetlbfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_hugetlbfs_files',` gen_require(` type hugetlbfs_t; ') rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t) ') ######################################## ## ## Search inotifyfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_inotifyfs',` gen_require(` type inotifyfs_t; ') allow $1 inotifyfs_t:dir search_dir_perms; ') ######################################## ## ## List inotifyfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_inotifyfs',` gen_require(` type inotifyfs_t; ') allow $1 inotifyfs_t:dir list_dir_perms; ') ######################################## ## ## Mount an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem mount; ') ######################################## ## ## Remount an iso9660 filesystem, which ## is usually used on CDs. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem remount; ') ######################################## ## ## Unmount an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem unmount; ') ######################################## ## ## Get the attributes of an iso9660 ## filesystem, which is usually used on CDs. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem getattr; ') ######################################## ## ## Read files on an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_iso9660_files',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:dir list_dir_perms; allow $1 iso9660_t:file getattr; ') ######################################## ## ## Read files on an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_iso9660_files',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:dir list_dir_perms; read_files_pattern($1, iso9660_t, iso9660_t) read_lnk_files_pattern($1, iso9660_t, iso9660_t) ') ######################################## ## ## Mount a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem mount; ') ######################################## ## ## Remount a NFS filesystem. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem remount; ') ######################################## ## ## Unmount a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem getattr; ') ######################################## ## ## Search directories on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir search_dir_perms; ') ######################################## ## ## List NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_nfs',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:dir list_dir_perms; ') ######################################## ## ## Read files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; read_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Do not audit attempts to read ## files on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file read_file_perms; ') ######################################## ## ## Read files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; write_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Execute files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; exec_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Do not audit attempts to read or ## write files on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file { read write }; ') ######################################## ## ## Read symbolic links on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_nfs_symlinks',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; read_lnk_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Read named sockets on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_nfs_named_sockets',` gen_require(` type nfs_t; ') read_sock_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Read named pipes on a NFS network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_nfs_named_pipes',` gen_require(` type nfs_t; ') read_fifo_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Read directories of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_rpc_dirs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir getattr; ') ######################################## ## ## Search directories of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_rpc',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir search_dir_perms; ') ######################################## ## ## Search removable storage directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_removable',` gen_require(` type removable_t; ') allow $1 removable_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to list removable storage directories. ## ## ## ## Domain not to audit. ## ## # interface(`fs_dontaudit_list_removable',` gen_require(` type removable_t; ') dontaudit $1 removable_t:dir list_dir_perms; ') ######################################## ## ## Read removable storage files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_files',` gen_require(` type removable_t; ') read_files_pattern($1, removable_t, removable_t) ') ######################################## ## ## Do not audit attempts to read removable storage files. ## ## ## ## Domain not to audit. ## ## # interface(`fs_dontaudit_read_removable_files',` gen_require(` type removable_t; ') dontaudit $1 removable_t:file read_file_perms; ') ######################################## ## ## Read removable storage symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_symlinks',` gen_require(` type removable_t; ') read_lnk_files_pattern($1, removable_t, removable_t) ') ######################################## ## ## Read directories of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_rpc',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir list_dir_perms; ') ######################################## ## ## Read files of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_rpc_files',` gen_require(` type rpc_pipefs_t; ') read_files_pattern($1, rpc_pipefs_t, rpc_pipefs_t) ') ######################################## ## ## Read symbolic links of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_rpc_symlinks',` gen_require(` type rpc_pipefs_t; ') read_lnk_files_pattern($1, rpc_pipefs_t, rpc_pipefs_t) ') ######################################## ## ## Read sockets of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_rpc_sockets',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:sock_file { read write }; ') ######################################## ## ## Create, read, write, and delete directories ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_nfs_dirs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_nfs_dirs',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:dir manage_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_nfs_files',` gen_require(` type nfs_t; ') manage_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Do not audit attempts to create, ## read, write, and delete files ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file manage_file_perms; ') ######################################### ## ## Create, read, write, and delete symbolic links ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_nfs_symlinks',` gen_require(` type nfs_t; ') manage_lnk_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Create, read, write, and delete named pipes ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_nfs_named_pipes',` gen_require(` type nfs_t; ') manage_fifo_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Create, read, write, and delete named sockets ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_nfs_named_sockets',` gen_require(` type nfs_t; ') manage_sock_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Execute a file on a NFS filesystem ## in the specified domain. ## ## ##

## Execute a file on a NFS filesystem ## in the specified domain. This allows ## the specified domain to execute any file ## on a NFS filesystem in the specified ## domain. This is not suggested. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##

## This interface was added to handle ## home directories on NFS filesystems, ## in particular used by the ssh-agent policy. ##

##
## ## ## Domain allowed access. ## ## ## ## ## The type of the new process. ## ## # interface(`fs_nfs_domtrans',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir search_dir_perms; domain_auto_transition_pattern($1, nfs_t, $2) ') ######################################## ## ## Mount a NFS server pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem mount; ') ######################################## ## ## Mount a NFS server pseudo filesystem. ## This allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem remount; ') ######################################## ## ## Unmount a NFS server pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a NFS server ## pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem getattr; ') ######################################## ## ## Search NFS server directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:dir search_dir_perms; ') ######################################## ## ## Read and write NFS server files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_nfsd_fs',` gen_require(` type nfsd_fs_t; ') rw_files_pattern($1, nfsd_fs_t, nfsd_fs_t) ') ######################################## ## ## Allow the type to associate to ramfs filesystems. ## ## ## ## The type of the object to be associated. ## ## # interface(`fs_associate_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem associate; ') ######################################## ## ## Mount a RAM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem mount; ') ######################################## ## ## Remount a RAM filesystem. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem remount; ') ######################################## ## ## Unmount a RAM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a RAM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem getattr; ') ######################################## ## ## Search directories on a ramfs ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir search_dir_perms; ') ######################################## ## ## Dontaudit Search directories on a ramfs ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_search_ramfs',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:dir search_dir_perms; ') ######################################## ## ## Create, read, write, and delete ## directories on a ramfs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_dirs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir manage_dir_perms; ') ######################################## ## ## Dontaudit read on a ramfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_read_ramfs_files',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:file read; ') ######################################## ## ## Dontaudit read on a ramfs fifo_files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_read_ramfs_pipes',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:fifo_file read; ') ######################################## ## ## Create, read, write, and delete ## files on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_files',` gen_require(` type ramfs_t; ') manage_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Write to named pipe on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_ramfs_pipes',` gen_require(` type ramfs_t; ') write_fifo_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Do not audit attempts to write to named ## pipes on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_write_ramfs_pipes',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:fifo_file write; ') ######################################## ## ## Read and write a named pipe on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_ramfs_pipes',` gen_require(` type ramfs_t; ') rw_fifo_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Create, read, write, and delete ## named pipes on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_pipes',` gen_require(` type ramfs_t; ') manage_fifo_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Write to named socket on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_ramfs_sockets',` gen_require(` type ramfs_t; ') write_sock_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Create, read, write, and delete ## named sockets on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_sockets',` gen_require(` type ramfs_t; ') manage_sock_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Mount a ROM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem mount; ') ######################################## ## ## Remount a ROM filesystem. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem remount; ') ######################################## ## ## Unmount a ROM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a ROM ## filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem getattr; ') ######################################## ## ## Mount a RPC pipe filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem mount; ') ######################################## ## ## Remount a RPC pipe filesystem. This ## allows some mount option to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem remount; ') ######################################## ## ## Unmount a RPC pipe filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a RPC pipe ## filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem getattr; ') ######################################### ## ## Read and write RPC pipe filesystem named pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_rpc_named_pipes',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:fifo_file { read write }; ') ######################################## ## ## Mount a tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem mount; ') ######################################## ## ## Remount a tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem remount; ') ######################################## ## ## Unmount a tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a tmpfs ## filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem getattr; ') ######################################## ## ## Allow the type to associate to tmpfs filesystems. ## ## ## ## The type of the object to be associated. ## ## # interface(`fs_associate_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem associate; ') ######################################## ## ## Get the attributes of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir getattr; ') ######################################## ## ## Set the attributes of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_setattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir setattr; ') ######################################## ## ## Search tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir search_dir_perms; ') ######################################## ## ## List the contents of generic tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list the ## contents of generic tmpfs directories. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_tmpfs',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete ## tmpfs directories ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir manage_dir_perms; ') ######################################## ## ## Create an object in a tmpfs filesystem, with a private ## type using a type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the object to be created. ## ## ## ## ## The object class of the object being created. ## ## # interface(`fs_tmpfs_filetrans',` gen_require(` type tmpfs_t; ') allow $2 tmpfs_t:filesystem associate; filetrans_pattern($1, tmpfs_t, $2, $3) ') ######################################## ## ## Do not audit attempts to getattr ## generic tmpfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_tmpfs_files',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:file getattr; ') ######################################## ## ## Do not audit attempts to read or write ## generic tmpfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_tmpfs_files',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:file rw_file_perms; ') ######################################## ## ## Create, read, write, and delete ## auto moutpoints. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir manage_dir_perms; ') ######################################## ## ## Read and write generic tmpfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_tmpfs_files',` gen_require(` type tmpfs_t; ') rw_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read tmpfs link files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') read_lnk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write character nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_tmpfs_chr_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; rw_chr_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## dontaudit Read and write character nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_use_tmpfs_chr_dev',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir list_dir_perms; dontaudit $1 tmpfs_t:chr_file rw_chr_file_perms; ') ######################################## ## ## Relabel character nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_tmpfs_chr_file',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; relabel_chr_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write block nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_tmpfs_blk_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; rw_blk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Relabel block nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_tmpfs_blk_file',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; relabel_blk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete generic ## files on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_files',` gen_require(` type tmpfs_t; ') manage_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete symbolic ## links on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') manage_lnk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete socket ## files on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_sockets',` gen_require(` type tmpfs_t; ') manage_sock_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete character ## nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_chr_files',` gen_require(` type tmpfs_t; ') manage_chr_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete block nodes ## on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_blk_files',` gen_require(` type tmpfs_t; ') manage_blk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Mount all filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem mount; ') ######################################## ## ## Remount all filesystems. This ## allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem remount; ') ######################################## ## ## Unmount all filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem unmount; ') ######################################## ## ## Get the attributes of all persistent ## filesystems. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## all filesystems. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_fs',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:filesystem getattr; ') ######################################## ## ## Get the quotas of all filesystems. ## ## ## ## The type of the domain getting quotas. ## ## ## # interface(`fs_get_all_fs_quotas',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem quotaget; ') ######################################## ## ## Set the quotas of all filesystems. ## ## ## ## The type of the domain setting quotas. ## ## ## # interface(`fs_set_all_quotas',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem quotamod; ') ######################################## ## ## Relabelfrom all filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem relabelfrom; ') ######################################## ## ## Get the attributes of all directories ## with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_dirs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir getattr; ') ######################################## ## ## Search all directories with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_all',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir search_dir_perms; ') ######################################## ## ## List all directories with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_all',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir list_dir_perms; ') ######################################## ## ## Get the attributes of all files with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_files',` gen_require(` attribute filesystem_type; ') getattr_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Get the attributes of all symbolic links with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') getattr_lnk_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Get the attributes of all named pipes with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') getattr_fifo_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Get the attributes of all named sockets with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') getattr_sock_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Do not audit attempts to get the attributes ## of all files with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_files',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all symbolic links with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:lnk_file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all named pipes with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:fifo_file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all named sockets with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:sock_file getattr; ') ######################################## ## ## Unconfined access to filesystems ## ## ## ## Domain allowed access. ## ## # interface(`fs_unconfined',` gen_require(` attribute filesystem_unconfined_type; ') typeattribute $1 filesystem_unconfined_type; ') ######################################## ## ## Relabel all objets from filesystems that ## do not support extended attributes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir list_dir_perms; relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs) relabelfrom_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) ')