## <summary>Policy for reading and setting the hardware clock.</summary> ######################################## ## <summary> ## Execute hwclock in the clock domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`clock_domtrans',` gen_require(` type hwclock_t, hwclock_exec_t; ') domain_auto_trans($1,hwclock_exec_t,hwclock_t) allow $1 hwclock_t:fd use; allow hwclock_t $1:fd use; allow hwclock_t $1:fifo_file rw_file_perms; allow hwclock_t $1:process sigchld; ') ######################################## ## <summary> ## Execute hwclock in the clock domain, and ## allow the specified role the hwclock domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> ## <param name="role"> ## <summary> ## The role to be allowed the clock domain. ## </summary> ## </param> ## <param name="terminal"> ## <summary> ## The type of the terminal allow the clock domain to use. ## </summary> ## </param> # interface(`clock_run',` gen_require(` type hwclock_t; ') clock_domtrans($1) role $2 types hwclock_t; allow hwclock_t $3:chr_file { getattr read write ioctl }; ') ######################################## ## <summary> ## Execute hwclock in the caller domain. ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`clock_exec',` gen_require(` type hwclock_exec_t; ') can_exec($1,hwclock_exec_t) ') ######################################## ## <summary> ## Allow executing domain to modify clock drift ## </summary> ## <param name="domain"> ## <summary> ## The type of the process performing this action. ## </summary> ## </param> # interface(`clock_rw_adjtime',` gen_require(` type adjtime_t; ') allow $1 adjtime_t:file rw_file_perms; files_list_etc($1) ')