## Policy for filesystems. ## ## Contains the initial SID for the filesystems. ## ######################################## ## ## Transform specified type into a filesystem type. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_type',` gen_require(` attribute filesystem_type; ') typeattribute $1 filesystem_type; allow $1 self:filesystem associate; ') ######################################## ## ## Transform specified type into a filesystem ## type which does not have extended attribute ## support. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_noxattr_type',` gen_require(` attribute noxattrfs; ') fs_type($1) typeattribute $1 noxattrfs; ') ######################################## ## ## Associate the specified file type to persistent ## filesystems with extended attributes. This ## allows a file of this type to be created on ## a filesystem such as ext3, JFS, and XFS. ## ## ## ## The type of the to be associated. ## ## # interface(`fs_associate',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem associate; ') ######################################## ## ## Associate the specified file type to ## filesystems which lack extended attributes ## support. This allows a file of this type ## to be created on a filesystem such as ## FAT32, and NFS. ## ## ## ## The type of the to be associated. ## ## # interface(`fs_associate_noxattr',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:filesystem associate; ') ######################################## ## ## Execute files on a filesystem that does ## not support extended attributes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_exec_noxattr',` gen_require(` attribute noxattrfs; ') can_exec($1,noxattrfs) ') ######################################## ## ## Mount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem mount; ') ######################################## ## ## Remount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. This allows ## some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem remount; ') ######################################## ## ## Unmount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a persistent ## filesystem which has extended ## attributes, such as ext3, JFS, or XFS. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem getattr; ') ######################################## ## ## Do not audit attempts to ## get the attributes of a persistent ## filesystem which has extended ## attributes, such as ext3, JFS, or XFS. ## ## ## ## The type of the domain to not audit. ## ## # interface(`fs_dontaudit_getattr_xattr_fs',` gen_require(` type fs_t; ') dontaudit $1 fs_t:filesystem getattr; ') ######################################## ## ## Allow changing of the label of a ## filesystem with extended attributes ## using the context= mount option. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_relabelfrom_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem relabelfrom; ') ######################################## ## ## Get the filesystem quotas of a filesystem ## with extended attributes. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_get_xattr_fs_quotas',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem quotaget; ') ######################################## ## ## Set the filesystem quotas of a filesystem ## with extended attributes. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_set_xattr_fs_quotas',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem quotamod; ') ######################################## ## ## Mount an automount pseudo filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem mount; ') ######################################## ## ## Remount an automount pseudo filesystem ## This allows some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem remount; ') ######################################## ## ## Unmount an automount pseudo filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of an automount ## pseudo filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem getattr; ') ######################################## ## ## Search automount filesystem to use automatically ## mounted filesystems. ## ## ## ## The type of the domain performing this action. ## ## # interface(`fs_search_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir { getattr search }; ') ######################################## ## ## Read directories of automatically ## mounted filesystems. ## ## ## ## The type of the domain performing this action. ## ## # interface(`fs_list_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir r_dir_perms; ') ######################################## ## ## Do not audit attempts to list directories of automatically ## mounted filesystems. ## ## ## ## The type of the domain performing this action. ## ## # interface(`fs_dontaudit_list_auto_mountpoints',` gen_require(` type autofs_t; ') dontaudit $1 autofs_t:dir r_dir_perms; ') ######################################## ## ## Register an interpreter for new binary ## file types, using the kernel binfmt_misc ## support. A common use for this is to ## register a JVM as an interpreter for ## Java byte code. Registered binaries ## can be directly executed on a command line ## without specifying the interpreter. ## ## ## ## The type of the domain registering ## the interpreter. ## ## # interface(`fs_register_binary_executable_type',` gen_require(` type binfmt_misc_fs_t; ') allow $1 binfmt_misc_fs_t:dir { getattr search }; allow $1 binfmt_misc_fs_t:file { getattr ioctl write }; ') ######################################## ## ## Mount a CIFS or SMB network filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem mount; ') ######################################## ## ## Remount a CIFS or SMB network filesystem. ## This allows some mount options to be changed. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_remount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem remount; ') ######################################## ## ## Unmount a CIFS or SMB network filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_unmount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a CIFS or ## SMB network filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem getattr; ') ######################################## ## ## Search directories on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir search; ') ######################################## ## ## List the contents of directories on a ## CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir r_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_cifs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir r_dir_perms; ') ######################################## ## ## Read files on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir r_dir_perms; allow $1 cifs_t:file r_file_perms; ') ######################################## ## ## Read all noxattrfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir r_dir_perms; ') ######################################## ## ## Read all noxattrfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir search; allow $1 noxattrfs:file r_file_perms; ') ######################################## ## ## Read all noxattrfs symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_noxattr_fs_symlinks',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir search; allow $1 noxattrfs:lnk_file r_file_perms; ') ######################################## ## ## Do not audit attempts to read ## files on a CIFS or SMB filesystem. ## ## ## ## The type of the domain to not audit. ## ## # interface(`fs_dontaudit_read_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file r_file_perms; ') ######################################## ## ## Do not audit attempts to read or ## write files on a CIFS or SMB filesystem. ## ## ## ## The type of the domain to not audit. ## ## # interface(`fs_dontaudit_rw_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file { read write }; ') ######################################## ## ## Read symbolic links on a CIFS or SMB filesystem. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_read_cifs_symlinks',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir r_dir_perms; allow $1 cifs_t:lnk_file r_file_perms; ') ######################################## ## ## Execute files on a CIFS or SMB ## network filesystem, in the caller ## domain. ## ## ## ## The type of the domain executing the files. ## ## # interface(`fs_exec_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir r_dir_perms; can_exec($1, cifs_t) ') ######################################## ## ## Create, read, write, and delete directories ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the directories. ## ## # interface(`fs_manage_cifs_dirs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir create_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the directories. ## ## # interface(`fs_dontaudit_manage_cifs_dirs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir create_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the files. ## ## # interface(`fs_manage_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir rw_dir_perms; allow $1 cifs_t:file create_file_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete files ## on a CIFS or SMB network filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file create_file_perms; ') ######################################## ## ## Create, read, write, and delete symbolic links ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the symbolic links. ## ## # interface(`fs_manage_cifs_symlinks',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir rw_dir_perms; allow $1 cifs_t:lnk_file create_lnk_perms; ') ######################################## ## ## Create, read, write, and delete named pipes ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the pipes. ## ## # interface(`fs_manage_cifs_named_pipes',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir rw_dir_perms; allow $1 cifs_t:fifo_file create_file_perms; ') ######################################## ## ## Create, read, write, and delete named sockets ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the sockets. ## ## # interface(`fs_manage_cifs_named_sockets',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir rw_file_perms; allow $1 cifs_t:sock_file create_file_perms; ') ######################################## ## ## Execute a file on a CIFS or SMB filesystem ## in the specified domain. ## ## ##

## Execute a file on a CIFS or SMB filesystem ## in the specified domain. This allows ## the specified domain to execute any file ## on these filesystems in the specified ## domain. This is not suggested. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##

## This interface was added to handle ## home directories on CIFS/SMB filesystems, ## in particular used by the ssh-agent policy. ##

##
## ## ## The type of the process performing this action. ## ## ## ## ## The type of the new process. ## ## # interface(`fs_cifs_domtrans',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir search; domain_auto_trans($1,cifs_t,$2) ') ######################################## ## ## Mount a DOS filesystem, such as ## FAT32 or NTFS. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem mount; ') ######################################## ## ## Remount a DOS filesystem, such as ## FAT32 or NTFS. This allows ## some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem remount; ') ######################################## ## ## Unmount a DOS filesystem, such as ## FAT32 or NTFS. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a DOS ## filesystem, such as FAT32 or NTFS. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem getattr; ') ######################################## ## ## Allow changing of the label of a ## DOS filesystem using the context= mount option. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_relabelfrom_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem relabelfrom; ') ######################################## ## ## Read eventpollfs files ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_eventpollfs',` gen_require(` type eventpollfs_t; ') allow $1 eventpollfs_t:dir search_dir_perms; allow $1 eventpollfs_t:file r_file_perms; ') ######################################## ## ## Search inotifyfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_inotifyfs',` gen_require(` type inotifyfs_t; ') allow $1 inotifyfs_t:dir search_dir_perms; ') ######################################## ## ## List inotifyfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_inotifyfs',` gen_require(` type inotifyfs_t; ') allow $1 inotifyfs_t:dir r_dir_perms; ') ######################################## ## ## Mount an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem mount; ') ######################################## ## ## Remount an iso9660 filesystem, which ## is usually used on CDs. This allows ## some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem remount; ') ######################################## ## ## Unmount an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem unmount; ') ######################################## ## ## Get the attributes of an iso9660 ## filesystem, which is usually used on CDs. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem getattr; ') ######################################## ## ## Mount a NFS filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem mount; ') ######################################## ## ## Remount a NFS filesystem. This allows ## some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem remount; ') ######################################## ## ## Unmount a NFS filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a NFS filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem getattr; ') ######################################## ## ## Search directories on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir search; ') ######################################## ## ## List NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir r_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_nfs',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:dir r_dir_perms; ') ######################################## ## ## Read files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir r_dir_perms; allow $1 nfs_t:file r_file_perms; ') ######################################## ## ## Do not audit attempts to read ## files on a NFS filesystem. ## ## ## ## The type of the domain to not audit. ## ## # interface(`fs_dontaudit_read_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file r_file_perms; ') ######################################## ## ## Read files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir r_dir_perms; allow $1 nfs_t:file write; ') ######################################## ## ## Execute files on a NFS filesystem. ## ## ## ## The type of the domain executing the files. ## ## # interface(`fs_exec_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir r_dir_perms; can_exec($1, nfs_t) ') ######################################## ## ## Do not audit attempts to read or ## write files on a NFS filesystem. ## ## ## ## The type of the domain to not audit. ## ## # interface(`fs_dontaudit_rw_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file { read write }; ') ######################################## ## ## Read symbolic links on a NFS filesystem. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_read_nfs_symlinks',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir r_dir_perms; allow $1 nfs_t:lnk_file r_file_perms; ') ######################################## ## ## Read directories of RPC file system pipes. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_getattr_rpc_dirs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir getattr; ') ######################################## ## ## Search directories of RPC file system pipes. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_search_rpc',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir search_dir_perms; ') ######################################## ## ## Search removable storage directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_removable',` gen_require(` type removable_t; ') allow $1 removable_t:dir { getattr read search }; ') ######################################## ## ## Do not audit attempts to list removable storage directories. ## ## ## ## Domain not to audit. ## ## # interface(`fs_dontaudit_list_removable',` gen_require(` type removable_t; ') dontaudit $1 removable_t:dir r_dir_perms; ') ######################################## ## ## Read removable storage files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_files',` gen_require(` type removable_t; ') allow $1 removable_t:file { read getattr }; ') ######################################## ## ## Do not audit attempts to read removable storage files. ## ## ## ## Domain not to audit. ## ## # interface(`fs_donaudit_read_removable_files',` gen_require(` type removable_t; ') dontaudit $1 removable_t:file r_file_perms; ') ######################################## ## ## Read removable storage symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_symlinks',` gen_require(` type removable_t; ') allow $1 removable_t:lnk_file { getattr read }; ') ######################################## ## ## Read directories of RPC file system pipes. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_list_rpc',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir { getattr read search }; ') ######################################## ## ## Read files of RPC file system pipes. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_read_rpc_files',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:file { read getattr }; ') ######################################## ## ## Read symbolic links of RPC file system pipes. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_read_rpc_symlinks',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:lnk_file { getattr read }; ') ######################################## ## ## Read sockets of RPC file system pipes. ## ## ## ## The type of the domain reading the symbolic links. ## ## # interface(`fs_read_rpc_sockets',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:sock_file { read write }; ') ######################################## ## ## Create, read, write, and delete directories ## on a NFS filesystem. ## ## ## ## The type of the domain managing the directories. ## ## # interface(`fs_manage_nfs_dirs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir create_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_nfs_dirs',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:dir create_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a NFS filesystem. ## ## ## ## The type of the domain managing the files. ## ## # interface(`fs_manage_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir rw_dir_perms; allow $1 nfs_t:file create_file_perms; ') ######################################## ## ## Do not audit attempts to create, ## read, write, and delete files ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file create_file_perms; ') ######################################### ## ## Create, read, write, and delete symbolic links ## on a CIFS or SMB network filesystem. ## ## ## ## The type of the domain managing the symbolic links. ## ## # interface(`fs_manage_nfs_symlinks',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir rw_dir_perms; allow $1 nfs_t:lnk_file create_lnk_perms; ') ######################################### ## ## Create, read, write, and delete named pipes ## on a NFS filesystem. ## ## ## ## The type of the domain managing the pipes. ## ## # interface(`fs_manage_nfs_named_pipes',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir rw_dir_perms; allow $1 nfs_t:fifo_file create_file_perms; ') ######################################### ## ## Create, read, write, and delete named sockets ## on a NFS filesystem. ## ## ## ## The type of the domain managing the sockets. ## ## # interface(`fs_manage_nfs_named_sockets',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir rw_dir_perms; allow $1 nfs_t:sock_file create_file_perms; ') ######################################## ## ## Execute a file on a NFS filesystem ## in the specified domain. ## ## ##

## Execute a file on a NFS filesystem ## in the specified domain. This allows ## the specified domain to execute any file ## on a NFS filesystem in the specified ## domain. This is not suggested. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##

## This interface was added to handle ## home directories on NFS filesystems, ## in particular used by the ssh-agent policy. ##

##
## ## ## The type of the process performing this action. ## ## ## ## ## The type of the new process. ## ## # interface(`fs_nfs_domtrans',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir search; domain_auto_trans($1,nfs_t,$2) ') ######################################## ## ## Mount a NFS server pseudo filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem mount; ') ######################################## ## ## Mount a NFS server pseudo filesystem. ## This allows some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem remount; ') ######################################## ## ## Unmount a NFS server pseudo filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a NFS server ## pseudo filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem getattr; ') ######################################## ## ## Search NFS server directories. ## ## ## ## The type of the domain doing the ## search on nfsd directories. ## ## # interface(`fs_search_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:dir search; ') ######################################## ## ## Read and write NFS server files. ## ## ## ## The type of the domain doing the ## read or write on nfsd files. ## ## # interface(`fs_rw_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:file rw_file_perms; ') ######################################## ## ## Mount a RAM filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem mount; ') ######################################## ## ## Remount a RAM filesystem. This allows ## some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem remount; ') ######################################## ## ## Unmount a RAM filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a RAM filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem getattr; ') ######################################## ## ## Search directories on a ramfs ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir search_dir_perms; ') ######################################## ## ## Dontaudit Search directories on a ramfs ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_search_ramfs',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:dir search; ') ######################################## ## ## Dontaudit read on a ramfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_read_ramfs_files',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:file read; ') ######################################## ## ## Dontaudit read on a ramfs fifo_files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_read_ramfs_pipes',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:fifo_file read; ') ######################################## ## ## Create, read, write, and delete ## files on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_files',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir rw_dir_perms; allow $1 ramfs_t:file manage_file_perms; ') ######################################## ## ## Write to named pipe on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_ramfs_pipes',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir search_dir_perms; allow $1 ramfs_t:fifo_file write; ') ######################################## ## ## Do not audit attempts to write to named ## pipes on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_write_ramfs_pipes',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:fifo_file write; ') ######################################## ## ## Read and write a named pipe on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_ramfs_pipes',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir search_dir_perms; allow $1 ramfs_t:fifo_file rw_file_perms; ') ######################################## ## ## Create, read, write, and delete ## named pipes on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_pipes',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir rw_dir_perms; allow $1 ramfs_t:fifo_file manage_file_perms; ') ######################################## ## ## Write to named socket on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_ramfs_sockets',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:sock_file write; ') ######################################## ## ## Create, read, write, and delete ## named sockets on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_sockets',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir rw_dir_perms; allow $1 ramfs_t:sock_file manage_file_perms; ') ######################################## ## ## Mount a ROM filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem mount; ') ######################################## ## ## Remount a ROM filesystem. This allows ## some mount options to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem remount; ') ######################################## ## ## Unmount a ROM filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a ROM ## filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem getattr; ') ######################################## ## ## Mount a RPC pipe filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem mount; ') ######################################## ## ## Remount a RPC pipe filesystem. This ## allows some mount option to be changed. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem remount; ') ######################################## ## ## Unmount a RPC pipe filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a RPC pipe ## filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem getattr; ') ######################################## ## ## Mount a tmpfs filesystem. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem mount; ') ######################################## ## ## Remount a tmpfs filesystem. ## ## ## ## The type of the domain remounting the filesystem. ## ## # interface(`fs_remount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem remount; ') ######################################## ## ## Unmount a tmpfs filesystem. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a tmpfs ## filesystem. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem getattr; ') ######################################## ## ## Allow the type to associate to tmpfs filesystems. ## ## ## ## The type of the object to be associated. ## ## # interface(`fs_associate_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem associate; ') ######################################## ## ## Get the attributes of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir getattr; ') ######################################## ## ## Set the attributes of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_setattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir setattr; ') ######################################## ## ## Search tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir search; ') ######################################## ## ## List the contents of generic tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir r_dir_perms; ') ######################################## ## ## Do not audit attempts to list the ## contents of generic tmpfs directories. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_tmpfs',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir r_dir_perms; ') ######################################## ## ## Create, read, write, and delete ## tmpfs directories ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir create_dir_perms; ') ######################################## # # fs_tmpfs_filetrans(domain,derivedtype,class) # interface(`fs_tmpfs_filetrans',` gen_require(` type tmpfs_t; ') allow $2 tmpfs_t:filesystem associate; allow $1 tmpfs_t:dir rw_dir_perms; type_transition $1 tmpfs_t:$3 $2; ') ######################################## ## ## Do not audit attempts to read or write ## generic tmpfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_tmpfs_files',` gen_require(` type tmp_t; ') dontaudit $1 tmpfs_t:file { read write }; ') ######################################## ## ## Create, read, write, and delete ## auto moutpoints. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir manage_dir_perms; ') ######################################## ## ## Read and write generic tmpfs files. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_rw_tmpfs_files',` gen_require(` type tmpfs_t; ') fs_search_tmpfs($1) allow $1 tmpfs_t:file rw_file_perms; ') ######################################## ## ## Read tmpfs link files. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_read_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') fs_search_tmpfs($1) allow $1 tmpfs_t:lnk_file read; ') ######################################## ## ## Read and write character nodes on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_rw_tmpfs_chr_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir r_dir_perms; allow $1 tmpfs_t:chr_file rw_file_perms; ') ######################################## ## ## dontaudit Read and write character nodes on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_dontaudit_use_tmpfs_chr_dev',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir r_dir_perms; dontaudit $1 tmpfs_t:chr_file rw_file_perms; ') ######################################## ## ## Relabel character nodes on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_relabel_tmpfs_chr_file',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir r_dir_perms; allow $1 tmpfs_t:chr_file { getattr relabelfrom relabelto }; ') ######################################## ## ## Read and write block nodes on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_rw_tmpfs_blk_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir r_dir_perms; allow $1 tmpfs_t:blk_file rw_file_perms; ') ######################################## ## ## Relabel block nodes on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_relabel_tmpfs_blk_file',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir r_dir_perms; allow $1 tmpfs_t:blk_file { getattr relabelfrom relabelto }; ') ######################################## ## ## Read and write, create and delete generic ## files on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_manage_tmpfs_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir rw_dir_perms; allow $1 tmpfs_t:file create_file_perms; ') ######################################## ## ## Read and write, create and delete symbolic ## links on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_manage_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir rw_dir_perms; allow $1 tmpfs_t:chr_file create_lnk_perms; ') ######################################## ## ## Read and write, create and delete socket ## files on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_manage_tmpfs_sockets',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir rw_dir_perms; allow $1 tmpfs_t:sock_file create_file_perms; ') ######################################## ## ## Read and write, create and delete character ## nodes on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_manage_tmpfs_chr_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir rw_dir_perms; allow $1 tmpfs_t:chr_file create_file_perms; ') ######################################## ## ## Read and write, create and delete block nodes ## on tmpfs filesystems. ## ## ## ## The type of the process performing this action. ## ## # interface(`fs_manage_tmpfs_blk_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir rw_dir_perms; allow $1 tmpfs_t:blk_file create_file_perms; ') ######################################## ## ## Mount all filesystems. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_mount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem mount; ') ######################################## ## ## Remount all filesystems. This ## allows some mount options to be changed. ## ## ## ## The type of the domain mounting the filesystem. ## ## # interface(`fs_remount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem remount; ') ######################################## ## ## Unmount all filesystems. ## ## ## ## The type of the domain unmounting the filesystem. ## ## # interface(`fs_unmount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem unmount; ') ######################################## ## ## Get the attributes of all persistent ## filesystems. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_getattr_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## all filesystems. ## ## ## ## The type of the domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_fs',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:filesystem getattr; ') ######################################## ## ## Get the quotas of all filesystems. ## ## ## ## The type of the domain getting quotas. ## ## # interface(`fs_get_all_fs_quotas',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem quotaget; ') ######################################## ## ## Set the quotas of all filesystems. ## ## ## ## The type of the domain setting quotas. ## ## # interface(`fs_set_all_quotas',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem quotamod; ') ######################################## ## ## Relabelfrom all filesystems. ## ## ## ## The type of the domain doing the ## getattr on the filesystem. ## ## # interface(`fs_relabelfrom_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem relabelfrom; ') ######################################## ## ## Get the attributes of all directories ## with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_dirs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir getattr; ') ######################################## ## ## Search all directories with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_all',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir search_dir_perms; ') ######################################## ## ## List all directories with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_all',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir r_dir_perms; ') ######################################## ## ## Get the attributes of all files with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_files',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir { search getattr }; allow $1 filesystem_type:file getattr; ') ######################################## ## ## Get the attributes of all symbolic links with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir { search getattr }; allow $1 filesystem_type:lnk_file getattr; ') ######################################## ## ## Get the attributes of all named pipes with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir { search getattr }; allow $1 filesystem_type:fifo_file getattr; ') ######################################## ## ## Get the attributes of all named sockets with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir { search getattr }; allow $1 filesystem_type:sock_file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all files with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_files',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all symbolic links with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:lnk_file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all named pipes with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:fifo_file getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of all named sockets with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_dontaudit_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:sock_file getattr; ') ######################################## ## ## Unconfined access to filesystems ## ## ## ## Domain allowed access. ## ## # interface(`fs_unconfined',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem *; # Create/access other files. fs_type is to pick up various # pseudo filesystem types that are applied to both the filesystem # and its files. allow $1 filesystem_type:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *; ')