## <module name="mount" layer="system"> ## <summary>Policy for mount.</summary> ######################################## ## <interface name="mount_domtrans"> ## <description> ## Execute mount in the mount domain. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## </interface> # define(`mount_domtrans',` gen_require(`$0'_depend) allow $1 mount_exec_t:file rx_file_perms; allow $1 mount_t:process transition; type_transition $1 mount_exec_t:process mount_t; dontaudit $1 mount_t:process { noatsecure siginh rlimitinh }; allow $1 mount_t:fd use; allow mount_t $1:fd use; allow mount_t $1:fifo_file rw_file_perms; allow mount_t $1:process sigchld; ') define(`mount_domtrans_depend',` type mount_t, mount_exec_t; class file rx_file_perms; class process { transition noatsecure siginh rlimitinh sigchld }; class fd use; class fifo_file rw_file_perms; ') ######################################## ## <interface name="mount_run"> ## <description> ## Execute mount in the mount domain, and ## allow the specified role the mount domain, ## and use the caller's terminal. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## <parameter name="role"> ## The role to be allowed the mount domain. ## </parameter> ## <parameter name="terminal"> ## The type of the terminal allow the mount domain to use. ## </parameter> ## </interface> # define(`mount_run',` gen_require(`$0'_depend) mount_domtrans($1) role $2 types mount_t; allow mount_t $3:chr_file rw_file_perms; ') define(`mount_run_depend',` type mount_t; class chr_file rw_file_perms; ') ######################################## ## <interface name="mount_use_fd"> ## <description> ## Use file descriptors for mount. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## </interface> # define(`mount_use_fd',` gen_require(`$0'_depend) allow $1 mount_t:fd use; ') define(`mount_use_fd_depend',` type mount_t; class fd use; ') ######################################## ## <interface name="mount_send_nfs_client_request"> ## <description> ## Allow the mount domain to send nfs requests for mounting ## network drives ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## </interface> # define(`mount_send_nfs_client_request',` gen_require(`$0'_depend) allow $1 mount_t:udp_socket rw_socket_perms; ') define(`mount_send_nfs_client_request_depend',` type mount_t; class udp_socket rw_socket_perms; ') ## </module>