# Copyright (C) 2005 Tresys Technology, LLC

########################################
#
# files_make_file(type)
#
define(`files_make_file',`
requires_block_template(`$0'_depend)
typeattribute $1 file_type;
filesystem_associate($1)
filesystem_noxattr_associate($1)
')

define(`files_make_file_depend',`
attribute file_type;
')

########################################
#
# files_make_mountpoint(type)
#
define(`files_make_mountpoint',`
requires_block_template(`$0'_depend)
typeattribute $1 mountpoint;
')

define(`files_make_mountpoint_depend',`
attribute mountpoint;
')

########################################
#
# files_get_all_file_attributes(type)
#
define(`files_get_all_file_attributes',`
requires_block_template(`$0'_depend)
allow $1 file_type:dir { search getattr };
allow $1 file_type:file getattr;
allow $1 file_type:lnk_file getattr;
allow $1 file_type:fifo_file getattr;
allow $1 file_type:sock_file getattr;
')

define(`files_get_all_file_attributes_depend',`
attribute file_type;
class dir { search getattr };
class file getattr;
class lnk_file getattr;
class fifo_file getattr;
class sock_file getattr;
')

########################################
#
# files_manage_all_files_labels(type)
#
define(`files_manage_all_files_labels',`
requires_block_template(`$0'_depend)
allow $1 file_type:dir { getattr relabelfrom relabelto };
allow $1 file_type:file { getattr relabelfrom relabelto };
allow $1 file_type:lnk_file { getattr relabelfrom relabelto };
allow $1 file_type:fifo_file { getattr relabelfrom relabelto };
allow $1 file_type:sock_file { getattr relabelfrom relabelto };
allow $1 file_type:blk_file { getattr relabelfrom };
allow $1 file_type:chr_file { getattr relabelfrom };
')

define(`files_manage_all_files_labels_depend',`
attribute file_type;
class dir { relabelfrom relabelto };
class file { relabelfrom relabelto };
class lnk_file { relabelfrom relabelto };
class fifo_file { relabelfrom relabelto };
class sock_file { relabelfrom relabelto };
class blk_file relabelfrom;
class chr_file relabelfrom;
')

########################################
#
# files_search_all_directories(domain)
#
define(`files_search_all_directories',`
requires_block_template(`$0'_depend)
allow $1 file_type:dir search;
')

define(`files_search_all_directories_depend',`
attribute file_type;
class dir search;
')

########################################
#
# files_ignore_search_all_directories(domain)
#
define(`files_ignore_search_all_directories',`
requires_block_template(`$0'_depend)
dontaudit $1 file_type:dir search;
')

define(`files_ignore_search_all_directories_depend',`
attribute file_type;
class dir search;
')

########################################
#
# files_read_all_directories(type)
#
define(`files_read_all_directories',`
requires_block_template(`$0'_depend)
allow $1 file_type:dir { getattr search read };
')

define(`files_read_all_directories_depend',`
attribute file_type;
class dir { getattr search read };
')

########################################
#
# files_mount_on_all_mountpoints(type)
#
define(`files_mount_on_all_mountpoints',`
requires_block_template(`$0'_depend)
allow $1 mountpoint:dir { getattr search mounton };
')

define(`files_mount_on_all_mountpoints_depend',`
attribute mountpoint;
class dir { getattr search mounton };
')

########################################
#
# files_read_root_dir(domain)
#
define(`files_read_root_dir',`
requires_block_template(`$0'_depend)
allow $1 root_t:dir { getattr search read };
allow $1 root_t:lnk_file { getattr read };
')

define(`files_read_root_dir_depend',`
type root_t;
class dir { getattr search read };
class lnk_file { getattr read };
')

########################################
#
# files_create_root_dir_entry(domain)
#
define(`files_create_root_dir_entry',`
requires_block_template(`$0'_depend)
allow $1 root_t:dir { getattr search read write add_name };
')

define(`files_create_root_dir_entry_depend',`
type root_t;
class dir { getattr search read write add_name };
')

########################################
#
# files_ignore_read_rootfs_file(domain)
#
define(`files_ignore_read_rootfs_file',`
requires_block_template(`$0'_depend)
dontaudit $1 root_t:file read;
')

define(`files_ignore_read_rootfs_file_depend',`
type root_t;
class file read;
')

########################################
#
# files_ignore_modify_rootfs_file(domain)
#
define(`files_ignore_modify_rootfs_file',`
requires_block_template(`$0'_depend)
dontaudit $1 root_t:file { read write };
')

define(`files_ignore_modify_rootfs_file_depend',`
type root_t;
class file { read write };
')

########################################
#
# files_ignore_modify_rootfs_device(domain)
#
define(`files_ignore_modify_rootfs_device',`
requires_block_template(`$0'_depend)
dontaudit $1 root_t:chr_file { read write };
')

define(`files_ignore_modify_rootfs_device_depend',`
type root_t;
class chr_file { read write };
')

########################################
#
# files_create_private_root_dir_entry(domain,privatetype,[class(es)])
#
define(`files_create_private_root_dir_entry',`
requires_block_template(`$0'_depend)
allow $1 root_t:dir { getattr search read write add_name remove_name };
ifelse(`$3',`',`
type_transition $1 root_t:file $2;
',`
type_transition $1 root_t:$3 $2;
') dnl end ifelse
')

define(`files_create_private_root_dir_entry_depend',`
type root_t;
class dir { getattr search read write add_name remove_name };
')

########################################
#
# files_remove_root_dir_entry(domain)
#
define(`files_remove_root_dir_entry',`
requires_block_template(`$0'_depend)
allow $1 root_t:dir { getattr search read write remove_name };
')

define(`files_remove_root_dir_entry_depend',`
type root_t;
class dir { getattr search read write remove_name };
')

########################################
#
# files_unmount_root_filesystem(domain)
#
define(`files_unmount_root_filesystem',`
requires_block_template(`$0'_depend)
allow $1 root_t:filesystem unmount;
')

define(`files_unmount_root_filesystem_depend',`
type root_t;
class filesystem unmount;
')

########################################
#
# files_read_general_system_config(domain)
#
define(`files_read_general_system_config',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { getattr search read };
allow $1 etc_t:file { getattr read };
allow $1 etc_t:lnk_file { getattr read };
')

define(`files_read_general_system_config_depend',`
type etc_t;
class dir { getattr search read };
class file { getattr read };
class lnk_file { getattr read };
')

########################################
#
# files_modify_general_system_config(domain)
#
define(`files_modify_general_system_config',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { getattr search read };
allow $1 etc_t:file { getattr read write };
allow $1 etc_t:lnk_file { getattr read };
')

define(`files_modify_general_system_config_depend',`
type etc_t;
class dir { getattr search read };
class file { getattr read write };
class lnk_file { getattr read };
')

########################################
#
# files_manage_general_system_config(domain)
#
define(`files_manage_general_system_config',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { read getattr lock search ioctl add_name remove_name write };
allow $1 etc_t:file { create ioctl read getattr lock write setattr append link unlink rename };
allow $1 etc_t:lnk_file { getattr read };
')

define(`files_manage_general_system_config_depend',`
type etc_t;
class dir { read getattr lock search ioctl add_name remove_name write };
class file { create ioctl read getattr lock write setattr append link unlink rename };
class lnk_file { getattr read };
')

########################################
#
# files_execute_system_config_script(domain)
#
define(`files_execute_system_config_script',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { getattr search read };
allow $1 etc_t:lnk_file { getattr read };
allow $1 etc_t:file { getattr read execute execute_no_trans };
')

define(`files_execute_system_config_script_depend',`
type etc_t, etc_runtime_t;
class dir { getattr search read };
class lnk_file { getattr read };
class file { getattr read execute execute_no_trans };
')

########################################
#
# files_create_boot_flag(type)
#
# /halt, /.autofsck, etc
#
define(`files_create_boot_flag',`
requires_block_template(`$0'_depend)
allow $1 root_t:dir { getattr search read write add_name remove_name };
allow $1 etc_runtime_t:file { create read write setattr unlink };
type_transition $1 root_t:file etc_runtime_t;
')

define(`files_create_boot_flag_depend',`
type root_t, etc_runtime_t;
class dir { getattr search read write add_name };
class file { create read write setattr };
')

########################################
#
# files_create_runtime_system_config(type)
#
define(`files_create_runtime_system_config',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { getattr search read write add_name remove_name };
allow $1 etc_runtime_t:file { create read write setattr unlink };
type_transition $1 etc_t:file etc_runtime_t;
')

define(`files_create_runtime_system_config_depend',`
type etc_t, etc_runtime_t;
class dir { getattr search read write add_name };
class file { create read write setattr };
')

########################################
#
# files_read_runtime_system_config(domain)
#
define(`files_read_runtime_system_config',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { getattr search read };
allow $1 etc_runtime_t:file { getattr read };
')

define(`files_create_runtime_system_config_depend',`
type etc_t, etc_runtime_t;
class dir { getattr search read };
class file { getattr read };
')

########################################
#
# files_create_private_config(domain,privatetype,[class(es)])
#
define(`files_create_private_config',`
requires_block_template(`$0'_depend)
allow $1 etc_t:dir { getattr search read write add_name remove_name };
ifelse(`$3',`',`
type_transition $1 etc_t:file $2;
',`
type_transition $1 etc_t:$3 $2;
') dnl end ifelse
')

define(`files_create_private_config_depend',`
type etc_t;
class dir { getattr search read write add_name remove_name };
')

########################################
#
# files_list_home_directories(type)
#
define(`files_list_home_directories',`
requires_block_template(`$0'_depend)
allow $1 home_root_t:dir { getattr search read };
')

define(`files_list_home_directories_depend',`
type home_root_t;
class dir { getattr search read };
')

########################################
#
# files_create_private_tmp_data(domain,private_type,[object class(es)])
#
define(`files_create_private_tmp_data',`
requires_block_template(`$0'_depend)
allow $1 tmp_t:dir { getattr search read write add_name remove_name };
ifelse(`$3',`',`
type_transition $1 tmp_t:file $2;
',`
type_transition $1 tmp_t:$3 $2;
')
typeattribute $1 tmpfile;
')

define(`files_create_private_tmp_data_depend',`
attribute tmpfile;
type tmp_t;
class dir { getattr search read write add_name };
')

########################################
#
# files_remove_all_tmp_data(domain)
#
define(`files_remove_all_tmp_data',`
requires_block_template(`$0'_depend)
allow $1 tmpfile:dir { getattr search read write add_name remove_name rmdir };
allow $1 tmpfile:file { getattr unlink };
allow $1 tmpfile:lnk_file { getattr unlink };
allow $1 tmpfile:fifo_file { getattr unlink };
allow $1 tmpfile:sock_file { getattr unlink };
')

define(`files_remove_all_tmp_data_depend',`
attribute tmpfile;
class dir { getattr search read write add_name remove_name rmdir };
class file { getattr unlink };
class lnk_file { getattr unlink };
class fifo_file { getattr unlink };
class sock_file { getattr unlink };
')

########################################
#
# files_read_general_application_resources(domain)
#
define(`files_read_general_application_resources',`
requires_block_template(`$0'_depend)
allow $1 usr_t:dir { getattr search read };
allow $1 usr_t:{ file lnk_file } { getattr read };
')

define(`files_read_general_application_resources_depend',`
type usr_t;
class dir { getattr search read };
class file { getattr read };
class lnk_file { getattr read };
')

########################################
#
# files_read_system_source_code(domain)
#
define(`files_read_system_source_code',`
requires_block_template(`$0'_depend)
allow $1 usr_t:dir search;
allow $1 src_t:dir { getattr search read };
allow $1 src_t:{ file lnk_file } { getattr read };
')

define(`files_read_system_source_code_depend',`
type usr_t, src_t;
class dir { getattr search read };
class file { getattr read };
class lnk_file { getattr read };
')

########################################
#
# files_search_system_state_data_directory(domain)
#
define(`files_search_system_state_data_directory',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
')

define(`files_search_system_state_data_directory_depend',`
type var_t;
class dir search;
')

########################################
#
# files_ignore_search_system_state_data_directory(domain)
#
define(`files_ignore_search_system_state_data_directory',`
requires_block_template(`$0'_depend)
dontaudit $1 var_t:dir search;
')

define(`files_ignore_search_system_state_data_directory_depend',`
type var_t;
class dir search;
')

########################################
#
# files_manage_pseudorandom_saved_seed(domain)
#
define(`files_manage_pseudorandom_saved_seed',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
allow $1 var_lib_t:dir { getattr search read write add_name remove_name };
allow $1 var_lib_t:file { getattr create read write setattr unlink };
')

define(`files_manage_pseudorandom_saved_seed_depend',`
type var_t, var_lib_t;
class dir { getattr search read write add_name remove_name };
class file { getattr create read write setattr unlink };
')

########################################
#
# files_manage_system_lock_files(domain)
#
define(`files_manage_system_lock_files',`
requires_block_template(`$0'_depend)
allow $1 var_lock_t:dir { getattr search create read write setattr add_name remove_name rmdir };
allow $1 var_lock_t:file { getattr create read write setattr unlink };
')

define(`files_manage_system_lock_files_depend',`
type var_lock_t;
class dir { getattr search create read write setattr add_name remove_name rmdir };
class file { getattr create read write setattr unlink };
')

########################################
#
# files_remove_all_lock_files(domain)
#
define(`files_remove_all_lock_files',`
requires_block_template(`$0'_depend)
allow $1 lockfile:dir { getattr search read write add_name remove_name };
allow $1 lockfile:file { getattr unlink };
')

define(`files_remove_all_lock_files_depend',`
attribute lockfile;
class dir { getattr search read write add_name remove_name };
class file { getattr unlink };
')

########################################
#
# files_search_runtime_data_directory(domain)
#
define(`files_search_runtime_data_directory',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
allow $1 var_run_t:dir search;
')

define(`files_search_runtime_data_directory_depend',`
type var_t, var_run_t;
class dir search;
')

########################################
#
# files_read_runtime_data_directory(domain)
#
define(`files_read_runtime_data_directory',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
allow $1 var_run_t:dir { getattr search read };
')

define(`files_read_runtime_data_directory_depend',`
type var_t, var_run_t;
class dir { getattr search read };
')

########################################
#
# files_create_daemon_runtime_data(domain,pidfile,[object class(es)])
#
define(`files_create_daemon_runtime_data',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
allow $1 var_run_t:dir { getattr search read write add_name remove_name };
ifelse(`$3',`',`
type_transition $1 var_run_t:file $2;
',`
type_transition $1 var_run_t:$3 $2;
') dnl end ifelse
typeattribute $1 pidfile;
')

define(`files_create_daemon_runtime_data_depend',`
attribute pidfile;
type var_t, var_run_t;
class dir { getattr search read write add_name remove_name };
')

########################################
#
# files_modify_system_runtime_data(domain)
#
define(`files_modify_system_runtime_data',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
allow $1 var_run_t:dir { getattr search read };
allow $1 var_run_t:file { getattr read write };
')

define(`files_modify_system_runtime_data_depend',`
type var_t, var_run_t;
class dir { getattr search read };
class file { getattr read write };
')

########################################
#
# files_remove_all_daemon_runtime_data(domain)
#
define(`files_remove_all_daemon_runtime_data',`
requires_block_template(`$0'_depend)
allow $1 var_t:dir search;
allow $1 var_run_t:{ sock_file lnk_file } { getattr unlink };
allow $1 var_run_t:dir rmdir;
allow $1 pidfile:dir { getattr search read write add_name remove_name };
allow $1 pidfile:file { getattr unlink };
allow $1 pidfile:sock_file { getattr unlink };
')

define(`files_remove_all_daemon_runtime_data_depend',`
attribute pidfile;
type var_t, var_run_t;
class dir { getattr search read write add_name remove_name rmdir };
class file { getattr unlink };
class lnk_file { getattr unlink };
class sock_file { getattr unlink };
')