## <module name="lvm" layer="system"> ## <summary>Policy for logical volume management programs.</summary> ######################################## ## <interface name="lvm_transition"> ## <description> ## Execute lvm programs in the lvm domain. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## </interface> # define(`lvm_transition',` requires_block_template(`$0'_depend) domain_auto_trans($1, lvm_exec_t, lvm_t) allow $1 lvm_t:fd use; allow lvm_t $1:fd use; allow lvm_t $1:fifo_file rw_file_perms; allow lvm_t $1:process sigchld; ') define(`lvm_transition_depend',` type lvm_t, lvm_exec_t; class file { getattr read execute }; class process { transition noatsecure siginh rlimitinh sigchld }; class fd use; class fifo_file rw_file_perms; ') ######################################## ## <interface name="lvm_transition_add_role_use_terminal"> ## <description> ## Execute lvm programs in the lvm domain. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## <parameter name="role"> ## The role to allow the LVM domain. ## </parameter> ## <parameter name="terminal"> ## The type of the terminal allow the LVM domain to use. ## </parameter> ## </interface> # define(`lvm_transition_add_role_use_terminal',` requires_block_template(`$0'_depend) lvm_transition($1) role $2 types lvm_t; allow lvm_t $3:chr_file { getattr read write ioctl }; ') define(`lvm_transition_add_role_use_terminal_depend',` type lvm_t; class chr_file { getattr read write ioctl }; ') ######################################## ## <interface name="lvm_read_config"> ## <description> ## Read LVM configuration files. ## </description> ## <parameter name="domain"> ## The type of the process performing this action. ## </parameter> ## </interface> # define(`lvm_read_config',` requires_block_template(`$0'_depend) allow $1 lvm_etc_t:dir r_dir_perms; allow $1 lvm_etc_t:file r_file_perms; ') define(`lvm_read_config_depend',` type lvm_t, lvm_exec_t; class dir r_dir_perms; class file r_file_perms; ') ## </module>