1293 lines
30 KiB
Plaintext
1293 lines
30 KiB
Plaintext
## <module name="files" layer="system">
|
|
## <summary>Policy controlling access to general files</summary>
|
|
|
|
########################################
|
|
#
|
|
# files_make_file(type)
|
|
#
|
|
define(`files_make_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
filesystem_associate($1)
|
|
filesystem_noxattr_associate($1)
|
|
typeattribute $1 file_type;
|
|
')
|
|
|
|
define(`files_make_file_depend',`
|
|
attribute file_type;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_make_lock_file(type)
|
|
#
|
|
define(`files_make_lock_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
files_make_file($1)
|
|
typeattribute $1 lockfile;
|
|
')
|
|
|
|
define(`files_make_lock_file_depend',`
|
|
attribute lockfile;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_make_mountpoint(type)
|
|
#
|
|
define(`files_make_mountpoint',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
files_make_file($1)
|
|
typeattribute $1 mountpoint;
|
|
')
|
|
|
|
define(`files_make_mountpoint_depend',`
|
|
attribute mountpoint;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_make_daemon_runtime_file(type)
|
|
#
|
|
define(`files_make_daemon_runtime_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
files_make_file($1)
|
|
typeattribute $1 pidfile;
|
|
')
|
|
|
|
define(`files_make_daemon_runtime_file_depend',`
|
|
attribute pidfile;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_make_temporary_file(type)
|
|
#
|
|
define(`files_make_temporary_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
files_make_file($1)
|
|
typeattribute $1 tmpfile;
|
|
')
|
|
|
|
define(`files_make_temporary_file_depend',`
|
|
attribute tmpfile;
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_make_tmpfs_file">
|
|
## <description>
|
|
## Transform the type into a file, for use on a
|
|
## virtual memory filesystem (tmpfs).
|
|
## </description>
|
|
## <parameter name="type">
|
|
## The type to be transformed.
|
|
## </parameter>
|
|
## <infoflow type="none"/>
|
|
## </interface>
|
|
#
|
|
define(`files_make_tmpfs_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
files_make_file($1)
|
|
filesystem_tmpfs_associate($1)
|
|
typeattribute $1 tmpfsfile;
|
|
')
|
|
|
|
define(`files_make_tmpfs_file_depend',`
|
|
attribute tmpfsfile;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_get_all_file_attributes(domain)
|
|
|
|
define(`files_get_all_file_attributes',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_type:dir { search getattr };
|
|
allow $1 file_type:file getattr;
|
|
allow $1 file_type:lnk_file getattr;
|
|
allow $1 file_type:fifo_file getattr;
|
|
allow $1 file_type:sock_file getattr;
|
|
')
|
|
|
|
define(`files_get_all_file_attributes_depend',`
|
|
attribute file_type;
|
|
|
|
class dir { search getattr };
|
|
class file getattr;
|
|
class lnk_file getattr;
|
|
class fifo_file getattr;
|
|
class sock_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_relabel_all_files">
|
|
## <description>
|
|
## Relabel all files on the filesystem, except
|
|
## the listed exceptions.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the domain perfoming this action.
|
|
## </parameter>
|
|
## <parameter name="exception_types" optional="true">
|
|
## The types to be excluded. Each type or attribute
|
|
## must be negated by the caller.
|
|
## </parameter>
|
|
## <infoflow type="both" weight="10"/>
|
|
## </interface>
|
|
#
|
|
define(`files_relabel_all_files',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };
|
|
allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };
|
|
allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };
|
|
allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };
|
|
allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };
|
|
allow $1 { file_type $2 }:blk_file { getattr relabelfrom };
|
|
allow $1 { file_type $2 }:chr_file { getattr relabelfrom };
|
|
|
|
# satisfy the assertions:
|
|
selinux_relabelto_binary_policy($1)
|
|
')
|
|
|
|
define(`files_relabel_all_files_depend',`
|
|
attribute file_type;
|
|
|
|
class dir { r_dir_perms relabelfrom relabelto };
|
|
class file { relabelfrom relabelto };
|
|
class lnk_file { relabelfrom relabelto };
|
|
class fifo_file { relabelfrom relabelto };
|
|
class sock_file { relabelfrom relabelto };
|
|
class blk_file relabelfrom;
|
|
class chr_file relabelfrom;
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_manage_all_files">
|
|
## <description>
|
|
## Manage all files on the filesystem, except
|
|
## the listed exceptions.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the domain perfoming this action.
|
|
## </parameter>
|
|
## <parameter name="exception_types" optional="true">
|
|
## The types to be excluded. Each type or attribute
|
|
## must be negated by the caller.
|
|
## </parameter>
|
|
## <infoflow type="both" weight="10"/>
|
|
## </interface>
|
|
#
|
|
define(`files_manage_all_files',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 { file_type $2 }:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
|
|
allow $1 { file_type $2 }:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
allow $1 { file_type $2 }:lnk_file { create read getattr setattr link unlink rename };
|
|
allow $1 { file_type $2 }:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
allow $1 { file_type $2 }:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
|
|
# satisfy the assertions:
|
|
selinux_write_binary_policy($1)
|
|
bootloader_manage_kernel_modules($1)
|
|
')
|
|
|
|
define(`files_manage_all_files_depend',`
|
|
attribute file_type;
|
|
|
|
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
|
|
class file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
class lnk_file { create read getattr setattr link unlink rename };
|
|
class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_search_all_directories(domain)
|
|
#
|
|
define(`files_search_all_directories',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_type:dir search;
|
|
')
|
|
|
|
define(`files_search_all_directories_depend',`
|
|
attribute file_type;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_all_directories(domain)
|
|
#
|
|
define(`files_read_all_directories',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_type:dir r_dir_perms;
|
|
')
|
|
|
|
define(`files_read_all_directories_depend',`
|
|
attribute file_type;
|
|
|
|
class dir r_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_search_all_directories(domain)
|
|
#
|
|
define(`files_ignore_search_all_directories',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 file_type:dir search;
|
|
')
|
|
|
|
define(`files_ignore_search_all_directories_depend',`
|
|
attribute file_type;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
#######################################
|
|
#
|
|
# files_relabelto_all_file_type_filesystems(domain)
|
|
#
|
|
define(`files_relabelto_all_file_type_filesystems',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_type:filesystem relabelto;
|
|
')
|
|
|
|
define(`files_relabelto_all_file_type_filesystems_depend',`
|
|
attribute file_type;
|
|
|
|
filesystem relabelto;
|
|
')
|
|
|
|
#######################################
|
|
#
|
|
# files_mount_all_file_type_filesystems(domain)
|
|
#
|
|
define(`files_mount_all_file_type_filesystems',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_type:filesystem mount;
|
|
')
|
|
|
|
define(`files_mount_all_file_type_filesystems_depend',`
|
|
attribute file_type;
|
|
|
|
filesystem mount;
|
|
')
|
|
|
|
#######################################
|
|
#
|
|
# files_unmount_all_file_type_filesystems(domain)
|
|
#
|
|
define(`files_unmount_all_file_type_filesystems',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_type:filesystem mount;
|
|
')
|
|
|
|
define(`files_unmount_all_file_type_filesystems_depend',`
|
|
attribute file_type;
|
|
|
|
filesystem mount;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_mount_on_all_mountpoints(domain)
|
|
#
|
|
define(`files_mount_on_all_mountpoints',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 mountpoint:dir { getattr search mounton };
|
|
')
|
|
|
|
define(`files_mount_on_all_mountpoints_depend',`
|
|
attribute mountpoint;
|
|
|
|
class dir { getattr search mounton };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_root_dir(domain)
|
|
#
|
|
define(`files_read_root_dir',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 root_t:dir r_dir_perms;
|
|
allow $1 root_t:lnk_file { getattr read };
|
|
')
|
|
|
|
define(`files_read_root_dir_depend',`
|
|
type root_t;
|
|
|
|
class dir r_dir_perms;
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_create_root_dir_entry(domain)
|
|
#
|
|
define(`files_create_root_dir_entry',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 root_t:dir ra_dir_perms;
|
|
')
|
|
|
|
define(`files_create_root_dir_entry_depend',`
|
|
type root_t;
|
|
|
|
class dir ra_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_read_rootfs_file(domain)
|
|
#
|
|
define(`files_ignore_read_rootfs_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 root_t:file read;
|
|
')
|
|
|
|
define(`files_ignore_read_rootfs_file_depend',`
|
|
type root_t;
|
|
|
|
class file read;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_modify_rootfs_file(domain)
|
|
#
|
|
define(`files_ignore_modify_rootfs_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 root_t:file { read write };
|
|
')
|
|
|
|
define(`files_ignore_modify_rootfs_file_depend',`
|
|
type root_t;
|
|
|
|
class file { read write };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_modify_rootfs_device(domain)
|
|
#
|
|
define(`files_ignore_modify_rootfs_device',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 root_t:chr_file { read write };
|
|
')
|
|
|
|
define(`files_ignore_modify_rootfs_device_depend',`
|
|
type root_t;
|
|
|
|
class chr_file { read write };
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_create_private_root_dir_entry">
|
|
## <description>
|
|
## Create an object in the root directory, with a private
|
|
## type. If no object class is specified, the
|
|
## default is file.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <parameter name="private type">
|
|
## The type of the object to be created.
|
|
## </parameter>
|
|
## <parameter name="object" optional="true">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <infoflow type="write" weight="10"/>
|
|
## </interface>
|
|
#
|
|
define(`files_create_private_root_dir_entry',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 root_t:dir rw_dir_perms;
|
|
|
|
ifelse(`$3',`',`
|
|
type_transition $1 root_t:file $2;
|
|
',`
|
|
type_transition $1 root_t:$3 $2;
|
|
') dnl end ifelse
|
|
')
|
|
|
|
define(`files_create_private_root_dir_entry_depend',`
|
|
type root_t;
|
|
|
|
class dir rw_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_remove_root_dir_entry(domain)
|
|
#
|
|
define(`files_remove_root_dir_entry',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 root_t:dir { getattr search read write remove_name };
|
|
')
|
|
|
|
define(`files_remove_root_dir_entry_depend',`
|
|
type root_t;
|
|
|
|
class dir { getattr search read write remove_name };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_unmount_root_filesystem(domain)
|
|
#
|
|
define(`files_unmount_root_filesystem',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 root_t:filesystem unmount;
|
|
')
|
|
|
|
define(`files_unmount_root_filesystem_depend',`
|
|
type root_t;
|
|
|
|
class filesystem unmount;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_search_general_system_config_directory(domain)
|
|
#
|
|
define(`files_search_general_system_config_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir search;
|
|
')
|
|
|
|
define(`files_search_general_system_config_directory_depend',`
|
|
type etc_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_general_system_config_directory(domain)
|
|
#
|
|
define(`files_read_general_system_config_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read };
|
|
')
|
|
|
|
define(`files_read_general_system_config_directory_depend',`
|
|
type etc_t;
|
|
|
|
class dir { getattr search read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_general_system_config(domain)
|
|
#
|
|
define(`files_read_general_system_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read };
|
|
allow $1 etc_t:file { getattr read ioctl };
|
|
allow $1 etc_t:lnk_file { getattr read };
|
|
')
|
|
|
|
define(`files_read_general_system_config_depend',`
|
|
type etc_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read };
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_modify_general_system_config(domain)
|
|
#
|
|
define(`files_modify_general_system_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read };
|
|
allow $1 etc_t:file { getattr read write ioctl };
|
|
allow $1 etc_t:lnk_file { getattr read };
|
|
')
|
|
|
|
define(`files_modify_general_system_config_depend',`
|
|
type etc_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read write ioctl };
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_manage_general_system_config(domain)
|
|
#
|
|
define(`files_manage_general_system_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { read getattr lock search ioctl add_name remove_name write };
|
|
allow $1 etc_t:file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
allow $1 etc_t:lnk_file { getattr read };
|
|
')
|
|
|
|
define(`files_manage_general_system_config_depend',`
|
|
type etc_t;
|
|
|
|
class dir { read getattr lock search ioctl add_name remove_name write };
|
|
class file { create ioctl read getattr lock write setattr append link unlink rename };
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_remove_general_system_config">
|
|
## <description>
|
|
## Delete system configuration files in /etc.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <infoflow type="write" weight="1"/>
|
|
## </interface>
|
|
#
|
|
define(`files_remove_general_system_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read write remove_name };
|
|
allow $1 etc_t:file unlink;
|
|
')
|
|
|
|
define(`files_remove_general_system_config_depend',`
|
|
type etc_t;
|
|
|
|
class dir { getattr search read write remove_name };
|
|
class file unlink;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_execute_system_config_script(domain)
|
|
#
|
|
define(`files_execute_system_config_script',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read };
|
|
allow $1 etc_t:lnk_file { getattr read };
|
|
allow $1 etc_t:file { getattr read execute execute_no_trans };
|
|
')
|
|
|
|
define(`files_execute_system_config_script_depend',`
|
|
type etc_t;
|
|
|
|
class dir { getattr search read };
|
|
class lnk_file { getattr read };
|
|
class file { getattr read execute execute_no_trans };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_create_boot_flag(domain)
|
|
#
|
|
# /halt, /.autofsck, etc
|
|
#
|
|
define(`files_create_boot_flag',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 root_t:dir { getattr search read write add_name remove_name };
|
|
allow $1 etc_runtime_t:file { create read write setattr unlink };
|
|
type_transition $1 root_t:file etc_runtime_t;
|
|
')
|
|
|
|
define(`files_create_boot_flag_depend',`
|
|
type root_t, etc_runtime_t;
|
|
|
|
class dir { getattr search read write add_name };
|
|
class file { create read write setattr };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_manage_runtime_system_config(type)
|
|
#
|
|
define(`files_manage_runtime_system_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read write add_name remove_name };
|
|
allow $1 etc_runtime_t:file { getattr create read write append setattr rename link unlink lock };
|
|
type_transition $1 etc_t:file etc_runtime_t;
|
|
')
|
|
|
|
define(`files_manage_runtime_system_config_depend',`
|
|
type etc_t, etc_runtime_t;
|
|
|
|
class dir { getattr search read write add_name };
|
|
class file { getattr create read write append setattr rename unlink unlink lock };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_runtime_system_config(domain)
|
|
#
|
|
define(`files_read_runtime_system_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir { getattr search read };
|
|
allow $1 etc_runtime_t:file { getattr read };
|
|
')
|
|
|
|
define(`files_read_runtime_system_config_depend',`
|
|
type etc_t, etc_runtime_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_create_private_config(domain,privatetype,[class(es)])
|
|
#
|
|
define(`files_create_private_config',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 etc_t:dir rw_dir_perms;
|
|
ifelse(`$3',`',`
|
|
type_transition $1 etc_t:file $2;
|
|
',`
|
|
type_transition $1 etc_t:$3 $2;
|
|
')
|
|
')
|
|
|
|
define(`files_create_private_config_depend',`
|
|
type etc_t;
|
|
|
|
class dir rw_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_modify_isid_type_dir(domain)
|
|
#
|
|
define(`files_modify_isid_type_dir',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 file_t:dir rw_dir_perms;
|
|
')
|
|
|
|
define(`files_modify_isid_type_dir_depend',`
|
|
type file_t;
|
|
|
|
class dir rw_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_get_isid_type_dir_attrib(domain)
|
|
#
|
|
define(`files_ignore_get_isid_type_dir_attrib',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 file_t:dir search;
|
|
')
|
|
|
|
define(`files_ignore_get_isid_type_dir_attrib_depend',`
|
|
type file_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_search_isid_type_dir(domain)
|
|
#
|
|
define(`files_ignore_search_isid_type_dir',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 file_t:dir search;
|
|
')
|
|
|
|
define(`files_ignore_search_isid_type_dir_depend',`
|
|
type file_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_list_home_directories">
|
|
## <description>
|
|
## Get listing home home directories.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <infoflow type="read" weight="10"/>
|
|
## </interface>
|
|
#
|
|
define(`files_list_home_directories',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 home_root_t:dir { getattr search read };
|
|
')
|
|
|
|
define(`files_list_home_directories_depend',`
|
|
type home_root_t;
|
|
|
|
class dir { getattr search read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_mnt_dir(domain)
|
|
#
|
|
define(`files_read_mnt_dir',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 mnt_t:dir { getattr search read };
|
|
')
|
|
|
|
define(`files_read_runtime_system_config_depend',`
|
|
type mnt_t;
|
|
|
|
class dir { getattr search read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_create_private_tmp_data(domain,private_type,[object class(es)])
|
|
#
|
|
define(`files_create_private_tmp_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 tmp_t:dir { getattr search read write add_name remove_name };
|
|
|
|
ifelse(`$3',`',`
|
|
type_transition $1 tmp_t:file $2;
|
|
',`
|
|
type_transition $1 tmp_t:$3 $2;
|
|
')
|
|
')
|
|
|
|
define(`files_create_private_tmp_data_depend',`
|
|
type tmp_t;
|
|
|
|
class dir { getattr search read write add_name };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_remove_all_tmp_data(domain)
|
|
#
|
|
define(`files_remove_all_tmp_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 tmpfile:dir { getattr search read write add_name remove_name rmdir };
|
|
allow $1 tmpfile:file { getattr unlink };
|
|
allow $1 tmpfile:lnk_file { getattr unlink };
|
|
allow $1 tmpfile:fifo_file { getattr unlink };
|
|
allow $1 tmpfile:sock_file { getattr unlink };
|
|
')
|
|
|
|
define(`files_remove_all_tmp_data_depend',`
|
|
attribute tmpfile;
|
|
|
|
class dir { getattr search read write add_name remove_name rmdir };
|
|
class file { getattr unlink };
|
|
class lnk_file { getattr unlink };
|
|
class fifo_file { getattr unlink };
|
|
class sock_file { getattr unlink };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_search_general_application_resources_dir(domain)
|
|
#
|
|
define(`files_search_general_application_resources_dir',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 usr_t:dir search;
|
|
')
|
|
|
|
define(`files_search_general_application_resources_dir_depend',`
|
|
type usr_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_general_application_resources(domain)
|
|
#
|
|
define(`files_read_general_application_resources',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 usr_t:dir { getattr search read };
|
|
allow $1 usr_t:{ file lnk_file } { getattr read };
|
|
')
|
|
|
|
define(`files_read_general_application_resources_depend',`
|
|
type usr_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read };
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_execute_system_source_code_scripts">
|
|
## <description>
|
|
## Execute programs in /usr/src in the caller domain.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <infoflow type="none"/>
|
|
## </interface>
|
|
#
|
|
define(`files_execute_system_source_code_scripts',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 usr_t:dir search;
|
|
allow $1 src_t:dir { getattr search read };
|
|
allow $1 src_t:lnk_file { getattr read };
|
|
allow $1 src_t:file { getattr read execute execute_no_trans };
|
|
')
|
|
|
|
define(`files_read_system_source_code_depend',`
|
|
type usr_t, src_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read execute execute_no_trans };
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_system_source_code(domain)
|
|
#
|
|
define(`files_read_system_source_code',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 usr_t:dir search;
|
|
allow $1 src_t:dir { getattr search read };
|
|
allow $1 src_t:{ file lnk_file } { getattr read };
|
|
')
|
|
|
|
define(`files_read_system_source_code_depend',`
|
|
type usr_t, src_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read };
|
|
class lnk_file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_search_system_state_data_directory(domain)
|
|
#
|
|
define(`files_search_system_state_data_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
')
|
|
|
|
define(`files_search_system_state_data_directory_depend',`
|
|
type var_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_search_system_state_data_directory(domain)
|
|
#
|
|
define(`files_ignore_search_system_state_data_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 var_t:dir search;
|
|
')
|
|
|
|
define(`files_ignore_search_system_state_data_directory_depend',`
|
|
type var_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_manage_pseudorandom_saved_seed(domain)
|
|
#
|
|
define(`files_manage_pseudorandom_saved_seed',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_lib_t:dir { getattr search read write add_name remove_name };
|
|
allow $1 var_lib_t:file { getattr create read write setattr unlink };
|
|
')
|
|
|
|
define(`files_manage_pseudorandom_saved_seed_depend',`
|
|
type var_t, var_lib_t;
|
|
|
|
class dir { getattr search read write add_name remove_name };
|
|
class file { getattr create read write setattr unlink };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_get_system_lock_file_attributes(domain)
|
|
#
|
|
define(`files_get_system_lock_file_attributes',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_lock_t:dir { getattr search read };
|
|
allow $1 var_lock_t:file getattr;
|
|
')
|
|
|
|
define(`files_get_system_lock_file_attributes_depend',`
|
|
type var_lock_t;
|
|
|
|
class dir { getattr search read };
|
|
class file getattr;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_manage_system_lock_files(domain)
|
|
#
|
|
define(`files_manage_system_lock_files',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_lock_t:dir { getattr search create read write setattr add_name remove_name rmdir };
|
|
allow $1 var_lock_t:file { getattr create read write setattr unlink };
|
|
')
|
|
|
|
define(`files_manage_system_lock_files_depend',`
|
|
type var_lock_t;
|
|
|
|
class dir { getattr search create read write setattr add_name remove_name rmdir };
|
|
class file { getattr create read write setattr unlink };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_remove_all_lock_files(domain)
|
|
#
|
|
define(`files_remove_all_lock_files',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 lockfile:dir { getattr search read write add_name remove_name };
|
|
allow $1 lockfile:file { getattr unlink };
|
|
')
|
|
|
|
define(`files_remove_all_lock_files_depend',`
|
|
attribute lockfile;
|
|
|
|
class dir { getattr search read write add_name remove_name };
|
|
class file { getattr unlink };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_create_private_lock_file(domain,private_type,[object class(es)])
|
|
#
|
|
define(`files_create_private_lock_file',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_lock_t:dir rw_dir_perms;
|
|
|
|
ifelse(`$3',`',`
|
|
type_transition $1 var_lock_t:file $2;
|
|
',`
|
|
type_transition $1 var_lock_t:$3 $2;
|
|
')
|
|
')
|
|
|
|
define(`files_create_private_lock_file_depend',`
|
|
type var_t, var_lock_t;
|
|
|
|
class dir rw_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_search_runtime_data_directory(domain)
|
|
#
|
|
define(`files_search_runtime_data_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_run_t:dir search;
|
|
')
|
|
|
|
define(`files_search_runtime_data_directory_depend',`
|
|
type var_t, var_run_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_ignore_search_runtime_data_directory(domain)
|
|
#
|
|
define(`files_ignore_search_runtime_data_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_run_t:dir search;
|
|
')
|
|
|
|
define(`files_ignore_search_runtime_data_directory_depend',`
|
|
type var_run_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_runtime_data_directory(domain)
|
|
#
|
|
define(`files_read_runtime_data_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_run_t:dir { getattr search read };
|
|
')
|
|
|
|
define(`files_read_runtime_data_directory_depend',`
|
|
type var_t, var_run_t;
|
|
|
|
class dir { getattr search read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_create_daemon_runtime_data(domain,pidfile,[object class(es)])
|
|
#
|
|
define(`files_create_daemon_runtime_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_run_t:dir rw_dir_perms;
|
|
|
|
ifelse(`$3',`',`
|
|
type_transition $1 var_run_t:file $2;
|
|
',`
|
|
type_transition $1 var_run_t:$3 $2;
|
|
')
|
|
')
|
|
|
|
define(`files_create_daemon_runtime_data_depend',`
|
|
type var_t, var_run_t;
|
|
|
|
class dir rw_dir_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_modify_system_runtime_data(domain)
|
|
#
|
|
define(`files_modify_system_runtime_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_run_t:dir { getattr search read };
|
|
allow $1 var_run_t:file { getattr read write };
|
|
')
|
|
|
|
define(`files_modify_system_runtime_data_depend',`
|
|
type var_t, var_run_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read write };
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_ignore_write_all_daemon_runtime_data">
|
|
## <description>
|
|
## Do not audit attempts to write to daemon runtime data files.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <infoflow type="none"/>
|
|
## </interface>
|
|
#
|
|
|
|
define(`files_ignore_write_all_daemon_runtime_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 pidfile:file write;
|
|
')
|
|
|
|
define(`files_ignore_write_all_daemon_runtime_data_depend',`
|
|
attribute pidfile;
|
|
|
|
class file write;
|
|
')
|
|
|
|
########################################
|
|
## <interface name="files_ignore_ioctl_all_daemon_runtime_data">
|
|
## <description>
|
|
## Do not audit attempts to ioctl daemon runtime data files.
|
|
## </description>
|
|
## <parameter name="domain">
|
|
## The type of the process performing this action.
|
|
## </parameter>
|
|
## <infoflow type="none"/>
|
|
## </interface>
|
|
#
|
|
|
|
define(`files_ignore_ioctl_all_daemon_runtime_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
dontaudit $1 pidfile:file ioctl;
|
|
')
|
|
|
|
define(`files_ignore_ioctl_all_daemon_runtime_data_depend',`
|
|
attribute pidfile;
|
|
|
|
class file ioctl;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_all_daemon_runtime_data(domain)
|
|
#
|
|
define(`files_read_all_daemon_runtime_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 pidfile:dir r_dir_perms;
|
|
allow $1 pidfile:file r_file_perms;
|
|
')
|
|
|
|
define(`files_read_all_daemon_runtime_data_depend',`
|
|
attribute pidfile;
|
|
|
|
type var_t;
|
|
class dir r_dir_perms;
|
|
class file r_file_perms;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_remove_all_daemon_runtime_data(domain)
|
|
#
|
|
define(`files_remove_all_daemon_runtime_data',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_run_t:{ sock_file lnk_file } { getattr unlink };
|
|
allow $1 var_run_t:dir rmdir;
|
|
allow $1 pidfile:dir rw_dir_perms;
|
|
allow $1 pidfile:file { getattr unlink };
|
|
allow $1 pidfile:sock_file { getattr unlink };
|
|
')
|
|
|
|
define(`files_remove_all_daemon_runtime_data_depend',`
|
|
attribute pidfile;
|
|
|
|
type var_t, var_run_t;
|
|
|
|
class dir rw_dir_perms;
|
|
class file { getattr unlink };
|
|
class lnk_file { getattr unlink };
|
|
class sock_file { getattr unlink };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_search_system_spool_directory(domain)
|
|
#
|
|
define(`files_search_system_spool_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_spool_t:dir search;
|
|
')
|
|
|
|
define(`files_search_system_spool_directory_depend',`
|
|
type var_t, var_spool_t;
|
|
|
|
class dir search;
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_system_spool_directory(domain)
|
|
#
|
|
define(`files_read_system_spool_directory',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_spool_t:dir { getattr search read };
|
|
')
|
|
|
|
define(`files_read_system_spool_directory_depend',`
|
|
type var_t, var_spool_t;
|
|
|
|
class dir { getattr search read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_read_system_spools(domain)
|
|
#
|
|
define(`files_read_system_spools',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_spool_t:dir { getattr search read };
|
|
allow $1 var_spool_t:file { getattr read };
|
|
')
|
|
|
|
define(`files_read_system_spools_depend',`
|
|
type var_t, var_spool_t;
|
|
|
|
class dir { getattr search read };
|
|
class file { getattr read };
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# files_manage_system_spools(domain)
|
|
#
|
|
define(`files_manage_system_spools',`
|
|
requires_block_template(`$0'_depend)
|
|
|
|
allow $1 var_t:dir search;
|
|
allow $1 var_spool_t:dir { getattr search read write add_name remove_name };
|
|
allow $1 var_spool_t:file { getattr create read write append unlink setattr };
|
|
')
|
|
|
|
define(`files_manage_system_spools_depend',`
|
|
type var_t, var_spool_t;
|
|
|
|
class dir { getattr search read write add_name remove_name };
|
|
class file { getattr create read write append unlink setattr };
|
|
')
|
|
|
|
## </module>
|