selinux-policy/strict/domains/program/hwclock.te

50 lines
1.7 KiB
Plaintext

#DESC Hwclock - Hardware clock manager
#
# Author: David A. Wheeler <dwheeler@ida.org>
# Russell Coker <russell@coker.com.au>
# X-Debian-Packages: util-linux
#
#################################
#
# Rules for the hwclock_t domain.
# This domain moves time information between the "hardware clock"
# (which runs when the system is off) and the "system clock",
# and it stores adjustment values in /etc/adjtime so that errors in the
# hardware clock are corrected.
# Note that any errors from this domain are NOT recorded by the system logger,
# because the system logger isnt running when this domain is active.
#
daemon_base_domain(hwclock)
role sysadm_r types hwclock_t;
ifdef(`targeted_policy', `', `
domain_auto_trans(sysadm_t, hwclock_exec_t, hwclock_t)
')
type adjtime_t, file_type, sysadmfile;
allow hwclock_t fs_t:filesystem getattr;
read_locale(hwclock_t)
# Give hwclock the capabilities it requires. dac_override is a surprise,
# but hwclock does require it.
allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config };
# Allow hwclock to set the hardware clock.
allow hwclock_t clock_device_t:devfile_class_set { setattr rw_file_perms };
# Allow hwclock to store & retrieve correction factors.
allow hwclock_t adjtime_t:file { setattr rw_file_perms };
# Read and write console and ttys.
allow hwclock_t tty_device_t:chr_file rw_file_perms;
allow hwclock_t ttyfile:chr_file rw_file_perms;
allow hwclock_t ptyfile:chr_file rw_file_perms;
ifdef(`gnome-pty-helper.te', `allow hwclock_t sysadm_gph_t:fd use;')
read_locale(hwclock_t)
# for when /usr is not mounted
dontaudit hwclock_t file_t:dir search;
allow hwclock_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
r_dir_file(hwclock_t, etc_t)