145 lines
3.5 KiB
Plaintext
145 lines
3.5 KiB
Plaintext
# Copyright (C) 2005 Tresys Technology, LLC
|
|
|
|
policy_module(devices,1.0)
|
|
|
|
#
|
|
# Device types
|
|
#
|
|
|
|
attribute device_node;
|
|
|
|
#
|
|
# device_t is the type of /dev.
|
|
#
|
|
type device_t;
|
|
files_make_file(device_t)
|
|
files_make_mountpoint(device_t)
|
|
filesystem_tmpfs_associate(device_t)
|
|
|
|
type cardmgr_dev_t, device_node;
|
|
filesystem_associate(cardmgr_dev_t)
|
|
filesystem_tmpfs_associate(cardmgr_dev_t)
|
|
|
|
# Only directories and symlinks should be labeled device_t.
|
|
# If there are other files with this type, it is wrong.
|
|
# Relabelto is allowed for setfiles to function, in case
|
|
# a device node has no specific type yet, but is for some
|
|
# reason labeled with a specific type
|
|
#cjp: want this, but udev policy breaks this
|
|
#neverallow * device_t:{ file fifo_file sock_file chr_file blk_file } ~{ getattr setattr relabelfrom relabelto };
|
|
|
|
#
|
|
# zero_device_t is the type of /dev/zero.
|
|
#
|
|
type zero_device_t, device_node;
|
|
filesystem_associate(zero_device_t)
|
|
filesystem_tmpfs_associate(zero_device_t)
|
|
|
|
#
|
|
# null_device_t is the type of /dev/null.
|
|
#
|
|
type null_device_t, device_node;
|
|
filesystem_associate(null_device_t)
|
|
filesystem_tmpfs_associate(null_device_t)
|
|
|
|
#
|
|
# memory_device_t is the type of /dev/kmem,
|
|
# /dev/mem and /dev/port.
|
|
#
|
|
type memory_device_t, device_node;
|
|
filesystem_associate(memory_device_t)
|
|
filesystem_tmpfs_associate(memory_device_t)
|
|
|
|
attribute memory_raw_read;
|
|
attribute memory_raw_write;
|
|
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
|
|
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
|
|
|
|
#
|
|
# random_device_t is the type of /dev/random
|
|
# urandom_device_t is the type of /dev/urandom
|
|
#
|
|
type random_device_t, device_node;
|
|
type urandom_device_t, device_node;
|
|
filesystem_associate(random_device_t)
|
|
filesystem_associate(urandom_device_t)
|
|
filesystem_tmpfs_associate(random_device_t)
|
|
filesystem_tmpfs_associate(urandom_device_t)
|
|
|
|
#
|
|
# Type for /dev/agpgart
|
|
#
|
|
type agp_device_t, device_node;
|
|
filesystem_associate(agp_device_t)
|
|
filesystem_tmpfs_associate(agp_device_t)
|
|
|
|
#
|
|
# Type for /dev/apm_bios
|
|
#
|
|
type apm_bios_t, device_node;
|
|
filesystem_associate(apm_bios_t)
|
|
filesystem_tmpfs_associate(apm_bios_t)
|
|
|
|
#
|
|
# clock_device_t is the type of
|
|
# /dev/rtc.
|
|
#
|
|
type clock_device_t, device_node;
|
|
filesystem_associate(clock_device_t)
|
|
filesystem_tmpfs_associate(clock_device_t)
|
|
|
|
#
|
|
# cpu control devices /dev/cpu/0/*
|
|
#
|
|
type cpu_device_t, device_node;
|
|
filesystem_associate(cpu_device_t)
|
|
filesystem_tmpfs_associate(cpu_device_t)
|
|
|
|
#
|
|
# Type for framebuffer /dev/fb/*
|
|
#
|
|
type framebuf_device_t, device_node;
|
|
filesystem_associate(framebuf_device_t)
|
|
filesystem_tmpfs_associate(framebuf_device_t)
|
|
|
|
#
|
|
# Type for /dev/mapper/control
|
|
#
|
|
type lvm_control_t, device_node;
|
|
filesystem_associate(lvm_control_t)
|
|
filesystem_tmpfs_associate(lvm_control_t)
|
|
|
|
#
|
|
# Type for /dev/cpu/mtrr and /proc/mtrr
|
|
#
|
|
type mtrr_device_t, device_node;
|
|
filesystem_associate(mtrr_device_t)
|
|
filesystem_tmpfs_associate(mtrr_device_t)
|
|
genfscon proc /mtrr system_u:object_r:mtrr_device_t
|
|
|
|
#
|
|
# Type for /dev/pmu
|
|
#
|
|
type power_device_t, device_node;
|
|
filesystem_associate(power_device_t)
|
|
filesystem_tmpfs_associate(power_device_t)
|
|
|
|
type printer_device_t, device_node;
|
|
filesystem_associate(printer_device_t)
|
|
filesystem_tmpfs_associate(printer_device_t)
|
|
|
|
#
|
|
# Type for sound devices and mixers
|
|
#
|
|
type sound_device_t, device_node;
|
|
filesystem_associate(sound_device_t)
|
|
filesystem_tmpfs_associate(sound_device_t)
|
|
|
|
type v4l_device_t, device_node;
|
|
filesystem_associate(v4l_device_t)
|
|
filesystem_tmpfs_associate(v4l_device_t)
|
|
|
|
type xserver_misc_device_t, device_node;
|
|
filesystem_associate(xserver_misc_device_t)
|
|
filesystem_tmpfs_associate(xserver_misc_device_t)
|