selinux-policy/policy/modules/apps/lockdev.if
2006-12-12 20:08:08 +00:00

84 lines
1.8 KiB
Plaintext

## <summary>device locking policy for lockdev</summary>
#######################################
## <summary>
## The per role template for the lockdev module.
## </summary>
## <desc>
## <p>
## This template creates derived domains which are used
## for lockdev. A derived type is also created to protect
## the user's device locks.
## </p>
## <p>
## This template is invoked automatically for each user, and
## generally does not need to be invoked directly
## by policy writers.
## </p>
## </desc>
## <param name="userdomain_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## </summary>
## </param>
#
template(`lockdev_per_role_template',`
gen_require(`
type lockdev_exec_t;
')
########################################
#
# Declarations
#
type $1_lockdev_t;
domain_type($1_lockdev_t)
domain_entry_file($1_lockdev_t,lockdev_exec_t)
role $3 types $1_lockdev_t;
type $1_lockdev_lock_t;
files_lock_file($1_lockdev_lock_t)
########################################
#
# Local policy
#
# Use capabilities.
allow $1_lockdev_t self:capability setgid;
allow $1_lockdev_t $2:process signull;
# Transition from the user domain to the derived domain.
domtrans_pattern($2, lockdev_exec_t, $1_lockdev_t)
allow $1_lockdev_t $1_lockdev_lock_t:file manage_file_perms;
files_lock_filetrans($1_lockdev_t,$1_lockdev_lock_t,file)
files_read_all_locks($1_lockdev_t)
fs_getattr_xattr_fs($1_lockdev_t)
libs_use_ld_so($1_lockdev_t)
libs_use_shared_libs($1_lockdev_t)
logging_send_syslog_msg($1_lockdev_t)
userdom_use_user_terminals($1, $1_lockdev_t)
optional_policy(`
logging_send_syslog_msg($1_t)
')
')