policy/modules/system/clock.te

   1
   2 policy_module(clock,1.5.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type adjtime_t;
  10 files_type(adjtime_t)
  11
  12 type hwclock_t;
  13 type hwclock_exec_t;
  14 init_system_domain(hwclock_t,hwclock_exec_t)
  15 role system_r types hwclock_t;
  16
  17 ########################################
  18 #
  19 # Local policy
  20 #
  21
  22 # Give hwclock the capabilities it requires.  dac_override is a surprise,
  23 # but hwclock does require it.
  24 allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config };
  25 dontaudit hwclock_t self:capability sys_tty_config;
  26 allow hwclock_t self:process signal_perms;
  27 allow hwclock_t self:fifo_file rw_fifo_file_perms;
  28
  29 # Allow hwclock to store & retrieve correction factors.
  30 allow hwclock_t adjtime_t:file { rw_file_perms setattr };
  31
  32 kernel_read_kernel_sysctls(hwclock_t)
  33 kernel_read_system_state(hwclock_t)
  34
  35 corecmd_exec_bin(hwclock_t)
  36 corecmd_exec_shell(hwclock_t)
  37
  38 dev_read_sysfs(hwclock_t)
  39 dev_rw_realtime_clock(hwclock_t)
  40
  41 fs_getattr_xattr_fs(hwclock_t)
  42 fs_search_auto_mountpoints(hwclock_t)
  43
  44 term_dontaudit_use_console(hwclock_t)
  45 term_use_unallocated_ttys(hwclock_t)
  46 term_use_all_user_ttys(hwclock_t)
  47 term_use_all_user_ptys(hwclock_t)
  48
  49 domain_use_interactive_fds(hwclock_t)
  50
  51 init_use_fds(hwclock_t)
  52 init_use_script_ptys(hwclock_t)
  53
  54 files_read_etc_files(hwclock_t)
  55 # for when /usr is not mounted:
  56 files_dontaudit_search_isid_type_dirs(hwclock_t)
  57
  58 libs_use_ld_so(hwclock_t)
  59 libs_use_shared_libs(hwclock_t)
  60
  61 logging_send_audit_msgs(hwclock_t)
  62 logging_send_syslog_msg(hwclock_t)
  63
  64 miscfiles_read_localization(hwclock_t)
  65
  66 optional_policy(`
  67         apm_append_log(hwclock_t)
  68         apm_rw_stream_sockets(hwclock_t)
  69 ')
  70
  71 optional_policy(`
  72         nscd_socket_use(hwclock_t)
  73 ')
  74
  75 optional_policy(`
  76         seutil_sigchld_newrole(hwclock_t)
  77 ')
  78
  79 optional_policy(`
  80         udev_read_db(hwclock_t)
  81 ')
  82
  83 optional_policy(`
  84         userdom_dontaudit_use_unpriv_user_fds(hwclock_t)
  85 ')