projects / people / stevee / selinux-policy.git / blame
| Commit | Line | Data |
|---|---|---|
| f862c35c CP |
1 | |
| 2 | policy_module(gpm,1.0) | |
| 3 | ||
| 4 | ######################################## | |
| 5 | # | |
| 6 | # Declarations | |
| 7 | # | |
| 8 | ||
| 9 | type gpm_t; | |
| 10 | type gpm_exec_t; | |
| 11 | init_daemon_domain(gpm_t,gpm_exec_t) | |
| 12 | ||
| 13 | type gpm_conf_t; | |
| 14 | files_type(gpm_conf_t) | |
| 15 | ||
| 16 | type gpm_tmp_t; | |
| 17 | files_tmp_file(gpm_tmp_t) | |
| 18 | ||
| 19 | type gpm_var_run_t; | |
| 20 | files_pid_file(gpm_var_run_t) | |
| 21 | ||
| 22 | type gpmctl_t; | |
| 23 | files_type(gpmctl_t) | |
| 24 | ||
| 25 | ######################################## | |
| 26 | # | |
| 27 | # Local policy | |
| 28 | # | |
| 29 | ||
| 30 | allow gpm_t self:capability { setuid dac_override sys_admin sys_tty_config }; | |
| 31 | ||
| 32 | allow gpm_t gpm_conf_t:dir r_dir_perms; | |
| 33 | allow gpm_t gpm_conf_t:file r_file_perms; | |
| 34 | allow gpm_t gpm_conf_t:lnk_file { getattr read }; | |
| 35 | ||
| 36 | allow gpm_t gpm_tmp_t:dir create_dir_perms; | |
| 37 | allow gpm_t gpm_tmp_t:file create_file_perms; | |
| 38 | files_create_tmp_files(gpm_t, gpm_tmp_t, { file dir }) | |
| 39 | ||
| 40 | allow gpm_t gpm_var_run_t:file create_file_perms; | |
| 41 | files_create_pid(gpm_t,gpm_var_run_t) | |
| 42 | ||
| 43 | allow gpm_t gpmctl_t:sock_file create_file_perms; | |
| 44 | allow gpm_t gpmctl_t:fifo_file create_file_perms; | |
| 45 | dev_create_dev_node(gpm_t,gpmctl_t,{ sock_file fifo_file }) | |
| 46 | ||
| 47 | # cjp: this has no effect | |
| 48 | allow gpm_t gpmctl_t:unix_stream_socket name_bind; | |
| 49 | ||
| 50 | kernel_read_kernel_sysctl(gpm_t) | |
| 51 | kernel_list_proc(gpm_t) | |
| 52 | kernel_read_proc_symlinks(gpm_t) | |
| 53 | ||
| 54 | dev_read_sysfs(gpm_t) | |
| 55 | # Access the mouse. | |
| 56 | dev_read_input(gpm_t) | |
| 57 | dev_read_mouse(gpm_t) | |
| 58 | ||
| 59 | fs_getattr_all_fs(gpm_t) | |
| 60 | fs_search_auto_mountpoints(gpm_t) | |
| 61 | ||
| 62 | term_use_unallocated_tty(gpm_t) | |
| 63 | term_dontaudit_use_console(gpm_t) | |
| 64 | ||
| 65 | domain_use_wide_inherit_fd(gpm_t) | |
| 66 | ||
| 67 | init_use_fd(gpm_t) | |
| 68 | init_use_script_pty(gpm_t) | |
| 69 | ||
| 70 | libs_use_ld_so(gpm_t) | |
| 71 | libs_use_shared_libs(gpm_t) | |
| 72 | ||
| 73 | logging_send_syslog_msg(gpm_t) | |
| 74 | ||
| 75 | miscfiles_read_localization(gpm_t) | |
| 76 | ||
| 77 | userdom_dontaudit_use_unpriv_user_fd(gpm_t) | |
| 78 | userdom_dontaudit_search_sysadm_home_dir(gpm_t) | |
| 79 | ||
| 80 | ifdef(`targeted_policy', ` | |
| 81 | term_dontaudit_use_unallocated_tty(gpm_t) | |
| 82 | term_dontaudit_use_generic_pty(gpm_t) | |
| 83 | files_dontaudit_read_root_file(gpm_t) | |
| 84 | ') | |
| 85 | ||
| 86 | optional_policy(`rhgb.te',` | |
| 87 | rhgb_domain(gpm_t) | |
| 88 | ') | |
| 89 | ||
| 90 | optional_policy(`selinuxutil.te',` | |
| 91 | seutil_sigchld_newrole(gpm_t) | |
| 92 | ') | |
| 93 | ||
| 94 | optional_policy(`udev.te', ` | |
| 95 | udev_read_db(gpm_t) | |
| 96 | ') | |
| 97 | ||
| 98 | ifdef(`TODO',` | |
| 99 | # Access the mouse. | |
| 100 | # cjp: why write? | |
| 101 | allow gpm_t { event_device_t mouse_device_t }:chr_file rw_file_perms; | |
| 102 | ') |