policy/modules/admin/readahead.te

   1
   2 policy_module(readahead, 1.11.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type readahead_t;
  10 type readahead_exec_t;
  11 init_daemon_domain(readahead_t, readahead_exec_t)
  12 application_domain(readahead_t, readahead_exec_t)
  13
  14 type readahead_var_lib_t;
  15 files_type(readahead_var_lib_t)
  16 typealias readahead_var_lib_t alias readahead_etc_rw_t;
  17
  18 type readahead_var_run_t;
  19 files_pid_file(readahead_var_run_t)
  20
  21 ########################################
  22 #
  23 # Local policy
  24 #
  25
  26 allow readahead_t self:capability { fowner dac_override dac_read_search };
  27 dontaudit readahead_t self:capability { net_admin sys_tty_config };
  28 allow readahead_t self:process { setsched signal_perms };
  29
  30 manage_dirs_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t)
  31 manage_files_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t)
  32 files_search_var_lib(readahead_t)
  33
  34 manage_files_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t)
  35 files_pid_filetrans(readahead_t, readahead_var_run_t, file)
  36
  37 kernel_read_all_sysctls(readahead_t)
  38 kernel_read_system_state(readahead_t)
  39 kernel_dontaudit_getattr_core_if(readahead_t)
  40
  41 dev_read_sysfs(readahead_t)
  42 dev_getattr_generic_chr_files(readahead_t)
  43 dev_getattr_generic_blk_files(readahead_t)
  44 dev_getattr_all_chr_files(readahead_t)
  45 dev_getattr_all_blk_files(readahead_t)
  46 dev_dontaudit_read_all_blk_files(readahead_t)
  47 dev_dontaudit_getattr_memory_dev(readahead_t)
  48 dev_dontaudit_getattr_nvram_dev(readahead_t)
  49
  50 domain_use_interactive_fds(readahead_t)
  51 domain_read_all_domains_state(readahead_t)
  52
  53 files_list_non_security(readahead_t)
  54 files_read_non_security_files(readahead_t)
  55 files_create_boot_flag(readahead_t)
  56 files_getattr_all_pipes(readahead_t)
  57 files_dontaudit_getattr_all_sockets(readahead_t)
  58 files_dontaudit_getattr_non_security_blk_files(readahead_t)
  59
  60 fs_getattr_all_fs(readahead_t)
  61 fs_search_auto_mountpoints(readahead_t)
  62 fs_getattr_all_pipes(readahead_t)
  63 fs_getattr_all_files(readahead_t)
  64 fs_read_cgroup_files(readahead_t)
  65 fs_read_tmpfs_files(readahead_t)
  66 fs_read_tmpfs_symlinks(readahead_t)
  67 fs_list_inotifyfs(readahead_t)
  68 fs_dontaudit_search_ramfs(readahead_t)
  69 fs_dontaudit_read_ramfs_pipes(readahead_t)
  70 fs_dontaudit_read_ramfs_files(readahead_t)
  71 fs_dontaudit_use_tmpfs_chr_dev(readahead_t)
  72
  73 mls_file_read_all_levels(readahead_t)
  74
  75 storage_raw_read_fixed_disk(readahead_t)
  76
  77 term_dontaudit_use_console(readahead_t)
  78
  79 auth_dontaudit_read_shadow(readahead_t)
  80
  81 init_use_fds(readahead_t)
  82 init_use_script_ptys(readahead_t)
  83 init_getattr_initctl(readahead_t)
  84
  85 logging_send_syslog_msg(readahead_t)
  86 logging_set_audit_parameters(readahead_t)
  87 logging_dontaudit_search_audit_config(readahead_t)
  88
  89 miscfiles_read_localization(readahead_t)
  90
  91 userdom_dontaudit_use_unpriv_user_fds(readahead_t)
  92 userdom_dontaudit_search_user_home_dirs(readahead_t)
  93
  94 optional_policy(`
  95         cron_system_entry(readahead_t, readahead_exec_t)
  96 ')
  97
  98 optional_policy(`
  99         seutil_sigchld_newrole(readahead_t)
 100 ')