policy/modules/kernel/devices.if

   1 ## <summary>
   2 ## Device nodes and interfaces for many basic system devices.
   3 ## </summary>
   4 ## <desc>
   5 ## <p>
   6 ## This module creates the device node concept and provides
   7 ## the policy for many of the device files. Notable exceptions are
   8 ## the mass storage and terminal devices that are covered by other
   9 ## modules.
  10 ## </p>
  11 ## <p>
  12 ## This module creates the concept of a device node. That is a
  13 ## char or block device file, usually in /dev. All types that
  14 ## are used to label device nodes should use the dev_node macro.
  15 ## </p>
  16 ## <p>
  17 ## Additionally, this module controls access to three things:
  18 ##      <ul>
  19 ##              <li>the device directories containing device nodes</li>
  20 ##              <li>device nodes as a group</li>
  21 ##              <li>individual access to specific device nodes covered by
  22 ##              this module.</li>
  23 ##      </ul>
  24 ## </p>
  25 ## </desc>
  26 ## <required val="true">
  27 ##      Depended on by other required modules.
  28 ## </required>
  29
  30 ########################################
  31 ## <summary>
  32 ##      Make the passed in type a type appropriate for
  33 ##      use on device nodes (usually files in /dev).
  34 ## </summary>
  35 ## <param name="object_type">
  36 ##      <summary>
  37 ##      The object type that will be used on device nodes.
  38 ##      </summary>
  39 ## </param>
  40 #
  41 interface(`dev_node',`
  42         gen_require(`
  43                 attribute device_node;
  44         ')
  45
  46         typeattribute $1 device_node;
  47 ')
  48
  49 ########################################
  50 ## <summary>
  51 ##      Allow full relabeling (to and from) of all device nodes.
  52 ## </summary>
  53 ## <param name="domain">
  54 ##      <summary>
  55 ##      Domain allowed to relabel.
  56 ##      </summary>
  57 ## </param>
  58 ## <rolecap/>
  59 #
  60 interface(`dev_relabel_all_dev_nodes',`
  61         gen_require(`
  62                 attribute device_node;
  63                 type device_t;
  64         ')
  65
  66         relabelfrom_dirs_pattern($1,device_t,device_node)
  67         relabelfrom_files_pattern($1,device_t,device_node)
  68         relabelfrom_lnk_files_pattern($1,device_t,device_node)
  69         relabelfrom_fifo_files_pattern($1,device_t,device_node)
  70         relabelfrom_sock_files_pattern($1,device_t,device_node)
  71         relabel_blk_files_pattern($1,device_t,{ device_t device_node })
  72         relabel_chr_files_pattern($1,device_t,{ device_t device_node })
  73 ')
  74
  75 ########################################
  76 ## <summary>
  77 ##      List all of the device nodes in a device directory.
  78 ## </summary>
  79 ## <param name="domain">
  80 ##      <summary>
  81 ##      Domain allowed to list device nodes.
  82 ##      </summary>
  83 ## </param>
  84 #
  85 interface(`dev_list_all_dev_nodes',`
  86         gen_require(`
  87                 type device_t;
  88         ')
  89
  90
  91         list_dirs_pattern($1,device_t,device_t)
  92         read_lnk_files_pattern($1,device_t,device_t)
  93 ')
  94
  95 ########################################
  96 ## <summary>
  97 ##      Set the attributes of /dev directories.
  98 ## </summary>
  99 ## <param name="domain">
 100 ##      <summary>
 101 ##      Domain allowed access.
 102 ##      </summary>
 103 ## </param>
 104 #
 105 interface(`dev_setattr_generic_dirs',`
 106         gen_require(`
 107                 type device_t;
 108         ')
 109
 110         setattr_dirs_pattern($1,device_t,device_t)
 111 ')
 112
 113 ########################################
 114 ## <summary>
 115 ##      Dontaudit attempts to list all device nodes.
 116 ## </summary>
 117 ## <param name="domain">
 118 ##      <summary>
 119 ##      Domain to dontaudit listing of device nodes.
 120 ##      </summary>
 121 ## </param>
 122 #
 123 interface(`dev_dontaudit_list_all_dev_nodes',`
 124         gen_require(`
 125                 type device_t;
 126         ')
 127
 128         dontaudit $1 device_t:dir list_dir_perms;
 129 ')
 130
 131 ########################################
 132 ## <summary>
 133 ##      Add entries to directories in /dev.
 134 ## </summary>
 135 ## <param name="domain">
 136 ##      <summary>
 137 ##      Domain allowed to add entries.
 138 ##      </summary>
 139 ## </param>
 140 #
 141 interface(`dev_add_entry_generic_dirs',`
 142         gen_require(`
 143                 type device_t;
 144         ')
 145
 146         allow $1 device_t:dir add_entry_dir_perms;
 147 ')
 148
 149 ########################################
 150 ## <summary>
 151 ##      Create a directory in the device directory.
 152 ## </summary>
 153 ## <param name="domain">
 154 ##      <summary>
 155 ##      Domain allowed to create the directory.
 156 ##      </summary>
 157 ## </param>
 158 #
 159 interface(`dev_create_generic_dirs',`
 160         gen_require(`
 161                 type device_t;
 162         ')
 163
 164         allow $1 device_t:dir { ra_dir_perms create };
 165         create_dirs_pattern($1,device_t,device_t)
 166 ')
 167
 168 ########################################
 169 ## <summary>
 170 ##      Delete a directory in the device directory.
 171 ## </summary>
 172 ## <param name="domain">
 173 ##      <summary>
 174 ##      Domain allowed to create the directory.
 175 ##      </summary>
 176 ## </param>
 177 #
 178 interface(`dev_delete_generic_dirs',`
 179         gen_require(`
 180                 type device_t;
 181         ')
 182
 183         delete_dirs_pattern($1,device_t,device_t)
 184 ')
 185
 186 ########################################
 187 ## <summary>
 188 ##      Allow full relabeling (to and from) of directories in /dev.
 189 ## </summary>
 190 ## <param name="domain">
 191 ##      <summary>
 192 ##      Domain allowed to relabel.
 193 ##      </summary>
 194 ## </param>
 195 #
 196 interface(`dev_relabel_generic_dev_dirs',`
 197         gen_require(`
 198                 type device_t;
 199         ')
 200
 201         relabel_dirs_pattern($1,device_t,device_t)
 202 ')
 203
 204 ########################################
 205 ## <summary>
 206 ##      dontaudit getattr generic files in /dev.
 207 ## </summary>
 208 ## <param name="domain">
 209 ##      <summary>
 210 ##      Domain to not audit.
 211 ##      </summary>
 212 ## </param>
 213 #
 214 interface(`dev_dontaudit_getattr_generic_files',`
 215         gen_require(`
 216                 type device_t;
 217         ')
 218
 219         dontaudit $1 device_t:file getattr;
 220 ')
 221
 222 ########################################
 223 ## <summary>
 224 ##      Read and write generic files in /dev.
 225 ## </summary>
 226 ## <param name="domain">
 227 ##      <summary>
 228 ##      Domain allowed access.
 229 ##      </summary>
 230 ## </param>
 231 #
 232 interface(`dev_rw_generic_files',`
 233         gen_require(`
 234                 type device_t;
 235         ')
 236
 237         rw_files_pattern($1,device_t,device_t)
 238 ')
 239
 240 ########################################
 241 ## <summary>
 242 ##      Delete generic files in /dev.
 243 ## </summary>
 244 ## <param name="domain">
 245 ##      <summary>
 246 ##      Domain allowed access.
 247 ##      </summary>
 248 ## </param>
 249 #
 250 interface(`dev_delete_generic_files',`
 251         gen_require(`
 252                 type device_t;
 253         ')
 254
 255         delete_files_pattern($1,device_t,device_t)
 256 ')
 257
 258 ########################################
 259 ## <summary>
 260 ##      Create a file in the device directory.
 261 ## </summary>
 262 ## <param name="domain">
 263 ##      <summary>
 264 ##      Domain allowed to create the files.
 265 ##      </summary>
 266 ## </param>
 267 #
 268 interface(`dev_manage_generic_files',`
 269         gen_require(`
 270                 type device_t;
 271         ')
 272
 273         manage_files_pattern($1,device_t,device_t)
 274 ')
 275
 276 ########################################
 277 ## <summary>
 278 ##      Dontaudit getattr on generic pipes.
 279 ## </summary>
 280 ## <param name="domain">
 281 ##      <summary>
 282 ##      Domain to dontaudit.
 283 ##      </summary>
 284 ## </param>
 285 #
 286 interface(`dev_dontaudit_getattr_generic_pipes',`
 287         gen_require(`
 288                 type device_t;
 289         ')
 290
 291         dontaudit $1 device_t:fifo_file getattr;
 292 ')
 293
 294 ########################################
 295 ## <summary>
 296 ##      Allow getattr on generic block devices.
 297 ## </summary>
 298 ## <param name="domain">
 299 ##      <summary>
 300 ##      Domain allowed access.
 301 ##      </summary>
 302 ## </param>
 303 #
 304 interface(`dev_getattr_generic_blk_files',`
 305         gen_require(`
 306                 type device_t;
 307         ')
 308
 309         getattr_blk_files_pattern($1,device_t,device_t)
 310 ')
 311
 312 ########################################
 313 ## <summary>
 314 ##      Dontaudit getattr on generic block devices.
 315 ## </summary>
 316 ## <param name="domain">
 317 ##      <summary>
 318 ##      Domain to dontaudit access.
 319 ##      </summary>
 320 ## </param>
 321 #
 322 interface(`dev_dontaudit_getattr_generic_blk_files',`
 323         gen_require(`
 324                 type device_t;
 325         ')
 326
 327         dontaudit $1 device_t:blk_file getattr;
 328 ')
 329
 330 ########################################
 331 ## <summary>
 332 ##      Dontaudit setattr on generic block devices.
 333 ## </summary>
 334 ## <param name="domain">
 335 ##      <summary>
 336 ##      Domain to dontaudit access.
 337 ##      </summary>
 338 ## </param>
 339 #
 340 interface(`dev_dontaudit_setattr_generic_blk_files',`
 341         gen_require(`
 342                 type device_t;
 343         ')
 344
 345         dontaudit $1 device_t:blk_file setattr;
 346 ')
 347
 348 ########################################
 349 ## <summary>
 350 ##      Allow read, write, and create for generic character device files.
 351 ## </summary>
 352 ## <param name="domain">
 353 ##      <summary>
 354 ##      Domain allowed access.
 355 ##      </summary>
 356 ## </param>
 357 #
 358 interface(`dev_create_generic_chr_files',`
 359         gen_require(`
 360                 type device_t;
 361         ')
 362
 363         create_chr_files_pattern($1,device_t,device_t)
 364 ')
 365
 366 ########################################
 367 ## <summary>
 368 ##      Allow getattr for generic character device files.
 369 ## </summary>
 370 ## <param name="domain">
 371 ##      <summary>
 372 ##      Domain allowed access.
 373 ##      </summary>
 374 ## </param>
 375 #
 376 interface(`dev_getattr_generic_chr_files',`
 377         gen_require(`
 378                 type device_t;
 379         ')
 380
 381         getattr_chr_files_pattern($1,device_t,device_t)
 382 ')
 383
 384 ########################################
 385 ## <summary>
 386 ##      Dontaudit getattr for generic character device files.
 387 ## </summary>
 388 ## <param name="domain">
 389 ##      <summary>
 390 ##      Domain to dontaudit access.
 391 ##      </summary>
 392 ## </param>
 393 #
 394 interface(`dev_dontaudit_getattr_generic_chr_files',`
 395         gen_require(`
 396                 type device_t;
 397         ')
 398
 399         dontaudit $1 device_t:chr_file getattr;
 400 ')
 401
 402 ########################################
 403 ## <summary>
 404 ##      Dontaudit setattr for generic character device files.
 405 ## </summary>
 406 ## <param name="domain">
 407 ##      <summary>
 408 ##      Domain to dontaudit access.
 409 ##      </summary>
 410 ## </param>
 411 #
 412 interface(`dev_dontaudit_setattr_generic_chr_files',`
 413         gen_require(`
 414                 type device_t;
 415         ')
 416
 417         dontaudit $1 device_t:chr_file setattr;
 418 ')
 419
 420 ########################################
 421 ## <summary>
 422 ##      Do not audit attempts to set the attributes
 423 ##      of symbolic links in device directories (/dev).
 424 ## </summary>
 425 ## <param name="domain">
 426 ##      <summary>
 427 ##      Domain to not audit.
 428 ##      </summary>
 429 ## </param>
 430 #
 431 interface(`dev_dontaudit_setattr_generic_symlinks',`
 432         gen_require(`
 433                 type device_t;
 434         ')
 435
 436         dontaudit $1 device_t:lnk_file setattr;
 437 ')
 438
 439 ########################################
 440 ## <summary>
 441 ##      Create symbolic links in device directories.
 442 ## </summary>
 443 ## <param name="domain">
 444 ##      <summary>
 445 ##      Domain allowed access.
 446 ##      </summary>
 447 ## </param>
 448 #
 449 interface(`dev_create_generic_symlinks',`
 450         gen_require(`
 451                 type device_t;
 452         ')
 453
 454         create_lnk_files_pattern($1,device_t,device_t)
 455 ')
 456
 457 ########################################
 458 ## <summary>
 459 ##      Delete symbolic links in device directories.
 460 ## </summary>
 461 ## <param name="domain">
 462 ##      <summary>
 463 ##      Domain allowed access.
 464 ##      </summary>
 465 ## </param>
 466 #
 467 interface(`dev_delete_generic_symlinks',`
 468         gen_require(`
 469                 type device_t;
 470         ')
 471
 472         delete_lnk_files_pattern($1,device_t,device_t)
 473 ')
 474
 475 ########################################
 476 ## <summary>
 477 ##      Create, delete, read, and write symbolic links in device directories.
 478 ## </summary>
 479 ## <param name="domain">
 480 ##      <summary>
 481 ##      Domain allowed access.
 482 ##      </summary>
 483 ## </param>
 484 #
 485 interface(`dev_manage_generic_symlinks',`
 486         gen_require(`
 487                 type device_t;
 488         ')
 489
 490         manage_lnk_files_pattern($1,device_t,device_t)
 491 ')
 492
 493 ########################################
 494 ## <summary>
 495 ##      Relabel symbolic links in device directories.
 496 ## </summary>
 497 ## <param name="domain">
 498 ##      <summary>
 499 ##      Domain allowed access.
 500 ##      </summary>
 501 ## </param>
 502 #
 503 interface(`dev_relabel_generic_symlinks',`
 504         gen_require(`
 505                 type device_t;
 506         ')
 507
 508         relabel_lnk_files_pattern($1,device_t,device_t)
 509 ')
 510
 511 ########################################
 512 ## <summary>
 513 ##      Create, delete, read, and write device nodes in device directories.
 514 ## </summary>
 515 ## <param name="domain">
 516 ##      <summary>
 517 ##      Domain allowed access.
 518 ##      </summary>
 519 ## </param>
 520 #
 521 interface(`dev_manage_all_dev_nodes',`
 522         gen_require(`
 523                 attribute device_node, memory_raw_read, memory_raw_write;
 524                 type device_t;
 525         ')
 526
 527         manage_dirs_pattern($1,device_t,device_t)
 528         manage_sock_files_pattern($1,device_t,device_t)
 529         manage_lnk_files_pattern($1,device_t,device_t)
 530         manage_chr_files_pattern($1,device_t,{ device_t device_node })
 531         manage_blk_files_pattern($1,device_t,{ device_t device_node })
 532         relabel_dirs_pattern($1,device_t,device_t)
 533         relabel_chr_files_pattern($1,device_t,{ device_t device_node })
 534         relabel_blk_files_pattern($1,device_t,{ device_t device_node })
 535
 536         # these next rules are to satisfy assertions broken by the above lines.
 537         # the permissions hopefully can be cut back a lot
 538         storage_raw_read_fixed_disk($1)
 539         storage_raw_write_fixed_disk($1)
 540         storage_read_scsi_generic($1)
 541         storage_write_scsi_generic($1)
 542
 543         typeattribute $1 memory_raw_read;
 544         typeattribute $1 memory_raw_write;
 545 ')
 546
 547 ########################################
 548 ## <summary>
 549 ##      Dontaudit getattr for generic device files.
 550 ## </summary>
 551 ## <param name="domain">
 552 ##      <summary>
 553 ##      Domain to dontaudit access.
 554 ##      </summary>
 555 ## </param>
 556 #
 557 interface(`dev_dontaudit_rw_generic_dev_nodes',`
 558         gen_require(`
 559                 type device_t;
 560         ')
 561
 562         dontaudit $1 device_t:{ chr_file blk_file } { getattr read write ioctl };
 563 ')
 564
 565 ########################################
 566 ## <summary>
 567 ##      Create, delete, read, and write block device files.
 568 ## </summary>
 569 ## <param name="domain">
 570 ##      <summary>
 571 ##      Domain allowed access.
 572 ##      </summary>
 573 ## </param>
 574 #
 575 interface(`dev_manage_generic_blk_files',`
 576         gen_require(`
 577                 type device_t;
 578         ')
 579
 580         manage_blk_files_pattern($1,device_t,device_t)
 581 ')
 582
 583 ########################################
 584 ## <summary>
 585 ##      Create, delete, read, and write character device files.
 586 ## </summary>
 587 ## <param name="domain">
 588 ##      <summary>
 589 ##      Domain allowed access.
 590 ##      </summary>
 591 ## </param>
 592 #
 593 interface(`dev_manage_generic_chr_files',`
 594         gen_require(`
 595                 type device_t;
 596         ')
 597
 598         manage_chr_files_pattern($1,device_t,device_t)
 599 ')
 600
 601 ########################################
 602 ## <summary>
 603 ##      Create, read, and write device nodes. The node
 604 ##      will be transitioned to the type provided.
 605 ## </summary>
 606 ## <param name="domain">
 607 ##      <summary>
 608 ##      Domain allowed access.
 609 ##      </summary>
 610 ## </param>
 611 ## <param name="file">
 612 ##      <summary>
 613 ##      Type to which the created node will be transitioned.
 614 ##      </summary>
 615 ## </param>
 616 ## <param name="objectclass(es)">
 617 ##      <summary>
 618 ##      Object class(es) (single or set including {}) for which this
 619 ##      the transition will occur.
 620 ##      </summary>
 621 ## </param>
 622 #
 623 interface(`dev_filetrans',`
 624         gen_require(`
 625                 type device_t;
 626         ')
 627
 628         filetrans_pattern($1,device_t,$2,$3)
 629
 630         fs_associate_tmpfs($2)
 631         files_associate_tmp($2)
 632 ')
 633
 634 ########################################
 635 ## <summary>
 636 ##      Getattr on all block file device nodes.
 637 ## </summary>
 638 ## <param name="domain">
 639 ##      <summary>
 640 ##      Domain allowed access.
 641 ##      </summary>
 642 ## </param>
 643 ## <rolecap/>
 644 #
 645 interface(`dev_getattr_all_blk_files',`
 646         gen_require(`
 647                 attribute device_node;
 648                 type device_t;
 649         ')
 650
 651         getattr_blk_files_pattern($1,device_t,device_node)
 652 ')
 653
 654 ########################################
 655 ## <summary>
 656 ##      Dontaudit getattr on all block file device nodes.
 657 ## </summary>
 658 ## <param name="domain">
 659 ##      <summary>
 660 ##      Domain to dontaudit access.
 661 ##      </summary>
 662 ## </param>
 663 #
 664 interface(`dev_dontaudit_getattr_all_blk_files',`
 665         gen_require(`
 666                 attribute device_node;
 667         ')
 668
 669         dontaudit $1 device_node:blk_file getattr;
 670 ')
 671
 672 ########################################
 673 ## <summary>
 674 ##      Getattr on all character file device nodes.
 675 ## </summary>
 676 ## <param name="domain">
 677 ##      <summary>
 678 ##      Domain allowed access.
 679 ##      </summary>
 680 ## </param>
 681 ## <rolecap/>
 682 #
 683 interface(`dev_getattr_all_chr_files',`
 684         gen_require(`
 685                 attribute device_node;
 686         ')
 687
 688         getattr_chr_files_pattern($1,device_t,device_node)
 689 ')
 690
 691 ########################################
 692 ## <summary>
 693 ##      Dontaudit getattr on all character file device nodes.
 694 ## </summary>
 695 ## <param name="domain">
 696 ##      <summary>
 697 ##      Domain to dontaudit access.
 698 ##      </summary>
 699 ## </param>
 700 #
 701 interface(`dev_dontaudit_getattr_all_chr_files',`
 702         gen_require(`
 703                 attribute device_node;
 704         ')
 705
 706         dontaudit $1 device_node:chr_file getattr;
 707 ')
 708
 709 ########################################
 710 ## <summary>
 711 ##      Setattr on all block file device nodes.
 712 ## </summary>
 713 ## <param name="domain">
 714 ##      <summary>
 715 ##      Domain allowed access.
 716 ##      </summary>
 717 ## </param>
 718 ## <rolecap/>
 719 #
 720 interface(`dev_setattr_all_blk_files',`
 721         gen_require(`
 722                 attribute device_node;
 723         ')
 724
 725         setattr_blk_files_pattern($1,device_t,device_node)
 726 ')
 727
 728 ########################################
 729 ## <summary>
 730 ##      Setattr on all character file device nodes.
 731 ## </summary>
 732 ## <param name="domain">
 733 ##      <summary>
 734 ##      Domain allowed access.
 735 ##      </summary>
 736 ## </param>
 737 ## <rolecap/>
 738 #
 739 interface(`dev_setattr_all_chr_files',`
 740         gen_require(`
 741                 attribute device_node;
 742         ')
 743
 744         setattr_chr_files_pattern($1,device_t,device_node)
 745 ')
 746
 747 ########################################
 748 ## <summary>
 749 ##      Dontaudit read on all block file device nodes.
 750 ## </summary>
 751 ## <param name="domain">
 752 ##      <summary>
 753 ##      Domain to not audit.
 754 ##      </summary>
 755 ## </param>
 756 #
 757 interface(`dev_dontaudit_read_all_blk_files',`
 758         gen_require(`
 759                 attribute device_node;
 760         ')
 761
 762         dontaudit $1 device_node:blk_file { getattr read };
 763 ')
 764
 765 ########################################
 766 ## <summary>
 767 ##      Dontaudit read on all character file device nodes.
 768 ## </summary>
 769 ## <param name="domain">
 770 ##      <summary>
 771 ##      Domain to not audit.
 772 ##      </summary>
 773 ## </param>
 774 #
 775 interface(`dev_dontaudit_read_all_chr_files',`
 776         gen_require(`
 777                 attribute device_node;
 778         ')
 779
 780         dontaudit $1 device_node:chr_file { getattr read };
 781 ')
 782
 783 ########################################
 784 ## <summary>
 785 ##      Create all block device files.
 786 ## </summary>
 787 ## <param name="domain">
 788 ##      <summary>
 789 ##      Domain allowed access.
 790 ##      </summary>
 791 ## </param>
 792 #
 793 interface(`dev_create_all_blk_files',`
 794         gen_require(`
 795                 attribute device_node;
 796         ')
 797
 798         create_blk_files_pattern($1,device_t,device_node)
 799 ')
 800
 801 ########################################
 802 ## <summary>
 803 ##      Create all character device files.
 804 ## </summary>
 805 ## <param name="domain">
 806 ##      <summary>
 807 ##      Domain allowed access.
 808 ##      </summary>
 809 ## </param>
 810 #
 811 interface(`dev_create_all_chr_files',`
 812         gen_require(`
 813                 attribute device_node;
 814         ')
 815
 816         create_chr_files_pattern($1,device_t,device_node)
 817 ')
 818
 819 ########################################
 820 ## <summary>
 821 ##      Delete all block device files.
 822 ## </summary>
 823 ## <param name="domain">
 824 ##      <summary>
 825 ##      Domain allowed access.
 826 ##      </summary>
 827 ## </param>
 828 #
 829 interface(`dev_delete_all_blk_files',`
 830         gen_require(`
 831                 attribute device_node;
 832         ')
 833
 834         delete_blk_files_pattern($1,device_t,device_node)
 835 ')
 836
 837 ########################################
 838 ## <summary>
 839 ##      Delete all character device files.
 840 ## </summary>
 841 ## <param name="domain">
 842 ##      <summary>
 843 ##      Domain allowed access.
 844 ##      </summary>
 845 ## </param>
 846 #
 847 interface(`dev_delete_all_chr_files',`
 848         gen_require(`
 849                 attribute device_node;
 850         ')
 851
 852         delete_chr_files_pattern($1,device_t,device_node)
 853 ')
 854
 855 ########################################
 856 ## <summary>
 857 ##      Rename all block device files.
 858 ## </summary>
 859 ## <param name="domain">
 860 ##      <summary>
 861 ##      Domain allowed access.
 862 ##      </summary>
 863 ## </param>
 864 #
 865 interface(`dev_rename_all_blk_files',`
 866         gen_require(`
 867                 attribute device_node;
 868         ')
 869
 870         rename_blk_files_pattern($1,device_t,device_node)
 871 ')
 872
 873 ########################################
 874 ## <summary>
 875 ##      Rename all character device files.
 876 ## </summary>
 877 ## <param name="domain">
 878 ##      <summary>
 879 ##      Domain allowed access.
 880 ##      </summary>
 881 ## </param>
 882 #
 883 interface(`dev_rename_all_chr_files',`
 884         gen_require(`
 885                 attribute device_node;
 886         ')
 887
 888         rename_chr_files_pattern($1,device_t,device_node)
 889 ')
 890
 891 ########################################
 892 ## <summary>
 893 ##      Read, write, create, and delete all block device files.
 894 ## </summary>
 895 ## <param name="domain">
 896 ##      <summary>
 897 ##      Domain allowed access.
 898 ##      </summary>
 899 ## </param>
 900 #
 901 interface(`dev_manage_all_blk_files',`
 902         gen_require(`
 903                 attribute device_node;
 904         ')
 905
 906         manage_blk_files_pattern($1,device_t,device_node)
 907
 908         # these next rules are to satisfy assertions broken by the above lines.
 909         storage_raw_read_fixed_disk($1)
 910         storage_raw_write_fixed_disk($1)
 911         storage_read_scsi_generic($1)
 912         storage_write_scsi_generic($1)
 913 ')
 914
 915 ########################################
 916 ## <summary>
 917 ##      Read, write, create, and delete all character device files.
 918 ## </summary>
 919 ## <param name="domain">
 920 ##      <summary>
 921 ##      Domain allowed access.
 922 ##      </summary>
 923 ## </param>
 924 #
 925 interface(`dev_manage_all_chr_files',`
 926         gen_require(`
 927                 attribute device_node, memory_raw_read, memory_raw_write;
 928         ')
 929
 930         manage_chr_files_pattern($1,device_t,device_node)
 931
 932         typeattribute $1 memory_raw_read, memory_raw_write;
 933 ')
 934
 935 ########################################
 936 ## <summary>
 937 ##      Getattr the agp devices.
 938 ## </summary>
 939 ## <param name="domain">
 940 ##      <summary>
 941 ##      Domain allowed access.
 942 ##      </summary>
 943 ## </param>
 944 #
 945 interface(`dev_getattr_agp_dev',`
 946         gen_require(`
 947                 type device_t, agp_device_t;
 948         ')
 949
 950         getattr_chr_files_pattern($1,device_t,agp_device_t)
 951 ')
 952
 953 ########################################
 954 ## <summary>
 955 ##      Read and write the agp devices.
 956 ## </summary>
 957 ## <param name="domain">
 958 ##      <summary>
 959 ##      Domain allowed access.
 960 ##      </summary>
 961 ## </param>
 962 #
 963 interface(`dev_rw_agp',`
 964         gen_require(`
 965                 type device_t, agp_device_t;
 966         ')
 967
 968         rw_chr_files_pattern($1,device_t,agp_device_t)
 969 ')
 970
 971 ########################################
 972 ## <summary>
 973 ##      Get the attributes of the apm bios device node.
 974 ## </summary>
 975 ## <param name="domain">
 976 ##      <summary>
 977 ##      Domain allowed access.
 978 ##      </summary>
 979 ## </param>
 980 #
 981 interface(`dev_getattr_apm_bios_dev',`
 982         gen_require(`
 983                 type device_t, apm_bios_t;
 984         ')
 985
 986         getattr_chr_files_pattern($1,device_t,apm_bios_t)
 987 ')
 988
 989 ########################################
 990 ## <summary>
 991 ##      Do not audit attempts to get the attributes of
 992 ##      the apm bios device node.
 993 ## </summary>
 994 ## <param name="domain">
 995 ##      <summary>
 996 ##      Domain to not audit.
 997 ##      </summary>
 998 ## </param>
 999 #
1000 interface(`dev_dontaudit_getattr_apm_bios_dev',`
1001         gen_require(`
1002                 type apm_bios_t;
1003         ')
1004
1005         dontaudit $1 apm_bios_t:chr_file getattr;
1006 ')
1007
1008 ########################################
1009 ## <summary>
1010 ##      Set the attributes of the apm bios device node.
1011 ## </summary>
1012 ## <param name="domain">
1013 ##      <summary>
1014 ##      Domain allowed access.
1015 ##      </summary>
1016 ## </param>
1017 #
1018 interface(`dev_setattr_apm_bios_dev',`
1019         gen_require(`
1020                 type device_t, apm_bios_t;
1021         ')
1022
1023         setattr_chr_files_pattern($1,device_t,apm_bios_t)
1024 ')
1025
1026 ########################################
1027 ## <summary>
1028 ##      Do not audit attempts to set the attributes of
1029 ##      the apm bios device node.
1030 ## </summary>
1031 ## <param name="domain">
1032 ##      <summary>
1033 ##      Domain to not audit.
1034 ##      </summary>
1035 ## </param>
1036 #
1037 interface(`dev_dontaudit_setattr_apm_bios_dev',`
1038         gen_require(`
1039                 type apm_bios_t;
1040         ')
1041
1042         dontaudit $1 apm_bios_t:chr_file setattr;
1043 ')
1044
1045 ########################################
1046 ## <summary>
1047 ##      Read and write the apm bios.
1048 ## </summary>
1049 ## <param name="domain">
1050 ##      <summary>
1051 ##      Domain allowed access.
1052 ##      </summary>
1053 ## </param>
1054 #
1055 interface(`dev_rw_apm_bios',`
1056         gen_require(`
1057                 type device_t, apm_bios_t;
1058         ')
1059
1060         rw_chr_files_pattern($1,device_t,apm_bios_t)
1061 ')
1062
1063 ########################################
1064 ## <summary>
1065 ##      Read and write the PCMCIA card manager device.
1066 ## </summary>
1067 ## <param name="domain">
1068 ##      <summary>
1069 ##      Domain allowed access.
1070 ##      </summary>
1071 ## </param>
1072 #
1073 interface(`dev_rw_cardmgr',`
1074         gen_require(`
1075                 type cardmgr_dev_t;
1076         ')
1077
1078         rw_chr_files_pattern($1,device_t,cardmgr_dev_t)
1079 ')
1080
1081 ########################################
1082 ## <summary>
1083 ##      Do not audit attempts to read and
1084 ##      write the PCMCIA card manager device.
1085 ## </summary>
1086 ## <param name="domain">
1087 ##      <summary>
1088 ##      Domain to not audit.
1089 ##      </summary>
1090 ## </param>
1091 #
1092 interface(`dev_dontaudit_rw_cardmgr',`
1093         gen_require(`
1094                 type cardmgr_dev_t;
1095         ')
1096
1097         dontaudit $1 cardmgr_dev_t:chr_file { read write };
1098 ')
1099
1100 ########################################
1101 ## <summary>
1102 ##      Create, read, write, and delete
1103 ##      the PCMCIA card manager device.
1104 ## </summary>
1105 ## <param name="domain">
1106 ##      <summary>
1107 ##      Domain allowed access.
1108 ##      </summary>
1109 ## </param>
1110 #
1111 interface(`dev_manage_cardmgr_dev',`
1112         gen_require(`
1113                 type device_t, cardmgr_dev_t;
1114         ')
1115
1116         manage_chr_files_pattern($1,device_t,cardmgr_dev_t)
1117         manage_blk_files_pattern($1,device_t,cardmgr_dev_t)
1118 ')
1119
1120 ########################################
1121 ## <summary>
1122 ##      Create, read, write, and delete
1123 ##      the PCMCIA card manager device
1124 ##      with the correct type.
1125 ## </summary>
1126 ## <param name="domain">
1127 ##      <summary>
1128 ##      Domain allowed access.
1129 ##      </summary>
1130 ## </param>
1131 #
1132 interface(`dev_create_cardmgr_dev',`
1133         gen_require(`
1134                 type device_t, cardmgr_dev_t;
1135         ')
1136
1137         create_chr_files_pattern($1,device_t,cardmgr_dev_t)
1138         create_blk_files_pattern($1,device_t,cardmgr_dev_t)
1139         filetrans_pattern($1,device_t,cardmgr_dev_t,{ chr_file blk_file })
1140 ')
1141
1142 ########################################
1143 ## <summary>
1144 ##      Get the attributes of the CPU
1145 ##      microcode and id interfaces.
1146 ## </summary>
1147 ## <param name="domain">
1148 ##      <summary>
1149 ##      Domain allowed access.
1150 ##      </summary>
1151 ## </param>
1152 #
1153 interface(`dev_getattr_cpu_dev',`
1154         gen_require(`
1155                 type device_t, cpu_device_t;
1156         ')
1157
1158         getattr_chr_files_pattern($1,device_t,cpu_device_t)
1159 ')
1160
1161 ########################################
1162 ## <summary>
1163 ##      Read the CPU identity.
1164 ## </summary>
1165 ## <param name="domain">
1166 ##      <summary>
1167 ##      Domain allowed access.
1168 ##      </summary>
1169 ## </param>
1170 #
1171 interface(`dev_read_cpuid',`
1172         gen_require(`
1173                 type device_t, cpu_device_t;
1174         ')
1175
1176         read_chr_files_pattern($1,device_t,cpu_device_t)
1177 ')
1178
1179 ########################################
1180 ## <summary>
1181 ##      Read and write the the CPU microcode device. This
1182 ##      is required to load CPU microcode.
1183 ## </summary>
1184 ## <param name="domain">
1185 ##      <summary>
1186 ##      Domain allowed access.
1187 ##      </summary>
1188 ## </param>
1189 #
1190 interface(`dev_rw_cpu_microcode',`
1191         gen_require(`
1192                 type device_t, cpu_device_t;
1193         ')
1194
1195         rw_chr_files_pattern($1,device_t,cpu_device_t)
1196 ')
1197
1198 ########################################
1199 ## <summary>
1200 ##      Read and write the the hardware SSL accelerator.
1201 ## </summary>
1202 ## <param name="domain">
1203 ##      <summary>
1204 ##      Domain allowed access.
1205 ##      </summary>
1206 ## </param>
1207 #
1208 interface(`dev_rw_crypto',`
1209         gen_require(`
1210                 type device_t, crypt_device_t;
1211         ')
1212
1213         rw_chr_files_pattern($1,device_t,crypt_device_t)
1214 ')
1215
1216 ########################################
1217 ## <summary>
1218 ##      getattr the dri devices.
1219 ## </summary>
1220 ## <param name="domain">
1221 ##      <summary>
1222 ##      Domain allowed access.
1223 ##      </summary>
1224 ## </param>
1225 #
1226 interface(`dev_getattr_dri_dev',`
1227         gen_require(`
1228                 type device_t, dri_device_t;
1229         ')
1230
1231         getattr_chr_files_pattern($1,device_t,dri_device_t)
1232 ')
1233
1234 ########################################
1235 ## <summary>
1236 ##      Setattr the dri devices.
1237 ## </summary>
1238 ## <param name="domain">
1239 ##      <summary>
1240 ##      Domain allowed access.
1241 ##      </summary>
1242 ## </param>
1243 #
1244 interface(`dev_setattr_dri_dev',`
1245         gen_require(`
1246                 type device_t, dri_device_t;
1247         ')
1248
1249         setattr_chr_files_pattern($1,device_t,dri_device_t)
1250 ')
1251
1252 ########################################
1253 ## <summary>
1254 ##      Read and write the dri devices.
1255 ## </summary>
1256 ## <param name="domain">
1257 ##      <summary>
1258 ##      Domain allowed access.
1259 ##      </summary>
1260 ## </param>
1261 #
1262 interface(`dev_rw_dri',`
1263         gen_require(`
1264                 type device_t, dri_device_t;
1265         ')
1266
1267         rw_chr_files_pattern($1,device_t,dri_device_t)
1268 ')
1269
1270 ########################################
1271 ## <summary>
1272 ##      Dontaudit read and write on the dri devices.
1273 ## </summary>
1274 ## <param name="domain">
1275 ##      <summary>
1276 ##      Domain to dontaudit access.
1277 ##      </summary>
1278 ## </param>
1279 #
1280 interface(`dev_dontaudit_rw_dri',`
1281         gen_require(`
1282                 type dri_device_t;
1283         ')
1284
1285         dontaudit $1 dri_device_t:chr_file { getattr read write ioctl };
1286 ')
1287
1288 ########################################
1289 ## <summary>
1290 ##      Create, read, write, and delete the dri devices.
1291 ## </summary>
1292 ## <param name="domain">
1293 ##      <summary>
1294 ##      Domain allowed access.
1295 ##      </summary>
1296 ## </param>
1297 #
1298 interface(`dev_manage_dri_dev',`
1299         gen_require(`
1300                 type device_t, dri_device_t;
1301         ')
1302
1303         manage_chr_files_pattern($1,device_t,dri_device_t)
1304         filetrans_pattern($1,device_t,dri_device_t,chr_file)
1305 ')
1306
1307 ########################################
1308 ## <summary>
1309 ##      Read input event devices (/dev/input).
1310 ## </summary>
1311 ## <param name="domain">
1312 ##      <summary>
1313 ##      Domain allowed access.
1314 ##      </summary>
1315 ## </param>
1316 #
1317 interface(`dev_read_input',`
1318         gen_require(`
1319                 type device_t, event_device_t;
1320         ')
1321
1322         read_chr_files_pattern($1,device_t,event_device_t)
1323 ')
1324
1325 ########################################
1326 ## <summary>
1327 ##      Read input event devices (/dev/input).
1328 ## </summary>
1329 ## <param name="domain">
1330 ##      <summary>
1331 ##      Domain allowed access.
1332 ##      </summary>
1333 ## </param>
1334 #
1335 interface(`dev_rw_input_dev',`
1336         gen_require(`
1337                 type device_t, event_device_t;
1338         ')
1339
1340         rw_chr_files_pattern($1,device_t,event_device_t)
1341 ')
1342
1343 ########################################
1344 ## <summary>
1345 ##      Get the attributes of the framebuffer device node.
1346 ## </summary>
1347 ## <param name="domain">
1348 ##      <summary>
1349 ##      Domain allowed access.
1350 ##      </summary>
1351 ## </param>
1352 #
1353 interface(`dev_getattr_framebuffer_dev',`
1354         gen_require(`
1355                 type device_t, framebuf_device_t;
1356         ')
1357
1358         getattr_chr_files_pattern($1,device_t,framebuf_device_t)
1359 ')
1360
1361 ########################################
1362 ## <summary>
1363 ##      Set the attributes of the framebuffer device node.
1364 ## </summary>
1365 ## <param name="domain">
1366 ##      <summary>
1367 ##      Domain allowed access.
1368 ##      </summary>
1369 ## </param>
1370 #
1371 interface(`dev_setattr_framebuffer_dev',`
1372         gen_require(`
1373                 type device_t, framebuf_device_t;
1374         ')
1375
1376         setattr_chr_files_pattern($1,device_t,framebuf_device_t)
1377 ')
1378
1379 ########################################
1380 ## <summary>
1381 ##      Dot not audit attempts to set the attributes
1382 ##      of the framebuffer device node.
1383 ## </summary>
1384 ## <param name="domain">
1385 ##      <summary>
1386 ##      Domain to not audit.
1387 ##      </summary>
1388 ## </param>
1389 #
1390 interface(`dev_dontaudit_setattr_framebuffer_dev',`
1391         gen_require(`
1392                 type framebuf_device_t;
1393         ')
1394
1395         dontaudit $1 framebuf_device_t:chr_file setattr;
1396 ')
1397
1398 ########################################
1399 ## <summary>
1400 ##      Read the framebuffer.
1401 ## </summary>
1402 ## <param name="domain">
1403 ##      <summary>
1404 ##      Domain allowed access.
1405 ##      </summary>
1406 ## </param>
1407 #
1408 interface(`dev_read_framebuffer',`
1409         gen_require(`
1410                 type framebuf_device_t;
1411         ')
1412
1413         read_chr_files_pattern($1,device_t,framebuf_device_t)
1414 ')
1415
1416 ########################################
1417 ## <summary>
1418 ##      Do not audit attempts to read the framebuffer.
1419 ## </summary>
1420 ## <param name="domain">
1421 ##      <summary>
1422 ##      Domain allowed access.
1423 ##      </summary>
1424 ## </param>
1425 #
1426 interface(`dev_dontaudit_read_framebuffer',`
1427         gen_require(`
1428                 type framebuf_device_t;
1429         ')
1430
1431         dontaudit $1 framebuf_device_t:chr_file { getattr read };
1432 ')
1433
1434 ########################################
1435 ## <summary>
1436 ##      Write the framebuffer.
1437 ## </summary>
1438 ## <param name="domain">
1439 ##      <summary>
1440 ##      Domain allowed access.
1441 ##      </summary>
1442 ## </param>
1443 #
1444 interface(`dev_write_framebuffer',`
1445         gen_require(`
1446                 type device_t, framebuf_device_t;
1447         ')
1448
1449         write_chr_files_pattern($1,device_t,framebuf_device_t)
1450 ')
1451
1452 ########################################
1453 ## <summary>
1454 ##      Read and write the framebuffer.
1455 ## </summary>
1456 ## <param name="domain">
1457 ##      <summary>
1458 ##      Domain allowed access.
1459 ##      </summary>
1460 ## </param>
1461 #
1462 interface(`dev_rw_framebuffer',`
1463         gen_require(`
1464                 type device_t, framebuf_device_t;
1465         ')
1466
1467         rw_chr_files_pattern($1,device_t,framebuf_device_t)
1468 ')
1469
1470 ########################################
1471 ## <summary>
1472 ##      Read the lvm comtrol device.
1473 ## </summary>
1474 ## <param name="domain">
1475 ##      <summary>
1476 ##      Domain allowed access.
1477 ##      </summary>
1478 ## </param>
1479 #
1480 interface(`dev_read_lvm_control',`
1481         gen_require(`
1482                 type device_t, lvm_control_t;
1483         ')
1484
1485         read_chr_files_pattern($1,device_t,lvm_control_t)
1486 ')
1487
1488 ########################################
1489 ## <summary>
1490 ##      Read and write the lvm control device.
1491 ## </summary>
1492 ## <param name="domain">
1493 ##      <summary>
1494 ##      Domain allowed access.
1495 ##      </summary>
1496 ## </param>
1497 #
1498 interface(`dev_rw_lvm_control',`
1499         gen_require(`
1500                 type device_t, lvm_control_t;
1501         ')
1502
1503         rw_chr_files_pattern($1,device_t,lvm_control_t)
1504 ')
1505
1506 ########################################
1507 ## <summary>
1508 ##      Delete the lvm control device.
1509 ## </summary>
1510 ## <param name="domain">
1511 ##      <summary>
1512 ##      Domain allowed access.
1513 ##      </summary>
1514 ## </param>
1515 #
1516 interface(`dev_delete_lvm_control_dev',`
1517         gen_require(`
1518                 type device_t, lvm_control_t;
1519         ')
1520
1521         delete_chr_files_pattern($1,device_t,lvm_control_t)
1522 ')
1523
1524 ########################################
1525 ## <summary>
1526 ##      dontaudit getattr raw memory devices (e.g. /dev/mem).
1527 ## </summary>
1528 ## <param name="domain">
1529 ##      <summary>
1530 ##      Domain allowed access.
1531 ##      </summary>
1532 ## </param>
1533 #
1534 interface(`dev_dontaudit_getattr_memory_dev',`
1535         gen_require(`
1536                 type memory_device_t;
1537         ')
1538
1539         dontaudit $1 memory_device_t:chr_file getattr;
1540 ')
1541
1542 ########################################
1543 ## <summary>
1544 ##      Read raw memory devices (e.g. /dev/mem).
1545 ## </summary>
1546 ## <param name="domain">
1547 ##      <summary>
1548 ##      Domain allowed access.
1549 ##      </summary>
1550 ## </param>
1551 #
1552 interface(`dev_read_raw_memory',`
1553         gen_require(`
1554                 type device_t, memory_device_t;
1555                 attribute memory_raw_read;
1556         ')
1557
1558         read_chr_files_pattern($1,device_t,memory_device_t)
1559
1560         allow $1 self:capability sys_rawio;
1561         typeattribute $1 memory_raw_read;
1562 ')
1563
1564 ########################################
1565 ## <summary>
1566 ##      Write raw memory devices (e.g. /dev/mem).
1567 ## </summary>
1568 ## <param name="domain">
1569 ##      <summary>
1570 ##      Domain allowed access.
1571 ##      </summary>
1572 ## </param>
1573 #
1574 interface(`dev_write_raw_memory',`
1575         gen_require(`
1576                 type device_t, memory_device_t;
1577                 attribute memory_raw_write;
1578         ')
1579
1580         write_chr_files_pattern($1,device_t,memory_device_t)
1581
1582         allow $1 self:capability sys_rawio;
1583         typeattribute $1 memory_raw_write;
1584 ')
1585
1586 ########################################
1587 ## <summary>
1588 ##      Read and execute raw memory devices (e.g. /dev/mem).
1589 ## </summary>
1590 ## <param name="domain">
1591 ##      <summary>
1592 ##      Domain allowed access.
1593 ##      </summary>
1594 ## </param>
1595 #
1596 interface(`dev_rx_raw_memory',`
1597         gen_require(`
1598                 type device_t, memory_device_t;
1599         ')
1600
1601         dev_read_raw_memory($1)
1602         allow $1 memory_device_t:chr_file execute;
1603 ')
1604
1605 ########################################
1606 ## <summary>
1607 ##      Write and execute raw memory devices (e.g. /dev/mem).
1608 ## </summary>
1609 ## <param name="domain">
1610 ##      <summary>
1611 ##      Domain allowed access.
1612 ##      </summary>
1613 ## </param>
1614 #
1615 interface(`dev_wx_raw_memory',`
1616         gen_require(`
1617                 type device_t, memory_device_t;
1618         ')
1619
1620         dev_write_raw_memory($1)
1621         allow $1 memory_device_t:chr_file execute;
1622 ')
1623
1624 ########################################
1625 ## <summary>
1626 ##      Get the attributes of miscellaneous devices.
1627 ## </summary>
1628 ## <param name="domain">
1629 ##      <summary>
1630 ##      Domain allowed access.
1631 ##      </summary>
1632 ## </param>
1633 #
1634 interface(`dev_getattr_misc_dev',`
1635         gen_require(`
1636                 type device_t, misc_device_t;
1637         ')
1638
1639         getattr_chr_files_pattern($1,device_t,misc_device_t)
1640 ')
1641
1642 ########################################
1643 ## <summary>
1644 ##      Do not audit attempts to get the attributes
1645 ##      of miscellaneous devices.
1646 ## </summary>
1647 ## <param name="domain">
1648 ##      <summary>
1649 ##      Domain allowed access.
1650 ##      </summary>
1651 ## </param>
1652 #
1653 interface(`dev_dontaudit_getattr_misc_dev',`
1654         gen_require(`
1655                 type misc_device_t;
1656         ')
1657
1658         dontaudit $1 misc_device_t:chr_file getattr;
1659 ')
1660
1661 ########################################
1662 ## <summary>
1663 ##      Set the attributes of miscellaneous devices.
1664 ## </summary>
1665 ## <param name="domain">
1666 ##      <summary>
1667 ##      Domain allowed access.
1668 ##      </summary>
1669 ## </param>
1670 #
1671 interface(`dev_setattr_misc_dev',`
1672         gen_require(`
1673                 type device_t, misc_device_t;
1674         ')
1675
1676         setattr_chr_files_pattern($1,device_t,misc_device_t)
1677 ')
1678
1679 ########################################
1680 ## <summary>
1681 ##      Do not audit attempts to set the attributes
1682 ##      of miscellaneous devices.
1683 ## </summary>
1684 ## <param name="domain">
1685 ##      <summary>
1686 ##      Domain allowed access.
1687 ##      </summary>
1688 ## </param>
1689 #
1690 interface(`dev_dontaudit_setattr_misc_dev',`
1691         gen_require(`
1692                 type misc_device_t;
1693         ')
1694
1695         dontaudit $1 misc_device_t:chr_file setattr;
1696 ')
1697
1698 ########################################
1699 ## <summary>
1700 ##      Read miscellaneous devices.
1701 ## </summary>
1702 ## <param name="domain">
1703 ##      <summary>
1704 ##      Domain allowed access.
1705 ##      </summary>
1706 ## </param>
1707 #
1708 interface(`dev_read_misc',`
1709         gen_require(`
1710                 type device_t, misc_device_t;
1711         ')
1712
1713         read_chr_files_pattern($1,device_t,misc_device_t)
1714 ')
1715
1716 ########################################
1717 ## <summary>
1718 ##      Write miscellaneous devices.
1719 ## </summary>
1720 ## <param name="domain">
1721 ##      <summary>
1722 ##      Domain allowed access.
1723 ##      </summary>
1724 ## </param>
1725 #
1726 interface(`dev_write_misc',`
1727         gen_require(`
1728                 type device_t, misc_device_t;
1729         ')
1730
1731         write_chr_files_pattern($1,device_t,misc_device_t)
1732 ')
1733
1734 ########################################
1735 ## <summary>
1736 ##      Do not audit attempts to read and write miscellaneous devices.
1737 ## </summary>
1738 ## <param name="domain">
1739 ##      <summary>
1740 ##      Domain allowed access.
1741 ##      </summary>
1742 ## </param>
1743 #
1744 interface(`dev_dontaudit_rw_misc',`
1745         gen_require(`
1746                 type misc_device_t;
1747         ')
1748
1749         dontaudit $1 misc_device_t:chr_file rw_file_perms;
1750 ')
1751
1752 ########################################
1753 ## <summary>
1754 ##      Get the attributes of the mouse devices.
1755 ## </summary>
1756 ## <param name="domain">
1757 ##      <summary>
1758 ##      Domain allowed access.
1759 ##      </summary>
1760 ## </param>
1761 #
1762 interface(`dev_getattr_mouse_dev',`
1763         gen_require(`
1764                 type device_t, mouse_device_t;
1765         ')
1766
1767         getattr_chr_files_pattern($1,device_t,mouse_device_t)
1768 ')
1769
1770 ########################################
1771 ## <summary>
1772 ##      Set the attributes of the mouse devices.
1773 ## </summary>
1774 ## <param name="domain">
1775 ##      <summary>
1776 ##      Domain allowed access.
1777 ##      </summary>
1778 ## </param>
1779 #
1780 interface(`dev_setattr_mouse_dev',`
1781         gen_require(`
1782                 type device_t, mouse_device_t;
1783         ')
1784
1785         setattr_chr_files_pattern($1,device_t,mouse_device_t)
1786 ')
1787
1788 ########################################
1789 ## <summary>
1790 ##      Read the mouse devices.
1791 ## </summary>
1792 ## <param name="domain">
1793 ##      <summary>
1794 ##      Domain allowed access.
1795 ##      </summary>
1796 ## </param>
1797 #
1798 interface(`dev_read_mouse',`
1799         gen_require(`
1800                 type device_t, mouse_device_t;
1801         ')
1802
1803         read_chr_files_pattern($1,device_t,mouse_device_t)
1804 ')
1805
1806 ########################################
1807 ## <summary>
1808 ##      Read and write to mouse devices.
1809 ## </summary>
1810 ## <param name="domain">
1811 ##      <summary>
1812 ##      Domain allowed access.
1813 ##      </summary>
1814 ## </param>
1815 #
1816 interface(`dev_rw_mouse',`
1817         gen_require(`
1818                 type device_t, mouse_device_t;
1819         ')
1820
1821         rw_chr_files_pattern($1,device_t,mouse_device_t)
1822 ')
1823
1824 ########################################
1825 ## <summary>
1826 ##      Get the attributes of the memory type range
1827 ##      registers (MTRR) device.
1828 ## </summary>
1829 ## <param name="domain">
1830 ##      <summary>
1831 ##      Domain allowed access.
1832 ##      </summary>
1833 ## </param>
1834 #
1835 interface(`dev_getattr_mtrr_dev',`
1836         gen_require(`
1837                 type device_t, mtrr_device_t;
1838         ')
1839
1840         getattr_files_pattern($1,device_t,mtrr_device_t)
1841         getattr_chr_files_pattern($1,device_t,mtrr_device_t)
1842 ')
1843
1844 ########################################
1845 ## <summary>
1846 ##      Read the memory type range
1847 ##      registers (MTRR).  (Deprecated)
1848 ## </summary>
1849 ## <desc>
1850 ##      <p>
1851 ##      Read the memory type range
1852 ##      registers (MTRR).  This interface has
1853 ##      been deprecated, dev_rw_mtrr() should be
1854 ##      used instead.
1855 ##      </p>
1856 ##      <p>
1857 ##      The MTRR device ioctls can be used for
1858 ##      reading and writing; thus, read access to the
1859 ##      device cannot be separated from write access.
1860 ##      </p>
1861 ## </desc>
1862 ## <param name="domain">
1863 ##      <summary>
1864 ##      Domain allowed access.
1865 ##      </summary>
1866 ## </param>
1867 #
1868 interface(`dev_read_mtrr',`
1869         refpolicywarn(`$0($*) has been replaced with dev_rw_mtrr().')
1870         dev_rw_mtrr($1)
1871 ')
1872
1873 ########################################
1874 ## <summary>
1875 ##      Write the memory type range
1876 ##      registers (MTRR).  (Deprecated)
1877 ## </summary>
1878 ## <desc>
1879 ##      <p>
1880 ##      Write the memory type range
1881 ##      registers (MTRR).  This interface has
1882 ##      been deprecated, dev_rw_mtrr() should be
1883 ##      used instead.
1884 ##      </p>
1885 ##      <p>
1886 ##      The MTRR device ioctls can be used for
1887 ##      reading and writing; thus, write access to the
1888 ##      device cannot be separated from read access.
1889 ##      </p>
1890 ## </desc>
1891 ## <param name="domain">
1892 ##      <summary>
1893 ##      Domain allowed access.
1894 ##      </summary>
1895 ## </param>
1896 #
1897 interface(`dev_write_mtrr',`
1898         refpolicywarn(`$0($*) has been replaced with dev_rw_mtrr().')
1899         dev_rw_mtrr($1)
1900 ')
1901
1902 ########################################
1903 ## <summary>
1904 ##      Read and write the memory type range registers (MTRR).
1905 ## </summary>
1906 ## <param name="domain">
1907 ##      <summary>
1908 ##      Domain allowed access.
1909 ##      </summary>
1910 ## </param>
1911 #
1912 interface(`dev_rw_mtrr',`
1913         gen_require(`
1914                 type device_t, mtrr_device_t;
1915         ')
1916
1917         rw_files_pattern($1,device_t,mtrr_device_t)
1918         rw_chr_files_pattern($1,device_t,mtrr_device_t)
1919 ')
1920
1921 ########################################
1922 ## <summary>
1923 ##      Read and write to the null device (/dev/null).
1924 ## </summary>
1925 ## <param name="domain">
1926 ##      <summary>
1927 ##      Domain allowed access.
1928 ##      </summary>
1929 ## </param>
1930 #
1931 interface(`dev_rw_null',`
1932         gen_require(`
1933                 type device_t, null_device_t;
1934         ')
1935
1936         rw_chr_files_pattern($1,device_t,null_device_t)
1937 ')
1938
1939 ########################################
1940 ## <summary>
1941 ##      Create the null device (/dev/null).
1942 ## </summary>
1943 ## <param name="domain">
1944 ##      <summary>
1945 ##      Domain allowed access.
1946 ##      </summary>
1947 ## </param>
1948 #
1949 interface(`dev_create_null_dev',`
1950         gen_require(`
1951                 type device_t, null_device_t;
1952         ')
1953
1954         create_chr_files_pattern($1,device_t,null_device_t)
1955 ')
1956
1957 ########################################
1958 ## <summary>
1959 ##      Do not audit attempts to get the attributes
1960 ##      of the BIOS non-volatile RAM device.
1961 ## </summary>
1962 ## <param name="domain">
1963 ##      <summary>
1964 ##      Domain allowed access.
1965 ##      </summary>
1966 ## </param>
1967 #
1968 interface(`dev_dontaudit_getattr_nvram_dev',`
1969         gen_require(`
1970                 type nvram_device_t;
1971         ')
1972
1973         dontaudit $1 nvram_device_t:chr_file getattr;
1974 ')
1975
1976 ########################################
1977 ## <summary>
1978 ##      Read and write BIOS non-volatile RAM.
1979 ## </summary>
1980 ## <param name="domain">
1981 ##      <summary>
1982 ##      Domain allowed access.
1983 ##      </summary>
1984 ## </param>
1985 #
1986 interface(`dev_rw_nvram',`
1987         gen_require(`
1988                 type nvram_device_t;
1989         ')
1990
1991         rw_chr_files_pattern($1,device_t,nvram_device_t)
1992 ')
1993
1994 ########################################
1995 ## <summary>
1996 ##      Get the attributes of the printer device nodes.
1997 ## </summary>
1998 ## <param name="domain">
1999 ##      <summary>
2000 ##      Domain allowed access.
2001 ##      </summary>
2002 ## </param>
2003 #
2004 interface(`dev_getattr_printer_dev',`
2005         gen_require(`
2006                 type device_t, printer_device_t;
2007         ')
2008
2009         getattr_chr_files_pattern($1,device_t,printer_device_t)
2010 ')
2011
2012 ########################################
2013 ## <summary>
2014 ##      Set the attributes of the printer device nodes.
2015 ## </summary>
2016 ## <param name="domain">
2017 ##      <summary>
2018 ##      Domain allowed access.
2019 ##      </summary>
2020 ## </param>
2021 #
2022 interface(`dev_setattr_printer_dev',`
2023         gen_require(`
2024                 type device_t, printer_device_t;
2025         ')
2026
2027         setattr_chr_files_pattern($1,device_t,printer_device_t)
2028 ')
2029
2030 ########################################
2031 ## <summary>
2032 ##      Append the printer device.
2033 ## </summary>
2034 ## <param name="domain">
2035 ##      <summary>
2036 ##      Domain allowed access.
2037 ##      </summary>
2038 ## </param>
2039 #
2040 # cjp: added for lpd/checkpc_t
2041 interface(`dev_append_printer',`
2042         gen_require(`
2043                 type device_t, printer_device_t;
2044         ')
2045
2046         append_chr_files_pattern($1,device_t,printer_device_t)
2047 ')
2048
2049 ########################################
2050 ## <summary>
2051 ##      Read and write the printer device.
2052 ## </summary>
2053 ## <param name="domain">
2054 ##      <summary>
2055 ##      Domain allowed access.
2056 ##      </summary>
2057 ## </param>
2058 #
2059 interface(`dev_rw_printer',`
2060         gen_require(`
2061                 type device_t, printer_device_t;
2062         ')
2063
2064         rw_chr_files_pattern($1,device_t,printer_device_t)
2065 ')
2066
2067 ########################################
2068 ## <summary>
2069 ##      Read from random number generator
2070 ##      devices (e.g., /dev/random)
2071 ## </summary>
2072 ## <param name="domain">
2073 ##      <summary>
2074 ##      Domain allowed access.
2075 ##      </summary>
2076 ## </param>
2077 #
2078 interface(`dev_read_rand',`
2079         gen_require(`
2080                 type device_t, random_device_t;
2081         ')
2082
2083         read_chr_files_pattern($1,device_t,random_device_t)
2084 ')
2085
2086 ########################################
2087 ## <summary>
2088 ##      Do not audit attempts to read from random
2089 ##      number generator devices (e.g., /dev/random)
2090 ## </summary>
2091 ## <param name="domain">
2092 ##      <summary>
2093 ##      Domain allowed access.
2094 ##      </summary>
2095 ## </param>
2096 #
2097 interface(`dev_dontaudit_read_rand',`
2098         gen_require(`
2099                 type random_device_t;
2100         ')
2101
2102         dontaudit $1 random_device_t:chr_file { getattr read };
2103 ')
2104
2105 ########################################
2106 ## <summary>
2107 ##      Write to the random device (e.g., /dev/random). This adds
2108 ##      entropy used to generate the random data read from the
2109 ##      random device.
2110 ## </summary>
2111 ## <param name="domain">
2112 ##      <summary>
2113 ##      Domain allowed access.
2114 ##      </summary>
2115 ## </param>
2116 #
2117 interface(`dev_write_rand',`
2118         gen_require(`
2119                 type device_t, random_device_t;
2120         ')
2121
2122         write_chr_files_pattern($1,device_t,random_device_t)
2123 ')
2124
2125 ########################################
2126 ## <summary>
2127 ##      Read the realtime clock (/dev/rtc).
2128 ## </summary>
2129 ## <param name="domain">
2130 ##      <summary>
2131 ##      Domain allowed access.
2132 ##      </summary>
2133 ## </param>
2134 #
2135 interface(`dev_read_realtime_clock',`
2136         gen_require(`
2137                 type device_t, clock_device_t;
2138         ')
2139
2140         read_chr_files_pattern($1,device_t,clock_device_t)
2141 ')
2142
2143 ########################################
2144 ## <summary>
2145 ##      Set the realtime clock (/dev/rtc).
2146 ## </summary>
2147 ## <param name="domain">
2148 ##      <summary>
2149 ##      Domain allowed access.
2150 ##      </summary>
2151 ## </param>
2152 #
2153 interface(`dev_write_realtime_clock',`
2154         gen_require(`
2155                 type device_t, clock_device_t;
2156         ')
2157
2158         write_chr_files_pattern($1,device_t,clock_device_t)
2159
2160         allow $1 clock_device_t:chr_file setattr;
2161 ')
2162
2163 ########################################
2164 ## <summary>
2165 ##      Read and set the realtime clock (/dev/rtc).
2166 ## </summary>
2167 ## <param name="domain">
2168 ##      <summary>
2169 ##      Domain allowed access.
2170 ##      </summary>
2171 ## </param>
2172 #
2173 interface(`dev_rw_realtime_clock',`
2174         dev_read_realtime_clock($1)
2175         dev_write_realtime_clock($1)
2176 ')
2177
2178 ########################################
2179 ## <summary>
2180 ##      Get the attributes of the scanner device.
2181 ## </summary>
2182 ## <param name="domain">
2183 ##      <summary>
2184 ##      Domain allowed access.
2185 ##      </summary>
2186 ## </param>
2187 #
2188 interface(`dev_getattr_scanner_dev',`
2189         gen_require(`
2190                 type device_t, scanner_device_t;
2191         ')
2192
2193         getattr_chr_files_pattern($1,device_t,scanner_device_t)
2194 ')
2195
2196 ########################################
2197 ## <summary>
2198 ##      Do not audit attempts to get the attributes of
2199 ##      the scanner device.
2200 ## </summary>
2201 ## <param name="domain">
2202 ##      <summary>
2203 ##      Domain to not audit.
2204 ##      </summary>
2205 ## </param>
2206 #
2207 interface(`dev_dontaudit_getattr_scanner_dev',`
2208         gen_require(`
2209                 type scanner_device_t;
2210         ')
2211
2212         dontaudit $1 scanner_device_t:chr_file getattr;
2213 ')
2214
2215 ########################################
2216 ## <summary>
2217 ##      Set the attributes of the scanner device.
2218 ## </summary>
2219 ## <param name="domain">
2220 ##      <summary>
2221 ##      Domain allowed access.
2222 ##      </summary>
2223 ## </param>
2224 #
2225 interface(`dev_setattr_scanner_dev',`
2226         gen_require(`
2227                 type device_t, scanner_device_t;
2228         ')
2229
2230         setattr_chr_files_pattern($1,device_t,scanner_device_t)
2231 ')
2232
2233 ########################################
2234 ## <summary>
2235 ##      Do not audit attempts to set the attributes of
2236 ##      the scanner device.
2237 ## </summary>
2238 ## <param name="domain">
2239 ##      <summary>
2240 ##      Domain to not audit.
2241 ##      </summary>
2242 ## </param>
2243 #
2244 interface(`dev_dontaudit_setattr_scanner_dev',`
2245         gen_require(`
2246                 type scanner_device_t;
2247         ')
2248
2249         dontaudit $1 scanner_device_t:chr_file setattr;
2250 ')
2251
2252 ########################################
2253 ## <summary>
2254 ##      Read and write the scanner device.
2255 ## </summary>
2256 ## <param name="domain">
2257 ##      <summary>
2258 ##      Domain allowed access.
2259 ##      </summary>
2260 ## </param>
2261 #
2262 interface(`dev_rw_scanner',`
2263         gen_require(`
2264                 type device_t, scanner_device_t;
2265         ')
2266
2267         rw_chr_files_pattern($1,device_t,scanner_device_t)
2268 ')
2269
2270 ########################################
2271 ## <summary>
2272 ##      Get the attributes of the sound devices.
2273 ## </summary>
2274 ## <param name="domain">
2275 ##      <summary>
2276 ##      Domain allowed access.
2277 ##      </summary>
2278 ## </param>
2279 #
2280 interface(`dev_getattr_sound_dev',`
2281         gen_require(`
2282                 type device_t, sound_device_t;
2283         ')
2284
2285         getattr_chr_files_pattern($1,device_t,sound_device_t)
2286 ')
2287
2288 ########################################
2289 ## <summary>
2290 ##      Set the attributes of the sound devices.
2291 ## </summary>
2292 ## <param name="domain">
2293 ##      <summary>
2294 ##      Domain allowed access.
2295 ##      </summary>
2296 ## </param>
2297 #
2298 interface(`dev_setattr_sound_dev',`
2299         gen_require(`
2300                 type device_t, sound_device_t;
2301         ')
2302
2303         setattr_chr_files_pattern($1,device_t,sound_device_t)
2304 ')
2305
2306 ########################################
2307 ## <summary>
2308 ##      Read the sound devices.
2309 ## </summary>
2310 ## <param name="domain">
2311 ##      <summary>
2312 ##      Domain allowed access.
2313 ##      </summary>
2314 ## </param>
2315 #
2316 interface(`dev_read_sound',`
2317         gen_require(`
2318                 type device_t, sound_device_t;
2319         ')
2320
2321         read_chr_files_pattern($1,device_t,sound_device_t)
2322 ')
2323
2324 ########################################
2325 ## <summary>
2326 ##      Write the sound devices.
2327 ## </summary>
2328 ## <param name="domain">
2329 ##      <summary>
2330 ##      Domain allowed access.
2331 ##      </summary>
2332 ## </param>
2333 #
2334 interface(`dev_write_sound',`
2335         gen_require(`
2336                 type device_t, sound_device_t;
2337         ')
2338
2339         write_chr_files_pattern($1,device_t,sound_device_t)
2340 ')
2341
2342 ########################################
2343 ## <summary>
2344 ##      Read the sound mixer devices.
2345 ## </summary>
2346 ## <param name="domain">
2347 ##      <summary>
2348 ##      Domain allowed access.
2349 ##      </summary>
2350 ## </param>
2351 #
2352 interface(`dev_read_sound_mixer',`
2353         gen_require(`
2354                 type device_t, sound_device_t;
2355         ')
2356
2357         read_chr_files_pattern($1,device_t,sound_device_t)
2358 ')
2359
2360 ########################################
2361 ## <summary>
2362 ##      Write the sound mixer devices.
2363 ## </summary>
2364 ## <param name="domain">
2365 ##      <summary>
2366 ##      Domain allowed access.
2367 ##      </summary>
2368 ## </param>
2369 #
2370 interface(`dev_write_sound_mixer',`
2371         gen_require(`
2372                 type device_t, sound_device_t;
2373         ')
2374
2375         write_chr_files_pattern($1,device_t,sound_device_t)
2376 ')
2377
2378 ########################################
2379 ## <summary>
2380 ##      Get the attributes of the the power management device.
2381 ## </summary>
2382 ## <param name="domain">
2383 ##      <summary>
2384 ##      Domain allowed access.
2385 ##      </summary>
2386 ## </param>
2387 #
2388 interface(`dev_getattr_power_mgmt_dev',`
2389         gen_require(`
2390                 type device_t, power_device_t;
2391         ')
2392
2393         getattr_chr_files_pattern($1,device_t,power_device_t)
2394 ')
2395
2396 ########################################
2397 ## <summary>
2398 ##      Set the attributes of the the power management device.
2399 ## </summary>
2400 ## <param name="domain">
2401 ##      <summary>
2402 ##      Domain allowed access.
2403 ##      </summary>
2404 ## </param>
2405 #
2406 interface(`dev_setattr_power_mgmt_dev',`
2407         gen_require(`
2408                 type device_t, power_device_t;
2409         ')
2410
2411         setattr_chr_files_pattern($1,device_t,power_device_t)
2412 ')
2413
2414 ########################################
2415 ## <summary>
2416 ##      Read and write the the power management device.
2417 ## </summary>
2418 ## <param name="domain">
2419 ##      <summary>
2420 ##      Domain allowed access.
2421 ##      </summary>
2422 ## </param>
2423 #
2424 interface(`dev_rw_power_management',`
2425         gen_require(`
2426                 type device_t, power_device_t;
2427         ')
2428
2429         rw_chr_files_pattern($1,device_t,power_device_t)
2430 ')
2431
2432 ########################################
2433 ## <summary>
2434 ##      Get the attributes of sysfs directories.
2435 ## </summary>
2436 ## <param name="domain">
2437 ##      <summary>
2438 ##      The type of the process performing this action.
2439 ##      </summary>
2440 ## </param>
2441 #
2442 interface(`dev_getattr_sysfs_dirs',`
2443         gen_require(`
2444                 type sysfs_t;
2445         ')
2446
2447         allow $1 sysfs_t:dir getattr_dir_perms;
2448 ')
2449
2450 ########################################
2451 ## <summary>
2452 ##      Search the sysfs directories.
2453 ## </summary>
2454 ## <param name="domain">
2455 ##      <summary>
2456 ##      The type of the process performing this action.
2457 ##      </summary>
2458 ## </param>
2459 #
2460 interface(`dev_search_sysfs',`
2461         gen_require(`
2462                 type sysfs_t;
2463         ')
2464
2465         search_dirs_pattern($1,sysfs_t,sysfs_t)
2466 ')
2467
2468 ########################################
2469 ## <summary>
2470 ##      Do not audit attempts to search sysfs.
2471 ## </summary>
2472 ## <param name="domain">
2473 ##      <summary>
2474 ##      The type of the process performing this action.
2475 ##      </summary>
2476 ## </param>
2477 #
2478 interface(`dev_dontaudit_search_sysfs',`
2479         gen_require(`
2480                 type sysfs_t;
2481         ')
2482
2483         dontaudit $1 sysfs_t:dir search_dir_perms;
2484 ')
2485
2486 ########################################
2487 ## <summary>
2488 ##      List the contents of the sysfs directories.
2489 ## </summary>
2490 ## <param name="domain">
2491 ##      <summary>
2492 ##      The type of the process performing this action.
2493 ##      </summary>
2494 ## </param>
2495 #
2496 interface(`dev_list_sysfs',`
2497         gen_require(`
2498                 type sysfs_t;
2499         ')
2500
2501         list_dirs_pattern($1,sysfs_t,sysfs_t)
2502 ')
2503
2504 ########################################
2505 ## <summary>
2506 ##      Write in a sysfs directories.
2507 ## </summary>
2508 ## <param name="domain">
2509 ##      <summary>
2510 ##      The type of the process performing this action.
2511 ##      </summary>
2512 ## </param>
2513 #
2514 # cjp: added for cpuspeed
2515 interface(`dev_write_sysfs_dirs',`
2516         gen_require(`
2517                 type sysfs_t;
2518         ')
2519
2520         allow $1 sysfs_t:dir write;
2521 ')
2522
2523 ########################################
2524 ## <summary>
2525 ##      Allow caller to read hardware state information.
2526 ## </summary>
2527 ## <param name="domain">
2528 ##      <summary>
2529 ##      The process type reading hardware state information.
2530 ##      </summary>
2531 ## </param>
2532 #
2533 interface(`dev_read_sysfs',`
2534         gen_require(`
2535                 type sysfs_t;
2536         ')
2537
2538         read_files_pattern($1,sysfs_t,sysfs_t)
2539         read_lnk_files_pattern($1,sysfs_t,sysfs_t)
2540
2541         list_dirs_pattern($1,sysfs_t,sysfs_t)
2542 ')
2543
2544 ########################################
2545 ## <summary>
2546 ##      Allow caller to modify hardware state information.
2547 ## </summary>
2548 ## <param name="domain">
2549 ##      <summary>
2550 ##      The process type modifying hardware state information.
2551 ##      </summary>
2552 ## </param>
2553 #
2554 interface(`dev_rw_sysfs',`
2555         gen_require(`
2556                 type sysfs_t;
2557         ')
2558
2559
2560         rw_files_pattern($1,sysfs_t,sysfs_t)
2561         read_lnk_files_pattern($1,sysfs_t,sysfs_t)
2562
2563         list_dirs_pattern($1,sysfs_t,sysfs_t)
2564 ')
2565
2566 ########################################
2567 ## <summary>
2568 ##      Read from pseudo random devices (e.g., /dev/urandom)
2569 ## </summary>
2570 ## <param name="domain">
2571 ##      <summary>
2572 ##      Domain allowed access.
2573 ##      </summary>
2574 ## </param>
2575 #
2576 interface(`dev_read_urand',`
2577         gen_require(`
2578                 type device_t, urandom_device_t;
2579         ')
2580
2581         read_chr_files_pattern($1,device_t,urandom_device_t)
2582 ')
2583
2584 ########################################
2585 ## <summary>
2586 ##      Do not audit attempts to read from pseudo
2587 ##      random devices (e.g., /dev/urandom)
2588 ## </summary>
2589 ## <param name="domain">
2590 ##      <summary>
2591 ##      Domain to not audit.
2592 ##      </summary>
2593 ## </param>
2594 #
2595 interface(`dev_dontaudit_read_urand',`
2596         gen_require(`
2597                 type urandom_device_t;
2598         ')
2599
2600         dontaudit $1 urandom_device_t:chr_file { getattr read };
2601 ')
2602
2603 ########################################
2604 ## <summary>
2605 ##      Write to the pseudo random device (e.g., /dev/urandom). This
2606 ##      sets the random number generator seed.
2607 ## </summary>
2608 ## <param name="domain">
2609 ##      <summary>
2610 ##      Domain allowed access.
2611 ##      </summary>
2612 ## </param>
2613 #
2614 interface(`dev_write_urand',`
2615         gen_require(`
2616                 type device_t, urandom_device_t;
2617         ')
2618
2619         write_chr_files_pattern($1,device_t,urandom_device_t)
2620 ')
2621
2622 ########################################
2623 ## <summary>
2624 ##      Getattr generic the USB devices.
2625 ## </summary>
2626 ## <param name="domain">
2627 ##      <summary>
2628 ##      Domain allowed access.
2629 ##      </summary>
2630 ## </param>
2631 #
2632 interface(`dev_getattr_generic_usb_dev',`
2633         gen_require(`
2634                 type usb_device_t;
2635         ')
2636
2637         getattr_chr_files_pattern($1,device_t,usb_device_t)
2638 ')
2639
2640 ########################################
2641 ## <summary>
2642 ##      Setattr generic the USB devices.
2643 ## </summary>
2644 ## <param name="domain">
2645 ##      <summary>
2646 ##      Domain allowed access.
2647 ##      </summary>
2648 ## </param>
2649 #
2650 interface(`dev_setattr_generic_usb_dev',`
2651         gen_require(`
2652                 type usb_device_t;
2653         ')
2654
2655         setattr_chr_files_pattern($1,device_t,usb_device_t)
2656 ')
2657
2658 ########################################
2659 ## <summary>
2660 ##      Read and write generic the USB devices.
2661 ## </summary>
2662 ## <param name="domain">
2663 ##      <summary>
2664 ##      Domain allowed access.
2665 ##      </summary>
2666 ## </param>
2667 #
2668 interface(`dev_rw_generic_usb_dev',`
2669         gen_require(`
2670                 type usb_device_t;
2671         ')
2672
2673         rw_chr_files_pattern($1,device_t,usb_device_t)
2674 ')
2675
2676 ########################################
2677 ## <summary>
2678 ##      Mount a usbfs filesystem.
2679 ## </summary>
2680 ## <param name="domain">
2681 ##      <summary>
2682 ##      The type of the process performing this action.
2683 ##      </summary>
2684 ## </param>
2685 #
2686 interface(`dev_mount_usbfs',`
2687         gen_require(`
2688                 type usbfs_t;
2689         ')
2690
2691         allow $1 usbfs_t:filesystem mount;
2692 ')
2693
2694 ########################################
2695 ## <summary>
2696 ##      Associate a file to a usbfs filesystem.
2697 ## </summary>
2698 ## <param name="file_type">
2699 ##      <summary>
2700 ##      The type of the file to be associated to usbfs.
2701 ##      </summary>
2702 ## </param>
2703 #
2704 interface(`dev_associate_usbfs',`
2705         gen_require(`
2706                 type usbfs_t;
2707         ')
2708
2709         allow $1 usbfs_t:filesystem associate;
2710 ')
2711
2712 ########################################
2713 ## <summary>
2714 ##      Get the attributes of a directory in the usb filesystem.
2715 ## </summary>
2716 ## <param name="domain">
2717 ##      <summary>
2718 ##      Domain allowed access.
2719 ##      </summary>
2720 ## </param>
2721 #
2722 interface(`dev_getattr_usbfs_dirs',`
2723         gen_require(`
2724                 type usbfs_t;
2725         ')
2726
2727         allow $1 usbfs_t:dir getattr_dir_perms;
2728 ')
2729
2730 ########################################
2731 ## <summary>
2732 ##      Do not audit attempts to get the attributes
2733 ##      of a directory in the usb filesystem.
2734 ## </summary>
2735 ## <param name="domain">
2736 ##      <summary>
2737 ##      Domain to not audit.
2738 ##      </summary>
2739 ## </param>
2740 #
2741 interface(`dev_dontaudit_getattr_usbfs_dirs',`
2742         gen_require(`
2743                 type usbfs_t;
2744         ')
2745
2746         dontaudit $1 usbfs_t:dir getattr_dir_perms;
2747 ')
2748
2749 ########################################
2750 ## <summary>
2751 ##      Search the directory containing USB hardware information.
2752 ## </summary>
2753 ## <param name="domain">
2754 ##      <summary>
2755 ##      The type of the process performing this action.
2756 ##      </summary>
2757 ## </param>
2758 #
2759 interface(`dev_search_usbfs',`
2760         gen_require(`
2761                 type usbfs_t;
2762         ')
2763
2764         search_dirs_pattern($1,usbfs_t,usbfs_t)
2765 ')
2766
2767 ########################################
2768 ## <summary>
2769 ##      Allow caller to get a list of usb hardware.
2770 ## </summary>
2771 ## <param name="domain">
2772 ##      <summary>
2773 ##      The process type getting the list.
2774 ##      </summary>
2775 ## </param>
2776 #
2777 interface(`dev_list_usbfs',`
2778         gen_require(`
2779                 type usbfs_t;
2780         ')
2781
2782         read_lnk_files_pattern($1,usbfs_t,usbfs_t)
2783         getattr_files_pattern($1,usbfs_t,usbfs_t)
2784
2785         list_dirs_pattern($1,usbfs_t,usbfs_t)
2786 ')
2787
2788 ########################################
2789 ## <summary>
2790 ##      Set the attributes of usbfs filesystem.
2791 ## </summary>
2792 ## <param name="domain">
2793 ##      <summary>
2794 ##      Domain allowed access.
2795 ##      </summary>
2796 ## </param>
2797 #
2798 interface(`dev_setattr_usbfs_files',`
2799         gen_require(`
2800                 type usbfs_t;
2801         ')
2802
2803         setattr_files_pattern($1,usbfs_t,usbfs_t)
2804         list_dirs_pattern($1,usbfs_t,usbfs_t)
2805 ')
2806
2807 ########################################
2808 ## <summary>
2809 ##      Read USB hardware information using
2810 ##      the usbfs filesystem interface.
2811 ## </summary>
2812 ## <param name="domain">
2813 ##      <summary>
2814 ##      The type of the process performing this action.
2815 ##      </summary>
2816 ## </param>
2817 #
2818 interface(`dev_read_usbfs',`
2819         gen_require(`
2820                 type usbfs_t;
2821         ')
2822
2823         read_files_pattern($1,usbfs_t,usbfs_t)
2824         read_lnk_files_pattern($1,usbfs_t,usbfs_t)
2825         list_dirs_pattern($1,usbfs_t,usbfs_t)
2826 ')
2827
2828 ########################################
2829 ## <summary>
2830 ##      Allow caller to modify usb hardware configuration files.
2831 ## </summary>
2832 ## <param name="domain">
2833 ##      <summary>
2834 ##      The process type modifying the options.
2835 ##      </summary>
2836 ## </param>
2837 #
2838 interface(`dev_rw_usbfs',`
2839         gen_require(`
2840                 type usbfs_t;
2841         ')
2842
2843         list_dirs_pattern($1,usbfs_t,usbfs_t)
2844         rw_files_pattern($1,usbfs_t,usbfs_t)
2845         read_lnk_files_pattern($1,usbfs_t,usbfs_t)
2846 ')
2847
2848 ########################################
2849 ## <summary>
2850 ##      Get the attributes of video4linux devices.
2851 ## </summary>
2852 ## <param name="domain">
2853 ##      <summary>
2854 ##      Domain allowed access.
2855 ##      </summary>
2856 ## </param>
2857 #
2858 interface(`dev_getattr_video_dev',`
2859         gen_require(`
2860                 type device_t, v4l_device_t;
2861         ')
2862
2863         getattr_chr_files_pattern($1,device_t,v4l_device_t)
2864 ')
2865
2866 ########################################
2867 ## <summary>
2868 ##      Do not audit attempts to get the attributes
2869 ##      of video4linux device nodes.
2870 ## </summary>
2871 ## <param name="domain">
2872 ##      <summary>
2873 ##      Domain to not audit.
2874 ##      </summary>
2875 ## </param>
2876 #
2877 interface(`dev_dontaudit_getattr_video_dev',`
2878         gen_require(`
2879                 type v4l_device_t;
2880         ')
2881
2882         dontaudit $1 v4l_device_t:chr_file getattr;
2883 ')
2884
2885 ########################################
2886 ## <summary>
2887 ##      Set the attributes of video4linux device nodes.
2888 ## </summary>
2889 ## <param name="domain">
2890 ##      <summary>
2891 ##      Domain allowed access.
2892 ##      </summary>
2893 ## </param>
2894 #
2895 interface(`dev_setattr_video_dev',`
2896         gen_require(`
2897                 type device_t, v4l_device_t;
2898         ')
2899
2900         setattr_chr_files_pattern($1,device_t,v4l_device_t)
2901 ')
2902
2903 ########################################
2904 ## <summary>
2905 ##      Do not audit attempts to set the attributes
2906 ##      of video4linux device nodes.
2907 ## </summary>
2908 ## <param name="domain">
2909 ##      <summary>
2910 ##      Domain to not audit.
2911 ##      </summary>
2912 ## </param>
2913 #
2914 interface(`dev_dontaudit_setattr_video_dev',`
2915         gen_require(`
2916                 type v4l_device_t;
2917         ')
2918
2919         dontaudit $1 v4l_device_t:chr_file setattr;
2920 ')
2921
2922 ########################################
2923 ## <summary>
2924 ##      Read the video4linux devices.
2925 ## </summary>
2926 ## <param name="domain">
2927 ##      <summary>
2928 ##      Domain allowed access.
2929 ##      </summary>
2930 ## </param>
2931 #
2932 interface(`dev_read_video_dev',`
2933         gen_require(`
2934                 type device_t, v4l_device_t;
2935         ')
2936
2937         read_chr_files_pattern($1,device_t,v4l_device_t)
2938 ')
2939
2940 ########################################
2941 ## <summary>
2942 ##      Write the video4linux devices.
2943 ## </summary>
2944 ## <param name="domain">
2945 ##      <summary>
2946 ##      Domain allowed access.
2947 ##      </summary>
2948 ## </param>
2949 #
2950 interface(`dev_write_video_dev',`
2951         gen_require(`
2952                 type device_t, v4l_device_t;
2953         ')
2954
2955         write_chr_files_pattern($1,device_t,v4l_device_t)
2956 ')
2957
2958 ########################################
2959 ## <summary>
2960 ##      Read and write VMWare devices.
2961 ## </summary>
2962 ## <param name="domain">
2963 ##      <summary>
2964 ##      Domain allowed access.
2965 ##      </summary>
2966 ## </param>
2967 #
2968 interface(`dev_rw_vmware',`
2969         gen_require(`
2970                 type device_t, vmware_device_t;
2971         ')
2972
2973         rw_chr_files_pattern($1,device_t,vmware_device_t)
2974 ')
2975
2976 ########################################
2977 ## <summary>
2978 ##      Read, write, and mmap VMWare devices.
2979 ## </summary>
2980 ## <param name="domain">
2981 ##      <summary>
2982 ##      Domain allowed access.
2983 ##      </summary>
2984 ## </param>
2985 #
2986 interface(`dev_rwx_vmware',`
2987         gen_require(`
2988                 type device_t, vmware_device_t;
2989         ')
2990
2991         dev_rw_vmware($1)
2992         allow $1 vmware_device_t:chr_file execute;
2993 ')
2994
2995 ########################################
2996 ## <summary>
2997 ##      Write to watchdog devices.
2998 ## </summary>
2999 ## <param name="domain">
3000 ##      <summary>
3001 ##      Domain allowed access.
3002 ##      </summary>
3003 ## </param>
3004 #
3005 interface(`dev_write_watchdog',`
3006         gen_require(`
3007                 type device_t, watchdog_device_t;
3008         ')
3009
3010         write_chr_files_pattern($1,device_t,watchdog_device_t)
3011 ')
3012
3013 ########################################
3014 ## <summary>
3015 ##      Read and write Xen devices.
3016 ## </summary>
3017 ## <param name="domain">
3018 ##      <summary>
3019 ##      Domain allowed access.
3020 ##      </summary>
3021 ## </param>
3022 #
3023 interface(`dev_rw_xen',`
3024         gen_require(`
3025                 type device_t, xen_device_t;
3026         ')
3027
3028         rw_chr_files_pattern($1,device_t,xen_device_t)
3029 ')
3030
3031 ########################################
3032 ## <summary>
3033 ##      Create, read, write, and delete Xen devices.
3034 ## </summary>
3035 ## <param name="domain">
3036 ##      <summary>
3037 ##      Domain allowed access.
3038 ##      </summary>
3039 ## </param>
3040 #
3041 interface(`dev_manage_xen',`
3042         gen_require(`
3043                 type device_t, xen_device_t;
3044         ')
3045
3046         manage_chr_files_pattern($1,device_t,xen_device_t)
3047 ')
3048
3049 ########################################
3050 ## <summary>
3051 ##      Automatic type transition to the type
3052 ##      for xen device nodes when created in /dev.
3053 ## </summary>
3054 ## <param name="domain">
3055 ##      <summary>
3056 ##      Domain allowed access.
3057 ##      </summary>
3058 ## </param>
3059 #
3060 interface(`dev_filetrans_xen',`
3061         gen_require(`
3062                 type device_t, xen_device_t;
3063         ')
3064
3065         filetrans_pattern($1,device_t,xen_device_t,chr_file)
3066 ')
3067
3068 ########################################
3069 ## <summary>
3070 ##      Get the attributes of X server miscellaneous devices.
3071 ## </summary>
3072 ## <param name="domain">
3073 ##      <summary>
3074 ##      Domain allowed access.
3075 ##      </summary>
3076 ## </param>
3077 #
3078 interface(`dev_getattr_xserver_misc_dev',`
3079         gen_require(`
3080                 type device_t, xserver_misc_device_t;
3081         ')
3082
3083         getattr_chr_files_pattern($1,device_t,xserver_misc_device_t)
3084 ')
3085
3086 ########################################
3087 ## <summary>
3088 ##      Set the attributes of X server miscellaneous devices.
3089 ## </summary>
3090 ## <param name="domain">
3091 ##      <summary>
3092 ##      Domain allowed access.
3093 ##      </summary>
3094 ## </param>
3095 #
3096 interface(`dev_setattr_xserver_misc_dev',`
3097         gen_require(`
3098                 type device_t, xserver_misc_device_t;
3099         ')
3100
3101         setattr_chr_files_pattern($1,device_t,xserver_misc_device_t)
3102 ')
3103
3104 ########################################
3105 ## <summary>
3106 ##      Read and write X server miscellaneous devices.
3107 ## </summary>
3108 ## <param name="domain">
3109 ##      <summary>
3110 ##      Domain allowed access.
3111 ##      </summary>
3112 ## </param>
3113 #
3114 interface(`dev_rw_xserver_misc',`
3115         gen_require(`
3116                 type device_t, xserver_misc_device_t;
3117         ')
3118
3119         rw_chr_files_pattern($1,device_t,xserver_misc_device_t)
3120 ')
3121
3122 ########################################
3123 ## <summary>
3124 ##      Read and write to the zero device (/dev/zero).
3125 ## </summary>
3126 ## <param name="domain">
3127 ##      <summary>
3128 ##      Domain allowed access.
3129 ##      </summary>
3130 ## </param>
3131 #
3132 interface(`dev_rw_zero',`
3133         gen_require(`
3134                 type device_t, zero_device_t;
3135         ')
3136
3137         rw_chr_files_pattern($1,device_t,zero_device_t)
3138 ')
3139
3140 ########################################
3141 ## <summary>
3142 ##      Read, write, and execute the zero device (/dev/zero).
3143 ## </summary>
3144 ## <param name="domain">
3145 ##      <summary>
3146 ##      Domain allowed access.
3147 ##      </summary>
3148 ## </param>
3149 #
3150 interface(`dev_rwx_zero',`
3151         gen_require(`
3152                 type zero_device_t;
3153         ')
3154
3155         dev_rw_zero($1)
3156         allow $1 zero_device_t:chr_file execute;
3157 ')
3158
3159 ########################################
3160 ## <summary>
3161 ##      Execmod the zero device (/dev/zero).
3162 ## </summary>
3163 ## <param name="domain">
3164 ##      <summary>
3165 ##      Domain allowed access.
3166 ##      </summary>
3167 ## </param>
3168 #
3169 interface(`dev_execmod_zero',`
3170         gen_require(`
3171                 type zero_device_t;
3172         ')
3173
3174         dev_rw_zero($1)
3175         allow $1 zero_device_t:chr_file execmod;
3176 ')
3177
3178 ########################################
3179 ## <summary>
3180 ##      Create the zero device (/dev/zero).
3181 ## </summary>
3182 ## <param name="domain">
3183 ##      <summary>
3184 ##      Domain allowed access.
3185 ##      </summary>
3186 ## </param>
3187 #
3188 interface(`dev_create_zero_dev',`
3189         gen_require(`
3190                 type device_t, zero_device_t;
3191         ')
3192
3193         create_chr_files_pattern($1,device_t,zero_device_t)
3194 ')
3195
3196 ########################################
3197 ## <summary>
3198 ##      Unconfined access to devices.
3199 ## </summary>
3200 ## <param name="domain">
3201 ##      <summary>
3202 ##      Domain allowed access.
3203 ##      </summary>
3204 ## </param>
3205 #
3206 interface(`dev_unconfined',`
3207         gen_require(`
3208                 attribute devices_unconfined_type;
3209         ')
3210
3211         typeattribute $1 devices_unconfined_type;
3212 ')