policy/modules/kernel/files.if

   1 ## <summary>
   2 ## Basic filesystem types and interfaces.
   3 ## </summary>
   4 ## <desc>
   5 ## <p>
   6 ## This module contains basic filesystem types and interfaces. This
   7 ## includes:
   8 ## <ul>
   9 ##      <li>The concept of different file types including basic
  10 ##      files, mount points, tmp files, etc.</li>
  11 ##      <li>Access to groups of files and all files.</li>
  12 ##      <li>Types and interfaces for the basic filesystem layout
  13 ##      (/, /etc, /tmp, /usr, etc.).</li>
  14 ## </ul>
  15 ## </p>
  16 ## </desc>
  17 ## <required val="true">
  18 ##      Contains the concept of a file.
  19 ##      Comains the file initial SID.
  20 ## </required>
  21
  22 ########################################
  23 ## <summary>
  24 ##      Make the specified type usable for files
  25 ##      in a filesystem.
  26 ## </summary>
  27 ## <desc>
  28 ##      <p>
  29 ##      Make the specified type usable for files
  30 ##      in a filesystem.  Types used for files that
  31 ##      do not use this interface, or an interface that
  32 ##      calls this one, will have unexpected behaviors
  33 ##      while the system is running. If the type is used
  34 ##      for device nodes (character or block files), then
  35 ##      the dev_node() interface is more appropriate.
  36 ##      </p>
  37 ##      <p>
  38 ##      Related interfaces:
  39 ##      </p>
  40 ##      <ul>
  41 ##              <li>application_domain()</li>
  42 ##              <li>application_executable_file()</li>
  43 ##              <li>corecmd_executable_file()</li>
  44 ##              <li>init_daemon_domain()</li>
  45 ##              <li>init_domaion()</li>
  46 ##              <li>init_ranged_daemon_domain()</li>
  47 ##              <li>init_ranged_domain()</li>
  48 ##              <li>init_ranged_system_domain()</li>
  49 ##              <li>init_script_file()</li>
  50 ##              <li>init_script_domain()</li>
  51 ##              <li>init_system_domain()</li>
  52 ##              <li>files_config_files()</li>
  53 ##              <li>files_lock_file()</li>
  54 ##              <li>files_mountpoint()</li>
  55 ##              <li>files_pid_file()</li>
  56 ##              <li>files_security_file()</li>
  57 ##              <li>files_security_mountpoint()</li>
  58 ##              <li>files_tmp_file()</li>
  59 ##              <li>files_tmpfs_file()</li>
  60 ##              <li>logging_log_file()</li>
  61 ##              <li>userdom_user_home_content()</li>
  62 ##      </ul>
  63 ##      <p>
  64 ##      Example:
  65 ##      </p>
  66 ##      <p>
  67 ##      type myfile_t;
  68 ##      files_type(myfile_t)
  69 ##      allow mydomain_t myfile_t:file read_file_perms;
  70 ##      </p>
  71 ## </desc>
  72 ## <param name="type">
  73 ##      <summary>
  74 ##      Type to be used for files.
  75 ##      </summary>
  76 ## </param>
  77 ## <infoflow type="none"/>
  78 #
  79 interface(`files_type',`
  80         gen_require(`
  81                 attribute file_type, non_security_file_type;
  82         ')
  83
  84         typeattribute $1 file_type, non_security_file_type;
  85 ')
  86
  87 ########################################
  88 ## <summary>
  89 ##      Make the specified type a file that
  90 ##      should not be dontaudited from
  91 ##      browsing from user domains.
  92 ## </summary>
  93 ## <param name="file_type">
  94 ##      <summary>
  95 ##      Type of the file to be used as a
  96 ##      member directory.
  97 ##      </summary>
  98 ## </param>
  99 #
 100 interface(`files_security_file',`
 101         gen_require(`
 102                 attribute file_type, security_file_type;
 103         ')
 104
 105         typeattribute $1 file_type, security_file_type;
 106 ')
 107
 108 ########################################
 109 ## <summary>
 110 ##      Make the specified type usable for
 111 ##      lock files.
 112 ## </summary>
 113 ## <param name="type">
 114 ##      <summary>
 115 ##      Type to be used for lock files.
 116 ##      </summary>
 117 ## </param>
 118 #
 119 interface(`files_lock_file',`
 120         gen_require(`
 121                 attribute lockfile;
 122         ')
 123
 124         files_type($1)
 125         typeattribute $1 lockfile;
 126 ')
 127
 128 ########################################
 129 ## <summary>
 130 ##      Make the specified type usable for
 131 ##      filesystem mount points.
 132 ## </summary>
 133 ## <param name="type">
 134 ##      <summary>
 135 ##      Type to be used for mount points.
 136 ##      </summary>
 137 ## </param>
 138 #
 139 interface(`files_mountpoint',`
 140         gen_require(`
 141                 attribute mountpoint;
 142         ')
 143
 144         files_type($1)
 145         typeattribute $1 mountpoint;
 146 ')
 147
 148 ########################################
 149 ## <summary>
 150 ##      Make the specified type usable for
 151 ##      security file filesystem mount points.
 152 ## </summary>
 153 ## <param name="type">
 154 ##      <summary>
 155 ##      Type to be used for mount points.
 156 ##      </summary>
 157 ## </param>
 158 #
 159 interface(`files_security_mountpoint',`
 160         gen_require(`
 161                 attribute mountpoint;
 162         ')
 163
 164         files_security_file($1)
 165         typeattribute $1 mountpoint;
 166 ')
 167
 168 ########################################
 169 ## <summary>
 170 ##      Make the specified type usable for
 171 ##      runtime process ID files.
 172 ## </summary>
 173 ## <desc>
 174 ##      <p>
 175 ##      Make the specified type usable for runtime process ID files,
 176 ##      typically found in /var/run.
 177 ##      This will also make the type usable for files, making
 178 ##      calls to files_type() redundant.  Failure to use this interface
 179 ##      for a PID file type may result in problems with starting
 180 ##      or stopping services.
 181 ##      </p>
 182 ##      <p>
 183 ##      Related interfaces:
 184 ##      </p>
 185 ##      <ul>
 186 ##              <li>files_pid_filetrans()</li>
 187 ##      </ul>
 188 ##      <p>
 189 ##      Example usage with a domain that can create and
 190 ##      write its PID file with a private PID file type in the
 191 ##      /var/run directory:
 192 ##      </p>
 193 ##      <p>
 194 ##      type mypidfile_t;
 195 ##      files_pid_file(mypidfile_t)
 196 ##      allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms };
 197 ##      files_pid_filetrans(mydomain_t, mypidfile_t, file)
 198 ##      </p>
 199 ## </desc>
 200 ## <param name="type">
 201 ##      <summary>
 202 ##      Type to be used for PID files.
 203 ##      </summary>
 204 ## </param>
 205 ## <infoflow type="none"/>
 206 #
 207 interface(`files_pid_file',`
 208         gen_require(`
 209                 attribute pidfile;
 210         ')
 211
 212         files_type($1)
 213         typeattribute $1 pidfile;
 214 ')
 215
 216 ########################################
 217 ## <summary>
 218 ##      Make the specified type a
 219 ##      configuration file.
 220 ## </summary>
 221 ## <desc>
 222 ##      <p>
 223 ##      Make the specified type usable for configuration files.
 224 ##      This will also make the type usable for files, making
 225 ##      calls to files_type() redundant.  Failure to use this interface
 226 ##      for a temporary file may result in problems with
 227 ##      configuration management tools.
 228 ##      </p>
 229 ##      <p>
 230 ##      Example usage with a domain that can read
 231 ##      its configuration file /etc:
 232 ##      </p>
 233 ##      <p>
 234 ##      type myconffile_t;
 235 ##      files_config_file(myconffile_t)
 236 ##      allow mydomain_t myconffile_t:file read_file_perms;
 237 ##      files_search_etc(mydomain_t)
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="file_type">
 241 ##      <summary>
 242 ##      Type to be used as a configuration file.
 243 ##      </summary>
 244 ## </param>
 245 ## <infoflow type="none"/>
 246 #
 247 interface(`files_config_file',`
 248         gen_require(`
 249                 attribute configfile;
 250         ')
 251         files_type($1)
 252         typeattribute $1 configfile;
 253 ')
 254
 255 ########################################
 256 ## <summary>
 257 ##      Make the specified type a
 258 ##      polyinstantiated directory.
 259 ## </summary>
 260 ## <param name="file_type">
 261 ##      <summary>
 262 ##      Type of the file to be used as a
 263 ##      polyinstantiated directory.
 264 ##      </summary>
 265 ## </param>
 266 #
 267 interface(`files_poly',`
 268         gen_require(`
 269                 attribute polydir;
 270         ')
 271
 272         files_type($1)
 273         typeattribute $1 polydir;
 274 ')
 275
 276 ########################################
 277 ## <summary>
 278 ##      Make the specified type a parent
 279 ##      of a polyinstantiated directory.
 280 ## </summary>
 281 ## <param name="file_type">
 282 ##      <summary>
 283 ##      Type of the file to be used as a
 284 ##      parent directory.
 285 ##      </summary>
 286 ## </param>
 287 #
 288 interface(`files_poly_parent',`
 289         gen_require(`
 290                 attribute polyparent;
 291         ')
 292
 293         files_type($1)
 294         typeattribute $1 polyparent;
 295 ')
 296
 297 ########################################
 298 ## <summary>
 299 ##      Make the specified type a
 300 ##      polyinstantiation member directory.
 301 ## </summary>
 302 ## <param name="file_type">
 303 ##      <summary>
 304 ##      Type of the file to be used as a
 305 ##      member directory.
 306 ##      </summary>
 307 ## </param>
 308 #
 309 interface(`files_poly_member',`
 310         gen_require(`
 311                 attribute polymember;
 312         ')
 313
 314         files_type($1)
 315         typeattribute $1 polymember;
 316 ')
 317
 318 ########################################
 319 ## <summary>
 320 ##      Make the domain use the specified
 321 ##      type of polyinstantiated directory.
 322 ## </summary>
 323 ## <param name="domain">
 324 ##      <summary>
 325 ##      Domain using the polyinstantiated
 326 ##      directory.
 327 ##      </summary>
 328 ## </param>
 329 ## <param name="file_type">
 330 ##      <summary>
 331 ##      Type of the file to be used as a
 332 ##      member directory.
 333 ##      </summary>
 334 ## </param>
 335 #
 336 interface(`files_poly_member_tmp',`
 337         gen_require(`
 338                 type tmp_t;
 339         ')
 340
 341         type_member $1 tmp_t:dir $2;
 342 ')
 343
 344 ########################################
 345 ## <summary>
 346 ##      Make the specified type a file
 347 ##      used for temporary files.
 348 ## </summary>
 349 ## <desc>
 350 ##      <p>
 351 ##      Make the specified type usable for temporary files.
 352 ##      This will also make the type usable for files, making
 353 ##      calls to files_type() redundant.  Failure to use this interface
 354 ##      for a temporary file may result in problems with
 355 ##      purging temporary files.
 356 ##      </p>
 357 ##      <p>
 358 ##      Related interfaces:
 359 ##      </p>
 360 ##      <ul>
 361 ##              <li>files_tmp_filetrans()</li>
 362 ##      </ul>
 363 ##      <p>
 364 ##      Example usage with a domain that can create and
 365 ##      write its temporary file in the system temporary file
 366 ##      directories (/tmp or /var/tmp):
 367 ##      </p>
 368 ##      <p>
 369 ##      type mytmpfile_t;
 370 ##      files_tmp_file(mytmpfile_t)
 371 ##      allow mydomain_t mytmpfile_t:file { create_file_perms write_file_perms };
 372 ##      files_tmp_filetrans(mydomain_t, mytmpfile_t, file)
 373 ##      </p>
 374 ## </desc>
 375 ## <param name="file_type">
 376 ##      <summary>
 377 ##      Type of the file to be used as a
 378 ##      temporary file.
 379 ##      </summary>
 380 ## </param>
 381 ## <infoflow type="none"/>
 382 #
 383 interface(`files_tmp_file',`
 384         gen_require(`
 385                 attribute tmpfile;
 386                 type tmp_t;
 387         ')
 388
 389         files_type($1)
 390         files_poly_member($1)
 391         typeattribute $1 tmpfile;
 392 ')
 393
 394 ########################################
 395 ## <summary>
 396 ##      Transform the type into a file, for use on a
 397 ##      virtual memory filesystem (tmpfs).
 398 ## </summary>
 399 ## <param name="type">
 400 ##      <summary>
 401 ##      The type to be transformed.
 402 ##      </summary>
 403 ## </param>
 404 #
 405 interface(`files_tmpfs_file',`
 406         gen_require(`
 407                 attribute tmpfsfile;
 408         ')
 409
 410         files_type($1)
 411         typeattribute $1 tmpfsfile;
 412 ')
 413
 414 ########################################
 415 ## <summary>
 416 ##      Get the attributes of all directories.
 417 ## </summary>
 418 ## <param name="domain">
 419 ##      <summary>
 420 ##      Domain allowed access.
 421 ##      </summary>
 422 ## </param>
 423 #
 424 interface(`files_getattr_all_dirs',`
 425         gen_require(`
 426                 attribute file_type;
 427         ')
 428
 429         getattr_dirs_pattern($1, file_type, file_type)
 430 ')
 431
 432 ########################################
 433 ## <summary>
 434 ##      Do not audit attempts to get the attributes
 435 ##      of all directories.
 436 ## </summary>
 437 ## <param name="domain">
 438 ##      <summary>
 439 ##      Domain to not audit.
 440 ##      </summary>
 441 ## </param>
 442 #
 443 interface(`files_dontaudit_getattr_all_dirs',`
 444         gen_require(`
 445                 attribute file_type;
 446         ')
 447
 448         dontaudit $1 file_type:dir getattr;
 449 ')
 450
 451 ########################################
 452 ## <summary>
 453 ##      List all non-security directories.
 454 ## </summary>
 455 ## <param name="domain">
 456 ##      <summary>
 457 ##      Domain allowed access.
 458 ##      </summary>
 459 ## </param>
 460 #
 461 interface(`files_list_non_security',`
 462         gen_require(`
 463                 attribute non_security_file_type;
 464         ')
 465
 466         list_dirs_pattern($1, non_security_file_type, non_security_file_type)
 467 ')
 468
 469 ########################################
 470 ## <summary>
 471 ##      Do not audit attempts to list all
 472 ##      non-security directories.
 473 ## </summary>
 474 ## <param name="domain">
 475 ##      <summary>
 476 ##      Domain to not audit.
 477 ##      </summary>
 478 ## </param>
 479 #
 480 interface(`files_dontaudit_list_non_security',`
 481         gen_require(`
 482                 attribute non_security_file_type;
 483         ')
 484
 485         dontaudit $1 non_security_file_type:dir list_dir_perms;
 486 ')
 487
 488 ########################################
 489 ## <summary>
 490 ##      Mount a filesystem on all non-security
 491 ##      directories and files.
 492 ## </summary>
 493 ## <param name="domain">
 494 ##      <summary>
 495 ##      Domain allowed access.
 496 ##      </summary>
 497 ## </param>
 498 #
 499 interface(`files_mounton_non_security',`
 500         gen_require(`
 501                 attribute non_security_file_type;
 502         ')
 503
 504         allow $1 non_security_file_type:dir mounton;
 505         allow $1 non_security_file_type:file mounton;
 506 ')
 507
 508 ########################################
 509 ## <summary>
 510 ##      Allow attempts to modify any directory
 511 ## </summary>
 512 ## <param name="domain">
 513 ##      <summary>
 514 ##      Domain allowed access.
 515 ##      </summary>
 516 ## </param>
 517 #
 518 interface(`files_write_non_security_dirs',`
 519         gen_require(`
 520                 attribute non_security_file_type;
 521         ')
 522
 523         allow $1 non_security_file_type:dir write;
 524 ')
 525
 526 ########################################
 527 ## <summary>
 528 ##      Allow attempts to manage non-security directories
 529 ## </summary>
 530 ## <param name="domain">
 531 ##      <summary>
 532 ##      Domain allowed access.
 533 ##      </summary>
 534 ## </param>
 535 #
 536 interface(`files_manage_non_security_dirs',`
 537         gen_require(`
 538                 attribute non_security_file_type;
 539         ')
 540
 541         allow $1 non_security_file_type:dir manage_dir_perms;
 542 ')
 543
 544 ########################################
 545 ## <summary>
 546 ##      Get the attributes of all files.
 547 ## </summary>
 548 ## <param name="domain">
 549 ##      <summary>
 550 ##      Domain allowed access.
 551 ##      </summary>
 552 ## </param>
 553 #
 554 interface(`files_getattr_all_files',`
 555         gen_require(`
 556                 attribute file_type;
 557         ')
 558
 559         getattr_files_pattern($1, file_type, file_type)
 560         getattr_lnk_files_pattern($1, file_type, file_type)
 561 ')
 562
 563 ########################################
 564 ## <summary>
 565 ##      Do not audit attempts to get the attributes
 566 ##      of all files.
 567 ## </summary>
 568 ## <param name="domain">
 569 ##      <summary>
 570 ##      Domain to not audit.
 571 ##      </summary>
 572 ## </param>
 573 #
 574 interface(`files_dontaudit_getattr_all_files',`
 575         gen_require(`
 576                 attribute file_type;
 577         ')
 578
 579         dontaudit $1 file_type:file getattr;
 580 ')
 581
 582 ########################################
 583 ## <summary>
 584 ##      Do not audit attempts to get the attributes
 585 ##      of non security files.
 586 ## </summary>
 587 ## <param name="domain">
 588 ##      <summary>
 589 ##      Domain to not audit.
 590 ##      </summary>
 591 ## </param>
 592 #
 593 interface(`files_dontaudit_getattr_non_security_files',`
 594         gen_require(`
 595                 attribute non_security_file_type;
 596         ')
 597
 598         dontaudit $1 non_security_file_type:file getattr;
 599 ')
 600
 601 ########################################
 602 ## <summary>
 603 ##      Read all files.
 604 ## </summary>
 605 ## <param name="domain">
 606 ##      <summary>
 607 ##      Domain allowed access.
 608 ##      </summary>
 609 ## </param>
 610 #
 611 interface(`files_read_all_files',`
 612         gen_require(`
 613                 attribute file_type;
 614         ')
 615
 616         allow $1 file_type:dir list_dir_perms;
 617         read_files_pattern($1, file_type, file_type)
 618
 619         optional_policy(`
 620                 auth_read_shadow($1)
 621         ')
 622 ')
 623
 624 ########################################
 625 ## <summary>
 626 ##      Allow shared library text relocations in all files.
 627 ## </summary>
 628 ## <desc>
 629 ##      <p>
 630 ##      Allow shared library text relocations in all files.
 631 ##      </p>
 632 ##      <p>
 633 ##      This is added to support WINE policy.
 634 ##      </p>
 635 ## </desc>
 636 ## <param name="domain">
 637 ##      <summary>
 638 ##      Domain allowed access.
 639 ##      </summary>
 640 ## </param>
 641 #
 642 interface(`files_execmod_all_files',`
 643         gen_require(`
 644                 attribute file_type;
 645         ')
 646
 647         allow $1 file_type:file execmod;
 648 ')
 649
 650 ########################################
 651 ## <summary>
 652 ##      Read all non-security files.
 653 ## </summary>
 654 ## <param name="domain">
 655 ##      <summary>
 656 ##      Domain allowed access.
 657 ##      </summary>
 658 ## </param>
 659 ## <rolecap/>
 660 #
 661 interface(`files_read_non_security_files',`
 662         gen_require(`
 663                 attribute non_security_file_type;
 664         ')
 665
 666         read_files_pattern($1, non_security_file_type, non_security_file_type)
 667         read_lnk_files_pattern($1, non_security_file_type, non_security_file_type)
 668 ')
 669
 670 ########################################
 671 ## <summary>
 672 ##      Read all directories on the filesystem, except
 673 ##      the listed exceptions.
 674 ## </summary>
 675 ## <param name="domain">
 676 ##      <summary>
 677 ##      Domain allowed access.
 678 ##      </summary>
 679 ## </param>
 680 ## <param name="exception_types" optional="true">
 681 ##      <summary>
 682 ##      The types to be excluded.  Each type or attribute
 683 ##      must be negated by the caller.
 684 ##      </summary>
 685 ## </param>
 686 #
 687 interface(`files_read_all_dirs_except',`
 688         gen_require(`
 689                 attribute file_type;
 690         ')
 691
 692         allow $1 { file_type $2 }:dir list_dir_perms;
 693 ')
 694
 695 ########################################
 696 ## <summary>
 697 ##      Read all files on the filesystem, except
 698 ##      the listed exceptions.
 699 ## </summary>
 700 ## <param name="domain">
 701 ##      <summary>
 702 ##      Domain allowed access.
 703 ##      </summary>
 704 ## </param>
 705 ## <param name="exception_types" optional="true">
 706 ##      <summary>
 707 ##      The types to be excluded.  Each type or attribute
 708 ##      must be negated by the caller.
 709 ##      </summary>
 710 ## </param>
 711 #
 712 interface(`files_read_all_files_except',`
 713         gen_require(`
 714                 attribute file_type;
 715         ')
 716
 717         read_files_pattern($1, { file_type $2 }, { file_type $2 })
 718 ')
 719
 720 ########################################
 721 ## <summary>
 722 ##      Read all symbolic links on the filesystem, except
 723 ##      the listed exceptions.
 724 ## </summary>
 725 ## <param name="domain">
 726 ##      <summary>
 727 ##      Domain allowed access.
 728 ##      </summary>
 729 ## </param>
 730 ## <param name="exception_types" optional="true">
 731 ##      <summary>
 732 ##      The types to be excluded.  Each type or attribute
 733 ##      must be negated by the caller.
 734 ##      </summary>
 735 ## </param>
 736 #
 737 interface(`files_read_all_symlinks_except',`
 738         gen_require(`
 739                 attribute file_type;
 740         ')
 741
 742         read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
 743 ')
 744
 745 ########################################
 746 ## <summary>
 747 ##      Get the attributes of all symbolic links.
 748 ## </summary>
 749 ## <param name="domain">
 750 ##      <summary>
 751 ##      Domain allowed access.
 752 ##      </summary>
 753 ## </param>
 754 #
 755 interface(`files_getattr_all_symlinks',`
 756         gen_require(`
 757                 attribute file_type;
 758         ')
 759
 760         getattr_lnk_files_pattern($1, file_type, file_type)
 761 ')
 762
 763 ########################################
 764 ## <summary>
 765 ##      Do not audit attempts to get the attributes
 766 ##      of all symbolic links.
 767 ## </summary>
 768 ## <param name="domain">
 769 ##      <summary>
 770 ##      Domain to not audit.
 771 ##      </summary>
 772 ## </param>
 773 #
 774 interface(`files_dontaudit_getattr_all_symlinks',`
 775         gen_require(`
 776                 attribute file_type;
 777         ')
 778
 779         dontaudit $1 file_type:lnk_file getattr;
 780 ')
 781
 782 ########################################
 783 ## <summary>
 784 ##      Do not audit attempts to read all symbolic links.
 785 ## </summary>
 786 ## <param name="domain">
 787 ##      <summary>
 788 ##      Domain to not audit.
 789 ##      </summary>
 790 ## </param>
 791 #
 792 interface(`files_dontaudit_read_all_symlinks',`
 793         gen_require(`
 794                 attribute file_type;
 795         ')
 796
 797         dontaudit $1 file_type:lnk_file read;
 798 ')
 799
 800 ########################################
 801 ## <summary>
 802 ##      Do not audit attempts to get the attributes
 803 ##      of non security symbolic links.
 804 ## </summary>
 805 ## <param name="domain">
 806 ##      <summary>
 807 ##      Domain to not audit.
 808 ##      </summary>
 809 ## </param>
 810 #
 811 interface(`files_dontaudit_getattr_non_security_symlinks',`
 812         gen_require(`
 813                 attribute non_security_file_type;
 814         ')
 815
 816         dontaudit $1 non_security_file_type:lnk_file getattr;
 817 ')
 818
 819 ########################################
 820 ## <summary>
 821 ##      Do not audit attempts to get the attributes
 822 ##      of non security block devices.
 823 ## </summary>
 824 ## <param name="domain">
 825 ##      <summary>
 826 ##      Domain to not audit.
 827 ##      </summary>
 828 ## </param>
 829 #
 830 interface(`files_dontaudit_getattr_non_security_blk_files',`
 831         gen_require(`
 832                 attribute non_security_file_type;
 833         ')
 834
 835         dontaudit $1 non_security_file_type:blk_file getattr;
 836 ')
 837
 838 ########################################
 839 ## <summary>
 840 ##      Do not audit attempts to get the attributes
 841 ##      of non security character devices.
 842 ## </summary>
 843 ## <param name="domain">
 844 ##      <summary>
 845 ##      Domain to not audit.
 846 ##      </summary>
 847 ## </param>
 848 #
 849 interface(`files_dontaudit_getattr_non_security_chr_files',`
 850         gen_require(`
 851                 attribute non_security_file_type;
 852         ')
 853
 854         dontaudit $1 non_security_file_type:chr_file getattr;
 855 ')
 856
 857 ########################################
 858 ## <summary>
 859 ##      Read all symbolic links.
 860 ## </summary>
 861 ## <param name="domain">
 862 ##      <summary>
 863 ##      Domain allowed access.
 864 ##      </summary>
 865 ## </param>
 866 ## <rolecap/>
 867 #
 868 interface(`files_read_all_symlinks',`
 869         gen_require(`
 870                 attribute file_type;
 871         ')
 872
 873         allow $1 file_type:dir list_dir_perms;
 874         read_lnk_files_pattern($1, file_type, file_type)
 875 ')
 876
 877 ########################################
 878 ## <summary>
 879 ##      Get the attributes of all named pipes.
 880 ## </summary>
 881 ## <param name="domain">
 882 ##      <summary>
 883 ##      Domain allowed access.
 884 ##      </summary>
 885 ## </param>
 886 #
 887 interface(`files_getattr_all_pipes',`
 888         gen_require(`
 889                 attribute file_type;
 890         ')
 891
 892         allow $1 file_type:dir list_dir_perms;
 893         getattr_fifo_files_pattern($1, file_type, file_type)
 894 ')
 895
 896 ########################################
 897 ## <summary>
 898 ##      Do not audit attempts to get the attributes
 899 ##      of all named pipes.
 900 ## </summary>
 901 ## <param name="domain">
 902 ##      <summary>
 903 ##      Domain to not audit.
 904 ##      </summary>
 905 ## </param>
 906 #
 907 interface(`files_dontaudit_getattr_all_pipes',`
 908         gen_require(`
 909                 attribute file_type;
 910         ')
 911
 912         dontaudit $1 file_type:fifo_file getattr;
 913 ')
 914
 915 ########################################
 916 ## <summary>
 917 ##      Do not audit attempts to get the attributes
 918 ##      of non security named pipes.
 919 ## </summary>
 920 ## <param name="domain">
 921 ##      <summary>
 922 ##      Domain to not audit.
 923 ##      </summary>
 924 ## </param>
 925 #
 926 interface(`files_dontaudit_getattr_non_security_pipes',`
 927         gen_require(`
 928                 attribute non_security_file_type;
 929         ')
 930
 931         dontaudit $1 non_security_file_type:fifo_file getattr;
 932 ')
 933
 934 ########################################
 935 ## <summary>
 936 ##      Get the attributes of all named sockets.
 937 ## </summary>
 938 ## <param name="domain">
 939 ##      <summary>
 940 ##      Domain allowed access.
 941 ##      </summary>
 942 ## </param>
 943 #
 944 interface(`files_getattr_all_sockets',`
 945         gen_require(`
 946                 attribute file_type;
 947         ')
 948
 949         allow $1 file_type:dir list_dir_perms;
 950         getattr_sock_files_pattern($1, file_type, file_type)
 951 ')
 952
 953 ########################################
 954 ## <summary>
 955 ##      Do not audit attempts to get the attributes
 956 ##      of all named sockets.
 957 ## </summary>
 958 ## <param name="domain">
 959 ##      <summary>
 960 ##      Domain to not audit.
 961 ##      </summary>
 962 ## </param>
 963 #
 964 interface(`files_dontaudit_getattr_all_sockets',`
 965         gen_require(`
 966                 attribute file_type;
 967         ')
 968
 969         dontaudit $1 file_type:sock_file getattr;
 970 ')
 971
 972 ########################################
 973 ## <summary>
 974 ##      Do not audit attempts to get the attributes
 975 ##      of non security named sockets.
 976 ## </summary>
 977 ## <param name="domain">
 978 ##      <summary>
 979 ##      Domain to not audit.
 980 ##      </summary>
 981 ## </param>
 982 #
 983 interface(`files_dontaudit_getattr_non_security_sockets',`
 984         gen_require(`
 985                 attribute non_security_file_type;
 986         ')
 987
 988         dontaudit $1 non_security_file_type:sock_file getattr;
 989 ')
 990
 991 ########################################
 992 ## <summary>
 993 ##      Read all block nodes with file types.
 994 ## </summary>
 995 ## <param name="domain">
 996 ##      <summary>
 997 ##      Domain allowed access.
 998 ##      </summary>
 999 ## </param>
1000 #
1001 interface(`files_read_all_blk_files',`
1002         gen_require(`
1003                 attribute file_type;
1004         ')
1005
1006         read_blk_files_pattern($1, file_type, file_type)
1007 ')
1008
1009 ########################################
1010 ## <summary>
1011 ##      Read all character nodes with file types.
1012 ## </summary>
1013 ## <param name="domain">
1014 ##      <summary>
1015 ##      Domain allowed access.
1016 ##      </summary>
1017 ## </param>
1018 #
1019 interface(`files_read_all_chr_files',`
1020         gen_require(`
1021                 attribute file_type;
1022         ')
1023
1024         read_chr_files_pattern($1, file_type, file_type)
1025 ')
1026
1027 ########################################
1028 ## <summary>
1029 ##      Relabel all files on the filesystem, except
1030 ##      the listed exceptions.
1031 ## </summary>
1032 ## <param name="domain">
1033 ##      <summary>
1034 ##      Domain allowed access.
1035 ##      </summary>
1036 ## </param>
1037 ## <param name="exception_types" optional="true">
1038 ##      <summary>
1039 ##      The types to be excluded.  Each type or attribute
1040 ##      must be negated by the caller.
1041 ##      </summary>
1042 ## </param>
1043 ## <rolecap/>
1044 #
1045 interface(`files_relabel_all_files',`
1046         gen_require(`
1047                 attribute file_type;
1048         ')
1049
1050         allow $1 { file_type $2 }:dir list_dir_perms;
1051         relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 })
1052         relabel_files_pattern($1, { file_type $2 }, { file_type $2 })
1053         relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
1054         relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
1055         relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
1056         relabel_blk_files_pattern($1, { file_type $2 }, { file_type $2 })
1057         relabel_chr_files_pattern($1, { file_type $2 }, { file_type $2 })
1058
1059         # satisfy the assertions:
1060         seutil_relabelto_bin_policy($1)
1061 ')
1062
1063 ########################################
1064 ## <summary>
1065 ##      rw all files on the filesystem, except
1066 ##      the listed exceptions.
1067 ## </summary>
1068 ## <param name="domain">
1069 ##      <summary>
1070 ##      Domain allowed access.
1071 ##      </summary>
1072 ## </param>
1073 ## <param name="exception_types" optional="true">
1074 ##      <summary>
1075 ##      The types to be excluded.  Each type or attribute
1076 ##      must be negated by the caller.
1077 ##      </summary>
1078 ## </param>
1079 ## <rolecap/>
1080 #
1081 interface(`files_rw_all_files',`
1082         gen_require(`
1083                 attribute file_type;
1084         ')
1085
1086         rw_files_pattern($1, { file_type $2 }, { file_type $2 })
1087 ')
1088
1089 ########################################
1090 ## <summary>
1091 ##      Manage all files on the filesystem, except
1092 ##      the listed exceptions.
1093 ## </summary>
1094 ## <param name="domain">
1095 ##      <summary>
1096 ##      Domain allowed access.
1097 ##      </summary>
1098 ## </param>
1099 ## <param name="exception_types" optional="true">
1100 ##      <summary>
1101 ##      The types to be excluded.  Each type or attribute
1102 ##      must be negated by the caller.
1103 ##      </summary>
1104 ## </param>
1105 ## <rolecap/>
1106 #
1107 interface(`files_manage_all_files',`
1108         gen_require(`
1109                 attribute file_type;
1110         ')
1111
1112         manage_dirs_pattern($1, { file_type $2 }, { file_type $2 })
1113         manage_files_pattern($1, { file_type $2 }, { file_type $2 })
1114         manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
1115         manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
1116         manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
1117
1118         # satisfy the assertions:
1119         seutil_create_bin_policy($1)
1120         files_manage_kernel_modules($1)
1121 ')
1122
1123 ########################################
1124 ## <summary>
1125 ##      Search the contents of all directories on
1126 ##      extended attribute filesystems.
1127 ## </summary>
1128 ## <param name="domain">
1129 ##      <summary>
1130 ##      Domain allowed access.
1131 ##      </summary>
1132 ## </param>
1133 #
1134 interface(`files_search_all',`
1135         gen_require(`
1136                 attribute file_type;
1137         ')
1138
1139         allow $1 file_type:dir search_dir_perms;
1140 ')
1141
1142 ########################################
1143 ## <summary>
1144 ##      List the contents of all directories on
1145 ##      extended attribute filesystems.
1146 ## </summary>
1147 ## <param name="domain">
1148 ##      <summary>
1149 ##      Domain allowed access.
1150 ##      </summary>
1151 ## </param>
1152 #
1153 interface(`files_list_all',`
1154         gen_require(`
1155                 attribute file_type;
1156         ')
1157
1158         allow $1 file_type:dir list_dir_perms;
1159 ')
1160
1161 ########################################
1162 ## <summary>
1163 ##      Do not audit attempts to search the
1164 ##      contents of any directories on extended
1165 ##      attribute filesystems.
1166 ## </summary>
1167 ## <param name="domain">
1168 ##      <summary>
1169 ##      Domain to not audit.
1170 ##      </summary>
1171 ## </param>
1172 #
1173 interface(`files_dontaudit_search_all_dirs',`
1174         gen_require(`
1175                 attribute file_type;
1176         ')
1177
1178         dontaudit $1 file_type:dir search_dir_perms;
1179 ')
1180
1181 ########################################
1182 ## <summary>
1183 ##      Get the attributes of all filesystems
1184 ##      with the type of a file.
1185 ## </summary>
1186 ## <param name="domain">
1187 ##      <summary>
1188 ##      Domain allowed access.
1189 ##      </summary>
1190 ## </param>
1191 #
1192 # dwalsh: This interface is to allow quotacheck to work on a
1193 # a filesystem mounted with the --context switch
1194 # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212957
1195 #
1196 interface(`files_getattr_all_file_type_fs',`
1197         gen_require(`
1198                 attribute file_type;
1199         ')
1200
1201         allow $1 file_type:filesystem getattr;
1202 ')
1203
1204 ########################################
1205 ## <summary>
1206 ##      Relabel a filesystem to the type of a file.
1207 ## </summary>
1208 ## <param name="domain">
1209 ##      <summary>
1210 ##      Domain allowed access.
1211 ##      </summary>
1212 ## </param>
1213 #
1214 interface(`files_relabelto_all_file_type_fs',`
1215         gen_require(`
1216                 attribute file_type;
1217         ')
1218
1219         allow $1 file_type:filesystem relabelto;
1220 ')
1221
1222 ########################################
1223 ## <summary>
1224 ##      Relabel a filesystem to the type of a file.
1225 ## </summary>
1226 ## <param name="domain">
1227 ##      <summary>
1228 ##      Domain allowed access.
1229 ##      </summary>
1230 ## </param>
1231 #
1232 interface(`files_relabel_all_file_type_fs',`
1233         gen_require(`
1234                 attribute file_type;
1235         ')
1236
1237         allow $1 file_type:filesystem { relabelfrom relabelto };
1238 ')
1239
1240 ########################################
1241 ## <summary>
1242 ##      Mount all filesystems with the type of a file.
1243 ## </summary>
1244 ## <param name="domain">
1245 ##      <summary>
1246 ##      Domain allowed access.
1247 ##      </summary>
1248 ## </param>
1249 #
1250 interface(`files_mount_all_file_type_fs',`
1251         gen_require(`
1252                 attribute file_type;
1253         ')
1254
1255         allow $1 file_type:filesystem mount;
1256 ')
1257
1258 ########################################
1259 ## <summary>
1260 ##      Unmount all filesystems with the type of a file.
1261 ## </summary>
1262 ## <param name="domain">
1263 ##      <summary>
1264 ##      Domain allowed access.
1265 ##      </summary>
1266 ## </param>
1267 #
1268 interface(`files_unmount_all_file_type_fs',`
1269         gen_require(`
1270                 attribute file_type;
1271         ')
1272
1273         allow $1 file_type:filesystem unmount;
1274 ')
1275
1276 #############################################
1277 ## <summary>
1278 ##      Manage all configuration directories on filesystem
1279 ## </summary>
1280 ## <param name="domain">
1281 ##      <summary>
1282 ##      Domain allowed access.
1283 ##      </summary>
1284 ## </param>
1285 ##
1286 #
1287 interface(`files_manage_config_dirs',`
1288         gen_require(`
1289                 attribute configfile;
1290         ')
1291
1292         manage_dirs_pattern($1, configfile, configfile)
1293 ')
1294
1295 #########################################
1296 ## <summary>
1297 ##      Relabel configuration directories
1298 ## </summary>
1299 ## <param name="domain">
1300 ##      <summary>
1301 ##      Domain allowed access.
1302 ##      </summary>
1303 ## </param>
1304 ##
1305 #
1306 interface(`files_relabel_config_dirs',`
1307         gen_require(`
1308                 attribute configfile;
1309         ')
1310
1311         relabel_dirs_pattern($1, configfile, configfile)
1312 ')
1313
1314 ########################################
1315 ## <summary>
1316 ##      Read config files in /etc.
1317 ## </summary>
1318 ## <param name="domain">
1319 ##      <summary>
1320 ##      Domain allowed access.
1321 ##      </summary>
1322 ## </param>
1323 #
1324 interface(`files_read_config_files',`
1325         gen_require(`
1326                 attribute configfile;
1327         ')
1328
1329         allow $1 configfile:dir list_dir_perms;
1330         read_files_pattern($1, configfile, configfile)
1331         read_lnk_files_pattern($1, configfile, configfile)
1332 ')
1333
1334 ###########################################
1335 ## <summary>
1336 ##      Manage all configuration files on filesystem
1337 ## </summary>
1338 ## <param name="domain">
1339 ##      <summary>
1340 ##      Domain allowed access.
1341 ##      </summary>
1342 ## </param>
1343 ##
1344 #
1345 interface(`files_manage_config_files',`
1346         gen_require(`
1347                 attribute configfile;
1348         ')
1349
1350         manage_files_pattern($1, configfile, configfile)
1351 ')
1352
1353 #######################################
1354 ## <summary>
1355 ##      Relabel configuration files
1356 ## </summary>
1357 ## <param name="domain">
1358 ##      <summary>
1359 ##      Domain allowed access.
1360 ##      </summary>
1361 ## </param>
1362 ##
1363 #
1364 interface(`files_relabel_config_files',`
1365         gen_require(`
1366                 attribute configfile;
1367         ')
1368
1369         relabel_files_pattern($1, configfile, configfile)
1370 ')
1371
1372 ########################################
1373 ## <summary>
1374 ##      Mount a filesystem on all mount points.
1375 ## </summary>
1376 ## <param name="domain">
1377 ##      <summary>
1378 ##      Domain allowed access.
1379 ##      </summary>
1380 ## </param>
1381 #
1382 interface(`files_mounton_all_mountpoints',`
1383         gen_require(`
1384                 attribute mountpoint;
1385         ')
1386
1387         allow $1 mountpoint:dir { search_dir_perms mounton };
1388         allow $1 mountpoint:file { getattr mounton };
1389 ')
1390
1391 ########################################
1392 ## <summary>
1393 ##      Get the attributes of all mount points.
1394 ## </summary>
1395 ## <param name="domain">
1396 ##      <summary>
1397 ##      Domain allowed access.
1398 ##      </summary>
1399 ## </param>
1400 #
1401 interface(`files_getattr_all_mountpoints',`
1402         gen_require(`
1403                 attribute mountpoint;
1404         ')
1405
1406         allow $1 mountpoint:dir getattr;
1407 ')
1408
1409 ########################################
1410 ## <summary>
1411 ##      Search all mount points.
1412 ## </summary>
1413 ## <param name="domain">
1414 ##      <summary>
1415 ##      Domain allowed access.
1416 ##      </summary>
1417 ## </param>
1418 #
1419 interface(`files_search_all_mountpoints',`
1420         gen_require(`
1421                 attribute mountpoint;
1422         ')
1423
1424         allow $1 mountpoint:dir search_dir_perms;
1425 ')
1426
1427 ########################################
1428 ## <summary>
1429 ##      Do not audit searching of all mount points.
1430 ## </summary>
1431 ## <param name="domain">
1432 ##      <summary>
1433 ##      Domain to not audit.
1434 ##      </summary>
1435 ## </param>
1436 #
1437 interface(`files_dontaudit_search_all_mountpoints',`
1438         gen_require(`
1439                 attribute mountpoint;
1440         ')
1441
1442         dontaudit $1 mountpoint:dir search_dir_perms;
1443 ')
1444
1445 ########################################
1446 ## <summary>
1447 ##      Do not audit listing of all mount points.
1448 ## </summary>
1449 ## <param name="domain">
1450 ##      <summary>
1451 ##      Domain to not audit.
1452 ##      </summary>
1453 ## </param>
1454 #
1455 interface(`files_dontaudit_list_all_mountpoints',`
1456         gen_require(`
1457                 attribute mountpoint;
1458         ')
1459
1460         dontaudit $1 mountpoint:dir list_dir_perms;
1461 ')
1462
1463 ########################################
1464 ## <summary>
1465 ##      Write all mount points.
1466 ## </summary>
1467 ## <param name="domain">
1468 ##      <summary>
1469 ##      Domain allowed access.
1470 ##      </summary>
1471 ## </param>
1472 #
1473 interface(`files_write_all_mountpoints',`
1474         gen_require(`
1475                 attribute mountpoint;
1476         ')
1477
1478         allow $1 mountpoint:dir write;
1479 ')
1480
1481 ########################################
1482 ## <summary>
1483 ##      List the contents of the root directory.
1484 ## </summary>
1485 ## <param name="domain">
1486 ##      <summary>
1487 ##      Domain allowed access.
1488 ##      </summary>
1489 ## </param>
1490 #
1491 interface(`files_list_root',`
1492         gen_require(`
1493                 type root_t;
1494         ')
1495
1496         allow $1 root_t:dir list_dir_perms;
1497         allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock };
1498 ')
1499
1500 ########################################
1501 ## <summary>
1502 ##      Do not audit attempts to write
1503 ##      files in the root directory.
1504 ## </summary>
1505 ## <param name="domain">
1506 ##      <summary>
1507 ##      Domain to not audit.
1508 ##      </summary>
1509 ## </param>
1510 #
1511 interface(`files_dontaudit_rw_root_dir',`
1512         gen_require(`
1513                 type root_t;
1514         ')
1515
1516         dontaudit $1 root_t:dir rw_dir_perms;
1517 ')
1518
1519 ########################################
1520 ## <summary>
1521 ##      Create an object in the root directory, with a private
1522 ##      type using a type transition.
1523 ## </summary>
1524 ## <param name="domain">
1525 ##      <summary>
1526 ##      Domain allowed access.
1527 ##      </summary>
1528 ## </param>
1529 ## <param name="private type">
1530 ##      <summary>
1531 ##      The type of the object to be created.
1532 ##      </summary>
1533 ## </param>
1534 ## <param name="object">
1535 ##      <summary>
1536 ##      The object class of the object being created.
1537 ##      </summary>
1538 ## </param>
1539 #
1540 interface(`files_root_filetrans',`
1541         gen_require(`
1542                 type root_t;
1543         ')
1544
1545         filetrans_pattern($1, root_t, $2, $3)
1546 ')
1547
1548 ########################################
1549 ## <summary>
1550 ##      Do not audit attempts to read files in
1551 ##      the root directory.
1552 ## </summary>
1553 ## <param name="domain">
1554 ##      <summary>
1555 ##      Domain to not audit.
1556 ##      </summary>
1557 ## </param>
1558 #
1559 interface(`files_dontaudit_read_root_files',`
1560         gen_require(`
1561                 type root_t;
1562         ')
1563
1564         dontaudit $1 root_t:file { getattr read };
1565 ')
1566
1567 ########################################
1568 ## <summary>
1569 ##      Do not audit attempts to read or write
1570 ##      files in the root directory.
1571 ## </summary>
1572 ## <param name="domain">
1573 ##      <summary>
1574 ##      Domain to not audit.
1575 ##      </summary>
1576 ## </param>
1577 #
1578 interface(`files_dontaudit_rw_root_files',`
1579         gen_require(`
1580                 type root_t;
1581         ')
1582
1583         dontaudit $1 root_t:file { read write };
1584 ')
1585
1586 ########################################
1587 ## <summary>
1588 ##      Do not audit attempts to read or write
1589 ##      character device nodes in the root directory.
1590 ## </summary>
1591 ## <param name="domain">
1592 ##      <summary>
1593 ##      Domain to not audit.
1594 ##      </summary>
1595 ## </param>
1596 #
1597 interface(`files_dontaudit_rw_root_chr_files',`
1598         gen_require(`
1599                 type root_t;
1600         ')
1601
1602         dontaudit $1 root_t:chr_file { read write };
1603 ')
1604
1605 ########################################
1606 ## <summary>
1607 ##      Delete files in the root directory.
1608 ## </summary>
1609 ## <param name="domain">
1610 ##      <summary>
1611 ##      Domain allowed access.
1612 ##      </summary>
1613 ## </param>
1614 #
1615 interface(`files_delete_root_files',`
1616         gen_require(`
1617                 type root_t;
1618         ')
1619
1620         allow $1 root_t:file unlink;
1621 ')
1622
1623 ########################################
1624 ## <summary>
1625 ##      Remove entries from the root directory.
1626 ## </summary>
1627 ## <param name="domain">
1628 ##      <summary>
1629 ##      Domain allowed access.
1630 ##      </summary>
1631 ## </param>
1632 #
1633 interface(`files_delete_root_dir_entry',`
1634         gen_require(`
1635                 type root_t;
1636         ')
1637
1638         allow $1 root_t:dir rw_dir_perms;
1639 ')
1640
1641 ########################################
1642 ## <summary>
1643 ##      Unmount a rootfs filesystem.
1644 ## </summary>
1645 ## <param name="domain">
1646 ##      <summary>
1647 ##      Domain allowed access.
1648 ##      </summary>
1649 ## </param>
1650 #
1651 interface(`files_unmount_rootfs',`
1652         gen_require(`
1653                 type root_t;
1654         ')
1655
1656         allow $1 root_t:filesystem unmount;
1657 ')
1658
1659 ########################################
1660 ## <summary>
1661 ##      Get attributes of the /boot directory.
1662 ## </summary>
1663 ## <param name="domain">
1664 ##      <summary>
1665 ##      Domain allowed access.
1666 ##      </summary>
1667 ## </param>
1668 #
1669 interface(`files_getattr_boot_dirs',`
1670         gen_require(`
1671                 type boot_t;
1672         ')
1673
1674         allow $1 boot_t:dir getattr;
1675 ')
1676
1677 ########################################
1678 ## <summary>
1679 ##      Do not audit attempts to get attributes
1680 ##      of the /boot directory.
1681 ## </summary>
1682 ## <param name="domain">
1683 ##      <summary>
1684 ##      Domain to not audit.
1685 ##      </summary>
1686 ## </param>
1687 #
1688 interface(`files_dontaudit_getattr_boot_dirs',`
1689         gen_require(`
1690                 type boot_t;
1691         ')
1692
1693         dontaudit $1 boot_t:dir getattr;
1694 ')
1695
1696 ########################################
1697 ## <summary>
1698 ##      Search the /boot directory.
1699 ## </summary>
1700 ## <param name="domain">
1701 ##      <summary>
1702 ##      Domain allowed access.
1703 ##      </summary>
1704 ## </param>
1705 #
1706 interface(`files_search_boot',`
1707         gen_require(`
1708                 type boot_t;
1709         ')
1710
1711         allow $1 boot_t:dir search_dir_perms;
1712 ')
1713
1714 ########################################
1715 ## <summary>
1716 ##      Do not audit attempts to search the /boot directory.
1717 ## </summary>
1718 ## <param name="domain">
1719 ##      <summary>
1720 ##      Domain to not audit.
1721 ##      </summary>
1722 ## </param>
1723 #
1724 interface(`files_dontaudit_search_boot',`
1725         gen_require(`
1726                 type boot_t;
1727         ')
1728
1729         dontaudit $1 boot_t:dir search_dir_perms;
1730 ')
1731
1732 ########################################
1733 ## <summary>
1734 ##      List the /boot directory.
1735 ## </summary>
1736 ## <param name="domain">
1737 ##      <summary>
1738 ##      Domain allowed access.
1739 ##      </summary>
1740 ## </param>
1741 #
1742 interface(`files_list_boot',`
1743         gen_require(`
1744                 type boot_t;
1745         ')
1746
1747         allow $1 boot_t:dir list_dir_perms;
1748 ')
1749
1750 ########################################
1751 ## <summary>
1752 ##      Create directories in /boot
1753 ## </summary>
1754 ## <param name="domain">
1755 ##      <summary>
1756 ##      Domain allowed access.
1757 ##      </summary>
1758 ## </param>
1759 #
1760 interface(`files_create_boot_dirs',`
1761         gen_require(`
1762                 type boot_t;
1763         ')
1764
1765         allow $1 boot_t:dir { create rw_dir_perms };
1766 ')
1767
1768 ########################################
1769 ## <summary>
1770 ##      Create, read, write, and delete
1771 ##      directories in /boot.
1772 ## </summary>
1773 ## <param name="domain">
1774 ##      <summary>
1775 ##      Domain allowed access.
1776 ##      </summary>
1777 ## </param>
1778 #
1779 interface(`files_manage_boot_dirs',`
1780         gen_require(`
1781                 type boot_t;
1782         ')
1783
1784         allow $1 boot_t:dir manage_dir_perms;
1785 ')
1786
1787 ########################################
1788 ## <summary>
1789 ##      Create a private type object in boot
1790 ##      with an automatic type transition
1791 ## </summary>
1792 ## <param name="domain">
1793 ##      <summary>
1794 ##      Domain allowed access.
1795 ##      </summary>
1796 ## </param>
1797 ## <param name="private_type">
1798 ##      <summary>
1799 ##      The type of the object to be created.
1800 ##      </summary>
1801 ## </param>
1802 ## <param name="object_class">
1803 ##      <summary>
1804 ##      The object class of the object being created.
1805 ##      </summary>
1806 ## </param>
1807 #
1808 interface(`files_boot_filetrans',`
1809         gen_require(`
1810                 type boot_t;
1811         ')
1812
1813         filetrans_pattern($1, boot_t, $2, $3)
1814 ')
1815
1816 ########################################
1817 ## <summary>
1818 ##      read files in the /boot directory.
1819 ## </summary>
1820 ## <param name="domain">
1821 ##      <summary>
1822 ##      Domain allowed access.
1823 ##      </summary>
1824 ## </param>
1825 ## <rolecap/>
1826 #
1827 interface(`files_read_boot_files',`
1828         gen_require(`
1829                 type boot_t;
1830         ')
1831
1832         read_files_pattern($1, boot_t, boot_t)
1833 ')
1834
1835 ########################################
1836 ## <summary>
1837 ##      Create, read, write, and delete files
1838 ##      in the /boot directory.
1839 ## </summary>
1840 ## <param name="domain">
1841 ##      <summary>
1842 ##      Domain allowed access.
1843 ##      </summary>
1844 ## </param>
1845 ## <rolecap/>
1846 #
1847 interface(`files_manage_boot_files',`
1848         gen_require(`
1849                 type boot_t;
1850         ')
1851
1852         manage_files_pattern($1, boot_t, boot_t)
1853 ')
1854
1855 ########################################
1856 ## <summary>
1857 ##      Relabel from files in the /boot directory.
1858 ## </summary>
1859 ## <param name="domain">
1860 ##      <summary>
1861 ##      Domain allowed access.
1862 ##      </summary>
1863 ## </param>
1864 #
1865 interface(`files_relabelfrom_boot_files',`
1866         gen_require(`
1867                 type boot_t;
1868         ')
1869
1870         relabelfrom_files_pattern($1, boot_t, boot_t)
1871 ')
1872
1873 ########################################
1874 ## <summary>
1875 ##      Read and write symbolic links
1876 ##      in the /boot directory.
1877 ## </summary>
1878 ## <param name="domain">
1879 ##      <summary>
1880 ##      Domain allowed access.
1881 ##      </summary>
1882 ## </param>
1883 #
1884 interface(`files_rw_boot_symlinks',`
1885         gen_require(`
1886                 type boot_t;
1887         ')
1888
1889         allow $1 boot_t:dir list_dir_perms;
1890         rw_lnk_files_pattern($1, boot_t, boot_t)
1891 ')
1892
1893 ########################################
1894 ## <summary>
1895 ##      Create, read, write, and delete symbolic links
1896 ##      in the /boot directory.
1897 ## </summary>
1898 ## <param name="domain">
1899 ##      <summary>
1900 ##      Domain allowed access.
1901 ##      </summary>
1902 ## </param>
1903 #
1904 interface(`files_manage_boot_symlinks',`
1905         gen_require(`
1906                 type boot_t;
1907         ')
1908
1909         manage_lnk_files_pattern($1, boot_t, boot_t)
1910 ')
1911
1912 ########################################
1913 ## <summary>
1914 ##      Read kernel files in the /boot directory.
1915 ## </summary>
1916 ## <param name="domain">
1917 ##      <summary>
1918 ##      Domain allowed access.
1919 ##      </summary>
1920 ## </param>
1921 #
1922 interface(`files_read_kernel_img',`
1923         gen_require(`
1924                 type boot_t;
1925         ')
1926
1927         allow $1 boot_t:dir list_dir_perms;
1928         read_files_pattern($1, boot_t, boot_t)
1929         read_lnk_files_pattern($1, boot_t, boot_t)
1930 ')
1931
1932 ########################################
1933 ## <summary>
1934 ##      Install a kernel into the /boot directory.
1935 ## </summary>
1936 ## <param name="domain">
1937 ##      <summary>
1938 ##      Domain allowed access.
1939 ##      </summary>
1940 ## </param>
1941 ## <rolecap/>
1942 #
1943 interface(`files_create_kernel_img',`
1944         gen_require(`
1945                 type boot_t;
1946         ')
1947
1948         allow $1 boot_t:file { create_file_perms rw_file_perms };
1949         manage_lnk_files_pattern($1, boot_t, boot_t)
1950 ')
1951
1952 ########################################
1953 ## <summary>
1954 ##      Delete a kernel from /boot.
1955 ## </summary>
1956 ## <param name="domain">
1957 ##      <summary>
1958 ##      Domain allowed access.
1959 ##      </summary>
1960 ## </param>
1961 ## <rolecap/>
1962 #
1963 interface(`files_delete_kernel',`
1964         gen_require(`
1965                 type boot_t;
1966         ')
1967
1968         delete_files_pattern($1, boot_t, boot_t)
1969 ')
1970
1971 ########################################
1972 ## <summary>
1973 ##      Getattr of directories with the default file type.
1974 ## </summary>
1975 ## <param name="domain">
1976 ##      <summary>
1977 ##      Domain allowed access.
1978 ##      </summary>
1979 ## </param>
1980 #
1981 interface(`files_getattr_default_dirs',`
1982         gen_require(`
1983                 type default_t;
1984         ')
1985
1986         allow $1 default_t:dir getattr;
1987 ')
1988
1989 ########################################
1990 ## <summary>
1991 ##      Do not audit attempts to get the attributes of
1992 ##      directories with the default file type.
1993 ## </summary>
1994 ## <param name="domain">
1995 ##      <summary>
1996 ##      Domain to not audit.
1997 ##      </summary>
1998 ## </param>
1999 #
2000 interface(`files_dontaudit_getattr_default_dirs',`
2001         gen_require(`
2002                 type default_t;
2003         ')
2004
2005         dontaudit $1 default_t:dir getattr;
2006 ')
2007
2008 ########################################
2009 ## <summary>
2010 ##      Search the contents of directories with the default file type.
2011 ## </summary>
2012 ## <param name="domain">
2013 ##      <summary>
2014 ##      Domain allowed access.
2015 ##      </summary>
2016 ## </param>
2017 #
2018 interface(`files_search_default',`
2019         gen_require(`
2020                 type default_t;
2021         ')
2022
2023         allow $1 default_t:dir search_dir_perms;
2024 ')
2025
2026 ########################################
2027 ## <summary>
2028 ##      List contents of directories with the default file type.
2029 ## </summary>
2030 ## <param name="domain">
2031 ##      <summary>
2032 ##      Domain allowed access.
2033 ##      </summary>
2034 ## </param>
2035 #
2036 interface(`files_list_default',`
2037         gen_require(`
2038                 type default_t;
2039         ')
2040
2041         allow $1 default_t:dir list_dir_perms;
2042 ')
2043
2044 ########################################
2045 ## <summary>
2046 ##      Do not audit attempts to list contents of
2047 ##      directories with the default file type.
2048 ## </summary>
2049 ## <param name="domain">
2050 ##      <summary>
2051 ##      Domain to not audit.
2052 ##      </summary>
2053 ## </param>
2054 #
2055 interface(`files_dontaudit_list_default',`
2056         gen_require(`
2057                 type default_t;
2058         ')
2059
2060         dontaudit $1 default_t:dir list_dir_perms;
2061 ')
2062
2063 ########################################
2064 ## <summary>
2065 ##      Create, read, write, and delete directories with
2066 ##      the default file type.
2067 ## </summary>
2068 ## <param name="domain">
2069 ##      <summary>
2070 ##      Domain allowed access.
2071 ##      </summary>
2072 ## </param>
2073 #
2074 interface(`files_manage_default_dirs',`
2075         gen_require(`
2076                 type default_t;
2077         ')
2078
2079         manage_dirs_pattern($1, default_t, default_t)
2080 ')
2081
2082 ########################################
2083 ## <summary>
2084 ##      Mount a filesystem on a directory with the default file type.
2085 ## </summary>
2086 ## <param name="domain">
2087 ##      <summary>
2088 ##      Domain allowed access.
2089 ##      </summary>
2090 ## </param>
2091 #
2092 interface(`files_mounton_default',`
2093         gen_require(`
2094                 type default_t;
2095         ')
2096
2097         allow $1 default_t:dir { search_dir_perms mounton };
2098 ')
2099
2100 ########################################
2101 ## <summary>
2102 ##      Do not audit attempts to get the attributes of
2103 ##      files with the default file type.
2104 ## </summary>
2105 ## <param name="domain">
2106 ##      <summary>
2107 ##      Domain to not audit.
2108 ##      </summary>
2109 ## </param>
2110 #
2111 interface(`files_dontaudit_getattr_default_files',`
2112         gen_require(`
2113                 type default_t;
2114         ')
2115
2116         dontaudit $1 default_t:file getattr;
2117 ')
2118
2119 ########################################
2120 ## <summary>
2121 ##      Read files with the default file type.
2122 ## </summary>
2123 ## <param name="domain">
2124 ##      <summary>
2125 ##      Domain allowed access.
2126 ##      </summary>
2127 ## </param>
2128 #
2129 interface(`files_read_default_files',`
2130         gen_require(`
2131                 type default_t;
2132         ')
2133
2134         allow $1 default_t:file read_file_perms;
2135 ')
2136
2137 ########################################
2138 ## <summary>
2139 ##      Do not audit attempts to read files
2140 ##      with the default file type.
2141 ## </summary>
2142 ## <param name="domain">
2143 ##      <summary>
2144 ##      Domain to not audit.
2145 ##      </summary>
2146 ## </param>
2147 #
2148 interface(`files_dontaudit_read_default_files',`
2149         gen_require(`
2150                 type default_t;
2151         ')
2152
2153         dontaudit $1 default_t:file read_file_perms;
2154 ')
2155
2156 ########################################
2157 ## <summary>
2158 ##      Create, read, write, and delete files with
2159 ##      the default file type.
2160 ## </summary>
2161 ## <param name="domain">
2162 ##      <summary>
2163 ##      Domain allowed access.
2164 ##      </summary>
2165 ## </param>
2166 #
2167 interface(`files_manage_default_files',`
2168         gen_require(`
2169                 type default_t;
2170         ')
2171
2172         manage_files_pattern($1, default_t, default_t)
2173 ')
2174
2175 ########################################
2176 ## <summary>
2177 ##      Read symbolic links with the default file type.
2178 ## </summary>
2179 ## <param name="domain">
2180 ##      <summary>
2181 ##      Domain allowed access.
2182 ##      </summary>
2183 ## </param>
2184 #
2185 interface(`files_read_default_symlinks',`
2186         gen_require(`
2187                 type default_t;
2188         ')
2189
2190         allow $1 default_t:lnk_file read_lnk_file_perms;
2191 ')
2192
2193 ########################################
2194 ## <summary>
2195 ##      Read sockets with the default file type.
2196 ## </summary>
2197 ## <param name="domain">
2198 ##      <summary>
2199 ##      Domain allowed access.
2200 ##      </summary>
2201 ## </param>
2202 #
2203 interface(`files_read_default_sockets',`
2204         gen_require(`
2205                 type default_t;
2206         ')
2207
2208         allow $1 default_t:sock_file read_sock_file_perms;
2209 ')
2210
2211 ########################################
2212 ## <summary>
2213 ##      Read named pipes with the default file type.
2214 ## </summary>
2215 ## <param name="domain">
2216 ##      <summary>
2217 ##      Domain allowed access.
2218 ##      </summary>
2219 ## </param>
2220 #
2221 interface(`files_read_default_pipes',`
2222         gen_require(`
2223                 type default_t;
2224         ')
2225
2226         allow $1 default_t:fifo_file read_fifo_file_perms;
2227 ')
2228
2229 ########################################
2230 ## <summary>
2231 ##      Search the contents of /etc directories.
2232 ## </summary>
2233 ## <param name="domain">
2234 ##      <summary>
2235 ##      Domain allowed access.
2236 ##      </summary>
2237 ## </param>
2238 #
2239 interface(`files_search_etc',`
2240         gen_require(`
2241                 type etc_t;
2242         ')
2243
2244         allow $1 etc_t:dir search_dir_perms;
2245 ')
2246
2247 ########################################
2248 ## <summary>
2249 ##      Set the attributes of the /etc directories.
2250 ## </summary>
2251 ## <param name="domain">
2252 ##      <summary>
2253 ##      Domain allowed access.
2254 ##      </summary>
2255 ## </param>
2256 #
2257 interface(`files_setattr_etc_dirs',`
2258         gen_require(`
2259                 type etc_t;
2260         ')
2261
2262         allow $1 etc_t:dir setattr;
2263 ')
2264
2265 ########################################
2266 ## <summary>
2267 ##      List the contents of /etc directories.
2268 ## </summary>
2269 ## <param name="domain">
2270 ##      <summary>
2271 ##      Domain allowed access.
2272 ##      </summary>
2273 ## </param>
2274 #
2275 interface(`files_list_etc',`
2276         gen_require(`
2277                 type etc_t;
2278         ')
2279
2280         allow $1 etc_t:dir list_dir_perms;
2281 ')
2282
2283 ########################################
2284 ## <summary>
2285 ##      Do not audit attempts to write to /etc dirs.
2286 ## </summary>
2287 ## <param name="domain">
2288 ##      <summary>
2289 ##      Domain to not audit.
2290 ##      </summary>
2291 ## </param>
2292 #
2293 interface(`files_dontaudit_write_etc_dirs',`
2294         gen_require(`
2295                 type etc_t;
2296         ')
2297
2298         dontaudit $1 etc_t:dir write;
2299 ')
2300
2301 ########################################
2302 ## <summary>
2303 ##      Add and remove entries from /etc directories.
2304 ## </summary>
2305 ## <param name="domain">
2306 ##      <summary>
2307 ##      Domain allowed access.
2308 ##      </summary>
2309 ## </param>
2310 #
2311 interface(`files_rw_etc_dirs',`
2312         gen_require(`
2313                 type etc_t;
2314         ')
2315
2316         allow $1 etc_t:dir rw_dir_perms;
2317 ')
2318
2319 ##########################################
2320 ## <summary>
2321 ##      Manage generic directories in /etc
2322 ## </summary>
2323 ## <param name="domain">
2324 ##      <summary>
2325 ##      Domain allowed access
2326 ##      </summary>
2327 ## </param>
2328 ##
2329 #
2330 interface(`files_manage_etc_dirs',`
2331         gen_require(`
2332                 type etc_t;
2333         ')
2334
2335         manage_dirs_pattern($1, etc_t, etc_t)
2336 ')
2337
2338 ########################################
2339 ## <summary>
2340 ##      Read generic files in /etc.
2341 ## </summary>
2342 ## <desc>
2343 ##      <p>
2344 ##      Allow the specified domain to read generic
2345 ##      files in /etc. These files are typically
2346 ##      general system configuration files that do
2347 ##      not have more specific SELinux types.  Some
2348 ##      examples of these files are:
2349 ##      </p>
2350 ##      <ul>
2351 ##              <li>/etc/fstab</li>
2352 ##              <li>/etc/passwd</li>
2353 ##              <li>/etc/services</li>
2354 ##              <li>/etc/shells</li>
2355 ##      </ul>
2356 ##      <p>
2357 ##      This interface does not include access to /etc/shadow.
2358 ##      </p>
2359 ##      <p>
2360 ##      Generally, it is safe for many domains to have
2361 ##      this access.  However, since this interface provides
2362 ##      access to the /etc/passwd file, caution must be
2363 ##      exercised, as user account names can be leaked
2364 ##      through this access.
2365 ##      </p>
2366 ##      <p>
2367 ##      Related interfaces:
2368 ##      </p>
2369 ##      <ul>
2370 ##              <li>auth_read_shadow()</li>
2371 ##              <li>files_read_etc_runtime_files()</li>
2372 ##              <li>seutil_read_config()</li>
2373 ##      </ul>
2374 ## </desc>
2375 ## <param name="domain">
2376 ##      <summary>
2377 ##      Domain allowed access.
2378 ##      </summary>
2379 ## </param>
2380 ## <infoflow type="read" weight="10"/>
2381 #
2382 interface(`files_read_etc_files',`
2383         gen_require(`
2384                 type etc_t;
2385         ')
2386
2387         allow $1 etc_t:dir list_dir_perms;
2388         read_files_pattern($1, etc_t, etc_t)
2389         read_lnk_files_pattern($1, etc_t, etc_t)
2390 ')
2391
2392 ########################################
2393 ## <summary>
2394 ##      Do not audit attempts to write generic files in /etc.
2395 ## </summary>
2396 ## <param name="domain">
2397 ##      <summary>
2398 ##      Domain allowed access.
2399 ##      </summary>
2400 ## </param>
2401 #
2402 interface(`files_dontaudit_write_etc_files',`
2403         gen_require(`
2404                 type etc_t;
2405         ')
2406
2407         dontaudit $1 etc_t:file write;
2408 ')
2409
2410 ########################################
2411 ## <summary>
2412 ##      Read and write generic files in /etc.
2413 ## </summary>
2414 ## <param name="domain">
2415 ##      <summary>
2416 ##      Domain allowed access.
2417 ##      </summary>
2418 ## </param>
2419 ## <rolecap/>
2420 #
2421 interface(`files_rw_etc_files',`
2422         gen_require(`
2423                 type etc_t;
2424         ')
2425
2426         allow $1 etc_t:dir list_dir_perms;
2427         rw_files_pattern($1, etc_t, etc_t)
2428         read_lnk_files_pattern($1, etc_t, etc_t)
2429 ')
2430
2431 ########################################
2432 ## <summary>
2433 ##      Create, read, write, and delete generic
2434 ##      files in /etc.
2435 ## </summary>
2436 ## <param name="domain">
2437 ##      <summary>
2438 ##      Domain allowed access.
2439 ##      </summary>
2440 ## </param>
2441 ## <rolecap/>
2442 #
2443 interface(`files_manage_etc_files',`
2444         gen_require(`
2445                 type etc_t;
2446         ')
2447
2448         manage_files_pattern($1, etc_t, etc_t)
2449         read_lnk_files_pattern($1, etc_t, etc_t)
2450 ')
2451
2452 ########################################
2453 ## <summary>
2454 ##      Delete system configuration files in /etc.
2455 ## </summary>
2456 ## <param name="domain">
2457 ##      <summary>
2458 ##      Domain allowed access.
2459 ##      </summary>
2460 ## </param>
2461 #
2462 interface(`files_delete_etc_files',`
2463         gen_require(`
2464                 type etc_t;
2465         ')
2466
2467         delete_files_pattern($1, etc_t, etc_t)
2468 ')
2469
2470 ########################################
2471 ## <summary>
2472 ##      Remove entries from the etc directory.
2473 ## </summary>
2474 ## <param name="domain">
2475 ##      <summary>
2476 ##      Domain allowed access.
2477 ##      </summary>
2478 ## </param>
2479 #
2480 interface(`files_delete_etc_dir_entry',`
2481         gen_require(`
2482                 type etc_t;
2483         ')
2484
2485         allow $1 etc_t:dir del_entry_dir_perms;
2486 ')
2487
2488 ########################################
2489 ## <summary>
2490 ##      Execute generic files in /etc.
2491 ## </summary>
2492 ## <param name="domain">
2493 ##      <summary>
2494 ##      Domain allowed access.
2495 ##      </summary>
2496 ## </param>
2497 #
2498 interface(`files_exec_etc_files',`
2499         gen_require(`
2500                 type etc_t;
2501         ')
2502
2503         allow $1 etc_t:dir list_dir_perms;
2504         read_lnk_files_pattern($1, etc_t, etc_t)
2505         exec_files_pattern($1, etc_t, etc_t)
2506 ')
2507
2508 #######################################
2509 ## <summary>
2510 ##      Relabel from and to generic files in /etc.
2511 ## </summary>
2512 ## <param name="domain">
2513 ##      <summary>
2514 ##      Domain allowed access.
2515 ##      </summary>
2516 ## </param>
2517 #
2518 interface(`files_relabel_etc_files',`
2519         gen_require(`
2520                 type etc_t;
2521         ')
2522
2523         allow $1 etc_t:dir list_dir_perms;
2524         relabel_files_pattern($1, etc_t, etc_t)
2525 ')
2526
2527 ########################################
2528 ## <summary>
2529 ##      Read symbolic links in /etc.
2530 ## </summary>
2531 ## <param name="domain">
2532 ##      <summary>
2533 ##      Domain allowed access.
2534 ##      </summary>
2535 ## </param>
2536 #
2537 interface(`files_read_etc_symlinks',`
2538         gen_require(`
2539                 type etc_t;
2540         ')
2541
2542         read_lnk_files_pattern($1, etc_t, etc_t)
2543 ')
2544
2545 ########################################
2546 ## <summary>
2547 ##      Create, read, write, and delete symbolic links in /etc.
2548 ## </summary>
2549 ## <param name="domain">
2550 ##      <summary>
2551 ##      Domain allowed access.
2552 ##      </summary>
2553 ## </param>
2554 #
2555 interface(`files_manage_etc_symlinks',`
2556         gen_require(`
2557                 type etc_t;
2558         ')
2559
2560         manage_lnk_files_pattern($1, etc_t, etc_t)
2561 ')
2562
2563 ########################################
2564 ## <summary>
2565 ##      Create objects in /etc with a private
2566 ##      type using a type_transition.
2567 ## </summary>
2568 ## <param name="domain">
2569 ##      <summary>
2570 ##      Domain allowed access.
2571 ##      </summary>
2572 ## </param>
2573 ## <param name="file_type">
2574 ##      <summary>
2575 ##      Private file type.
2576 ##      </summary>
2577 ## </param>
2578 ## <param name="class">
2579 ##      <summary>
2580 ##      Object classes to be created.
2581 ##      </summary>
2582 ## </param>
2583 #
2584 interface(`files_etc_filetrans',`
2585         gen_require(`
2586                 type etc_t;
2587         ')
2588
2589         filetrans_pattern($1, etc_t, $2, $3)
2590 ')
2591
2592 ########################################
2593 ## <summary>
2594 ##      Create a boot flag.
2595 ## </summary>
2596 ## <desc>
2597 ##      <p>
2598 ##      Create a boot flag, such as
2599 ##      /.autorelabel and /.autofsck.
2600 ##      </p>
2601 ## </desc>
2602 ## <param name="domain">
2603 ##      <summary>
2604 ##      Domain allowed access.
2605 ##      </summary>
2606 ## </param>
2607 ## <rolecap/>
2608 #
2609 interface(`files_create_boot_flag',`
2610         gen_require(`
2611                 type root_t, etc_runtime_t;
2612         ')
2613
2614         allow $1 etc_runtime_t:file manage_file_perms;
2615         filetrans_pattern($1, root_t, etc_runtime_t, file)
2616 ')
2617
2618 ########################################
2619 ## <summary>
2620 ##      Read files in /etc that are dynamically
2621 ##      created on boot, such as mtab.
2622 ## </summary>
2623 ## <desc>
2624 ##      <p>
2625 ##      Allow the specified domain to read dynamically created
2626 ##      configuration files in /etc. These files are typically
2627 ##      general system configuration files that do
2628 ##      not have more specific SELinux types.  Some
2629 ##      examples of these files are:
2630 ##      </p>
2631 ##      <ul>
2632 ##              <li>/etc/motd</li>
2633 ##              <li>/etc/mtab</li>
2634 ##              <li>/etc/nologin</li>
2635 ##      </ul>
2636 ##      <p>
2637 ##      This interface does not include access to /etc/shadow.
2638 ##      </p>
2639 ## </desc>
2640 ## <param name="domain">
2641 ##      <summary>
2642 ##      Domain allowed access.
2643 ##      </summary>
2644 ## </param>
2645 ## <infoflow type="read" weight="10" />
2646 ## <rolecap/>
2647 #
2648 interface(`files_read_etc_runtime_files',`
2649         gen_require(`
2650                 type etc_t, etc_runtime_t;
2651         ')
2652
2653         allow $1 etc_t:dir list_dir_perms;
2654         read_files_pattern($1, etc_t, etc_runtime_t)
2655         read_lnk_files_pattern($1, etc_t, etc_runtime_t)
2656 ')
2657
2658 ########################################
2659 ## <summary>
2660 ##      Do not audit attempts to read files
2661 ##      in /etc that are dynamically
2662 ##      created on boot, such as mtab.
2663 ## </summary>
2664 ## <param name="domain">
2665 ##      <summary>
2666 ##      Domain to not audit.
2667 ##      </summary>
2668 ## </param>
2669 #
2670 interface(`files_dontaudit_read_etc_runtime_files',`
2671         gen_require(`
2672                 type etc_runtime_t;
2673         ')
2674
2675         dontaudit $1 etc_runtime_t:file { getattr read };
2676 ')
2677
2678 ########################################
2679 ## <summary>
2680 ##      Read and write files in /etc that are dynamically
2681 ##      created on boot, such as mtab.
2682 ## </summary>
2683 ## <param name="domain">
2684 ##      <summary>
2685 ##      Domain allowed access.
2686 ##      </summary>
2687 ## </param>
2688 ## <rolecap/>
2689 #
2690 interface(`files_rw_etc_runtime_files',`
2691         gen_require(`
2692                 type etc_t, etc_runtime_t;
2693         ')
2694
2695         allow $1 etc_t:dir list_dir_perms;
2696         rw_files_pattern($1, etc_t, etc_runtime_t)
2697 ')
2698
2699 ########################################
2700 ## <summary>
2701 ##      Create, read, write, and delete files in
2702 ##      /etc that are dynamically created on boot,
2703 ##      such as mtab.
2704 ## </summary>
2705 ## <param name="domain">
2706 ##      <summary>
2707 ##      Domain allowed access.
2708 ##      </summary>
2709 ## </param>
2710 ## <rolecap/>
2711 #
2712 interface(`files_manage_etc_runtime_files',`
2713         gen_require(`
2714                 type etc_t, etc_runtime_t;
2715         ')
2716
2717         manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t)
2718 ')
2719
2720 ########################################
2721 ## <summary>
2722 ##      Create, etc runtime objects with an automatic
2723 ##      type transition.
2724 ## </summary>
2725 ## <param name="domain">
2726 ##      <summary>
2727 ##      Domain allowed access.
2728 ##      </summary>
2729 ## </param>
2730 ## <param name="object">
2731 ##      <summary>
2732 ##      The class of the object being created.
2733 ##      </summary>
2734 ## </param>
2735 #
2736 interface(`files_etc_filetrans_etc_runtime',`
2737         gen_require(`
2738                 type etc_t, etc_runtime_t;
2739         ')
2740
2741         filetrans_pattern($1, etc_t, etc_runtime_t, $2)
2742 ')
2743
2744 ########################################
2745 ## <summary>
2746 ##      Getattr of directories on new filesystems
2747 ##      that have not yet been labeled.
2748 ## </summary>
2749 ## <param name="domain">
2750 ##      <summary>
2751 ##      Domain allowed access.
2752 ##      </summary>
2753 ## </param>
2754 #
2755 interface(`files_getattr_isid_type_dirs',`
2756         gen_require(`
2757                 type file_t;
2758         ')
2759
2760         allow $1 file_t:dir getattr;
2761 ')
2762
2763 ########################################
2764 ## <summary>
2765 ##      Do not audit attempts to search directories on new filesystems
2766 ##      that have not yet been labeled.
2767 ## </summary>
2768 ## <param name="domain">
2769 ##      <summary>
2770 ##      Domain to not audit.
2771 ##      </summary>
2772 ## </param>
2773 #
2774 interface(`files_dontaudit_search_isid_type_dirs',`
2775         gen_require(`
2776                 type file_t;
2777         ')
2778
2779         dontaudit $1 file_t:dir search_dir_perms;
2780 ')
2781
2782 ########################################
2783 ## <summary>
2784 ##      List the contents of directories on new filesystems
2785 ##      that have not yet been labeled.
2786 ## </summary>
2787 ## <param name="domain">
2788 ##      <summary>
2789 ##      Domain allowed access.
2790 ##      </summary>
2791 ## </param>
2792 #
2793 interface(`files_list_isid_type_dirs',`
2794         gen_require(`
2795                 type file_t;
2796         ')
2797
2798         allow $1 file_t:dir list_dir_perms;
2799 ')
2800
2801 ########################################
2802 ## <summary>
2803 ##      Read and write directories on new filesystems
2804 ##      that have not yet been labeled.
2805 ## </summary>
2806 ## <param name="domain">
2807 ##      <summary>
2808 ##      Domain allowed access.
2809 ##      </summary>
2810 ## </param>
2811 #
2812 interface(`files_rw_isid_type_dirs',`
2813         gen_require(`
2814                 type file_t;
2815         ')
2816
2817         allow $1 file_t:dir rw_dir_perms;
2818 ')
2819
2820 ########################################
2821 ## <summary>
2822 ##      Delete directories on new filesystems
2823 ##      that have not yet been labeled.
2824 ## </summary>
2825 ## <param name="domain">
2826 ##      <summary>
2827 ##      Domain allowed access.
2828 ##      </summary>
2829 ## </param>
2830 #
2831 interface(`files_delete_isid_type_dirs',`
2832         gen_require(`
2833                 type file_t;
2834         ')
2835
2836         delete_dirs_pattern($1, file_t, file_t)
2837 ')
2838
2839 ########################################
2840 ## <summary>
2841 ##      Create, read, write, and delete directories
2842 ##      on new filesystems that have not yet been labeled.
2843 ## </summary>
2844 ## <param name="domain">
2845 ##      <summary>
2846 ##      Domain allowed access.
2847 ##      </summary>
2848 ## </param>
2849 #
2850 interface(`files_manage_isid_type_dirs',`
2851         gen_require(`
2852                 type file_t;
2853         ')
2854
2855         allow $1 file_t:dir manage_dir_perms;
2856 ')
2857
2858 ########################################
2859 ## <summary>
2860 ##      Mount a filesystem on a directory on new filesystems
2861 ##      that has not yet been labeled.
2862 ## </summary>
2863 ## <param name="domain">
2864 ##      <summary>
2865 ##      Domain allowed access.
2866 ##      </summary>
2867 ## </param>
2868 #
2869 interface(`files_mounton_isid_type_dirs',`
2870         gen_require(`
2871                 type file_t;
2872         ')
2873
2874         allow $1 file_t:dir { search_dir_perms mounton };
2875 ')
2876
2877 ########################################
2878 ## <summary>
2879 ##      Read files on new filesystems
2880 ##      that have not yet been labeled.
2881 ## </summary>
2882 ## <param name="domain">
2883 ##      <summary>
2884 ##      Domain allowed access.
2885 ##      </summary>
2886 ## </param>
2887 #
2888 interface(`files_read_isid_type_files',`
2889         gen_require(`
2890                 type file_t;
2891         ')
2892
2893         allow $1 file_t:file read_file_perms;
2894 ')
2895
2896 ########################################
2897 ## <summary>
2898 ##      Delete files on new filesystems
2899 ##      that have not yet been labeled.
2900 ## </summary>
2901 ## <param name="domain">
2902 ##      <summary>
2903 ##      Domain allowed access.
2904 ##      </summary>
2905 ## </param>
2906 #
2907 interface(`files_delete_isid_type_files',`
2908         gen_require(`
2909                 type file_t;
2910         ')
2911
2912         delete_files_pattern($1, file_t, file_t)
2913 ')
2914
2915 ########################################
2916 ## <summary>
2917 ##      Delete symbolic links on new filesystems
2918 ##      that have not yet been labeled.
2919 ## </summary>
2920 ## <param name="domain">
2921 ##      <summary>
2922 ##      Domain allowed access.
2923 ##      </summary>
2924 ## </param>
2925 #
2926 interface(`files_delete_isid_type_symlinks',`
2927         gen_require(`
2928                 type file_t;
2929         ')
2930
2931         delete_lnk_files_pattern($1, file_t, file_t)
2932 ')
2933
2934 ########################################
2935 ## <summary>
2936 ##      Delete named pipes on new filesystems
2937 ##      that have not yet been labeled.
2938 ## </summary>
2939 ## <param name="domain">
2940 ##      <summary>
2941 ##      Domain allowed access.
2942 ##      </summary>
2943 ## </param>
2944 #
2945 interface(`files_delete_isid_type_fifo_files',`
2946         gen_require(`
2947                 type file_t;
2948         ')
2949
2950         delete_fifo_files_pattern($1, file_t, file_t)
2951 ')
2952
2953 ########################################
2954 ## <summary>
2955 ##      Delete named sockets on new filesystems
2956 ##      that have not yet been labeled.
2957 ## </summary>
2958 ## <param name="domain">
2959 ##      <summary>
2960 ##      Domain allowed access.
2961 ##      </summary>
2962 ## </param>
2963 #
2964 interface(`files_delete_isid_type_sock_files',`
2965         gen_require(`
2966                 type file_t;
2967         ')
2968
2969         delete_sock_files_pattern($1, file_t, file_t)
2970 ')
2971
2972 ########################################
2973 ## <summary>
2974 ##      Delete block files on new filesystems
2975 ##      that have not yet been labeled.
2976 ## </summary>
2977 ## <param name="domain">
2978 ##      <summary>
2979 ##      Domain allowed access.
2980 ##      </summary>
2981 ## </param>
2982 #
2983 interface(`files_delete_isid_type_blk_files',`
2984         gen_require(`
2985                 type file_t;
2986         ')
2987
2988         delete_blk_files_pattern($1, file_t, file_t)
2989 ')
2990
2991 ########################################
2992 ## <summary>
2993 ##      Do not audit attempts to write to character
2994 ##      files that have not yet been labeled.
2995 ## </summary>
2996 ## <param name="domain">
2997 ##      <summary>
2998 ##      Domain to not audit.
2999 ##      </summary>
3000 ## </param>
3001 #
3002 interface(`files_dontaudit_write_isid_chr_files',`
3003         gen_require(`
3004                 type file_t;
3005         ')
3006
3007         dontaudit $1 file_t:chr_file write;
3008 ')
3009
3010 ########################################
3011 ## <summary>
3012 ##      Delete chr files on new filesystems
3013 ##      that have not yet been labeled.
3014 ## </summary>
3015 ## <param name="domain">
3016 ##      <summary>
3017 ##      Domain allowed access.
3018 ##      </summary>
3019 ## </param>
3020 #
3021 interface(`files_delete_isid_type_chr_files',`
3022         gen_require(`
3023                 type file_t;
3024         ')
3025
3026         delete_chr_files_pattern($1, file_t, file_t)
3027 ')
3028
3029 ########################################
3030 ## <summary>
3031 ##      Create, read, write, and delete files
3032 ##      on new filesystems that have not yet been labeled.
3033 ## </summary>
3034 ## <param name="domain">
3035 ##      <summary>
3036 ##      Domain allowed access.
3037 ##      </summary>
3038 ## </param>
3039 #
3040 interface(`files_manage_isid_type_files',`
3041         gen_require(`
3042                 type file_t;
3043         ')
3044
3045         allow $1 file_t:file manage_file_perms;
3046 ')
3047
3048 ########################################
3049 ## <summary>
3050 ##      Create, read, write, and delete symbolic links
3051 ##      on new filesystems that have not yet been labeled.
3052 ## </summary>
3053 ## <param name="domain">
3054 ##      <summary>
3055 ##      Domain allowed access.
3056 ##      </summary>
3057 ## </param>
3058 #
3059 interface(`files_manage_isid_type_symlinks',`
3060         gen_require(`
3061                 type file_t;
3062         ')
3063
3064         allow $1 file_t:lnk_file manage_lnk_file_perms;
3065 ')
3066
3067 ########################################
3068 ## <summary>
3069 ##      Read and write block device nodes on new filesystems
3070 ##      that have not yet been labeled.
3071 ## </summary>
3072 ## <param name="domain">
3073 ##      <summary>
3074 ##      Domain allowed access.
3075 ##      </summary>
3076 ## </param>
3077 #
3078 interface(`files_rw_isid_type_blk_files',`
3079         gen_require(`
3080                 type file_t;
3081         ')
3082
3083         allow $1 file_t:blk_file rw_blk_file_perms;
3084 ')
3085
3086 ########################################
3087 ## <summary>
3088 ##      Create, read, write, and delete block device nodes
3089 ##      on new filesystems that have not yet been labeled.
3090 ## </summary>
3091 ## <param name="domain">
3092 ##      <summary>
3093 ##      Domain allowed access.
3094 ##      </summary>
3095 ## </param>
3096 #
3097 interface(`files_manage_isid_type_blk_files',`
3098         gen_require(`
3099                 type file_t;
3100         ')
3101
3102         allow $1 file_t:blk_file manage_blk_file_perms;
3103 ')
3104
3105 ########################################
3106 ## <summary>
3107 ##      Create, read, write, and delete character device nodes
3108 ##      on new filesystems that have not yet been labeled.
3109 ## </summary>
3110 ## <param name="domain">
3111 ##      <summary>
3112 ##      Domain allowed access.
3113 ##      </summary>
3114 ## </param>
3115 #
3116 interface(`files_manage_isid_type_chr_files',`
3117         gen_require(`
3118                 type file_t;
3119         ')
3120
3121         allow $1 file_t:chr_file manage_chr_file_perms;
3122 ')
3123
3124 ########################################
3125 ## <summary>
3126 ##      Get the attributes of the home directories root
3127 ##      (/home).
3128 ## </summary>
3129 ## <param name="domain">
3130 ##      <summary>
3131 ##      Domain allowed access.
3132 ##      </summary>
3133 ## </param>
3134 #
3135 interface(`files_getattr_home_dir',`
3136         gen_require(`
3137                 type home_root_t;
3138         ')
3139
3140         allow $1 home_root_t:dir getattr;
3141         allow $1 home_root_t:lnk_file getattr;
3142 ')
3143
3144 ########################################
3145 ## <summary>
3146 ##      Do not audit attempts to get the
3147 ##      attributes of the home directories root
3148 ##      (/home).
3149 ## </summary>
3150 ## <param name="domain">
3151 ##      <summary>
3152 ##      Domain to not audit.
3153 ##      </summary>
3154 ## </param>
3155 #
3156 interface(`files_dontaudit_getattr_home_dir',`
3157         gen_require(`
3158                 type home_root_t;
3159         ')
3160
3161         dontaudit $1 home_root_t:dir getattr;
3162         dontaudit $1 home_root_t:lnk_file getattr;
3163 ')
3164
3165 ########################################
3166 ## <summary>
3167 ##      Search home directories root (/home).
3168 ## </summary>
3169 ## <param name="domain">
3170 ##      <summary>
3171 ##      Domain allowed access.
3172 ##      </summary>
3173 ## </param>
3174 #
3175 interface(`files_search_home',`
3176         gen_require(`
3177                 type home_root_t;
3178         ')
3179
3180         allow $1 home_root_t:dir search_dir_perms;
3181         allow $1 home_root_t:lnk_file read_lnk_file_perms;
3182 ')
3183
3184 ########################################
3185 ## <summary>
3186 ##      Do not audit attempts to search
3187 ##      home directories root (/home).
3188 ## </summary>
3189 ## <param name="domain">
3190 ##      <summary>
3191 ##      Domain to not audit.
3192 ##      </summary>
3193 ## </param>
3194 #
3195 interface(`files_dontaudit_search_home',`
3196         gen_require(`
3197                 type home_root_t;
3198         ')
3199
3200         dontaudit $1 home_root_t:dir search_dir_perms;
3201         dontaudit $1 home_root_t:lnk_file read_lnk_file_perms;
3202 ')
3203
3204 ########################################
3205 ## <summary>
3206 ##      Do not audit attempts to list
3207 ##      home directories root (/home).
3208 ## </summary>
3209 ## <param name="domain">
3210 ##      <summary>
3211 ##      Domain to not audit.
3212 ##      </summary>
3213 ## </param>
3214 #
3215 interface(`files_dontaudit_list_home',`
3216         gen_require(`
3217                 type home_root_t;
3218         ')
3219
3220         dontaudit $1 home_root_t:dir list_dir_perms;
3221         dontaudit $1 home_root_t:lnk_file read_lnk_file_perms;
3222 ')
3223
3224 ########################################
3225 ## <summary>
3226 ##      Get listing of home directories.
3227 ## </summary>
3228 ## <param name="domain">
3229 ##      <summary>
3230 ##      Domain allowed access.
3231 ##      </summary>
3232 ## </param>
3233 #
3234 interface(`files_list_home',`
3235         gen_require(`
3236                 type home_root_t;
3237         ')
3238
3239         allow $1 home_root_t:dir list_dir_perms;
3240         allow $1 home_root_t:lnk_file read_lnk_file_perms;
3241 ')
3242
3243 ########################################
3244 ## <summary>
3245 ##      Relabel to user home root (/home).
3246 ## </summary>
3247 ## <param name="domain">
3248 ##      <summary>
3249 ##      Domain allowed access.
3250 ##      </summary>
3251 ## </param>
3252 #
3253 interface(`files_relabelto_home',`
3254         gen_require(`
3255                 type home_root_t;
3256         ')
3257
3258         allow $1 home_root_t:dir relabelto;
3259 ')
3260
3261 ########################################
3262 ## <summary>
3263 ##      Create objects in /home.
3264 ## </summary>
3265 ## <param name="domain">
3266 ##      <summary>
3267 ##      Domain allowed access.
3268 ##      </summary>
3269 ## </param>
3270 ## <param name="home_type">
3271 ##      <summary>
3272 ##      The private type.
3273 ##      </summary>
3274 ## </param>
3275 ## <param name="object">
3276 ##      <summary>
3277 ##      The class of the object being created.
3278 ##      </summary>
3279 ## </param>
3280 #
3281 interface(`files_home_filetrans',`
3282         gen_require(`
3283                 type home_root_t;
3284         ')
3285
3286         filetrans_pattern($1, home_root_t, $2, $3)
3287 ')
3288
3289 ########################################
3290 ## <summary>
3291 ##      Get the attributes of lost+found directories.
3292 ## </summary>
3293 ## <param name="domain">
3294 ##      <summary>
3295 ##      Domain allowed access.
3296 ##      </summary>
3297 ## </param>
3298 #
3299 interface(`files_getattr_lost_found_dirs',`
3300         gen_require(`
3301                 type lost_found_t;
3302         ')
3303
3304         allow $1 lost_found_t:dir getattr;
3305 ')
3306
3307 ########################################
3308 ## <summary>
3309 ##      Do not audit attempts to get the attributes of
3310 ##      lost+found directories.
3311 ## </summary>
3312 ## <param name="domain">
3313 ##      <summary>
3314 ##      Domain to not audit.
3315 ##      </summary>
3316 ## </param>
3317 #
3318 interface(`files_dontaudit_getattr_lost_found_dirs',`
3319         gen_require(`
3320                 type lost_found_t;
3321         ')
3322
3323         dontaudit $1 lost_found_t:dir getattr;
3324 ')
3325
3326 ########################################
3327 ## <summary>
3328 ##      Create, read, write, and delete objects in
3329 ##      lost+found directories.
3330 ## </summary>
3331 ## <param name="domain">
3332 ##      <summary>
3333 ##      Domain allowed access.
3334 ##      </summary>
3335 ## </param>
3336 ## <rolecap/>
3337 #
3338 interface(`files_manage_lost_found',`
3339         gen_require(`
3340                 type lost_found_t;
3341         ')
3342
3343         manage_dirs_pattern($1, lost_found_t, lost_found_t)
3344         manage_files_pattern($1, lost_found_t, lost_found_t)
3345         manage_lnk_files_pattern($1, lost_found_t, lost_found_t)
3346         manage_fifo_files_pattern($1, lost_found_t, lost_found_t)
3347         manage_sock_files_pattern($1, lost_found_t, lost_found_t)
3348 ')
3349
3350 ########################################
3351 ## <summary>
3352 ##      Search the contents of /mnt.
3353 ## </summary>
3354 ## <param name="domain">
3355 ##      <summary>
3356 ##      Domain allowed access.
3357 ##      </summary>
3358 ## </param>
3359 #
3360 interface(`files_search_mnt',`
3361         gen_require(`
3362                 type mnt_t;
3363         ')
3364
3365         allow $1 mnt_t:dir search_dir_perms;
3366 ')
3367
3368 ########################################
3369 ## <summary>
3370 ##      Do not audit attempts to search /mnt.
3371 ## </summary>
3372 ## <param name="domain">
3373 ##      <summary>
3374 ##      Domain to not audit.
3375 ##      </summary>
3376 ## </param>
3377 #
3378 interface(`files_dontaudit_search_mnt',`
3379         gen_require(`
3380                 type mnt_t;
3381         ')
3382
3383         dontaudit $1 mnt_t:dir search_dir_perms;
3384 ')
3385
3386 ########################################
3387 ## <summary>
3388 ##      List the contents of /mnt.
3389 ## </summary>
3390 ## <param name="domain">
3391 ##      <summary>
3392 ##      Domain allowed access.
3393 ##      </summary>
3394 ## </param>
3395 #
3396 interface(`files_list_mnt',`
3397         gen_require(`
3398                 type mnt_t;
3399         ')
3400
3401         allow $1 mnt_t:dir list_dir_perms;
3402 ')
3403
3404 ######################################
3405 ## <summary>
3406 ##  dontaudit List the contents of /mnt.
3407 ## </summary>
3408 ## <param name="domain">
3409 ##  <summary>
3410 ##  Domain allowed access.
3411 ##  </summary>
3412 ## </param>
3413 #
3414 interface(`files_dontaudit_list_mnt',`
3415     gen_require(`
3416         type mnt_t;
3417     ')
3418
3419     dontaudit $1 mnt_t:dir list_dir_perms;
3420 ')
3421
3422 ########################################
3423 ## <summary>
3424 ##      Mount a filesystem on /mnt.
3425 ## </summary>
3426 ## <param name="domain">
3427 ##      <summary>
3428 ##      Domain allowed access.
3429 ##      </summary>
3430 ## </param>
3431 #
3432 interface(`files_mounton_mnt',`
3433         gen_require(`
3434                 type mnt_t;
3435         ')
3436
3437         allow $1 mnt_t:dir { search_dir_perms mounton };
3438 ')
3439
3440 ########################################
3441 ## <summary>
3442 ##      Create, read, write, and delete directories in /mnt.
3443 ## </summary>
3444 ## <param name="domain">
3445 ##      <summary>
3446 ##      Domain allowed access.
3447 ##      </summary>
3448 ## </param>
3449 ## <rolecap/>
3450 #
3451 interface(`files_manage_mnt_dirs',`
3452         gen_require(`
3453                 type mnt_t;
3454         ')
3455
3456         allow $1 mnt_t:dir manage_dir_perms;
3457 ')
3458
3459 ########################################
3460 ## <summary>
3461 ##      Create, read, write, and delete files in /mnt.
3462 ## </summary>
3463 ## <param name="domain">
3464 ##      <summary>
3465 ##      Domain allowed access.
3466 ##      </summary>
3467 ## </param>
3468 #
3469 interface(`files_manage_mnt_files',`
3470         gen_require(`
3471                 type mnt_t;
3472         ')
3473
3474         manage_files_pattern($1, mnt_t, mnt_t)
3475 ')
3476
3477 ########################################
3478 ## <summary>
3479 ##      read files in /mnt.
3480 ## </summary>
3481 ## <param name="domain">
3482 ##      <summary>
3483 ##      Domain allowed access.
3484 ##      </summary>
3485 ## </param>
3486 #
3487 interface(`files_read_mnt_files',`
3488         gen_require(`
3489                 type mnt_t;
3490         ')
3491
3492         read_files_pattern($1, mnt_t, mnt_t)
3493 ')
3494
3495 ######################################
3496 ## <summary>
3497 ##  Read symbolic links in /mnt.
3498 ## </summary>
3499 ## <param name="domain">
3500 ##  <summary>
3501 ##  Domain allowed access.
3502 ##  </summary>
3503 ## </param>
3504 #
3505 interface(`files_read_mnt_symlinks',`
3506     gen_require(`
3507         type mnt_t;
3508     ')
3509
3510     read_lnk_files_pattern($1, mnt_t, mnt_t)
3511 ')
3512
3513 ########################################
3514 ## <summary>
3515 ##      Create, read, write, and delete symbolic links in /mnt.
3516 ## </summary>
3517 ## <param name="domain">
3518 ##      <summary>
3519 ##      Domain allowed access.
3520 ##      </summary>
3521 ## </param>
3522 #
3523 interface(`files_manage_mnt_symlinks',`
3524         gen_require(`
3525                 type mnt_t;
3526         ')
3527
3528         manage_lnk_files_pattern($1, mnt_t, mnt_t)
3529 ')
3530
3531 ########################################
3532 ## <summary>
3533 ##      Search the contents of the kernel module directories.
3534 ## </summary>
3535 ## <param name="domain">
3536 ##      <summary>
3537 ##      Domain allowed access.
3538 ##      </summary>
3539 ## </param>
3540 #
3541 interface(`files_search_kernel_modules',`
3542         gen_require(`
3543                 type modules_object_t;
3544         ')
3545
3546         allow $1 modules_object_t:dir search_dir_perms;
3547         read_lnk_files_pattern($1, modules_object_t, modules_object_t)
3548 ')
3549
3550 ########################################
3551 ## <summary>
3552 ##      List the contents of the kernel module directories.
3553 ## </summary>
3554 ## <param name="domain">
3555 ##      <summary>
3556 ##      Domain allowed access.
3557 ##      </summary>
3558 ## </param>
3559 #
3560 interface(`files_list_kernel_modules',`
3561         gen_require(`
3562                 type modules_object_t;
3563         ')
3564
3565         allow $1 modules_object_t:dir list_dir_perms;
3566 ')
3567
3568 ########################################
3569 ## <summary>
3570 ##      Get the attributes of kernel module files.
3571 ## </summary>
3572 ## <param name="domain">
3573 ##      <summary>
3574 ##      Domain allowed access.
3575 ##      </summary>
3576 ## </param>
3577 #
3578 interface(`files_getattr_kernel_modules',`
3579         gen_require(`
3580                 type modules_object_t;
3581         ')
3582
3583         getattr_files_pattern($1, modules_object_t, modules_object_t)
3584 ')
3585
3586 ########################################
3587 ## <summary>
3588 ##      Read kernel module files.
3589 ## </summary>
3590 ## <param name="domain">
3591 ##      <summary>
3592 ##      Domain allowed access.
3593 ##      </summary>
3594 ## </param>
3595 #
3596 interface(`files_read_kernel_modules',`
3597         gen_require(`
3598                 type modules_object_t;
3599         ')
3600
3601         allow $1 modules_object_t:dir list_dir_perms;
3602         read_files_pattern($1, modules_object_t, modules_object_t)
3603         read_lnk_files_pattern($1, modules_object_t, modules_object_t)
3604 ')
3605
3606 ########################################
3607 ## <summary>
3608 ##      Write kernel module files.
3609 ## </summary>
3610 ## <param name="domain">
3611 ##      <summary>
3612 ##      Domain allowed access.
3613 ##      </summary>
3614 ## </param>
3615 #
3616 interface(`files_write_kernel_modules',`
3617         gen_require(`
3618                 type modules_object_t;
3619         ')
3620
3621         allow $1 modules_object_t:dir list_dir_perms;
3622         write_files_pattern($1, modules_object_t, modules_object_t)
3623 ')
3624
3625 ########################################
3626 ## <summary>
3627 ##      Delete kernel module files.
3628 ## </summary>
3629 ## <param name="domain">
3630 ##      <summary>
3631 ##      Domain allowed access.
3632 ##      </summary>
3633 ## </param>
3634 #
3635 interface(`files_delete_kernel_modules',`
3636         gen_require(`
3637                 type modules_object_t;
3638         ')
3639
3640         delete_files_pattern($1, modules_object_t, modules_object_t)
3641 ')
3642
3643 ########################################
3644 ## <summary>
3645 ##      Create, read, write, and delete
3646 ##      kernel module files.
3647 ## </summary>
3648 ## <param name="domain">
3649 ##      <summary>
3650 ##      Domain allowed access.
3651 ##      </summary>
3652 ## </param>
3653 ## <rolecap/>
3654 #
3655 interface(`files_manage_kernel_modules',`
3656         gen_require(`
3657                 type modules_object_t;
3658         ')
3659
3660         manage_files_pattern($1, modules_object_t, modules_object_t)
3661 ')
3662
3663 ########################################
3664 ## <summary>
3665 ##      Relabel from and to kernel module files.
3666 ## </summary>
3667 ## <param name="domain">
3668 ##      <summary>
3669 ##      Domain allowed access.
3670 ##      </summary>
3671 ## </param>
3672 #
3673 interface(`files_relabel_kernel_modules',`
3674         gen_require(`
3675                 type modules_object_t;
3676         ')
3677
3678         relabel_files_pattern($1, modules_object_t, modules_object_t)
3679         allow $1 modules_object_t:dir list_dir_perms;
3680 ')
3681
3682 ########################################
3683 ## <summary>
3684 ##      Create objects in the kernel module directories
3685 ##      with a private type via an automatic type transition.
3686 ## </summary>
3687 ## <param name="domain">
3688 ##      <summary>
3689 ##      Domain allowed access.
3690 ##      </summary>
3691 ## </param>
3692 ## <param name="private_type">
3693 ##      <summary>
3694 ##      The type of the object to be created.
3695 ##      </summary>
3696 ## </param>
3697 ## <param name="object_class">
3698 ##      <summary>
3699 ##      The object class of the object being created.
3700 ##      </summary>
3701 ## </param>
3702 #
3703 interface(`files_kernel_modules_filetrans',`
3704         gen_require(`
3705                 type modules_object_t;
3706         ')
3707
3708         filetrans_pattern($1, modules_object_t, $2, $3)
3709 ')
3710
3711 ########################################
3712 ## <summary>
3713 ##      List world-readable directories.
3714 ## </summary>
3715 ## <param name="domain">
3716 ##      <summary>
3717 ##      Domain allowed access.
3718 ##      </summary>
3719 ## </param>
3720 ## <rolecap/>
3721 #
3722 interface(`files_list_world_readable',`
3723         gen_require(`
3724                 type readable_t;
3725         ')
3726
3727         allow $1 readable_t:dir list_dir_perms;
3728 ')
3729
3730 ########################################
3731 ## <summary>
3732 ##      Read world-readable files.
3733 ## </summary>
3734 ## <param name="domain">
3735 ##      <summary>
3736 ##      Domain allowed access.
3737 ##      </summary>
3738 ## </param>
3739 ## <rolecap/>
3740 #
3741 interface(`files_read_world_readable_files',`
3742         gen_require(`
3743                 type readable_t;
3744         ')
3745
3746         allow $1 readable_t:file read_file_perms;
3747 ')
3748
3749 ########################################
3750 ## <summary>
3751 ##      Read world-readable symbolic links.
3752 ## </summary>
3753 ## <param name="domain">
3754 ##      <summary>
3755 ##      Domain allowed access.
3756 ##      </summary>
3757 ## </param>
3758 ## <rolecap/>
3759 #
3760 interface(`files_read_world_readable_symlinks',`
3761         gen_require(`
3762                 type readable_t;
3763         ')
3764
3765         allow $1 readable_t:lnk_file read_lnk_file_perms;
3766 ')
3767
3768 ########################################
3769 ## <summary>
3770 ##      Read world-readable named pipes.
3771 ## </summary>
3772 ## <param name="domain">
3773 ##      <summary>
3774 ##      Domain allowed access.
3775 ##      </summary>
3776 ## </param>
3777 #
3778 interface(`files_read_world_readable_pipes',`
3779         gen_require(`
3780                 type readable_t;
3781         ')
3782
3783         allow $1 readable_t:fifo_file read_fifo_file_perms;
3784 ')
3785
3786 ########################################
3787 ## <summary>
3788 ##      Read world-readable sockets.
3789 ## </summary>
3790 ## <param name="domain">
3791 ##      <summary>
3792 ##      Domain allowed access.
3793 ##      </summary>
3794 ## </param>
3795 #
3796 interface(`files_read_world_readable_sockets',`
3797         gen_require(`
3798                 type readable_t;
3799         ')
3800
3801         allow $1 readable_t:sock_file read_sock_file_perms;
3802 ')
3803
3804 #######################################
3805 ## <summary>
3806 ##  Read manageable system configuration files in /etc
3807 ## </summary>
3808 ## <param name="domain">
3809 ##  <summary>
3810 ##  Domain allowed access.
3811 ##  </summary>
3812 ## </param>
3813 ## <rolecap/>
3814 #
3815 interface(`files_read_system_conf_files',`
3816     gen_require(`
3817         type etc_t, system_conf_t;
3818     ')
3819
3820     allow $1 etc_t:dir list_dir_perms;
3821     read_files_pattern($1, etc_t, system_conf_t)
3822     read_lnk_files_pattern($1, etc_t, system_conf_t)
3823 ')
3824
3825 ######################################
3826 ## <summary>
3827 ##  Manage manageable system configuration files in /etc.
3828 ## </summary>
3829 ## <param name="domain">
3830 ##  <summary>
3831 ##  Domain allowed access.
3832 ##  </summary>
3833 ## </param>
3834 #
3835 interface(`files_manage_system_conf_files',`
3836     gen_require(`
3837         type etc_t, system_conf_t;
3838     ')
3839
3840     manage_files_pattern($1, { etc_t system_conf_t }, system_conf_t)
3841 ')
3842
3843 ######################################
3844 ## <summary>
3845 ##  Relabel manageable system configuration files in /etc.
3846 ## </summary>
3847 ## <param name="domain">
3848 ##  <summary>
3849 ##  Domain allowed access.
3850 ##  </summary>
3851 ## </param>
3852 #
3853 interface(`files_relabelto_system_conf_files',`
3854     gen_require(`
3855         type usr_t;
3856     ')
3857
3858     relabelto_files_pattern($1, system_conf_t, system_conf_t)
3859 ')
3860
3861 ######################################
3862 ## <summary>
3863 ##  Relabel manageable system configuration files in /etc.
3864 ## </summary>
3865 ## <param name="domain">
3866 ##  <summary>
3867 ##  Domain allowed access.
3868 ##  </summary>
3869 ## </param>
3870 #
3871 interface(`files_relabelfrom_system_conf_files',`
3872     gen_require(`
3873         type usr_t;
3874     ')
3875
3876     relabelfrom_files_pattern($1, system_conf_t, system_conf_t)
3877 ')
3878
3879 ###################################
3880 ## <summary>
3881 ##  Create files in /etc with the type used for
3882 ##  the manageable system config files.
3883 ## </summary>
3884 ## <param name="domain">
3885 ##  <summary>
3886 ##  The type of the process performing this action.
3887 ##  </summary>
3888 ## </param>
3889 #
3890 interface(`files_etc_filetrans_system_conf',`
3891     gen_require(`
3892         type etc_t, system_conf_t;
3893     ')
3894
3895     filetrans_pattern($1, etc_t, system_conf_t, file)
3896 ')
3897
3898 ########################################
3899 ## <summary>
3900 ##      Allow the specified type to associate
3901 ##      to a filesystem with the type of the
3902 ##      temporary directory (/tmp).
3903 ## </summary>
3904 ## <param name="file_type">
3905 ##      <summary>
3906 ##      Type of the file to associate.
3907 ##      </summary>
3908 ## </param>
3909 #
3910 interface(`files_associate_tmp',`
3911         gen_require(`
3912                 type tmp_t;
3913         ')
3914
3915         allow $1 tmp_t:filesystem associate;
3916 ')
3917
3918 ########################################
3919 ## <summary>
3920 ##      Get the attributes of the tmp directory (/tmp).
3921 ## </summary>
3922 ## <param name="domain">
3923 ##      <summary>
3924 ##      Domain allowed access.
3925 ##      </summary>
3926 ## </param>
3927 #
3928 interface(`files_getattr_tmp_dirs',`
3929         gen_require(`
3930                 type tmp_t;
3931         ')
3932
3933         allow $1 tmp_t:dir getattr;
3934 ')
3935
3936 ########################################
3937 ## <summary>
3938 ##      Do not audit attempts to get the
3939 ##      attributes of the tmp directory (/tmp).
3940 ## </summary>
3941 ## <param name="domain">
3942 ##      <summary>
3943 ##      Domain allowed access.
3944 ##      </summary>
3945 ## </param>
3946 #
3947 interface(`files_dontaudit_getattr_tmp_dirs',`
3948         gen_require(`
3949                 type tmp_t;
3950         ')
3951
3952         dontaudit $1 tmp_t:dir getattr;
3953 ')
3954
3955 ########################################
3956 ## <summary>
3957 ##      Search the tmp directory (/tmp).
3958 ## </summary>
3959 ## <param name="domain">
3960 ##      <summary>
3961 ##      Domain allowed access.
3962 ##      </summary>
3963 ## </param>
3964 #
3965 interface(`files_search_tmp',`
3966         gen_require(`
3967                 type tmp_t;
3968         ')
3969
3970         allow $1 tmp_t:dir search_dir_perms;
3971 ')
3972
3973 ########################################
3974 ## <summary>
3975 ##      Do not audit attempts to search the tmp directory (/tmp).
3976 ## </summary>
3977 ## <param name="domain">
3978 ##      <summary>
3979 ##      Domain to not audit.
3980 ##      </summary>
3981 ## </param>
3982 #
3983 interface(`files_dontaudit_search_tmp',`
3984         gen_require(`
3985                 type tmp_t;
3986         ')
3987
3988         dontaudit $1 tmp_t:dir search_dir_perms;
3989 ')
3990
3991 ########################################
3992 ## <summary>
3993 ##      Read the tmp directory (/tmp).
3994 ## </summary>
3995 ## <param name="domain">
3996 ##      <summary>
3997 ##      Domain allowed access.
3998 ##      </summary>
3999 ## </param>
4000 #
4001 interface(`files_list_tmp',`
4002         gen_require(`
4003                 type tmp_t;
4004         ')
4005
4006         allow $1 tmp_t:dir list_dir_perms;
4007 ')
4008
4009 ########################################
4010 ## <summary>
4011 ##      Do not audit listing of the tmp directory (/tmp).
4012 ## </summary>
4013 ## <param name="domain">
4014 ##      <summary>
4015 ##      Domain not to audit.
4016 ##      </summary>
4017 ## </param>
4018 #
4019 interface(`files_dontaudit_list_tmp',`
4020         gen_require(`
4021                 type tmp_t;
4022         ')
4023
4024         dontaudit $1 tmp_t:dir list_dir_perms;
4025 ')
4026
4027 ########################################
4028 ## <summary>
4029 ##      Remove entries from the tmp directory.
4030 ## </summary>
4031 ## <param name="domain">
4032 ##      <summary>
4033 ##      Domain allowed access.
4034 ##      </summary>
4035 ## </param>
4036 #
4037 interface(`files_delete_tmp_dir_entry',`
4038         gen_require(`
4039                 type tmp_t;
4040         ')
4041
4042         allow $1 tmp_t:dir del_entry_dir_perms;
4043 ')
4044
4045 ########################################
4046 ## <summary>
4047 ##      Read files in the tmp directory (/tmp).
4048 ## </summary>
4049 ## <param name="domain">
4050 ##      <summary>
4051 ##      Domain allowed access.
4052 ##      </summary>
4053 ## </param>
4054 #
4055 interface(`files_read_generic_tmp_files',`
4056         gen_require(`
4057                 type tmp_t;
4058         ')
4059
4060         read_files_pattern($1, tmp_t, tmp_t)
4061 ')
4062
4063 ########################################
4064 ## <summary>
4065 ##      Manage temporary directories in /tmp.
4066 ## </summary>
4067 ## <param name="domain">
4068 ##      <summary>
4069 ##      Domain allowed access.
4070 ##      </summary>
4071 ## </param>
4072 #
4073 interface(`files_manage_generic_tmp_dirs',`
4074         gen_require(`
4075                 type tmp_t;
4076         ')
4077
4078         manage_dirs_pattern($1, tmp_t, tmp_t)
4079 ')
4080
4081 ########################################
4082 ## <summary>
4083 ##      Allow shared library text relocations in tmp files.
4084 ## </summary>
4085 ## <desc>
4086 ##      <p>
4087 ##      Allow shared library text relocations in tmp files.
4088 ##      </p>
4089 ##      <p>
4090 ##      This is added to support java policy.
4091 ##      </p>
4092 ## </desc>
4093 ## <param name="domain">
4094 ##      <summary>
4095 ##      Domain allowed access.
4096 ##      </summary>
4097 ## </param>
4098 #
4099 interface(`files_execmod_tmp',`
4100         gen_require(`
4101                 attribute tmpfile;
4102         ')
4103
4104         allow $1 tmpfile:file execmod;
4105 ')
4106
4107 ########################################
4108 ## <summary>
4109 ##      Manage temporary files and directories in /tmp.
4110 ## </summary>
4111 ## <param name="domain">
4112 ##      <summary>
4113 ##      Domain allowed access.
4114 ##      </summary>
4115 ## </param>
4116 #
4117 interface(`files_manage_generic_tmp_files',`
4118         gen_require(`
4119                 type tmp_t;
4120         ')
4121
4122         manage_files_pattern($1, tmp_t, tmp_t)
4123 ')
4124
4125 ########################################
4126 ## <summary>
4127 ##      Read symbolic links in the tmp directory (/tmp).
4128 ## </summary>
4129 ## <param name="domain">
4130 ##      <summary>
4131 ##      Domain allowed access.
4132 ##      </summary>
4133 ## </param>
4134 #
4135 interface(`files_read_generic_tmp_symlinks',`
4136         gen_require(`
4137                 type tmp_t;
4138         ')
4139
4140         read_lnk_files_pattern($1, tmp_t, tmp_t)
4141 ')
4142
4143 ########################################
4144 ## <summary>
4145 ##      Read and write generic named sockets in the tmp directory (/tmp).
4146 ## </summary>
4147 ## <param name="domain">
4148 ##      <summary>
4149 ##      Domain allowed access.
4150 ##      </summary>
4151 ## </param>
4152 #
4153 interface(`files_rw_generic_tmp_sockets',`
4154         gen_require(`
4155                 type tmp_t;
4156         ')
4157
4158         rw_sock_files_pattern($1, tmp_t, tmp_t)
4159 ')
4160
4161 ########################################
4162 ## <summary>
4163 ##      Set the attributes of all tmp directories.
4164 ## </summary>
4165 ## <param name="domain">
4166 ##      <summary>
4167 ##      Domain allowed access.
4168 ##      </summary>
4169 ## </param>
4170 #
4171 interface(`files_setattr_all_tmp_dirs',`
4172         gen_require(`
4173                 attribute tmpfile;
4174         ')
4175
4176         allow $1 tmpfile:dir { search_dir_perms setattr };
4177 ')
4178
4179 ########################################
4180 ## <summary>
4181 ##      List all tmp directories.
4182 ## </summary>
4183 ## <param name="domain">
4184 ##      <summary>
4185 ##      Domain allowed access.
4186 ##      </summary>
4187 ## </param>
4188 #
4189 interface(`files_list_all_tmp',`
4190         gen_require(`
4191                 attribute tmpfile;
4192         ')
4193
4194         allow $1 tmpfile:dir list_dir_perms;
4195 ')
4196
4197 ########################################
4198 ## <summary>
4199 ##      Do not audit attempts to get the attributes
4200 ##      of all tmp files.
4201 ## </summary>
4202 ## <param name="domain">
4203 ##      <summary>
4204 ##      Domain not to audit.
4205 ##      </summary>
4206 ## </param>
4207 #
4208 interface(`files_dontaudit_getattr_all_tmp_files',`
4209         gen_require(`
4210                 attribute tmpfile;
4211         ')
4212
4213         dontaudit $1 tmpfile:file getattr;
4214 ')
4215
4216 ########################################
4217 ## <summary>
4218 ##      Allow attempts to get the attributes
4219 ##      of all tmp files.
4220 ## </summary>
4221 ## <param name="domain">
4222 ##      <summary>
4223 ##      Domain allowed access.
4224 ##      </summary>
4225 ## </param>
4226 #
4227 interface(`files_getattr_all_tmp_files',`
4228         gen_require(`
4229                 attribute tmpfile;
4230         ')
4231
4232         allow $1 tmpfile:file getattr;
4233 ')
4234
4235 ########################################
4236 ## <summary>
4237 ##      Do not audit attempts to get the attributes
4238 ##      of all tmp sock_file.
4239 ## </summary>
4240 ## <param name="domain">
4241 ##      <summary>
4242 ##      Domain not to audit.
4243 ##      </summary>
4244 ## </param>
4245 #
4246 interface(`files_dontaudit_getattr_all_tmp_sockets',`
4247         gen_require(`
4248                 attribute tmpfile;
4249         ')
4250
4251         dontaudit $1 tmpfile:sock_file getattr;
4252 ')
4253
4254 ########################################
4255 ## <summary>
4256 ##      Read all tmp files.
4257 ## </summary>
4258 ## <param name="domain">
4259 ##      <summary>
4260 ##      Domain allowed access.
4261 ##      </summary>
4262 ## </param>
4263 #
4264 interface(`files_read_all_tmp_files',`
4265         gen_require(`
4266                 attribute tmpfile;
4267         ')
4268
4269         read_files_pattern($1, tmpfile, tmpfile)
4270 ')
4271
4272 ########################################
4273 ## <summary>
4274 ##      Create an object in the tmp directories, with a private
4275 ##      type using a type transition.
4276 ## </summary>
4277 ## <param name="domain">
4278 ##      <summary>
4279 ##      Domain allowed access.
4280 ##      </summary>
4281 ## </param>
4282 ## <param name="private type">
4283 ##      <summary>
4284 ##      The type of the object to be created.
4285 ##      </summary>
4286 ## </param>
4287 ## <param name="object">
4288 ##      <summary>
4289 ##      The object class of the object being created.
4290 ##      </summary>
4291 ## </param>
4292 #
4293 interface(`files_tmp_filetrans',`
4294         gen_require(`
4295                 type tmp_t;
4296         ')
4297
4298         filetrans_pattern($1, tmp_t, $2, $3)
4299 ')
4300
4301 ########################################
4302 ## <summary>
4303 ##      Delete the contents of /tmp.
4304 ## </summary>
4305 ## <param name="domain">
4306 ##      <summary>
4307 ##      Domain allowed access.
4308 ##      </summary>
4309 ## </param>
4310 #
4311 interface(`files_purge_tmp',`
4312         gen_require(`
4313                 attribute tmpfile;
4314         ')
4315
4316         allow $1 tmpfile:dir list_dir_perms;
4317         delete_dirs_pattern($1, tmpfile, tmpfile)
4318         delete_files_pattern($1, tmpfile, tmpfile)
4319         delete_lnk_files_pattern($1, tmpfile, tmpfile)
4320         delete_fifo_files_pattern($1, tmpfile, tmpfile)
4321         delete_sock_files_pattern($1, tmpfile, tmpfile)
4322         files_delete_isid_type_dirs($1)
4323         files_delete_isid_type_files($1)
4324         files_delete_isid_type_symlinks($1)
4325         files_delete_isid_type_fifo_files($1)
4326         files_delete_isid_type_sock_files($1)
4327         files_delete_isid_type_blk_files($1)
4328         files_delete_isid_type_chr_files($1)
4329 ')
4330
4331 ########################################
4332 ## <summary>
4333 ##      Set the attributes of the /usr directory.
4334 ## </summary>
4335 ## <param name="domain">
4336 ##      <summary>
4337 ##      Domain allowed access.
4338 ##      </summary>
4339 ## </param>
4340 #
4341 interface(`files_setattr_usr_dirs',`
4342         gen_require(`
4343                 type usr_t;
4344         ')
4345
4346         allow $1 usr_t:dir setattr;
4347 ')
4348
4349 ########################################
4350 ## <summary>
4351 ##      Search the content of /etc.
4352 ## </summary>
4353 ## <param name="domain">
4354 ##      <summary>
4355 ##      Domain allowed access.
4356 ##      </summary>
4357 ## </param>
4358 #
4359 interface(`files_search_usr',`
4360         gen_require(`
4361                 type usr_t;
4362         ')
4363
4364         allow $1 usr_t:dir search_dir_perms;
4365 ')
4366
4367 ########################################
4368 ## <summary>
4369 ##      List the contents of generic
4370 ##      directories in /usr.
4371 ## </summary>
4372 ## <param name="domain">
4373 ##      <summary>
4374 ##      Domain allowed access.
4375 ##      </summary>
4376 ## </param>
4377 #
4378 interface(`files_list_usr',`
4379         gen_require(`
4380                 type usr_t;
4381         ')
4382
4383         allow $1 usr_t:dir list_dir_perms;
4384 ')
4385
4386 ########################################
4387 ## <summary>
4388 ##      Do not audit write of /usr dirs
4389 ## </summary>
4390 ## <param name="domain">
4391 ##      <summary>
4392 ##      Domain to not audit.
4393 ##      </summary>
4394 ## </param>
4395 #
4396 interface(`files_dontaudit_write_usr_dirs',`
4397         gen_require(`
4398                 type usr_t;
4399         ')
4400
4401         dontaudit $1 usr_t:dir write;
4402 ')
4403
4404 ########################################
4405 ## <summary>
4406 ##      Add and remove entries from /usr directories.
4407 ## </summary>
4408 ## <param name="domain">
4409 ##      <summary>
4410 ##      Domain allowed access.
4411 ##      </summary>
4412 ## </param>
4413 #
4414 interface(`files_rw_usr_dirs',`
4415         gen_require(`
4416                 type usr_t;
4417         ')
4418
4419         allow $1 usr_t:dir rw_dir_perms;
4420 ')
4421
4422 ########################################
4423 ## <summary>
4424 ##      Do not audit attempts to add and remove
4425 ##      entries from /usr directories.
4426 ## </summary>
4427 ## <param name="domain">
4428 ##      <summary>
4429 ##      Domain to not audit.
4430 ##      </summary>
4431 ## </param>
4432 #
4433 interface(`files_dontaudit_rw_usr_dirs',`
4434         gen_require(`
4435                 type usr_t;
4436         ')
4437
4438         dontaudit $1 usr_t:dir rw_dir_perms;
4439 ')
4440
4441 ########################################
4442 ## <summary>
4443 ##      Delete generic directories in /usr in the caller domain.
4444 ## </summary>
4445 ## <param name="domain">
4446 ##      <summary>
4447 ##      Domain allowed access.
4448 ##      </summary>
4449 ## </param>
4450 #
4451 interface(`files_delete_usr_dirs',`
4452         gen_require(`
4453                 type usr_t;
4454         ')
4455
4456         delete_dirs_pattern($1, usr_t, usr_t)
4457 ')
4458
4459 ########################################
4460 ## <summary>
4461 ##      Delete generic files in /usr in the caller domain.
4462 ## </summary>
4463 ## <param name="domain">
4464 ##      <summary>
4465 ##      Domain allowed access.
4466 ##      </summary>
4467 ## </param>
4468 #
4469 interface(`files_delete_usr_files',`
4470         gen_require(`
4471                 type usr_t;
4472         ')
4473
4474         delete_files_pattern($1, usr_t, usr_t)
4475 ')
4476
4477 ########################################
4478 ## <summary>
4479 ##      Get the attributes of files in /usr.
4480 ## </summary>
4481 ## <param name="domain">
4482 ##      <summary>
4483 ##      Domain allowed access.
4484 ##      </summary>
4485 ## </param>
4486 #
4487 interface(`files_getattr_usr_files',`
4488         gen_require(`
4489                 type usr_t;
4490         ')
4491
4492         getattr_files_pattern($1, usr_t, usr_t)
4493 ')
4494
4495 ########################################
4496 ## <summary>
4497 ##      Read generic files in /usr.
4498 ## </summary>
4499 ## <desc>
4500 ##      <p>
4501 ##      Allow the specified domain to read generic
4502 ##      files in /usr. These files are various program
4503 ##      files that do not have more specific SELinux types.
4504 ##      Some examples of these files are:
4505 ##      </p>
4506 ##      <ul>
4507 ##              <li>/usr/include/*</li>
4508 ##              <li>/usr/share/doc/*</li>
4509 ##              <li>/usr/share/info/*</li>
4510 ##      </ul>
4511 ##      <p>
4512 ##      Generally, it is safe for many domains to have
4513 ##      this access.
4514 ##      </p>
4515 ## </desc>
4516 ## <param name="domain">
4517 ##      <summary>
4518 ##      Domain allowed access.
4519 ##      </summary>
4520 ## </param>
4521 ## <infoflow type="read" weight="10"/>
4522 #
4523 interface(`files_read_usr_files',`
4524         gen_require(`
4525                 type usr_t;
4526         ')
4527
4528         allow $1 usr_t:dir list_dir_perms;
4529         read_files_pattern($1, usr_t, usr_t)
4530         read_lnk_files_pattern($1, usr_t, usr_t)
4531 ')
4532
4533 ########################################
4534 ## <summary>
4535 ##      Execute generic programs in /usr in the caller domain.
4536 ## </summary>
4537 ## <param name="domain">
4538 ##      <summary>
4539 ##      Domain allowed access.
4540 ##      </summary>
4541 ## </param>
4542 #
4543 interface(`files_exec_usr_files',`
4544         gen_require(`
4545                 type usr_t;
4546         ')
4547
4548         allow $1 usr_t:dir list_dir_perms;
4549         exec_files_pattern($1, usr_t, usr_t)
4550         read_lnk_files_pattern($1, usr_t, usr_t)
4551 ')
4552
4553 ########################################
4554 ## <summary>
4555 ##      dontaudit write of /usr files
4556 ## </summary>
4557 ## <param name="domain">
4558 ##      <summary>
4559 ##      Domain to not audit.
4560 ##      </summary>
4561 ## </param>
4562 #
4563 interface(`files_dontaudit_write_usr_files',`
4564         gen_require(`
4565                 type usr_t;
4566         ')
4567
4568         dontaudit $1 usr_t:file write;
4569 ')
4570
4571 ########################################
4572 ## <summary>
4573 ##      Create, read, write, and delete files in the /usr directory.
4574 ## </summary>
4575 ## <param name="domain">
4576 ##      <summary>
4577 ##      Domain allowed access.
4578 ##      </summary>
4579 ## </param>
4580 #
4581 interface(`files_manage_usr_files',`
4582         gen_require(`
4583                 type usr_t;
4584         ')
4585
4586         manage_files_pattern($1, usr_t, usr_t)
4587 ')
4588
4589 ########################################
4590 ## <summary>
4591 ##      Relabel a file to the type used in /usr.
4592 ## </summary>
4593 ## <param name="domain">
4594 ##      <summary>
4595 ##      Domain allowed access.
4596 ##      </summary>
4597 ## </param>
4598 #
4599 interface(`files_relabelto_usr_files',`
4600         gen_require(`
4601                 type usr_t;
4602         ')
4603
4604         relabelto_files_pattern($1, usr_t, usr_t)
4605 ')
4606
4607 ########################################
4608 ## <summary>
4609 ##      Relabel a file from the type used in /usr.
4610 ## </summary>
4611 ## <param name="domain">
4612 ##      <summary>
4613 ##      Domain allowed access.
4614 ##      </summary>
4615 ## </param>
4616 #
4617 interface(`files_relabelfrom_usr_files',`
4618         gen_require(`
4619                 type usr_t;
4620         ')
4621
4622         relabelfrom_files_pattern($1, usr_t, usr_t)
4623 ')
4624
4625 ########################################
4626 ## <summary>
4627 ##      Read symbolic links in /usr.
4628 ## </summary>
4629 ## <param name="domain">
4630 ##      <summary>
4631 ##      Domain allowed access.
4632 ##      </summary>
4633 ## </param>
4634 #
4635 interface(`files_read_usr_symlinks',`
4636         gen_require(`
4637                 type usr_t;
4638         ')
4639
4640         read_lnk_files_pattern($1, usr_t, usr_t)
4641 ')
4642
4643 ########################################
4644 ## <summary>
4645 ##      Create objects in the /usr directory
4646 ## </summary>
4647 ## <param name="domain">
4648 ##      <summary>
4649 ##      Domain allowed access.
4650 ##      </summary>
4651 ## </param>
4652 ## <param name="file_type">
4653 ##      <summary>
4654 ##      The type of the object to be created
4655 ##      </summary>
4656 ## </param>
4657 ## <param name="object_class">
4658 ##      <summary>
4659 ##      The object class.
4660 ##      </summary>
4661 ## </param>
4662 #
4663 interface(`files_usr_filetrans',`
4664         gen_require(`
4665                 type usr_t;
4666         ')
4667
4668         filetrans_pattern($1, usr_t, $2, $3)
4669 ')
4670
4671 ########################################
4672 ## <summary>
4673 ##      Do not audit attempts to search /usr/src.
4674 ## </summary>
4675 ## <param name="domain">
4676 ##      <summary>
4677 ##      Domain to not audit.
4678 ##      </summary>
4679 ## </param>
4680 #
4681 interface(`files_dontaudit_search_src',`
4682         gen_require(`
4683                 type src_t;
4684         ')
4685
4686         dontaudit $1 src_t:dir search_dir_perms;
4687 ')
4688
4689 ########################################
4690 ## <summary>
4691 ##      Get the attributes of files in /usr/src.
4692 ## </summary>
4693 ## <param name="domain">
4694 ##      <summary>
4695 ##      Domain allowed access.
4696 ##      </summary>
4697 ## </param>
4698 #
4699 interface(`files_getattr_usr_src_files',`
4700         gen_require(`
4701                 type usr_t, src_t;
4702         ')
4703
4704         getattr_files_pattern($1, src_t, src_t)
4705
4706         # /usr/src/linux symlink:
4707         read_lnk_files_pattern($1, usr_t, src_t)
4708 ')
4709
4710 ########################################
4711 ## <summary>
4712 ##      Read files in /usr/src.
4713 ## </summary>
4714 ## <param name="domain">
4715 ##      <summary>
4716 ##      Domain allowed access.
4717 ##      </summary>
4718 ## </param>
4719 #
4720 interface(`files_read_usr_src_files',`
4721         gen_require(`
4722                 type usr_t, src_t;
4723         ')
4724
4725         allow $1 usr_t:dir search_dir_perms;
4726         read_files_pattern($1, { usr_t src_t }, src_t)
4727         read_lnk_files_pattern($1, { usr_t src_t }, src_t)
4728         allow $1 src_t:dir list_dir_perms;
4729 ')
4730
4731 ########################################
4732 ## <summary>
4733 ##      Execute programs in /usr/src in the caller domain.
4734 ## </summary>
4735 ## <param name="domain">
4736 ##      <summary>
4737 ##      Domain allowed access.
4738 ##      </summary>
4739 ## </param>
4740 #
4741 interface(`files_exec_usr_src_files',`
4742         gen_require(`
4743                 type usr_t, src_t;
4744         ')
4745
4746         list_dirs_pattern($1, usr_t, src_t)
4747         exec_files_pattern($1, src_t, src_t)
4748         read_lnk_files_pattern($1, src_t, src_t)
4749 ')
4750
4751 ########################################
4752 ## <summary>
4753 ##      Install a system.map into the /boot directory.
4754 ## </summary>
4755 ## <param name="domain">
4756 ##      <summary>
4757 ##      Domain allowed access.
4758 ##      </summary>
4759 ## </param>
4760 #
4761 interface(`files_create_kernel_symbol_table',`
4762         gen_require(`
4763                 type boot_t, system_map_t;
4764         ')
4765
4766         allow $1 boot_t:dir { list_dir_perms add_entry_dir_perms };
4767         allow $1 system_map_t:file { create_file_perms rw_file_perms };
4768 ')
4769
4770 ########################################
4771 ## <summary>
4772 ##      Read system.map in the /boot directory.
4773 ## </summary>
4774 ## <param name="domain">
4775 ##      <summary>
4776 ##      Domain allowed access.
4777 ##      </summary>
4778 ## </param>
4779 #
4780 interface(`files_read_kernel_symbol_table',`
4781         gen_require(`
4782                 type boot_t, system_map_t;
4783         ')
4784
4785         allow $1 boot_t:dir list_dir_perms;
4786         read_files_pattern($1, boot_t, system_map_t)
4787 ')
4788
4789 ########################################
4790 ## <summary>
4791 ##      Delete a system.map in the /boot directory.
4792 ## </summary>
4793 ## <param name="domain">
4794 ##      <summary>
4795 ##      Domain allowed access.
4796 ##      </summary>
4797 ## </param>
4798 #
4799 interface(`files_delete_kernel_symbol_table',`
4800         gen_require(`
4801                 type boot_t, system_map_t;
4802         ')
4803
4804         allow $1 boot_t:dir list_dir_perms;
4805         delete_files_pattern($1, boot_t, system_map_t)
4806 ')
4807
4808 ########################################
4809 ## <summary>
4810 ##      Search the contents of /var.
4811 ## </summary>
4812 ## <param name="domain">
4813 ##      <summary>
4814 ##      Domain allowed access.
4815 ##      </summary>
4816 ## </param>
4817 #
4818 interface(`files_search_var',`
4819         gen_require(`
4820                 type var_t;
4821         ')
4822
4823         allow $1 var_t:dir search_dir_perms;
4824 ')
4825
4826 ########################################
4827 ## <summary>
4828 ##      Do not audit attempts to write to /var.
4829 ## </summary>
4830 ## <param name="domain">
4831 ##      <summary>
4832 ##      Domain to not audit.
4833 ##      </summary>
4834 ## </param>
4835 #
4836 interface(`files_dontaudit_write_var_dirs',`
4837         gen_require(`
4838                 type var_t;
4839         ')
4840
4841         dontaudit $1 var_t:dir write;
4842 ')
4843
4844 ########################################
4845 ## <summary>
4846 ##      Allow attempts to write to /var.dirs
4847 ## </summary>
4848 ## <param name="domain">
4849 ##      <summary>
4850 ##      Domain allowed access.
4851 ##      </summary>
4852 ## </param>
4853 #
4854 interface(`files_write_var_dirs',`
4855         gen_require(`
4856                 type var_t;
4857         ')
4858
4859         allow $1 var_t:dir write;
4860 ')
4861
4862 ########################################
4863 ## <summary>
4864 ##      Do not audit attempts to search
4865 ##      the contents of /var.
4866 ## </summary>
4867 ## <param name="domain">
4868 ##      <summary>
4869 ##      Domain to not audit.
4870 ##      </summary>
4871 ## </param>
4872 #
4873 interface(`files_dontaudit_search_var',`
4874         gen_require(`
4875                 type var_t;
4876         ')
4877
4878         dontaudit $1 var_t:dir search_dir_perms;
4879 ')
4880
4881 ########################################
4882 ## <summary>
4883 ##      List the contents of /var.
4884 ## </summary>
4885 ## <param name="domain">
4886 ##      <summary>
4887 ##      Domain allowed access.
4888 ##      </summary>
4889 ## </param>
4890 #
4891 interface(`files_list_var',`
4892         gen_require(`
4893                 type var_t;
4894         ')
4895
4896         allow $1 var_t:dir list_dir_perms;
4897 ')
4898
4899 ########################################
4900 ## <summary>
4901 ##      Create, read, write, and delete directories
4902 ##      in the /var directory.
4903 ## </summary>
4904 ## <param name="domain">
4905 ##      <summary>
4906 ##      Domain allowed access.
4907 ##      </summary>
4908 ## </param>
4909 #
4910 interface(`files_manage_var_dirs',`
4911         gen_require(`
4912                 type var_t;
4913         ')
4914
4915         allow $1 var_t:dir manage_dir_perms;
4916 ')
4917
4918 ########################################
4919 ## <summary>
4920 ##      Read files in the /var directory.
4921 ## </summary>
4922 ## <param name="domain">
4923 ##      <summary>
4924 ##      Domain allowed access.
4925 ##      </summary>
4926 ## </param>
4927 #
4928 interface(`files_read_var_files',`
4929         gen_require(`
4930                 type var_t;
4931         ')
4932
4933         read_files_pattern($1, var_t, var_t)
4934 ')
4935
4936 ########################################
4937 ## <summary>
4938 ##      Append files in the /var directory.
4939 ## </summary>
4940 ## <param name="domain">
4941 ##      <summary>
4942 ##      Domain allowed access.
4943 ##      </summary>
4944 ## </param>
4945 #
4946 interface(`files_append_var_files',`
4947         gen_require(`
4948                 type var_t;
4949         ')
4950
4951         append_files_pattern($1, var_t, var_t)
4952 ')
4953
4954 ########################################
4955 ## <summary>
4956 ##      Read and write files in the /var directory.
4957 ## </summary>
4958 ## <param name="domain">
4959 ##      <summary>
4960 ##      Domain allowed access.
4961 ##      </summary>
4962 ## </param>
4963 #
4964 interface(`files_rw_var_files',`
4965         gen_require(`
4966                 type var_t;
4967         ')
4968
4969         rw_files_pattern($1, var_t, var_t)
4970 ')
4971
4972 ########################################
4973 ## <summary>
4974 ##      Do not audit attempts to read and write
4975 ##      files in the /var directory.
4976 ## </summary>
4977 ## <param name="domain">
4978 ##      <summary>
4979 ##      Domain to not audit.
4980 ##      </summary>
4981 ## </param>
4982 #
4983 interface(`files_dontaudit_rw_var_files',`
4984         gen_require(`
4985                 type var_t;
4986         ')
4987
4988         dontaudit $1 var_t:file rw_file_perms;
4989 ')
4990
4991 ########################################
4992 ## <summary>
4993 ##      Create, read, write, and delete files in the /var directory.
4994 ## </summary>
4995 ## <param name="domain">
4996 ##      <summary>
4997 ##      Domain allowed access.
4998 ##      </summary>
4999 ## </param>
5000 #
5001 interface(`files_manage_var_files',`
5002         gen_require(`
5003                 type var_t;
5004         ')
5005
5006         manage_files_pattern($1, var_t, var_t)
5007 ')
5008
5009 ########################################
5010 ## <summary>
5011 ##      Read symbolic links in the /var directory.
5012 ## </summary>
5013 ## <param name="domain">
5014 ##      <summary>
5015 ##      Domain allowed access.
5016 ##      </summary>
5017 ## </param>
5018 #
5019 interface(`files_read_var_symlinks',`
5020         gen_require(`
5021                 type var_t;
5022         ')
5023
5024         read_lnk_files_pattern($1, var_t, var_t)
5025 ')
5026
5027 ########################################
5028 ## <summary>
5029 ##      Create, read, write, and delete symbolic
5030 ##      links in the /var directory.
5031 ## </summary>
5032 ## <param name="domain">
5033 ##      <summary>
5034 ##      Domain allowed access.
5035 ##      </summary>
5036 ## </param>
5037 #
5038 interface(`files_manage_var_symlinks',`
5039         gen_require(`
5040                 type var_t;
5041         ')
5042
5043         manage_lnk_files_pattern($1, var_t, var_t)
5044 ')
5045
5046 ########################################
5047 ## <summary>
5048 ##      Create objects in the /var directory
5049 ## </summary>
5050 ## <param name="domain">
5051 ##      <summary>
5052 ##      Domain allowed access.
5053 ##      </summary>
5054 ## </param>
5055 ## <param name="file_type">
5056 ##      <summary>
5057 ##      The type of the object to be created
5058 ##      </summary>
5059 ## </param>
5060 ## <param name="object_class">
5061 ##      <summary>
5062 ##      The object class.
5063 ##      </summary>
5064 ## </param>
5065 #
5066 interface(`files_var_filetrans',`
5067         gen_require(`
5068                 type var_t;
5069         ')
5070
5071         filetrans_pattern($1, var_t, $2, $3)
5072 ')
5073
5074 ########################################
5075 ## <summary>
5076 ##      Get the attributes of the /var/lib directory.
5077 ## </summary>
5078 ## <param name="domain">
5079 ##      <summary>
5080 ##      Domain allowed access.
5081 ##      </summary>
5082 ## </param>
5083 #
5084 interface(`files_getattr_var_lib_dirs',`
5085         gen_require(`
5086                 type var_t, var_lib_t;
5087         ')
5088
5089         getattr_dirs_pattern($1, var_t, var_lib_t)
5090 ')
5091
5092 ########################################
5093 ## <summary>
5094 ##      Search the /var/lib directory.
5095 ## </summary>
5096 ## <desc>
5097 ##      <p>
5098 ##      Search the /var/lib directory.  This is
5099 ##      necessary to access files or directories under
5100 ##      /var/lib that have a private type.  For example, a
5101 ##      domain accessing a private library file in the
5102 ##      /var/lib directory:
5103 ##      </p>
5104 ##      <p>
5105 ##      allow mydomain_t mylibfile_t:file read_file_perms;
5106 ##      files_search_var_lib(mydomain_t)
5107 ##      </p>
5108 ## </desc>
5109 ## <param name="domain">
5110 ##      <summary>
5111 ##      Domain allowed access.
5112 ##      </summary>
5113 ## </param>
5114 ## <infoflow type="read" weight="5"/>
5115 #
5116 interface(`files_search_var_lib',`
5117         gen_require(`
5118                 type var_t, var_lib_t;
5119         ')
5120
5121         search_dirs_pattern($1, var_t, var_lib_t)
5122 ')
5123
5124 ########################################
5125 ## <summary>
5126 ##      Do not audit attempts to search the
5127 ##      contents of /var/lib.
5128 ## </summary>
5129 ## <param name="domain">
5130 ##      <summary>
5131 ##      Domain to not audit.
5132 ##      </summary>
5133 ## </param>
5134 ## <infoflow type="read" weight="5"/>
5135 #
5136 interface(`files_dontaudit_search_var_lib',`
5137         gen_require(`
5138                 type var_lib_t;
5139         ')
5140
5141         dontaudit $1 var_lib_t:dir search_dir_perms;
5142 ')
5143
5144 ########################################
5145 ## <summary>
5146 ##      List the contents of the /var/lib directory.
5147 ## </summary>
5148 ## <param name="domain">
5149 ##      <summary>
5150 ##      Domain allowed access.
5151 ##      </summary>
5152 ## </param>
5153 #
5154 interface(`files_list_var_lib',`
5155         gen_require(`
5156                 type var_t, var_lib_t;
5157         ')
5158
5159         list_dirs_pattern($1, var_t, var_lib_t)
5160 ')
5161
5162 ###########################################
5163 ## <summary>
5164 ##      Read-write /var/lib directories
5165 ## </summary>
5166 ## <param name="domain">
5167 ##      <summary>
5168 ##      Domain allowed access.
5169 ##      </summary>
5170 ## </param>
5171 #
5172 interface(`files_rw_var_lib_dirs',`
5173         gen_require(`
5174                 type var_lib_t;
5175         ')
5176
5177         rw_dirs_pattern($1, var_lib_t, var_lib_t)
5178 ')
5179
5180 ########################################
5181 ## <summary>
5182 ##      Create objects in the /var/lib directory
5183 ## </summary>
5184 ## <param name="domain">
5185 ##      <summary>
5186 ##      Domain allowed access.
5187 ##      </summary>
5188 ## </param>
5189 ## <param name="file_type">
5190 ##      <summary>
5191 ##      The type of the object to be created
5192 ##      </summary>
5193 ## </param>
5194 ## <param name="object_class">
5195 ##      <summary>
5196 ##      The object class.
5197 ##      </summary>
5198 ## </param>
5199 #
5200 interface(`files_var_lib_filetrans',`
5201         gen_require(`
5202                 type var_t, var_lib_t;
5203         ')
5204
5205         allow $1 var_t:dir search_dir_perms;
5206         filetrans_pattern($1, var_lib_t, $2, $3)
5207 ')
5208
5209 ########################################
5210 ## <summary>
5211 ##      Read generic files in /var/lib.
5212 ## </summary>
5213 ## <param name="domain">
5214 ##      <summary>
5215 ##      Domain allowed access.
5216 ##      </summary>
5217 ## </param>
5218 #
5219 interface(`files_read_var_lib_files',`
5220         gen_require(`
5221                 type var_t, var_lib_t;
5222         ')
5223
5224         allow $1 var_lib_t:dir list_dir_perms;
5225         read_files_pattern($1, { var_t var_lib_t }, var_lib_t)
5226 ')
5227
5228 ########################################
5229 ## <summary>
5230 ##      Read generic symbolic links in /var/lib
5231 ## </summary>
5232 ## <param name="domain">
5233 ##      <summary>
5234 ##      Domain allowed access.
5235 ##      </summary>
5236 ## </param>
5237 #
5238 interface(`files_read_var_lib_symlinks',`
5239         gen_require(`
5240                 type var_t, var_lib_t;
5241         ')
5242
5243         read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
5244 ')
5245
5246 # cjp: the next two interfaces really need to be fixed
5247 # in some way.  They really neeed their own types.
5248
5249 ########################################
5250 ## <summary>
5251 ##      Create, read, write, and delete the
5252 ##      pseudorandom number generator seed.
5253 ## </summary>
5254 ## <param name="domain">
5255 ##      <summary>
5256 ##      Domain allowed access.
5257 ##      </summary>
5258 ## </param>
5259 #
5260 interface(`files_manage_urandom_seed',`
5261         gen_require(`
5262                 type var_t, var_lib_t;
5263         ')
5264
5265         allow $1 var_t:dir search_dir_perms;
5266         manage_files_pattern($1, var_lib_t, var_lib_t)
5267 ')
5268
5269 ########################################
5270 ## <summary>
5271 ##      Allow domain to manage mount tables
5272 ##      necessary for rpcd, nfsd, etc.
5273 ## </summary>
5274 ## <param name="domain">
5275 ##      <summary>
5276 ##      Domain allowed access.
5277 ##      </summary>
5278 ## </param>
5279 #
5280 interface(`files_manage_mounttab',`
5281         gen_require(`
5282                 type var_t, var_lib_t;
5283         ')
5284
5285         allow $1 var_t:dir search_dir_perms;
5286         manage_files_pattern($1, var_lib_t, var_lib_t)
5287 ')
5288
5289 ########################################
5290 ## <summary>
5291 ##      Search the locks directory (/var/lock).
5292 ## </summary>
5293 ## <param name="domain">
5294 ##      <summary>
5295 ##      Domain allowed access.
5296 ##      </summary>
5297 ## </param>
5298 #
5299 interface(`files_search_locks',`
5300         gen_require(`
5301                 type var_t, var_lock_t;
5302         ')
5303
5304         search_dirs_pattern($1, var_t, var_lock_t)
5305 ')
5306
5307 ########################################
5308 ## <summary>
5309 ##      Do not audit attempts to search the
5310 ##      locks directory (/var/lock).
5311 ## </summary>
5312 ## <param name="domain">
5313 ##      <summary>
5314 ##      Domain to not audit.
5315 ##      </summary>
5316 ## </param>
5317 #
5318 interface(`files_dontaudit_search_locks',`
5319         gen_require(`
5320                 type var_lock_t;
5321         ')
5322
5323         dontaudit $1 var_lock_t:dir search_dir_perms;
5324 ')
5325
5326 ########################################
5327 ## <summary>
5328 ##      Add and remove entries in the /var/lock
5329 ##      directories.
5330 ## </summary>
5331 ## <param name="domain">
5332 ##      <summary>
5333 ##      Domain allowed access.
5334 ##      </summary>
5335 ## </param>
5336 #
5337 interface(`files_rw_lock_dirs',`
5338         gen_require(`
5339                 type var_t, var_lock_t;
5340         ')
5341
5342         rw_dirs_pattern($1, var_t, var_lock_t)
5343 ')
5344
5345 ########################################
5346 ## <summary>
5347 ##      Get the attributes of generic lock files.
5348 ## </summary>
5349 ## <param name="domain">
5350 ##      <summary>
5351 ##      Domain allowed access.
5352 ##      </summary>
5353 ## </param>
5354 #
5355 interface(`files_getattr_generic_locks',`
5356         gen_require(`
5357                 type var_t, var_lock_t;
5358         ')
5359
5360         allow $1 var_t:dir search_dir_perms;
5361         allow $1 var_lock_t:dir list_dir_perms;
5362         getattr_files_pattern($1, var_lock_t, var_lock_t)
5363 ')
5364
5365 ########################################
5366 ## <summary>
5367 ##      Delete generic lock files.
5368 ## </summary>
5369 ## <param name="domain">
5370 ##      <summary>
5371 ##      Domain allowed access.
5372 ##      </summary>
5373 ## </param>
5374 #
5375 interface(`files_delete_generic_locks',`
5376        gen_require(`
5377                type var_t, var_lock_t;
5378        ')
5379
5380        allow $1 var_t:dir search_dir_perms;
5381        delete_files_pattern($1, var_lock_t, var_lock_t)
5382 ')
5383
5384 ########################################
5385 ## <summary>
5386 ##      Create, read, write, and delete generic
5387 ##      lock files.
5388 ## </summary>
5389 ## <param name="domain">
5390 ##      <summary>
5391 ##      Domain allowed access.
5392 ##      </summary>
5393 ## </param>
5394 #
5395 interface(`files_manage_generic_locks',`
5396         gen_require(`
5397                 type var_t, var_lock_t;
5398         ')
5399
5400         allow $1 var_t:dir search_dir_perms;
5401         manage_files_pattern($1, var_lock_t, var_lock_t)
5402 ')
5403
5404 ########################################
5405 ## <summary>
5406 ##      Delete all lock files.
5407 ## </summary>
5408 ## <param name="domain">
5409 ##      <summary>
5410 ##      Domain allowed access.
5411 ##      </summary>
5412 ## </param>
5413 ## <rolecap/>
5414 #
5415 interface(`files_delete_all_locks',`
5416         gen_require(`
5417                 attribute lockfile;
5418                 type var_t;
5419         ')
5420
5421         allow $1 var_t:dir search_dir_perms;
5422         delete_files_pattern($1, lockfile, lockfile)
5423 ')
5424
5425 ########################################
5426 ## <summary>
5427 ##      Read all lock files.
5428 ## </summary>
5429 ## <param name="domain">
5430 ##      <summary>
5431 ##      Domain allowed access.
5432 ##      </summary>
5433 ## </param>
5434 #
5435 interface(`files_read_all_locks',`
5436         gen_require(`
5437                 attribute lockfile;
5438                 type var_t, var_lock_t;
5439         ')
5440
5441         allow $1 { var_t var_lock_t }:dir search_dir_perms;
5442         allow $1 lockfile:dir list_dir_perms;
5443         read_files_pattern($1, lockfile, lockfile)
5444         read_lnk_files_pattern($1, lockfile, lockfile)
5445 ')
5446
5447 ########################################
5448 ## <summary>
5449 ##      manage all lock files.
5450 ## </summary>
5451 ## <param name="domain">
5452 ##      <summary>
5453 ##      Domain allowed access.
5454 ##      </summary>
5455 ## </param>
5456 #
5457 interface(`files_manage_all_locks',`
5458         gen_require(`
5459                 attribute lockfile;
5460                 type var_t, var_lock_t;
5461         ')
5462
5463         allow $1 { var_t var_lock_t }:dir search_dir_perms;
5464         manage_dirs_pattern($1, lockfile, lockfile)
5465         manage_files_pattern($1, lockfile, lockfile)
5466         manage_lnk_files_pattern($1, lockfile, lockfile)
5467 ')
5468
5469 ########################################
5470 ## <summary>
5471 ##      Create an object in the locks directory, with a private
5472 ##      type using a type transition.
5473 ## </summary>
5474 ## <param name="domain">
5475 ##      <summary>
5476 ##      Domain allowed access.
5477 ##      </summary>
5478 ## </param>
5479 ## <param name="private type">
5480 ##      <summary>
5481 ##      The type of the object to be created.
5482 ##      </summary>
5483 ## </param>
5484 ## <param name="object">
5485 ##      <summary>
5486 ##      The object class of the object being created.
5487 ##      </summary>
5488 ## </param>
5489 #
5490 interface(`files_lock_filetrans',`
5491         gen_require(`
5492                 type var_t, var_lock_t;
5493         ')
5494
5495         allow $1 var_t:dir search_dir_perms;
5496         filetrans_pattern($1, var_lock_t, $2, $3)
5497 ')
5498
5499 ########################################
5500 ## <summary>
5501 ##      Do not audit attempts to get the attributes
5502 ##      of the /var/run directory.
5503 ## </summary>
5504 ## <param name="domain">
5505 ##      <summary>
5506 ##      Domain to not audit.
5507 ##      </summary>
5508 ## </param>
5509 #
5510 interface(`files_dontaudit_getattr_pid_dirs',`
5511         gen_require(`
5512                 type var_run_t;
5513         ')
5514
5515         dontaudit $1 var_run_t:dir getattr;
5516 ')
5517
5518 ########################################
5519 ## <summary>
5520 ##      Set the attributes of the /var/run directory.
5521 ## </summary>
5522 ## <param name="domain">
5523 ##      <summary>
5524 ##      Domain allowed access.
5525 ##      </summary>
5526 ## </param>
5527 #
5528 interface(`files_setattr_pid_dirs',`
5529         gen_require(`
5530                 type var_run_t;
5531         ')
5532
5533         allow $1 var_run_t:dir setattr;
5534 ')
5535
5536 ########################################
5537 ## <summary>
5538 ##      Search the contents of runtime process
5539 ##      ID directories (/var/run).
5540 ## </summary>
5541 ## <param name="domain">
5542 ##      <summary>
5543 ##      Domain allowed access.
5544 ##      </summary>
5545 ## </param>
5546 #
5547 interface(`files_search_pids',`
5548         gen_require(`
5549                 type var_t, var_run_t;
5550         ')
5551
5552         search_dirs_pattern($1, var_t, var_run_t)
5553 ')
5554
5555 ######################################
5556 ## <summary>
5557 ## Add and remove entries from pid directories.
5558 ## </summary>
5559 ## <param name="domain">
5560 ## <summary>
5561 ## Domain allowed access.
5562 ## </summary>
5563 ## </param>
5564 #
5565 interface(`files_rw_pid_dirs',`
5566     gen_require(`
5567         type var_run_t;
5568     ')
5569
5570     allow $1 var_run_t:dir rw_dir_perms;
5571 ')
5572
5573 #######################################
5574 ## <summary>
5575 ##      Create generic pid directory.
5576 ## </summary>
5577 ## <param name="domain">
5578 ##      <summary>
5579 ##      Domain allowed access.
5580 ##      </summary>
5581 ## </param>
5582 #
5583 interface(`files_create_var_run_dirs',`
5584         gen_require(`
5585                 type var_t, var_run_t;
5586         ')
5587
5588         allow $1 var_t:dir search_dir_perms;
5589         allow $1 var_run_t:dir create_dir_perms;
5590 ')
5591
5592 ########################################
5593 ## <summary>
5594 ##      Do not audit attempts to search
5595 ##      the /var/run directory.
5596 ## </summary>
5597 ## <param name="domain">
5598 ##      <summary>
5599 ##      Domain to not audit.
5600 ##      </summary>
5601 ## </param>
5602 #
5603 interface(`files_dontaudit_search_pids',`
5604         gen_require(`
5605                 type var_run_t;
5606         ')
5607
5608         dontaudit $1 var_run_t:dir search_dir_perms;
5609 ')
5610
5611 ########################################
5612 ## <summary>
5613 ##      List the contents of the runtime process
5614 ##      ID directories (/var/run).
5615 ## </summary>
5616 ## <param name="domain">
5617 ##      <summary>
5618 ##      Domain allowed access.
5619 ##      </summary>
5620 ## </param>
5621 #
5622 interface(`files_list_pids',`
5623         gen_require(`
5624                 type var_t, var_run_t;
5625         ')
5626
5627         list_dirs_pattern($1, var_t, var_run_t)
5628 ')
5629
5630 ########################################
5631 ## <summary>
5632 ##      Read generic process ID files.
5633 ## </summary>
5634 ## <param name="domain">
5635 ##      <summary>
5636 ##      Domain allowed access.
5637 ##      </summary>
5638 ## </param>
5639 #
5640 interface(`files_read_generic_pids',`
5641         gen_require(`
5642                 type var_t, var_run_t;
5643         ')
5644
5645         list_dirs_pattern($1, var_t, var_run_t)
5646         read_files_pattern($1, var_run_t, var_run_t)
5647 ')
5648
5649 ########################################
5650 ## <summary>
5651 ##      Write named generic process ID pipes
5652 ## </summary>
5653 ## <param name="domain">
5654 ##      <summary>
5655 ##      Domain allowed access.
5656 ##      </summary>
5657 ## </param>
5658 #
5659 interface(`files_write_generic_pid_pipes',`
5660         gen_require(`
5661                 type var_run_t;
5662         ')
5663
5664         allow $1 var_run_t:fifo_file write;
5665 ')
5666
5667 ########################################
5668 ## <summary>
5669 ##      Create an object in the process ID directory, with a private type.
5670 ## </summary>
5671 ## <desc>
5672 ##      <p>
5673 ##      Create an object in the process ID directory (e.g., /var/run)
5674 ##      with a private type.  Typically this is used for creating
5675 ##      private PID files in /var/run with the private type instead
5676 ##      of the general PID file type. To accomplish this goal,
5677 ##      either the program must be SELinux-aware, or use this interface.
5678 ##      </p>
5679 ##      <p>
5680 ##      Related interfaces:
5681 ##      </p>
5682 ##      <ul>
5683 ##              <li>files_pid_file()</li>
5684 ##      </ul>
5685 ##      <p>
5686 ##      Example usage with a domain that can create and
5687 ##      write its PID file with a private PID file type in the
5688 ##      /var/run directory:
5689 ##      </p>
5690 ##      <p>
5691 ##      type mypidfile_t;
5692 ##      files_pid_file(mypidfile_t)
5693 ##      allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms };
5694 ##      files_pid_filetrans(mydomain_t, mypidfile_t, file)
5695 ##      </p>
5696 ## </desc>
5697 ## <param name="domain">
5698 ##      <summary>
5699 ##      Domain allowed access.
5700 ##      </summary>
5701 ## </param>
5702 ## <param name="private type">
5703 ##      <summary>
5704 ##      The type of the object to be created.
5705 ##      </summary>
5706 ## </param>
5707 ## <param name="object">
5708 ##      <summary>
5709 ##      The object class of the object being created.
5710 ##      </summary>
5711 ## </param>
5712 ## <infoflow type="write" weight="10"/>
5713 #
5714 interface(`files_pid_filetrans',`
5715         gen_require(`
5716                 type var_t, var_run_t;
5717         ')
5718
5719         allow $1 var_t:dir search_dir_perms;
5720         filetrans_pattern($1, var_run_t, $2, $3)
5721 ')
5722
5723 ########################################
5724 ## <summary>
5725 ##      Read and write generic process ID files.
5726 ## </summary>
5727 ## <param name="domain">
5728 ##      <summary>
5729 ##      Domain allowed access.
5730 ##      </summary>
5731 ## </param>
5732 #
5733 interface(`files_rw_generic_pids',`
5734         gen_require(`
5735                 type var_t, var_run_t;
5736         ')
5737
5738         list_dirs_pattern($1, var_t, var_run_t)
5739         rw_files_pattern($1, var_run_t, var_run_t)
5740 ')
5741
5742 ########################################
5743 ## <summary>
5744 ##      Do not audit attempts to get the attributes of
5745 ##      daemon runtime data files.
5746 ## </summary>
5747 ## <param name="domain">
5748 ##      <summary>
5749 ##      Domain to not audit.
5750 ##      </summary>
5751 ## </param>
5752 #
5753 interface(`files_dontaudit_getattr_all_pids',`
5754         gen_require(`
5755                 attribute pidfile;
5756         ')
5757
5758         dontaudit $1 pidfile:file getattr;
5759 ')
5760
5761 ########################################
5762 ## <summary>
5763 ##      Do not audit attempts to write to daemon runtime data files.
5764 ## </summary>
5765 ## <param name="domain">
5766 ##      <summary>
5767 ##      Domain to not audit.
5768 ##      </summary>
5769 ## </param>
5770 #
5771 interface(`files_dontaudit_write_all_pids',`
5772         gen_require(`
5773                 attribute pidfile;
5774         ')
5775
5776         dontaudit $1 pidfile:file write;
5777 ')
5778
5779 ########################################
5780 ## <summary>
5781 ##      Do not audit attempts to ioctl daemon runtime data files.
5782 ## </summary>
5783 ## <param name="domain">
5784 ##      <summary>
5785 ##      Domain to not audit.
5786 ##      </summary>
5787 ## </param>
5788 #
5789 interface(`files_dontaudit_ioctl_all_pids',`
5790         gen_require(`
5791                 attribute pidfile;
5792         ')
5793
5794         dontaudit $1 pidfile:file ioctl;
5795 ')
5796
5797 ########################################
5798 ## <summary>
5799 ##      manage all pidfile directories
5800 ##      in the /var/run directory.
5801 ## </summary>
5802 ## <param name="domain">
5803 ##      <summary>
5804 ##      Domain allowed access.
5805 ##      </summary>
5806 ## </param>
5807 #
5808 interface(`files_manage_all_pids_dirs',`
5809         gen_require(`
5810                 attribute pidfile;
5811         ')
5812
5813         manage_dirs_pattern($1,pidfile,pidfile)
5814 ')
5815
5816
5817 ########################################
5818 ## <summary>
5819 ##      Read all process ID files.
5820 ## </summary>
5821 ## <param name="domain">
5822 ##      <summary>
5823 ##      Domain allowed access.
5824 ##      </summary>
5825 ## </param>
5826 ## <rolecap/>
5827 #
5828 interface(`files_read_all_pids',`
5829         gen_require(`
5830                 attribute pidfile;
5831                 type var_t;
5832         ')
5833
5834         list_dirs_pattern($1, var_t, pidfile)
5835         read_files_pattern($1, pidfile, pidfile)
5836         read_lnk_files_pattern($1, pidfile, pidfile)
5837 ')
5838
5839 ########################################
5840 ## <summary>
5841 ##      Mount filesystems on all polyinstantiation
5842 ##      member directories.
5843 ## </summary>
5844 ## <param name="domain">
5845 ##      <summary>
5846 ##      Domain allowed access.
5847 ##      </summary>
5848 ## </param>
5849 #
5850 interface(`files_mounton_all_poly_members',`
5851         gen_require(`
5852                 attribute polymember;
5853         ')
5854
5855         allow $1 polymember:dir mounton;
5856 ')
5857
5858 ########################################
5859 ## <summary>
5860 ##      Delete all process IDs.
5861 ## </summary>
5862 ## <param name="domain">
5863 ##      <summary>
5864 ##      Domain allowed access.
5865 ##      </summary>
5866 ## </param>
5867 ## <rolecap/>
5868 #
5869 interface(`files_delete_all_pids',`
5870         gen_require(`
5871                 attribute pidfile;
5872                 type var_t, var_run_t;
5873         ')
5874
5875         allow $1 var_t:dir search_dir_perms;
5876         allow $1 var_run_t:dir rmdir;
5877         allow $1 var_run_t:lnk_file delete_lnk_file_perms;
5878         delete_files_pattern($1, pidfile, pidfile)
5879         delete_fifo_files_pattern($1, pidfile, pidfile)
5880         delete_sock_files_pattern($1, pidfile, { pidfile var_run_t })
5881 ')
5882
5883 ########################################
5884 ## <summary>
5885 ##      Delete all process ID directories.
5886 ## </summary>
5887 ## <param name="domain">
5888 ##      <summary>
5889 ##      Domain allowed access.
5890 ##      </summary>
5891 ## </param>
5892 #
5893 interface(`files_delete_all_pid_dirs',`
5894         gen_require(`
5895                 attribute pidfile;
5896                 type var_t;
5897         ')
5898
5899         allow $1 var_t:dir search_dir_perms;
5900         delete_dirs_pattern($1, pidfile, pidfile)
5901 ')
5902
5903 ########################################
5904 ## <summary>
5905 ##      Search the contents of generic spool
5906 ##      directories (/var/spool).
5907 ## </summary>
5908 ## <param name="domain">
5909 ##      <summary>
5910 ##      Domain allowed access.
5911 ##      </summary>
5912 ## </param>
5913 #
5914 interface(`files_search_spool',`
5915         gen_require(`
5916                 type var_t, var_spool_t;
5917         ')
5918
5919         search_dirs_pattern($1, var_t, var_spool_t)
5920 ')
5921
5922 ########################################
5923 ## <summary>
5924 ##      Do not audit attempts to search generic
5925 ##      spool directories.
5926 ## </summary>
5927 ## <param name="domain">
5928 ##      <summary>
5929 ##      Domain to not audit.
5930 ##      </summary>
5931 ## </param>
5932 #
5933 interface(`files_dontaudit_search_spool',`
5934         gen_require(`
5935                 type var_spool_t;
5936         ')
5937
5938         dontaudit $1 var_spool_t:dir search_dir_perms;
5939 ')
5940
5941 ########################################
5942 ## <summary>
5943 ##      List the contents of generic spool
5944 ##      (/var/spool) directories.
5945 ## </summary>
5946 ## <param name="domain">
5947 ##      <summary>
5948 ##      Domain allowed access.
5949 ##      </summary>
5950 ## </param>
5951 #
5952 interface(`files_list_spool',`
5953         gen_require(`
5954                 type var_t, var_spool_t;
5955         ')
5956
5957         list_dirs_pattern($1, var_t, var_spool_t)
5958 ')
5959
5960 ########################################
5961 ## <summary>
5962 ##      Create, read, write, and delete generic
5963 ##      spool directories (/var/spool).
5964 ## </summary>
5965 ## <param name="domain">
5966 ##      <summary>
5967 ##      Domain allowed access.
5968 ##      </summary>
5969 ## </param>
5970 #
5971 interface(`files_manage_generic_spool_dirs',`
5972         gen_require(`
5973                 type var_t, var_spool_t;
5974         ')
5975
5976         allow $1 var_t:dir search_dir_perms;
5977         manage_dirs_pattern($1, var_spool_t, var_spool_t)
5978 ')
5979
5980 ########################################
5981 ## <summary>
5982 ##      Read generic spool files.
5983 ## </summary>
5984 ## <param name="domain">
5985 ##      <summary>
5986 ##      Domain allowed access.
5987 ##      </summary>
5988 ## </param>
5989 #
5990 interface(`files_read_generic_spool',`
5991         gen_require(`
5992                 type var_t, var_spool_t;
5993         ')
5994
5995         list_dirs_pattern($1, var_t, var_spool_t)
5996         read_files_pattern($1, var_spool_t, var_spool_t)
5997 ')
5998
5999 ########################################
6000 ## <summary>
6001 ##      Create, read, write, and delete generic
6002 ##      spool files.
6003 ## </summary>
6004 ## <param name="domain">
6005 ##      <summary>
6006 ##      Domain allowed access.
6007 ##      </summary>
6008 ## </param>
6009 #
6010 interface(`files_manage_generic_spool',`
6011         gen_require(`
6012                 type var_t, var_spool_t;
6013         ')
6014
6015         allow $1 var_t:dir search_dir_perms;
6016         manage_files_pattern($1, var_spool_t, var_spool_t)
6017 ')
6018
6019 ########################################
6020 ## <summary>
6021 ##      Create objects in the spool directory
6022 ##      with a private type with a type transition.
6023 ## </summary>
6024 ## <param name="domain">
6025 ##      <summary>
6026 ##      Domain allowed access.
6027 ##      </summary>
6028 ## </param>
6029 ## <param name="file">
6030 ##      <summary>
6031 ##      Type to which the created node will be transitioned.
6032 ##      </summary>
6033 ## </param>
6034 ## <param name="class">
6035 ##      <summary>
6036 ##      Object class(es) (single or set including {}) for which this
6037 ##      the transition will occur.
6038 ##      </summary>
6039 ## </param>
6040 #
6041 interface(`files_spool_filetrans',`
6042         gen_require(`
6043                 type var_t, var_spool_t;
6044         ')
6045
6046         allow $1 var_t:dir search_dir_perms;
6047         filetrans_pattern($1, var_spool_t, $2, $3)
6048 ')
6049
6050 ########################################
6051 ## <summary>
6052 ##      Allow access to manage all polyinstantiated
6053 ##      directories on the system.
6054 ## </summary>
6055 ## <param name="domain">
6056 ##      <summary>
6057 ##      Domain allowed access.
6058 ##      </summary>
6059 ## </param>
6060 #
6061 interface(`files_polyinstantiate_all',`
6062         gen_require(`
6063                 attribute polydir, polymember, polyparent;
6064                 type poly_t;
6065         ')
6066
6067         # Need to give access to /selinux/member
6068         selinux_compute_member($1)
6069
6070         # Need sys_admin capability for mounting
6071         allow $1 self:capability { chown fsetid sys_admin fowner };
6072
6073         # Need to give access to the directories to be polyinstantiated
6074         allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
6075
6076         # Need to give access to the polyinstantiated subdirectories
6077         allow $1 polymember:dir search_dir_perms;
6078
6079         # Need to give access to parent directories where original
6080         # is remounted for polyinstantiation aware programs (like gdm)
6081         allow $1 polyparent:dir { getattr mounton };
6082
6083         # Need to give permission to create directories where applicable
6084         allow $1 self:process setfscreate;
6085         allow $1 polymember: dir { create setattr relabelto };
6086         allow $1 polydir: dir { write add_name open };
6087         allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto };
6088
6089         # Default type for mountpoints
6090         allow $1 poly_t:dir { create mounton };
6091         fs_unmount_xattr_fs($1)
6092
6093         fs_mount_tmpfs($1)
6094         fs_unmount_tmpfs($1)
6095
6096         ifdef(`distro_redhat',`
6097                 # namespace.init
6098                 files_search_tmp($1)
6099                 files_search_home($1)
6100                 corecmd_exec_bin($1)
6101                 seutil_domtrans_setfiles($1)
6102         ')
6103 ')
6104
6105 ########################################
6106 ## <summary>
6107 ##      Unconfined access to files.
6108 ## </summary>
6109 ## <param name="domain">
6110 ##      <summary>
6111 ##      Domain allowed access.
6112 ##      </summary>
6113 ## </param>
6114 #
6115 interface(`files_unconfined',`
6116         gen_require(`
6117                 attribute files_unconfined_type;
6118         ')
6119
6120         typeattribute $1 files_unconfined_type;
6121 ')
6122
6123 ########################################
6124 ## <summary>
6125 ##      Create a core files in /
6126 ## </summary>
6127 ## <desc>
6128 ##      <p>
6129 ##      Create a core file in /,
6130 ##      </p>
6131 ## </desc>
6132 ## <param name="domain">
6133 ##      <summary>
6134 ##      Domain allowed access.
6135 ##      </summary>
6136 ## </param>
6137 ## <rolecap/>
6138 #
6139 interface(`files_manage_root_files',`
6140         gen_require(`
6141                 type root_t;
6142         ')
6143
6144         manage_files_pattern($1, root_t, root_t)
6145 ')
6146
6147 ########################################
6148 ## <summary>
6149 ##     Create a default directory
6150 ## </summary>
6151 ## <desc>
6152 ##     <p>
6153 ##     Create a default_t direcrory
6154 ##     </p>
6155 ## </desc>
6156 ## <param name="domain">
6157 ##     <summary>
6158 ##     Domain allowed access.
6159 ##     </summary>
6160 ## </param>
6161 ## <rolecap/>
6162 #
6163 interface(`files_create_default_dir',`
6164        gen_require(`
6165                type default_t;
6166        ')
6167
6168        allow $1 default_t:dir create;
6169 ')
6170
6171 ########################################
6172 ## <summary>
6173 ##      Create, default_t objects with an automatic
6174 ##      type transition.
6175 ## </summary>
6176 ## <param name="domain">
6177 ##      <summary>
6178 ##      Domain allowed access.
6179 ##      </summary>
6180 ## </param>
6181 ## <param name="object">
6182 ##      <summary>
6183 ##      The class of the object being created.
6184 ##      </summary>
6185 ## </param>
6186 #
6187 interface(`files_root_filetrans_default',`
6188        gen_require(`
6189                type root_t, default_t;
6190        ')
6191
6192        filetrans_pattern($1, root_t, default_t, $2)
6193 ')
6194
6195 ########################################
6196 ## <summary>
6197 ##      manage generic symbolic links
6198 ##      in the /var/run directory.
6199 ## </summary>
6200 ## <param name="domain">
6201 ##      <summary>
6202 ##      Domain allowed access.
6203 ##      </summary>
6204 ## </param>
6205 #
6206 interface(`files_manage_generic_pids_symlinks',`
6207         gen_require(`
6208                 type var_run_t;
6209         ')
6210
6211         manage_lnk_files_pattern($1,var_run_t,var_run_t)
6212 ')
6213
6214 ########################################
6215 ## <summary>
6216 ##      Do not audit attempts to getattr
6217 ##      all tmpfs files.
6218 ## </summary>
6219 ## <param name="domain">
6220 ##      <summary>
6221 ##      Domain to not audit.
6222 ##      </summary>
6223 ## </param>
6224 #
6225 interface(`files_dontaudit_getattr_tmpfs_files',`
6226         gen_require(`
6227                 attribute tmpfsfile;
6228         ')
6229
6230         allow $1 tmpfsfile:file getattr;
6231 ')
6232
6233 ########################################
6234 ## <summary>
6235 ##      Do not audit attempts to read security files
6236 ## </summary>
6237 ## <param name="domain">
6238 ##      <summary>
6239 ##      Domain to not audit.
6240 ##      </summary>
6241 ## </param>
6242 #
6243 interface(`files_dontaudit_read_security_files',`
6244         gen_require(`
6245                 attribute security_file_type;
6246         ')
6247
6248         dontaudit $1 security_file_type:file read_file_perms;
6249 ')
6250
6251 ########################################
6252 ## <summary>
6253 ##      rw any files inherited from another process
6254 ## </summary>
6255 ## <param name="domain">
6256 ##      <summary>
6257 ##      Domain allowed access.
6258 ##      </summary>
6259 ## </param>
6260 ## <rolecap/>
6261 #
6262 interface(`files_rw_all_inherited_files',`
6263         gen_require(`
6264                 attribute file_type;
6265         ')
6266
6267         allow $1 { file_type $2 }:file rw_inherited_file_perms;
6268         allow $1 { file_type $2 }:fifo_file rw_inherited_fifo_file_perms;
6269         allow $1 { file_type $2 }:sock_file rw_inherited_sock_file_perms;
6270         allow $1 { file_type $2 }:chr_file rw_inherited_chr_file_perms;
6271 ')
6272
6273 ########################################
6274 ## <summary>
6275 ##      Allow any file point to be the entrypoint of this domain
6276 ## </summary>
6277 ## <param name="domain">
6278 ##      <summary>
6279 ##      Domain allowed access.
6280 ##      </summary>
6281 ## </param>
6282 ## <rolecap/>
6283 #
6284 interface(`files_entrypoint_all_files',`
6285         gen_require(`
6286                 attribute file_type;
6287         ')
6288         allow $1 file_type:file entrypoint;
6289 ')
6290
6291 ########################################
6292 ## <summary>
6293 ##      Do not audit attempts to rw inherited file perms
6294 ##      of non security files.
6295 ## </summary>
6296 ## <param name="domain">
6297 ##      <summary>
6298 ##      Domain to not audit.
6299 ##      </summary>
6300 ## </param>
6301 #
6302 interface(`files_dontaudit_all_non_security_leaks',`
6303         gen_require(`
6304                 attribute non_security_file_type;
6305         ')
6306
6307         dontaudit $1 non_security_file_type:file_class_set rw_inherited_file_perms;
6308 ')
6309
6310 ########################################
6311 ## <summary>
6312 ##      Do not audit attempts to read or write
6313 ##      all leaked files.
6314 ## </summary>
6315 ## <param name="domain">
6316 ##      <summary>
6317 ##      Domain allowed access.
6318 ##      </summary>
6319 ## </param>
6320 #
6321 interface(`files_dontaudit_leaks',`
6322         gen_require(`
6323                 attribute file_type;
6324         ')
6325
6326         dontaudit $1 file_type:file rw_inherited_file_perms;
6327         dontaudit $1 file_type:lnk_file { read };
6328 ')
6329
6330 ########################################
6331 ## <summary>
6332 ##      Allow domain to create_file_ass all types
6333 ## </summary>
6334 ## <param name="domain">
6335 ##      <summary>
6336 ##      Domain allowed access.
6337 ##      </summary>
6338 ## </param>
6339 #
6340 interface(`files_create_as_is_all_files',`
6341         gen_require(`
6342                 attribute file_type;
6343                 class kernel_service create_files_as;
6344         ')
6345
6346         allow $1 file_type:kernel_service create_files_as;
6347 ')