policy/modules/kernel/files.if

   1 ## <summary>
   2 ## Basic filesystem types and interfaces.
   3 ## </summary>
   4 ## <desc>
   5 ## <p>
   6 ## This module contains basic filesystem types and interfaces. This
   7 ## includes:
   8 ## <ul>
   9 ##      <li>The concept of different file types including basic
  10 ##      files, mount points, tmp files, etc.</li>
  11 ##      <li>Access to groups of files and all files.</li>
  12 ##      <li>Types and interfaces for the basic filesystem layout
  13 ##      (/, /etc, /tmp, /usr, etc.).</li>
  14 ## </ul>
  15 ## </p>
  16 ## </desc>
  17 ## <required val="true">
  18 ##      Contains the concept of a file.
  19 ##      Comains the file initial SID.
  20 ## </required>
  21
  22 ########################################
  23 ## <summary>
  24 ##      Make the specified type usable for files
  25 ##      in a filesystem.
  26 ## </summary>
  27 ## <desc>
  28 ##      <p>
  29 ##      Make the specified type usable for files
  30 ##      in a filesystem.  Types used for files that
  31 ##      do not use this interface, or an interface that
  32 ##      calls this one, will have unexpected behaviors
  33 ##      while the system is running. If the type is used
  34 ##      for device nodes (character or block files), then
  35 ##      the dev_node() interface is more appropriate.
  36 ##      </p>
  37 ##      <p>
  38 ##      Related interfaces:
  39 ##      </p>
  40 ##      <ul>
  41 ##              <li>application_domain()</li>
  42 ##              <li>application_executable_file()</li>
  43 ##              <li>corecmd_executable_file()</li>
  44 ##              <li>init_daemon_domain()</li>
  45 ##              <li>init_domaion()</li>
  46 ##              <li>init_ranged_daemon_domain()</li>
  47 ##              <li>init_ranged_domain()</li>
  48 ##              <li>init_ranged_system_domain()</li>
  49 ##              <li>init_script_file()</li>
  50 ##              <li>init_script_domain()</li>
  51 ##              <li>init_system_domain()</li>
  52 ##              <li>files_config_files()</li>
  53 ##              <li>files_lock_file()</li>
  54 ##              <li>files_mountpoint()</li>
  55 ##              <li>files_pid_file()</li>
  56 ##              <li>files_security_file()</li>
  57 ##              <li>files_security_mountpoint()</li>
  58 ##              <li>files_tmp_file()</li>
  59 ##              <li>files_tmpfs_file()</li>
  60 ##              <li>logging_log_file()</li>
  61 ##              <li>userdom_user_home_content()</li>
  62 ##      </ul>
  63 ##      <p>
  64 ##      Example:
  65 ##      </p>
  66 ##      <p>
  67 ##      type myfile_t;
  68 ##      files_type(myfile_t)
  69 ##      allow mydomain_t myfile_t:file read_file_perms;
  70 ##      </p>
  71 ## </desc>
  72 ## <param name="type">
  73 ##      <summary>
  74 ##      Type to be used for files.
  75 ##      </summary>
  76 ## </param>
  77 ## <infoflow type="none"/>
  78 #
  79 interface(`files_type',`
  80         gen_require(`
  81                 attribute file_type, non_security_file_type;
  82         ')
  83
  84         typeattribute $1 file_type, non_security_file_type;
  85 ')
  86
  87 ########################################
  88 ## <summary>
  89 ##      Make the specified type a file that
  90 ##      should not be dontaudited from
  91 ##      browsing from user domains.
  92 ## </summary>
  93 ## <param name="file_type">
  94 ##      <summary>
  95 ##      Type of the file to be used as a
  96 ##      member directory.
  97 ##      </summary>
  98 ## </param>
  99 #
 100 interface(`files_security_file',`
 101         gen_require(`
 102                 attribute file_type, security_file_type;
 103         ')
 104
 105         typeattribute $1 file_type, security_file_type;
 106 ')
 107
 108 ########################################
 109 ## <summary>
 110 ##      Make the specified type usable for
 111 ##      lock files.
 112 ## </summary>
 113 ## <param name="type">
 114 ##      <summary>
 115 ##      Type to be used for lock files.
 116 ##      </summary>
 117 ## </param>
 118 #
 119 interface(`files_lock_file',`
 120         gen_require(`
 121                 attribute lockfile;
 122         ')
 123
 124         files_type($1)
 125         typeattribute $1 lockfile;
 126 ')
 127
 128 ########################################
 129 ## <summary>
 130 ##      Make the specified type usable for
 131 ##      filesystem mount points.
 132 ## </summary>
 133 ## <param name="type">
 134 ##      <summary>
 135 ##      Type to be used for mount points.
 136 ##      </summary>
 137 ## </param>
 138 #
 139 interface(`files_mountpoint',`
 140         gen_require(`
 141                 attribute mountpoint;
 142         ')
 143
 144         files_type($1)
 145         typeattribute $1 mountpoint;
 146 ')
 147
 148 ########################################
 149 ## <summary>
 150 ##      Make the specified type usable for
 151 ##      security file filesystem mount points.
 152 ## </summary>
 153 ## <param name="type">
 154 ##      <summary>
 155 ##      Type to be used for mount points.
 156 ##      </summary>
 157 ## </param>
 158 #
 159 interface(`files_security_mountpoint',`
 160         gen_require(`
 161                 attribute mountpoint;
 162         ')
 163
 164         files_security_file($1)
 165         typeattribute $1 mountpoint;
 166 ')
 167
 168 ########################################
 169 ## <summary>
 170 ##      Make the specified type usable for
 171 ##      runtime process ID files.
 172 ## </summary>
 173 ## <desc>
 174 ##      <p>
 175 ##      Make the specified type usable for runtime process ID files,
 176 ##      typically found in /var/run.
 177 ##      This will also make the type usable for files, making
 178 ##      calls to files_type() redundant.  Failure to use this interface
 179 ##      for a PID file type may result in problems with starting
 180 ##      or stopping services.
 181 ##      </p>
 182 ##      <p>
 183 ##      Related interfaces:
 184 ##      </p>
 185 ##      <ul>
 186 ##              <li>files_pid_filetrans()</li>
 187 ##      </ul>
 188 ##      <p>
 189 ##      Example usage with a domain that can create and
 190 ##      write its PID file with a private PID file type in the
 191 ##      /var/run directory:
 192 ##      </p>
 193 ##      <p>
 194 ##      type mypidfile_t;
 195 ##      files_pid_file(mypidfile_t)
 196 ##      allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms };
 197 ##      files_pid_filetrans(mydomain_t, mypidfile_t, file)
 198 ##      </p>
 199 ## </desc>
 200 ## <param name="type">
 201 ##      <summary>
 202 ##      Type to be used for PID files.
 203 ##      </summary>
 204 ## </param>
 205 ## <infoflow type="none"/>
 206 #
 207 interface(`files_pid_file',`
 208         gen_require(`
 209                 attribute pidfile;
 210         ')
 211
 212         files_type($1)
 213         typeattribute $1 pidfile;
 214 ')
 215
 216 ########################################
 217 ## <summary>
 218 ##      Make the specified type a
 219 ##      configuration file.
 220 ## </summary>
 221 ## <desc>
 222 ##      <p>
 223 ##      Make the specified type usable for configuration files.
 224 ##      This will also make the type usable for files, making
 225 ##      calls to files_type() redundant.  Failure to use this interface
 226 ##      for a temporary file may result in problems with
 227 ##      configuration management tools.
 228 ##      </p>
 229 ##      <p>
 230 ##      Example usage with a domain that can read
 231 ##      its configuration file /etc:
 232 ##      </p>
 233 ##      <p>
 234 ##      type myconffile_t;
 235 ##      files_config_file(myconffile_t)
 236 ##      allow mydomain_t myconffile_t:file read_file_perms;
 237 ##      files_search_etc(mydomain_t)
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="file_type">
 241 ##      <summary>
 242 ##      Type to be used as a configuration file.
 243 ##      </summary>
 244 ## </param>
 245 ## <infoflow type="none"/>
 246 #
 247 interface(`files_config_file',`
 248         gen_require(`
 249                 attribute configfile;
 250         ')
 251         files_type($1)
 252         typeattribute $1 configfile;
 253 ')
 254
 255 ########################################
 256 ## <summary>
 257 ##      Make the specified type a
 258 ##      polyinstantiated directory.
 259 ## </summary>
 260 ## <param name="file_type">
 261 ##      <summary>
 262 ##      Type of the file to be used as a
 263 ##      polyinstantiated directory.
 264 ##      </summary>
 265 ## </param>
 266 #
 267 interface(`files_poly',`
 268         gen_require(`
 269                 attribute polydir;
 270         ')
 271
 272         files_type($1)
 273         typeattribute $1 polydir;
 274 ')
 275
 276 ########################################
 277 ## <summary>
 278 ##      Make the specified type a parent
 279 ##      of a polyinstantiated directory.
 280 ## </summary>
 281 ## <param name="file_type">
 282 ##      <summary>
 283 ##      Type of the file to be used as a
 284 ##      parent directory.
 285 ##      </summary>
 286 ## </param>
 287 #
 288 interface(`files_poly_parent',`
 289         gen_require(`
 290                 attribute polyparent;
 291         ')
 292
 293         files_type($1)
 294         typeattribute $1 polyparent;
 295 ')
 296
 297 ########################################
 298 ## <summary>
 299 ##      Make the specified type a
 300 ##      polyinstantiation member directory.
 301 ## </summary>
 302 ## <param name="file_type">
 303 ##      <summary>
 304 ##      Type of the file to be used as a
 305 ##      member directory.
 306 ##      </summary>
 307 ## </param>
 308 #
 309 interface(`files_poly_member',`
 310         gen_require(`
 311                 attribute polymember;
 312         ')
 313
 314         files_type($1)
 315         typeattribute $1 polymember;
 316 ')
 317
 318 ########################################
 319 ## <summary>
 320 ##      Make the domain use the specified
 321 ##      type of polyinstantiated directory.
 322 ## </summary>
 323 ## <param name="domain">
 324 ##      <summary>
 325 ##      Domain using the polyinstantiated
 326 ##      directory.
 327 ##      </summary>
 328 ## </param>
 329 ## <param name="file_type">
 330 ##      <summary>
 331 ##      Type of the file to be used as a
 332 ##      member directory.
 333 ##      </summary>
 334 ## </param>
 335 #
 336 interface(`files_poly_member_tmp',`
 337         gen_require(`
 338                 type tmp_t;
 339         ')
 340
 341         type_member $1 tmp_t:dir $2;
 342 ')
 343
 344 ########################################
 345 ## <summary>
 346 ##      Make the specified type a file
 347 ##      used for temporary files.
 348 ## </summary>
 349 ## <desc>
 350 ##      <p>
 351 ##      Make the specified type usable for temporary files.
 352 ##      This will also make the type usable for files, making
 353 ##      calls to files_type() redundant.  Failure to use this interface
 354 ##      for a temporary file may result in problems with
 355 ##      purging temporary files.
 356 ##      </p>
 357 ##      <p>
 358 ##      Related interfaces:
 359 ##      </p>
 360 ##      <ul>
 361 ##              <li>files_tmp_filetrans()</li>
 362 ##      </ul>
 363 ##      <p>
 364 ##      Example usage with a domain that can create and
 365 ##      write its temporary file in the system temporary file
 366 ##      directories (/tmp or /var/tmp):
 367 ##      </p>
 368 ##      <p>
 369 ##      type mytmpfile_t;
 370 ##      files_tmp_file(mytmpfile_t)
 371 ##      allow mydomain_t mytmpfile_t:file { create_file_perms write_file_perms };
 372 ##      files_tmp_filetrans(mydomain_t, mytmpfile_t, file)
 373 ##      </p>
 374 ## </desc>
 375 ## <param name="file_type">
 376 ##      <summary>
 377 ##      Type of the file to be used as a
 378 ##      temporary file.
 379 ##      </summary>
 380 ## </param>
 381 ## <infoflow type="none"/>
 382 #
 383 interface(`files_tmp_file',`
 384         gen_require(`
 385                 attribute tmpfile;
 386                 type tmp_t;
 387         ')
 388
 389         files_type($1)
 390         files_poly_member($1)
 391         typeattribute $1 tmpfile;
 392 ')
 393
 394 ########################################
 395 ## <summary>
 396 ##      Transform the type into a file, for use on a
 397 ##      virtual memory filesystem (tmpfs).
 398 ## </summary>
 399 ## <param name="type">
 400 ##      <summary>
 401 ##      The type to be transformed.
 402 ##      </summary>
 403 ## </param>
 404 #
 405 interface(`files_tmpfs_file',`
 406         gen_require(`
 407                 attribute tmpfsfile;
 408         ')
 409
 410         files_type($1)
 411         typeattribute $1 tmpfsfile;
 412 ')
 413
 414 ########################################
 415 ## <summary>
 416 ##      Get the attributes of all directories.
 417 ## </summary>
 418 ## <param name="domain">
 419 ##      <summary>
 420 ##      Domain allowed access.
 421 ##      </summary>
 422 ## </param>
 423 #
 424 interface(`files_getattr_all_dirs',`
 425         gen_require(`
 426                 attribute file_type;
 427         ')
 428
 429         getattr_dirs_pattern($1, file_type, file_type)
 430 ')
 431
 432 ########################################
 433 ## <summary>
 434 ##      Do not audit attempts to get the attributes
 435 ##      of all directories.
 436 ## </summary>
 437 ## <param name="domain">
 438 ##      <summary>
 439 ##      Domain to not audit.
 440 ##      </summary>
 441 ## </param>
 442 #
 443 interface(`files_dontaudit_getattr_all_dirs',`
 444         gen_require(`
 445                 attribute file_type;
 446         ')
 447
 448         dontaudit $1 file_type:dir getattr;
 449 ')
 450
 451 ########################################
 452 ## <summary>
 453 ##      List all non-security directories.
 454 ## </summary>
 455 ## <param name="domain">
 456 ##      <summary>
 457 ##      Domain allowed access.
 458 ##      </summary>
 459 ## </param>
 460 #
 461 interface(`files_list_non_security',`
 462         gen_require(`
 463                 attribute non_security_file_type;
 464         ')
 465
 466         list_dirs_pattern($1, non_security_file_type, non_security_file_type)
 467 ')
 468
 469 ########################################
 470 ## <summary>
 471 ##      Do not audit attempts to list all
 472 ##      non-security directories.
 473 ## </summary>
 474 ## <param name="domain">
 475 ##      <summary>
 476 ##      Domain to not audit.
 477 ##      </summary>
 478 ## </param>
 479 #
 480 interface(`files_dontaudit_list_non_security',`
 481         gen_require(`
 482                 attribute non_security_file_type;
 483         ')
 484
 485         dontaudit $1 non_security_file_type:dir list_dir_perms;
 486 ')
 487
 488 ########################################
 489 ## <summary>
 490 ##      Mount a filesystem on all non-security
 491 ##      directories and files.
 492 ## </summary>
 493 ## <param name="domain">
 494 ##      <summary>
 495 ##      Domain allowed access.
 496 ##      </summary>
 497 ## </param>
 498 #
 499 interface(`files_mounton_non_security',`
 500         gen_require(`
 501                 attribute non_security_file_type;
 502         ')
 503
 504         allow $1 non_security_file_type:dir mounton;
 505         allow $1 non_security_file_type:file mounton;
 506 ')
 507
 508 ########################################
 509 ## <summary>
 510 ##      Allow attempts to modify any directory
 511 ## </summary>
 512 ## <param name="domain">
 513 ##      <summary>
 514 ##      Domain allowed access.
 515 ##      </summary>
 516 ## </param>
 517 #
 518 interface(`files_write_non_security_dirs',`
 519         gen_require(`
 520                 attribute non_security_file_type;
 521         ')
 522
 523         allow $1 non_security_file_type:dir write;
 524 ')
 525
 526 ########################################
 527 ## <summary>
 528 ##      Allow attempts to manage non-security directories
 529 ## </summary>
 530 ## <param name="domain">
 531 ##      <summary>
 532 ##      Domain allowed access.
 533 ##      </summary>
 534 ## </param>
 535 #
 536 interface(`files_manage_non_security_dirs',`
 537         gen_require(`
 538                 attribute non_security_file_type;
 539         ')
 540
 541         allow $1 non_security_file_type:dir manage_dir_perms;
 542 ')
 543
 544 ########################################
 545 ## <summary>
 546 ##      Get the attributes of all files.
 547 ## </summary>
 548 ## <param name="domain">
 549 ##      <summary>
 550 ##      Domain allowed access.
 551 ##      </summary>
 552 ## </param>
 553 #
 554 interface(`files_getattr_all_files',`
 555         gen_require(`
 556                 attribute file_type;
 557         ')
 558
 559         getattr_files_pattern($1, file_type, file_type)
 560         getattr_lnk_files_pattern($1, file_type, file_type)
 561 ')
 562
 563 ########################################
 564 ## <summary>
 565 ##      Do not audit attempts to get the attributes
 566 ##      of all files.
 567 ## </summary>
 568 ## <param name="domain">
 569 ##      <summary>
 570 ##      Domain to not audit.
 571 ##      </summary>
 572 ## </param>
 573 #
 574 interface(`files_dontaudit_getattr_all_files',`
 575         gen_require(`
 576                 attribute file_type;
 577         ')
 578
 579         dontaudit $1 file_type:file getattr;
 580 ')
 581
 582 ########################################
 583 ## <summary>
 584 ##      Do not audit attempts to get the attributes
 585 ##      of non security files.
 586 ## </summary>
 587 ## <param name="domain">
 588 ##      <summary>
 589 ##      Domain to not audit.
 590 ##      </summary>
 591 ## </param>
 592 #
 593 interface(`files_dontaudit_getattr_non_security_files',`
 594         gen_require(`
 595                 attribute non_security_file_type;
 596         ')
 597
 598         dontaudit $1 non_security_file_type:file getattr;
 599 ')
 600
 601 ########################################
 602 ## <summary>
 603 ##      Read all files.
 604 ## </summary>
 605 ## <param name="domain">
 606 ##      <summary>
 607 ##      Domain allowed access.
 608 ##      </summary>
 609 ## </param>
 610 #
 611 interface(`files_read_all_files',`
 612         gen_require(`
 613                 attribute file_type;
 614         ')
 615
 616         allow $1 file_type:dir list_dir_perms;
 617         read_files_pattern($1, file_type, file_type)
 618
 619         optional_policy(`
 620                 auth_read_shadow($1)
 621         ')
 622 ')
 623
 624 ########################################
 625 ## <summary>
 626 ##      Allow shared library text relocations in all files.
 627 ## </summary>
 628 ## <desc>
 629 ##      <p>
 630 ##      Allow shared library text relocations in all files.
 631 ##      </p>
 632 ##      <p>
 633 ##      This is added to support WINE policy.
 634 ##      </p>
 635 ## </desc>
 636 ## <param name="domain">
 637 ##      <summary>
 638 ##      Domain allowed access.
 639 ##      </summary>
 640 ## </param>
 641 #
 642 interface(`files_execmod_all_files',`
 643         gen_require(`
 644                 attribute file_type;
 645         ')
 646
 647         allow $1 file_type:file execmod;
 648 ')
 649
 650 ########################################
 651 ## <summary>
 652 ##      Read all non-security files.
 653 ## </summary>
 654 ## <param name="domain">
 655 ##      <summary>
 656 ##      Domain allowed access.
 657 ##      </summary>
 658 ## </param>
 659 ## <rolecap/>
 660 #
 661 interface(`files_read_non_security_files',`
 662         gen_require(`
 663                 attribute non_security_file_type;
 664         ')
 665
 666         read_files_pattern($1, non_security_file_type, non_security_file_type)
 667         read_lnk_files_pattern($1, non_security_file_type, non_security_file_type)
 668 ')
 669
 670 ########################################
 671 ## <summary>
 672 ##      Read all directories on the filesystem, except
 673 ##      the listed exceptions.
 674 ## </summary>
 675 ## <param name="domain">
 676 ##      <summary>
 677 ##      Domain allowed access.
 678 ##      </summary>
 679 ## </param>
 680 ## <param name="exception_types" optional="true">
 681 ##      <summary>
 682 ##      The types to be excluded.  Each type or attribute
 683 ##      must be negated by the caller.
 684 ##      </summary>
 685 ## </param>
 686 #
 687 interface(`files_read_all_dirs_except',`
 688         gen_require(`
 689                 attribute file_type;
 690         ')
 691
 692         allow $1 { file_type $2 }:dir list_dir_perms;
 693 ')
 694
 695 ########################################
 696 ## <summary>
 697 ##      Read all files on the filesystem, except
 698 ##      the listed exceptions.
 699 ## </summary>
 700 ## <param name="domain">
 701 ##      <summary>
 702 ##      Domain allowed access.
 703 ##      </summary>
 704 ## </param>
 705 ## <param name="exception_types" optional="true">
 706 ##      <summary>
 707 ##      The types to be excluded.  Each type or attribute
 708 ##      must be negated by the caller.
 709 ##      </summary>
 710 ## </param>
 711 #
 712 interface(`files_read_all_files_except',`
 713         gen_require(`
 714                 attribute file_type;
 715         ')
 716
 717         read_files_pattern($1, { file_type $2 }, { file_type $2 })
 718 ')
 719
 720 ########################################
 721 ## <summary>
 722 ##      Read all symbolic links on the filesystem, except
 723 ##      the listed exceptions.
 724 ## </summary>
 725 ## <param name="domain">
 726 ##      <summary>
 727 ##      Domain allowed access.
 728 ##      </summary>
 729 ## </param>
 730 ## <param name="exception_types" optional="true">
 731 ##      <summary>
 732 ##      The types to be excluded.  Each type or attribute
 733 ##      must be negated by the caller.
 734 ##      </summary>
 735 ## </param>
 736 #
 737 interface(`files_read_all_symlinks_except',`
 738         gen_require(`
 739                 attribute file_type;
 740         ')
 741
 742         read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
 743 ')
 744
 745 ########################################
 746 ## <summary>
 747 ##      Get the attributes of all symbolic links.
 748 ## </summary>
 749 ## <param name="domain">
 750 ##      <summary>
 751 ##      Domain allowed access.
 752 ##      </summary>
 753 ## </param>
 754 #
 755 interface(`files_getattr_all_symlinks',`
 756         gen_require(`
 757                 attribute file_type;
 758         ')
 759
 760         getattr_lnk_files_pattern($1, file_type, file_type)
 761 ')
 762
 763 ########################################
 764 ## <summary>
 765 ##      Do not audit attempts to get the attributes
 766 ##      of all symbolic links.
 767 ## </summary>
 768 ## <param name="domain">
 769 ##      <summary>
 770 ##      Domain to not audit.
 771 ##      </summary>
 772 ## </param>
 773 #
 774 interface(`files_dontaudit_getattr_all_symlinks',`
 775         gen_require(`
 776                 attribute file_type;
 777         ')
 778
 779         dontaudit $1 file_type:lnk_file getattr;
 780 ')
 781
 782 ########################################
 783 ## <summary>
 784 ##      Do not audit attempts to read all symbolic links.
 785 ## </summary>
 786 ## <param name="domain">
 787 ##      <summary>
 788 ##      Domain to not audit.
 789 ##      </summary>
 790 ## </param>
 791 #
 792 interface(`files_dontaudit_read_all_symlinks',`
 793         gen_require(`
 794                 attribute file_type;
 795         ')
 796
 797         dontaudit $1 file_type:lnk_file read;
 798 ')
 799
 800 ########################################
 801 ## <summary>
 802 ##      Do not audit attempts to get the attributes
 803 ##      of non security symbolic links.
 804 ## </summary>
 805 ## <param name="domain">
 806 ##      <summary>
 807 ##      Domain to not audit.
 808 ##      </summary>
 809 ## </param>
 810 #
 811 interface(`files_dontaudit_getattr_non_security_symlinks',`
 812         gen_require(`
 813                 attribute non_security_file_type;
 814         ')
 815
 816         dontaudit $1 non_security_file_type:lnk_file getattr;
 817 ')
 818
 819 ########################################
 820 ## <summary>
 821 ##      Do not audit attempts to get the attributes
 822 ##      of non security block devices.
 823 ## </summary>
 824 ## <param name="domain">
 825 ##      <summary>
 826 ##      Domain to not audit.
 827 ##      </summary>
 828 ## </param>
 829 #
 830 interface(`files_dontaudit_getattr_non_security_blk_files',`
 831         gen_require(`
 832                 attribute non_security_file_type;
 833         ')
 834
 835         dontaudit $1 non_security_file_type:blk_file getattr;
 836 ')
 837
 838 ########################################
 839 ## <summary>
 840 ##      Do not audit attempts to get the attributes
 841 ##      of non security character devices.
 842 ## </summary>
 843 ## <param name="domain">
 844 ##      <summary>
 845 ##      Domain to not audit.
 846 ##      </summary>
 847 ## </param>
 848 #
 849 interface(`files_dontaudit_getattr_non_security_chr_files',`
 850         gen_require(`
 851                 attribute non_security_file_type;
 852         ')
 853
 854         dontaudit $1 non_security_file_type:chr_file getattr;
 855 ')
 856
 857 ########################################
 858 ## <summary>
 859 ##      Read all symbolic links.
 860 ## </summary>
 861 ## <param name="domain">
 862 ##      <summary>
 863 ##      Domain allowed access.
 864 ##      </summary>
 865 ## </param>
 866 ## <rolecap/>
 867 #
 868 interface(`files_read_all_symlinks',`
 869         gen_require(`
 870                 attribute file_type;
 871         ')
 872
 873         allow $1 file_type:dir list_dir_perms;
 874         read_lnk_files_pattern($1, file_type, file_type)
 875 ')
 876
 877 ########################################
 878 ## <summary>
 879 ##      Get the attributes of all named pipes.
 880 ## </summary>
 881 ## <param name="domain">
 882 ##      <summary>
 883 ##      Domain allowed access.
 884 ##      </summary>
 885 ## </param>
 886 #
 887 interface(`files_getattr_all_pipes',`
 888         gen_require(`
 889                 attribute file_type;
 890         ')
 891
 892         allow $1 file_type:dir list_dir_perms;
 893         getattr_fifo_files_pattern($1, file_type, file_type)
 894 ')
 895
 896 ########################################
 897 ## <summary>
 898 ##      Do not audit attempts to get the attributes
 899 ##      of all named pipes.
 900 ## </summary>
 901 ## <param name="domain">
 902 ##      <summary>
 903 ##      Domain to not audit.
 904 ##      </summary>
 905 ## </param>
 906 #
 907 interface(`files_dontaudit_getattr_all_pipes',`
 908         gen_require(`
 909                 attribute file_type;
 910         ')
 911
 912         dontaudit $1 file_type:fifo_file getattr;
 913 ')
 914
 915 ########################################
 916 ## <summary>
 917 ##      Do not audit attempts to get the attributes
 918 ##      of non security named pipes.
 919 ## </summary>
 920 ## <param name="domain">
 921 ##      <summary>
 922 ##      Domain to not audit.
 923 ##      </summary>
 924 ## </param>
 925 #
 926 interface(`files_dontaudit_getattr_non_security_pipes',`
 927         gen_require(`
 928                 attribute non_security_file_type;
 929         ')
 930
 931         dontaudit $1 non_security_file_type:fifo_file getattr;
 932 ')
 933
 934 ########################################
 935 ## <summary>
 936 ##      Get the attributes of all named sockets.
 937 ## </summary>
 938 ## <param name="domain">
 939 ##      <summary>
 940 ##      Domain allowed access.
 941 ##      </summary>
 942 ## </param>
 943 #
 944 interface(`files_getattr_all_sockets',`
 945         gen_require(`
 946                 attribute file_type;
 947         ')
 948
 949         allow $1 file_type:dir list_dir_perms;
 950         getattr_sock_files_pattern($1, file_type, file_type)
 951 ')
 952
 953 ########################################
 954 ## <summary>
 955 ##      Do not audit attempts to get the attributes
 956 ##      of all named sockets.
 957 ## </summary>
 958 ## <param name="domain">
 959 ##      <summary>
 960 ##      Domain to not audit.
 961 ##      </summary>
 962 ## </param>
 963 #
 964 interface(`files_dontaudit_getattr_all_sockets',`
 965         gen_require(`
 966                 attribute file_type;
 967         ')
 968
 969         dontaudit $1 file_type:sock_file getattr;
 970 ')
 971
 972 ########################################
 973 ## <summary>
 974 ##      Do not audit attempts to get the attributes
 975 ##      of non security named sockets.
 976 ## </summary>
 977 ## <param name="domain">
 978 ##      <summary>
 979 ##      Domain to not audit.
 980 ##      </summary>
 981 ## </param>
 982 #
 983 interface(`files_dontaudit_getattr_non_security_sockets',`
 984         gen_require(`
 985                 attribute non_security_file_type;
 986         ')
 987
 988         dontaudit $1 non_security_file_type:sock_file getattr;
 989 ')
 990
 991 ########################################
 992 ## <summary>
 993 ##      Read all block nodes with file types.
 994 ## </summary>
 995 ## <param name="domain">
 996 ##      <summary>
 997 ##      Domain allowed access.
 998 ##      </summary>
 999 ## </param>
1000 #
1001 interface(`files_read_all_blk_files',`
1002         gen_require(`
1003                 attribute file_type;
1004         ')
1005
1006         read_blk_files_pattern($1, file_type, file_type)
1007 ')
1008
1009 ########################################
1010 ## <summary>
1011 ##      Read all character nodes with file types.
1012 ## </summary>
1013 ## <param name="domain">
1014 ##      <summary>
1015 ##      Domain allowed access.
1016 ##      </summary>
1017 ## </param>
1018 #
1019 interface(`files_read_all_chr_files',`
1020         gen_require(`
1021                 attribute file_type;
1022         ')
1023
1024         read_chr_files_pattern($1, file_type, file_type)
1025 ')
1026
1027 ########################################
1028 ## <summary>
1029 ##      Relabel all files on the filesystem, except
1030 ##      the listed exceptions.
1031 ## </summary>
1032 ## <param name="domain">
1033 ##      <summary>
1034 ##      Domain allowed access.
1035 ##      </summary>
1036 ## </param>
1037 ## <param name="exception_types" optional="true">
1038 ##      <summary>
1039 ##      The types to be excluded.  Each type or attribute
1040 ##      must be negated by the caller.
1041 ##      </summary>
1042 ## </param>
1043 ## <rolecap/>
1044 #
1045 interface(`files_relabel_all_files',`
1046         gen_require(`
1047                 attribute file_type;
1048         ')
1049
1050         allow $1 { file_type $2 }:dir list_dir_perms;
1051         relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 })
1052         relabel_files_pattern($1, { file_type $2 }, { file_type $2 })
1053         relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
1054         relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
1055         relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
1056         relabel_blk_files_pattern($1, { file_type $2 }, { file_type $2 })
1057         relabel_chr_files_pattern($1, { file_type $2 }, { file_type $2 })
1058
1059         # satisfy the assertions:
1060         seutil_relabelto_bin_policy($1)
1061 ')
1062
1063 ########################################
1064 ## <summary>
1065 ##      rw all files on the filesystem, except
1066 ##      the listed exceptions.
1067 ## </summary>
1068 ## <param name="domain">
1069 ##      <summary>
1070 ##      Domain allowed access.
1071 ##      </summary>
1072 ## </param>
1073 ## <param name="exception_types" optional="true">
1074 ##      <summary>
1075 ##      The types to be excluded.  Each type or attribute
1076 ##      must be negated by the caller.
1077 ##      </summary>
1078 ## </param>
1079 ## <rolecap/>
1080 #
1081 interface(`files_rw_all_files',`
1082         gen_require(`
1083                 attribute file_type;
1084         ')
1085
1086         rw_files_pattern($1, { file_type $2 }, { file_type $2 })
1087 ')
1088
1089 ########################################
1090 ## <summary>
1091 ##      Manage all files on the filesystem, except
1092 ##      the listed exceptions.
1093 ## </summary>
1094 ## <param name="domain">
1095 ##      <summary>
1096 ##      Domain allowed access.
1097 ##      </summary>
1098 ## </param>
1099 ## <param name="exception_types" optional="true">
1100 ##      <summary>
1101 ##      The types to be excluded.  Each type or attribute
1102 ##      must be negated by the caller.
1103 ##      </summary>
1104 ## </param>
1105 ## <rolecap/>
1106 #
1107 interface(`files_manage_all_files',`
1108         gen_require(`
1109                 attribute file_type;
1110         ')
1111
1112         manage_dirs_pattern($1, { file_type $2 }, { file_type $2 })
1113         manage_files_pattern($1, { file_type $2 }, { file_type $2 })
1114         manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
1115         manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
1116         manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
1117
1118         # satisfy the assertions:
1119         seutil_create_bin_policy($1)
1120         files_manage_kernel_modules($1)
1121 ')
1122
1123 ########################################
1124 ## <summary>
1125 ##      Search the contents of all directories on
1126 ##      extended attribute filesystems.
1127 ## </summary>
1128 ## <param name="domain">
1129 ##      <summary>
1130 ##      Domain allowed access.
1131 ##      </summary>
1132 ## </param>
1133 #
1134 interface(`files_search_all',`
1135         gen_require(`
1136                 attribute file_type;
1137         ')
1138
1139         allow $1 file_type:dir search_dir_perms;
1140 ')
1141
1142 ########################################
1143 ## <summary>
1144 ##      List the contents of all directories on
1145 ##      extended attribute filesystems.
1146 ## </summary>
1147 ## <param name="domain">
1148 ##      <summary>
1149 ##      Domain allowed access.
1150 ##      </summary>
1151 ## </param>
1152 #
1153 interface(`files_list_all',`
1154         gen_require(`
1155                 attribute file_type;
1156         ')
1157
1158         allow $1 file_type:dir list_dir_perms;
1159 ')
1160
1161 ########################################
1162 ## <summary>
1163 ##      Do not audit attempts to search the
1164 ##      contents of any directories on extended
1165 ##      attribute filesystems.
1166 ## </summary>
1167 ## <param name="domain">
1168 ##      <summary>
1169 ##      Domain to not audit.
1170 ##      </summary>
1171 ## </param>
1172 #
1173 interface(`files_dontaudit_search_all_dirs',`
1174         gen_require(`
1175                 attribute file_type;
1176         ')
1177
1178         dontaudit $1 file_type:dir search_dir_perms;
1179 ')
1180
1181 ########################################
1182 ## <summary>
1183 ##      Get the attributes of all filesystems
1184 ##      with the type of a file.
1185 ## </summary>
1186 ## <param name="domain">
1187 ##      <summary>
1188 ##      Domain allowed access.
1189 ##      </summary>
1190 ## </param>
1191 #
1192 # dwalsh: This interface is to allow quotacheck to work on a
1193 # a filesystem mounted with the --context switch
1194 # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212957
1195 #
1196 interface(`files_getattr_all_file_type_fs',`
1197         gen_require(`
1198                 attribute file_type;
1199         ')
1200
1201         allow $1 file_type:filesystem getattr;
1202 ')
1203
1204 ########################################
1205 ## <summary>
1206 ##      Relabel a filesystem to the type of a file.
1207 ## </summary>
1208 ## <param name="domain">
1209 ##      <summary>
1210 ##      Domain allowed access.
1211 ##      </summary>
1212 ## </param>
1213 #
1214 interface(`files_relabelto_all_file_type_fs',`
1215         gen_require(`
1216                 attribute file_type;
1217         ')
1218
1219         allow $1 file_type:filesystem relabelto;
1220 ')
1221
1222 ########################################
1223 ## <summary>
1224 ##      Relabel a filesystem to the type of a file.
1225 ## </summary>
1226 ## <param name="domain">
1227 ##      <summary>
1228 ##      Domain allowed access.
1229 ##      </summary>
1230 ## </param>
1231 #
1232 interface(`files_relabel_all_file_type_fs',`
1233         gen_require(`
1234                 attribute file_type;
1235         ')
1236
1237         allow $1 file_type:filesystem { relabelfrom relabelto };
1238 ')
1239
1240 ########################################
1241 ## <summary>
1242 ##      Mount all filesystems with the type of a file.
1243 ## </summary>
1244 ## <param name="domain">
1245 ##      <summary>
1246 ##      Domain allowed access.
1247 ##      </summary>
1248 ## </param>
1249 #
1250 interface(`files_mount_all_file_type_fs',`
1251         gen_require(`
1252                 attribute file_type;
1253         ')
1254
1255         allow $1 file_type:filesystem mount;
1256 ')
1257
1258 ########################################
1259 ## <summary>
1260 ##      Unmount all filesystems with the type of a file.
1261 ## </summary>
1262 ## <param name="domain">
1263 ##      <summary>
1264 ##      Domain allowed access.
1265 ##      </summary>
1266 ## </param>
1267 #
1268 interface(`files_unmount_all_file_type_fs',`
1269         gen_require(`
1270                 attribute file_type;
1271         ')
1272
1273         allow $1 file_type:filesystem unmount;
1274 ')
1275
1276 #############################################
1277 ## <summary>
1278 ##      Manage all configuration directories on filesystem
1279 ## </summary>
1280 ## <param name="domain">
1281 ##      <summary>
1282 ##      Domain allowed access.
1283 ##      </summary>
1284 ## </param>
1285 ##
1286 #
1287 interface(`files_manage_config_dirs',`
1288         gen_require(`
1289                 attribute configfile;
1290         ')
1291
1292         manage_dirs_pattern($1, configfile, configfile)
1293 ')
1294
1295 #########################################
1296 ## <summary>
1297 ##      Relabel configuration directories
1298 ## </summary>
1299 ## <param name="domain">
1300 ##      <summary>
1301 ##      Domain allowed access.
1302 ##      </summary>
1303 ## </param>
1304 ##
1305 #
1306 interface(`files_relabel_config_dirs',`
1307         gen_require(`
1308                 attribute configfile;
1309         ')
1310
1311         relabel_dirs_pattern($1, configfile, configfile)
1312 ')
1313
1314 ########################################
1315 ## <summary>
1316 ##      Read config files in /etc.
1317 ## </summary>
1318 ## <param name="domain">
1319 ##      <summary>
1320 ##      Domain allowed access.
1321 ##      </summary>
1322 ## </param>
1323 #
1324 interface(`files_read_config_files',`
1325         gen_require(`
1326                 attribute configfile;
1327         ')
1328
1329         allow $1 configfile:dir list_dir_perms;
1330         read_files_pattern($1, configfile, configfile)
1331         read_lnk_files_pattern($1, configfile, configfile)
1332 ')
1333
1334 ###########################################
1335 ## <summary>
1336 ##      Manage all configuration files on filesystem
1337 ## </summary>
1338 ## <param name="domain">
1339 ##      <summary>
1340 ##      Domain allowed access.
1341 ##      </summary>
1342 ## </param>
1343 ##
1344 #
1345 interface(`files_manage_config_files',`
1346         gen_require(`
1347                 attribute configfile;
1348         ')
1349
1350         manage_files_pattern($1, configfile, configfile)
1351 ')
1352
1353 #######################################
1354 ## <summary>
1355 ##      Relabel configuration files
1356 ## </summary>
1357 ## <param name="domain">
1358 ##      <summary>
1359 ##      Domain allowed access.
1360 ##      </summary>
1361 ## </param>
1362 ##
1363 #
1364 interface(`files_relabel_config_files',`
1365         gen_require(`
1366                 attribute configfile;
1367         ')
1368
1369         relabel_files_pattern($1, configfile, configfile)
1370 ')
1371
1372 ########################################
1373 ## <summary>
1374 ##      Mount a filesystem on all mount points.
1375 ## </summary>
1376 ## <param name="domain">
1377 ##      <summary>
1378 ##      Domain allowed access.
1379 ##      </summary>
1380 ## </param>
1381 #
1382 interface(`files_mounton_all_mountpoints',`
1383         gen_require(`
1384                 attribute mountpoint;
1385         ')
1386
1387         allow $1 mountpoint:dir { search_dir_perms mounton };
1388         allow $1 mountpoint:file { getattr mounton };
1389 ')
1390
1391 ########################################
1392 ## <summary>
1393 ##      Get the attributes of all mount points.
1394 ## </summary>
1395 ## <param name="domain">
1396 ##      <summary>
1397 ##      Domain allowed access.
1398 ##      </summary>
1399 ## </param>
1400 #
1401 interface(`files_getattr_all_mountpoints',`
1402         gen_require(`
1403                 attribute mountpoint;
1404         ')
1405
1406         allow $1 mountpoint:dir getattr;
1407 ')
1408
1409 ########################################
1410 ## <summary>
1411 ##      Set the attributes of all mount points.
1412 ## </summary>
1413 ## <param name="domain">
1414 ##      <summary>
1415 ##      Domain allowed access.
1416 ##      </summary>
1417 ## </param>
1418 #
1419 interface(`files_setattr_all_mountpoints',`
1420         gen_require(`
1421                 attribute mountpoint;
1422         ')
1423
1424         allow $1 mountpoint:dir setattr;
1425 ')
1426
1427 ########################################
1428 ## <summary>
1429 ##      Search all mount points.
1430 ## </summary>
1431 ## <param name="domain">
1432 ##      <summary>
1433 ##      Domain allowed access.
1434 ##      </summary>
1435 ## </param>
1436 #
1437 interface(`files_search_all_mountpoints',`
1438         gen_require(`
1439                 attribute mountpoint;
1440         ')
1441
1442         allow $1 mountpoint:dir search_dir_perms;
1443 ')
1444
1445 ########################################
1446 ## <summary>
1447 ##      Do not audit searching of all mount points.
1448 ## </summary>
1449 ## <param name="domain">
1450 ##      <summary>
1451 ##      Domain to not audit.
1452 ##      </summary>
1453 ## </param>
1454 #
1455 interface(`files_dontaudit_search_all_mountpoints',`
1456         gen_require(`
1457                 attribute mountpoint;
1458         ')
1459
1460         dontaudit $1 mountpoint:dir search_dir_perms;
1461 ')
1462
1463 ########################################
1464 ## <summary>
1465 ##      Do not audit listing of all mount points.
1466 ## </summary>
1467 ## <param name="domain">
1468 ##      <summary>
1469 ##      Domain to not audit.
1470 ##      </summary>
1471 ## </param>
1472 #
1473 interface(`files_dontaudit_list_all_mountpoints',`
1474         gen_require(`
1475                 attribute mountpoint;
1476         ')
1477
1478         dontaudit $1 mountpoint:dir list_dir_perms;
1479 ')
1480
1481 ########################################
1482 ## <summary>
1483 ##      Write all mount points.
1484 ## </summary>
1485 ## <param name="domain">
1486 ##      <summary>
1487 ##      Domain allowed access.
1488 ##      </summary>
1489 ## </param>
1490 #
1491 interface(`files_write_all_mountpoints',`
1492         gen_require(`
1493                 attribute mountpoint;
1494         ')
1495
1496         allow $1 mountpoint:dir write;
1497 ')
1498
1499 ########################################
1500 ## <summary>
1501 ##      Write all file type directories.
1502 ## </summary>
1503 ## <param name="domain">
1504 ##      <summary>
1505 ##      Domain allowed access.
1506 ##      </summary>
1507 ## </param>
1508 #
1509 interface(`files_write_all_dirs',`
1510         gen_require(`
1511                 attribute file_type;
1512         ')
1513
1514         allow $1 file_type:dir write;
1515 ')
1516
1517 ########################################
1518 ## <summary>
1519 ##      List the contents of the root directory.
1520 ## </summary>
1521 ## <param name="domain">
1522 ##      <summary>
1523 ##      Domain allowed access.
1524 ##      </summary>
1525 ## </param>
1526 #
1527 interface(`files_list_root',`
1528         gen_require(`
1529                 type root_t;
1530         ')
1531
1532         allow $1 root_t:dir list_dir_perms;
1533         allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock };
1534 ')
1535
1536 ########################################
1537 ## <summary>
1538 ##      Do not audit attempts to write to / dirs.
1539 ## </summary>
1540 ## <param name="domain">
1541 ##      <summary>
1542 ##      Domain to not audit.
1543 ##      </summary>
1544 ## </param>
1545 #
1546 interface(`files_dontaudit_write_root_dirs',`
1547         gen_require(`
1548                 type root_t;
1549         ')
1550
1551         dontaudit $1 root_t:dir write;
1552 ')
1553
1554 ###################
1555 ## <summary>
1556 ##      Do not audit attempts to write
1557 ##      files in the root directory.
1558 ## </summary>
1559 ## <param name="domain">
1560 ##      <summary>
1561 ##      Domain to not audit.
1562 ##      </summary>
1563 ## </param>
1564 #
1565 interface(`files_dontaudit_rw_root_dir',`
1566         gen_require(`
1567                 type root_t;
1568         ')
1569
1570         dontaudit $1 root_t:dir rw_dir_perms;
1571 ')
1572
1573 ########################################
1574 ## <summary>
1575 ##      Create an object in the root directory, with a private
1576 ##      type using a type transition.
1577 ## </summary>
1578 ## <param name="domain">
1579 ##      <summary>
1580 ##      Domain allowed access.
1581 ##      </summary>
1582 ## </param>
1583 ## <param name="private type">
1584 ##      <summary>
1585 ##      The type of the object to be created.
1586 ##      </summary>
1587 ## </param>
1588 ## <param name="object">
1589 ##      <summary>
1590 ##      The object class of the object being created.
1591 ##      </summary>
1592 ## </param>
1593 #
1594 interface(`files_root_filetrans',`
1595         gen_require(`
1596                 type root_t;
1597         ')
1598
1599         filetrans_pattern($1, root_t, $2, $3)
1600 ')
1601
1602 ########################################
1603 ## <summary>
1604 ##      Do not audit attempts to read files in
1605 ##      the root directory.
1606 ## </summary>
1607 ## <param name="domain">
1608 ##      <summary>
1609 ##      Domain to not audit.
1610 ##      </summary>
1611 ## </param>
1612 #
1613 interface(`files_dontaudit_read_root_files',`
1614         gen_require(`
1615                 type root_t;
1616         ')
1617
1618         dontaudit $1 root_t:file { getattr read };
1619 ')
1620
1621 ########################################
1622 ## <summary>
1623 ##      Do not audit attempts to read or write
1624 ##      files in the root directory.
1625 ## </summary>
1626 ## <param name="domain">
1627 ##      <summary>
1628 ##      Domain to not audit.
1629 ##      </summary>
1630 ## </param>
1631 #
1632 interface(`files_dontaudit_rw_root_files',`
1633         gen_require(`
1634                 type root_t;
1635         ')
1636
1637         dontaudit $1 root_t:file { read write };
1638 ')
1639
1640 ########################################
1641 ## <summary>
1642 ##      Do not audit attempts to read or write
1643 ##      character device nodes in the root directory.
1644 ## </summary>
1645 ## <param name="domain">
1646 ##      <summary>
1647 ##      Domain to not audit.
1648 ##      </summary>
1649 ## </param>
1650 #
1651 interface(`files_dontaudit_rw_root_chr_files',`
1652         gen_require(`
1653                 type root_t;
1654         ')
1655
1656         dontaudit $1 root_t:chr_file { read write };
1657 ')
1658
1659 ########################################
1660 ## <summary>
1661 ##      Delete files in the root directory.
1662 ## </summary>
1663 ## <param name="domain">
1664 ##      <summary>
1665 ##      Domain allowed access.
1666 ##      </summary>
1667 ## </param>
1668 #
1669 interface(`files_delete_root_files',`
1670         gen_require(`
1671                 type root_t;
1672         ')
1673
1674         allow $1 root_t:file unlink;
1675 ')
1676
1677 ########################################
1678 ## <summary>
1679 ##      Remove entries from the root directory.
1680 ## </summary>
1681 ## <param name="domain">
1682 ##      <summary>
1683 ##      Domain allowed access.
1684 ##      </summary>
1685 ## </param>
1686 #
1687 interface(`files_delete_root_dir_entry',`
1688         gen_require(`
1689                 type root_t;
1690         ')
1691
1692         allow $1 root_t:dir rw_dir_perms;
1693 ')
1694
1695 ########################################
1696 ## <summary>
1697 ##      Unmount a rootfs filesystem.
1698 ## </summary>
1699 ## <param name="domain">
1700 ##      <summary>
1701 ##      Domain allowed access.
1702 ##      </summary>
1703 ## </param>
1704 #
1705 interface(`files_unmount_rootfs',`
1706         gen_require(`
1707                 type root_t;
1708         ')
1709
1710         allow $1 root_t:filesystem unmount;
1711 ')
1712
1713 ########################################
1714 ## <summary>
1715 ##      Get attributes of the /boot directory.
1716 ## </summary>
1717 ## <param name="domain">
1718 ##      <summary>
1719 ##      Domain allowed access.
1720 ##      </summary>
1721 ## </param>
1722 #
1723 interface(`files_getattr_boot_dirs',`
1724         gen_require(`
1725                 type boot_t;
1726         ')
1727
1728         allow $1 boot_t:dir getattr;
1729 ')
1730
1731 ########################################
1732 ## <summary>
1733 ##      Do not audit attempts to get attributes
1734 ##      of the /boot directory.
1735 ## </summary>
1736 ## <param name="domain">
1737 ##      <summary>
1738 ##      Domain to not audit.
1739 ##      </summary>
1740 ## </param>
1741 #
1742 interface(`files_dontaudit_getattr_boot_dirs',`
1743         gen_require(`
1744                 type boot_t;
1745         ')
1746
1747         dontaudit $1 boot_t:dir getattr;
1748 ')
1749
1750 ########################################
1751 ## <summary>
1752 ##      Search the /boot directory.
1753 ## </summary>
1754 ## <param name="domain">
1755 ##      <summary>
1756 ##      Domain allowed access.
1757 ##      </summary>
1758 ## </param>
1759 #
1760 interface(`files_search_boot',`
1761         gen_require(`
1762                 type boot_t;
1763         ')
1764
1765         allow $1 boot_t:dir search_dir_perms;
1766 ')
1767
1768 ########################################
1769 ## <summary>
1770 ##      Do not audit attempts to search the /boot directory.
1771 ## </summary>
1772 ## <param name="domain">
1773 ##      <summary>
1774 ##      Domain to not audit.
1775 ##      </summary>
1776 ## </param>
1777 #
1778 interface(`files_dontaudit_search_boot',`
1779         gen_require(`
1780                 type boot_t;
1781         ')
1782
1783         dontaudit $1 boot_t:dir search_dir_perms;
1784 ')
1785
1786 ########################################
1787 ## <summary>
1788 ##      List the /boot directory.
1789 ## </summary>
1790 ## <param name="domain">
1791 ##      <summary>
1792 ##      Domain allowed access.
1793 ##      </summary>
1794 ## </param>
1795 #
1796 interface(`files_list_boot',`
1797         gen_require(`
1798                 type boot_t;
1799         ')
1800
1801         allow $1 boot_t:dir list_dir_perms;
1802 ')
1803
1804 #######################################
1805 ## <summary>
1806 ##  Dontaudit List the /boot directory.
1807 ## </summary>
1808 ## <param name="domain">
1809 ##  <summary>
1810 ##  Domain allowed access.
1811 ##  </summary>
1812 ## </param>
1813 #
1814 interface(`files_dontaudit_list_boot',`
1815     gen_require(`
1816         type boot_t;
1817     ')
1818
1819     dontaudit $1 boot_t:dir list_dir_perms;
1820 ')
1821
1822 ########################################
1823 ## <summary>
1824 ##      Create directories in /boot
1825 ## </summary>
1826 ## <param name="domain">
1827 ##      <summary>
1828 ##      Domain allowed access.
1829 ##      </summary>
1830 ## </param>
1831 #
1832 interface(`files_create_boot_dirs',`
1833         gen_require(`
1834                 type boot_t;
1835         ')
1836
1837         allow $1 boot_t:dir { create rw_dir_perms };
1838 ')
1839
1840 ########################################
1841 ## <summary>
1842 ##      Create, read, write, and delete
1843 ##      directories in /boot.
1844 ## </summary>
1845 ## <param name="domain">
1846 ##      <summary>
1847 ##      Domain allowed access.
1848 ##      </summary>
1849 ## </param>
1850 #
1851 interface(`files_manage_boot_dirs',`
1852         gen_require(`
1853                 type boot_t;
1854         ')
1855
1856         allow $1 boot_t:dir manage_dir_perms;
1857 ')
1858
1859 ########################################
1860 ## <summary>
1861 ##      Create a private type object in boot
1862 ##      with an automatic type transition
1863 ## </summary>
1864 ## <param name="domain">
1865 ##      <summary>
1866 ##      Domain allowed access.
1867 ##      </summary>
1868 ## </param>
1869 ## <param name="private_type">
1870 ##      <summary>
1871 ##      The type of the object to be created.
1872 ##      </summary>
1873 ## </param>
1874 ## <param name="object_class">
1875 ##      <summary>
1876 ##      The object class of the object being created.
1877 ##      </summary>
1878 ## </param>
1879 #
1880 interface(`files_boot_filetrans',`
1881         gen_require(`
1882                 type boot_t;
1883         ')
1884
1885         filetrans_pattern($1, boot_t, $2, $3)
1886 ')
1887
1888 ########################################
1889 ## <summary>
1890 ##      read files in the /boot directory.
1891 ## </summary>
1892 ## <param name="domain">
1893 ##      <summary>
1894 ##      Domain allowed access.
1895 ##      </summary>
1896 ## </param>
1897 ## <rolecap/>
1898 #
1899 interface(`files_read_boot_files',`
1900         gen_require(`
1901                 type boot_t;
1902         ')
1903
1904         read_files_pattern($1, boot_t, boot_t)
1905 ')
1906
1907 ########################################
1908 ## <summary>
1909 ##      Create, read, write, and delete files
1910 ##      in the /boot directory.
1911 ## </summary>
1912 ## <param name="domain">
1913 ##      <summary>
1914 ##      Domain allowed access.
1915 ##      </summary>
1916 ## </param>
1917 ## <rolecap/>
1918 #
1919 interface(`files_manage_boot_files',`
1920         gen_require(`
1921                 type boot_t;
1922         ')
1923
1924         manage_files_pattern($1, boot_t, boot_t)
1925 ')
1926
1927 ########################################
1928 ## <summary>
1929 ##      Relabel from files in the /boot directory.
1930 ## </summary>
1931 ## <param name="domain">
1932 ##      <summary>
1933 ##      Domain allowed access.
1934 ##      </summary>
1935 ## </param>
1936 #
1937 interface(`files_relabelfrom_boot_files',`
1938         gen_require(`
1939                 type boot_t;
1940         ')
1941
1942         relabelfrom_files_pattern($1, boot_t, boot_t)
1943 ')
1944
1945 ######################################
1946 ## <summary>
1947 ##  Read symbolic links
1948 ##  in the /boot directory.
1949 ## </summary>
1950 ## <param name="domain">
1951 ##  <summary>
1952 ##  Domain allowed access.
1953 ##  </summary>
1954 ## </param>
1955 #
1956 interface(`files_read_boot_symlinks',`
1957     gen_require(`
1958         type boot_t;
1959     ')
1960
1961     read_lnk_files_pattern($1, boot_t, boot_t)
1962 ')
1963
1964 ########################################
1965 ## <summary>
1966 ##      Read and write symbolic links
1967 ##      in the /boot directory.
1968 ## </summary>
1969 ## <param name="domain">
1970 ##      <summary>
1971 ##      Domain allowed access.
1972 ##      </summary>
1973 ## </param>
1974 #
1975 interface(`files_rw_boot_symlinks',`
1976         gen_require(`
1977                 type boot_t;
1978         ')
1979
1980         allow $1 boot_t:dir list_dir_perms;
1981         rw_lnk_files_pattern($1, boot_t, boot_t)
1982 ')
1983
1984 ########################################
1985 ## <summary>
1986 ##      Create, read, write, and delete symbolic links
1987 ##      in the /boot directory.
1988 ## </summary>
1989 ## <param name="domain">
1990 ##      <summary>
1991 ##      Domain allowed access.
1992 ##      </summary>
1993 ## </param>
1994 #
1995 interface(`files_manage_boot_symlinks',`
1996         gen_require(`
1997                 type boot_t;
1998         ')
1999
2000         manage_lnk_files_pattern($1, boot_t, boot_t)
2001 ')
2002
2003 ########################################
2004 ## <summary>
2005 ##      Read kernel files in the /boot directory.
2006 ## </summary>
2007 ## <param name="domain">
2008 ##      <summary>
2009 ##      Domain allowed access.
2010 ##      </summary>
2011 ## </param>
2012 #
2013 interface(`files_read_kernel_img',`
2014         gen_require(`
2015                 type boot_t;
2016         ')
2017
2018         allow $1 boot_t:dir list_dir_perms;
2019         read_files_pattern($1, boot_t, boot_t)
2020         read_lnk_files_pattern($1, boot_t, boot_t)
2021 ')
2022
2023 ########################################
2024 ## <summary>
2025 ##      Install a kernel into the /boot directory.
2026 ## </summary>
2027 ## <param name="domain">
2028 ##      <summary>
2029 ##      Domain allowed access.
2030 ##      </summary>
2031 ## </param>
2032 ## <rolecap/>
2033 #
2034 interface(`files_create_kernel_img',`
2035         gen_require(`
2036                 type boot_t;
2037         ')
2038
2039         allow $1 boot_t:file { create_file_perms rw_file_perms };
2040         manage_lnk_files_pattern($1, boot_t, boot_t)
2041 ')
2042
2043 ########################################
2044 ## <summary>
2045 ##      Delete a kernel from /boot.
2046 ## </summary>
2047 ## <param name="domain">
2048 ##      <summary>
2049 ##      Domain allowed access.
2050 ##      </summary>
2051 ## </param>
2052 ## <rolecap/>
2053 #
2054 interface(`files_delete_kernel',`
2055         gen_require(`
2056                 type boot_t;
2057         ')
2058
2059         delete_files_pattern($1, boot_t, boot_t)
2060 ')
2061
2062 ########################################
2063 ## <summary>
2064 ##      Getattr of directories with the default file type.
2065 ## </summary>
2066 ## <param name="domain">
2067 ##      <summary>
2068 ##      Domain allowed access.
2069 ##      </summary>
2070 ## </param>
2071 #
2072 interface(`files_getattr_default_dirs',`
2073         gen_require(`
2074                 type default_t;
2075         ')
2076
2077         allow $1 default_t:dir getattr;
2078 ')
2079
2080 ########################################
2081 ## <summary>
2082 ##      Do not audit attempts to get the attributes of
2083 ##      directories with the default file type.
2084 ## </summary>
2085 ## <param name="domain">
2086 ##      <summary>
2087 ##      Domain to not audit.
2088 ##      </summary>
2089 ## </param>
2090 #
2091 interface(`files_dontaudit_getattr_default_dirs',`
2092         gen_require(`
2093                 type default_t;
2094         ')
2095
2096         dontaudit $1 default_t:dir getattr;
2097 ')
2098
2099 ########################################
2100 ## <summary>
2101 ##      Search the contents of directories with the default file type.
2102 ## </summary>
2103 ## <param name="domain">
2104 ##      <summary>
2105 ##      Domain allowed access.
2106 ##      </summary>
2107 ## </param>
2108 #
2109 interface(`files_search_default',`
2110         gen_require(`
2111                 type default_t;
2112         ')
2113
2114         allow $1 default_t:dir search_dir_perms;
2115 ')
2116
2117 ########################################
2118 ## <summary>
2119 ##      List contents of directories with the default file type.
2120 ## </summary>
2121 ## <param name="domain">
2122 ##      <summary>
2123 ##      Domain allowed access.
2124 ##      </summary>
2125 ## </param>
2126 #
2127 interface(`files_list_default',`
2128         gen_require(`
2129                 type default_t;
2130         ')
2131
2132         allow $1 default_t:dir list_dir_perms;
2133 ')
2134
2135 ########################################
2136 ## <summary>
2137 ##      Do not audit attempts to list contents of
2138 ##      directories with the default file type.
2139 ## </summary>
2140 ## <param name="domain">
2141 ##      <summary>
2142 ##      Domain to not audit.
2143 ##      </summary>
2144 ## </param>
2145 #
2146 interface(`files_dontaudit_list_default',`
2147         gen_require(`
2148                 type default_t;
2149         ')
2150
2151         dontaudit $1 default_t:dir list_dir_perms;
2152 ')
2153
2154 ########################################
2155 ## <summary>
2156 ##      Create, read, write, and delete directories with
2157 ##      the default file type.
2158 ## </summary>
2159 ## <param name="domain">
2160 ##      <summary>
2161 ##      Domain allowed access.
2162 ##      </summary>
2163 ## </param>
2164 #
2165 interface(`files_manage_default_dirs',`
2166         gen_require(`
2167                 type default_t;
2168         ')
2169
2170         manage_dirs_pattern($1, default_t, default_t)
2171 ')
2172
2173 ########################################
2174 ## <summary>
2175 ##      Mount a filesystem on a directory with the default file type.
2176 ## </summary>
2177 ## <param name="domain">
2178 ##      <summary>
2179 ##      Domain allowed access.
2180 ##      </summary>
2181 ## </param>
2182 #
2183 interface(`files_mounton_default',`
2184         gen_require(`
2185                 type default_t;
2186         ')
2187
2188         allow $1 default_t:dir { search_dir_perms mounton };
2189 ')
2190
2191 ########################################
2192 ## <summary>
2193 ##      Do not audit attempts to get the attributes of
2194 ##      files with the default file type.
2195 ## </summary>
2196 ## <param name="domain">
2197 ##      <summary>
2198 ##      Domain to not audit.
2199 ##      </summary>
2200 ## </param>
2201 #
2202 interface(`files_dontaudit_getattr_default_files',`
2203         gen_require(`
2204                 type default_t;
2205         ')
2206
2207         dontaudit $1 default_t:file getattr;
2208 ')
2209
2210 ########################################
2211 ## <summary>
2212 ##      Read files with the default file type.
2213 ## </summary>
2214 ## <param name="domain">
2215 ##      <summary>
2216 ##      Domain allowed access.
2217 ##      </summary>
2218 ## </param>
2219 #
2220 interface(`files_read_default_files',`
2221         gen_require(`
2222                 type default_t;
2223         ')
2224
2225         allow $1 default_t:file read_file_perms;
2226 ')
2227
2228 ########################################
2229 ## <summary>
2230 ##      Do not audit attempts to read files
2231 ##      with the default file type.
2232 ## </summary>
2233 ## <param name="domain">
2234 ##      <summary>
2235 ##      Domain to not audit.
2236 ##      </summary>
2237 ## </param>
2238 #
2239 interface(`files_dontaudit_read_default_files',`
2240         gen_require(`
2241                 type default_t;
2242         ')
2243
2244         dontaudit $1 default_t:file read_file_perms;
2245 ')
2246
2247 ########################################
2248 ## <summary>
2249 ##      Create, read, write, and delete files with
2250 ##      the default file type.
2251 ## </summary>
2252 ## <param name="domain">
2253 ##      <summary>
2254 ##      Domain allowed access.
2255 ##      </summary>
2256 ## </param>
2257 #
2258 interface(`files_manage_default_files',`
2259         gen_require(`
2260                 type default_t;
2261         ')
2262
2263         manage_files_pattern($1, default_t, default_t)
2264 ')
2265
2266 ########################################
2267 ## <summary>
2268 ##      Read symbolic links with the default file type.
2269 ## </summary>
2270 ## <param name="domain">
2271 ##      <summary>
2272 ##      Domain allowed access.
2273 ##      </summary>
2274 ## </param>
2275 #
2276 interface(`files_read_default_symlinks',`
2277         gen_require(`
2278                 type default_t;
2279         ')
2280
2281         allow $1 default_t:lnk_file read_lnk_file_perms;
2282 ')
2283
2284 ########################################
2285 ## <summary>
2286 ##      Read sockets with the default file type.
2287 ## </summary>
2288 ## <param name="domain">
2289 ##      <summary>
2290 ##      Domain allowed access.
2291 ##      </summary>
2292 ## </param>
2293 #
2294 interface(`files_read_default_sockets',`
2295         gen_require(`
2296                 type default_t;
2297         ')
2298
2299         allow $1 default_t:sock_file read_sock_file_perms;
2300 ')
2301
2302 ########################################
2303 ## <summary>
2304 ##      Read named pipes with the default file type.
2305 ## </summary>
2306 ## <param name="domain">
2307 ##      <summary>
2308 ##      Domain allowed access.
2309 ##      </summary>
2310 ## </param>
2311 #
2312 interface(`files_read_default_pipes',`
2313         gen_require(`
2314                 type default_t;
2315         ')
2316
2317         allow $1 default_t:fifo_file read_fifo_file_perms;
2318 ')
2319
2320 ########################################
2321 ## <summary>
2322 ##      Search the contents of /etc directories.
2323 ## </summary>
2324 ## <param name="domain">
2325 ##      <summary>
2326 ##      Domain allowed access.
2327 ##      </summary>
2328 ## </param>
2329 #
2330 interface(`files_search_etc',`
2331         gen_require(`
2332                 type etc_t;
2333         ')
2334
2335         allow $1 etc_t:dir search_dir_perms;
2336 ')
2337
2338 ########################################
2339 ## <summary>
2340 ##      Set the attributes of the /etc directories.
2341 ## </summary>
2342 ## <param name="domain">
2343 ##      <summary>
2344 ##      Domain allowed access.
2345 ##      </summary>
2346 ## </param>
2347 #
2348 interface(`files_setattr_etc_dirs',`
2349         gen_require(`
2350                 type etc_t;
2351         ')
2352
2353         allow $1 etc_t:dir setattr;
2354 ')
2355
2356 ########################################
2357 ## <summary>
2358 ##      List the contents of /etc directories.
2359 ## </summary>
2360 ## <param name="domain">
2361 ##      <summary>
2362 ##      Domain allowed access.
2363 ##      </summary>
2364 ## </param>
2365 #
2366 interface(`files_list_etc',`
2367         gen_require(`
2368                 type etc_t;
2369         ')
2370
2371         allow $1 etc_t:dir list_dir_perms;
2372 ')
2373
2374 ########################################
2375 ## <summary>
2376 ##      Do not audit attempts to write to /etc dirs.
2377 ## </summary>
2378 ## <param name="domain">
2379 ##      <summary>
2380 ##      Domain to not audit.
2381 ##      </summary>
2382 ## </param>
2383 #
2384 interface(`files_dontaudit_write_etc_dirs',`
2385         gen_require(`
2386                 type etc_t;
2387         ')
2388
2389         dontaudit $1 etc_t:dir write;
2390 ')
2391
2392 ########################################
2393 ## <summary>
2394 ##      Add and remove entries from /etc directories.
2395 ## </summary>
2396 ## <param name="domain">
2397 ##      <summary>
2398 ##      Domain allowed access.
2399 ##      </summary>
2400 ## </param>
2401 #
2402 interface(`files_rw_etc_dirs',`
2403         gen_require(`
2404                 type etc_t;
2405         ')
2406
2407         allow $1 etc_t:dir rw_dir_perms;
2408 ')
2409
2410 ##########################################
2411 ## <summary>
2412 ##      Manage generic directories in /etc
2413 ## </summary>
2414 ## <param name="domain">
2415 ##      <summary>
2416 ##      Domain allowed access
2417 ##      </summary>
2418 ## </param>
2419 ##
2420 #
2421 interface(`files_manage_etc_dirs',`
2422         gen_require(`
2423                 type etc_t;
2424         ')
2425
2426         manage_dirs_pattern($1, etc_t, etc_t)
2427 ')
2428
2429 ########################################
2430 ## <summary>
2431 ##      Read generic files in /etc.
2432 ## </summary>
2433 ## <desc>
2434 ##      <p>
2435 ##      Allow the specified domain to read generic
2436 ##      files in /etc. These files are typically
2437 ##      general system configuration files that do
2438 ##      not have more specific SELinux types.  Some
2439 ##      examples of these files are:
2440 ##      </p>
2441 ##      <ul>
2442 ##              <li>/etc/fstab</li>
2443 ##              <li>/etc/passwd</li>
2444 ##              <li>/etc/services</li>
2445 ##              <li>/etc/shells</li>
2446 ##      </ul>
2447 ##      <p>
2448 ##      This interface does not include access to /etc/shadow.
2449 ##      </p>
2450 ##      <p>
2451 ##      Generally, it is safe for many domains to have
2452 ##      this access.  However, since this interface provides
2453 ##      access to the /etc/passwd file, caution must be
2454 ##      exercised, as user account names can be leaked
2455 ##      through this access.
2456 ##      </p>
2457 ##      <p>
2458 ##      Related interfaces:
2459 ##      </p>
2460 ##      <ul>
2461 ##              <li>auth_read_shadow()</li>
2462 ##              <li>files_read_etc_runtime_files()</li>
2463 ##              <li>seutil_read_config()</li>
2464 ##      </ul>
2465 ## </desc>
2466 ## <param name="domain">
2467 ##      <summary>
2468 ##      Domain allowed access.
2469 ##      </summary>
2470 ## </param>
2471 ## <infoflow type="read" weight="10"/>
2472 #
2473 interface(`files_read_etc_files',`
2474         gen_require(`
2475                 type etc_t;
2476         ')
2477
2478         allow $1 etc_t:dir list_dir_perms;
2479         read_files_pattern($1, etc_t, etc_t)
2480         read_lnk_files_pattern($1, etc_t, etc_t)
2481 ')
2482
2483 ########################################
2484 ## <summary>
2485 ##      Do not audit attempts to write generic files in /etc.
2486 ## </summary>
2487 ## <param name="domain">
2488 ##      <summary>
2489 ##      Domain allowed access.
2490 ##      </summary>
2491 ## </param>
2492 #
2493 interface(`files_dontaudit_write_etc_files',`
2494         gen_require(`
2495                 type etc_t;
2496         ')
2497
2498         dontaudit $1 etc_t:file write;
2499 ')
2500
2501 ########################################
2502 ## <summary>
2503 ##      Read and write generic files in /etc.
2504 ## </summary>
2505 ## <param name="domain">
2506 ##      <summary>
2507 ##      Domain allowed access.
2508 ##      </summary>
2509 ## </param>
2510 ## <rolecap/>
2511 #
2512 interface(`files_rw_etc_files',`
2513         gen_require(`
2514                 type etc_t;
2515         ')
2516
2517         allow $1 etc_t:dir list_dir_perms;
2518         rw_files_pattern($1, etc_t, etc_t)
2519         read_lnk_files_pattern($1, etc_t, etc_t)
2520 ')
2521
2522 ########################################
2523 ## <summary>
2524 ##      Create, read, write, and delete generic
2525 ##      files in /etc.
2526 ## </summary>
2527 ## <param name="domain">
2528 ##      <summary>
2529 ##      Domain allowed access.
2530 ##      </summary>
2531 ## </param>
2532 ## <rolecap/>
2533 #
2534 interface(`files_manage_etc_files',`
2535         gen_require(`
2536                 type etc_t;
2537         ')
2538
2539         manage_files_pattern($1, etc_t, etc_t)
2540         read_lnk_files_pattern($1, etc_t, etc_t)
2541 ')
2542
2543 ########################################
2544 ## <summary>
2545 ##      Delete system configuration files in /etc.
2546 ## </summary>
2547 ## <param name="domain">
2548 ##      <summary>
2549 ##      Domain allowed access.
2550 ##      </summary>
2551 ## </param>
2552 #
2553 interface(`files_delete_etc_files',`
2554         gen_require(`
2555                 type etc_t;
2556         ')
2557
2558         delete_files_pattern($1, etc_t, etc_t)
2559 ')
2560
2561 ########################################
2562 ## <summary>
2563 ##      Remove entries from the etc directory.
2564 ## </summary>
2565 ## <param name="domain">
2566 ##      <summary>
2567 ##      Domain allowed access.
2568 ##      </summary>
2569 ## </param>
2570 #
2571 interface(`files_delete_etc_dir_entry',`
2572         gen_require(`
2573                 type etc_t;
2574         ')
2575
2576         allow $1 etc_t:dir del_entry_dir_perms;
2577 ')
2578
2579 ########################################
2580 ## <summary>
2581 ##      Execute generic files in /etc.
2582 ## </summary>
2583 ## <param name="domain">
2584 ##      <summary>
2585 ##      Domain allowed access.
2586 ##      </summary>
2587 ## </param>
2588 #
2589 interface(`files_exec_etc_files',`
2590         gen_require(`
2591                 type etc_t;
2592         ')
2593
2594         allow $1 etc_t:dir list_dir_perms;
2595         read_lnk_files_pattern($1, etc_t, etc_t)
2596         exec_files_pattern($1, etc_t, etc_t)
2597 ')
2598
2599 #######################################
2600 ## <summary>
2601 ##      Relabel from and to generic files in /etc.
2602 ## </summary>
2603 ## <param name="domain">
2604 ##      <summary>
2605 ##      Domain allowed access.
2606 ##      </summary>
2607 ## </param>
2608 #
2609 interface(`files_relabel_etc_files',`
2610         gen_require(`
2611                 type etc_t;
2612         ')
2613
2614         allow $1 etc_t:dir list_dir_perms;
2615         relabel_files_pattern($1, etc_t, etc_t)
2616 ')
2617
2618 ########################################
2619 ## <summary>
2620 ##      Read symbolic links in /etc.
2621 ## </summary>
2622 ## <param name="domain">
2623 ##      <summary>
2624 ##      Domain allowed access.
2625 ##      </summary>
2626 ## </param>
2627 #
2628 interface(`files_read_etc_symlinks',`
2629         gen_require(`
2630                 type etc_t;
2631         ')
2632
2633         read_lnk_files_pattern($1, etc_t, etc_t)
2634 ')
2635
2636 ########################################
2637 ## <summary>
2638 ##      Create, read, write, and delete symbolic links in /etc.
2639 ## </summary>
2640 ## <param name="domain">
2641 ##      <summary>
2642 ##      Domain allowed access.
2643 ##      </summary>
2644 ## </param>
2645 #
2646 interface(`files_manage_etc_symlinks',`
2647         gen_require(`
2648                 type etc_t;
2649         ')
2650
2651         manage_lnk_files_pattern($1, etc_t, etc_t)
2652 ')
2653
2654 ########################################
2655 ## <summary>
2656 ##      Create objects in /etc with a private
2657 ##      type using a type_transition.
2658 ## </summary>
2659 ## <param name="domain">
2660 ##      <summary>
2661 ##      Domain allowed access.
2662 ##      </summary>
2663 ## </param>
2664 ## <param name="file_type">
2665 ##      <summary>
2666 ##      Private file type.
2667 ##      </summary>
2668 ## </param>
2669 ## <param name="class">
2670 ##      <summary>
2671 ##      Object classes to be created.
2672 ##      </summary>
2673 ## </param>
2674 #
2675 interface(`files_etc_filetrans',`
2676         gen_require(`
2677                 type etc_t;
2678         ')
2679
2680         filetrans_pattern($1, etc_t, $2, $3)
2681 ')
2682
2683 ########################################
2684 ## <summary>
2685 ##      Create a boot flag.
2686 ## </summary>
2687 ## <desc>
2688 ##      <p>
2689 ##      Create a boot flag, such as
2690 ##      /.autorelabel and /.autofsck.
2691 ##      </p>
2692 ## </desc>
2693 ## <param name="domain">
2694 ##      <summary>
2695 ##      Domain allowed access.
2696 ##      </summary>
2697 ## </param>
2698 ## <rolecap/>
2699 #
2700 interface(`files_create_boot_flag',`
2701         gen_require(`
2702                 type root_t, etc_runtime_t;
2703         ')
2704
2705         allow $1 etc_runtime_t:file manage_file_perms;
2706         filetrans_pattern($1, root_t, etc_runtime_t, file)
2707 ')
2708
2709 ########################################
2710 ## <summary>
2711 ##      Delete a boot flag.
2712 ## </summary>
2713 ## <desc>
2714 ##      <p>
2715 ##      Delete a boot flag, such as
2716 ##      /.autorelabel and /.autofsck.
2717 ##      </p>
2718 ## </desc>
2719 ## <param name="domain">
2720 ##      <summary>
2721 ##      Domain allowed access.
2722 ##      </summary>
2723 ## </param>
2724 ## <rolecap/>
2725 #
2726 interface(`files_delete_boot_flag',`
2727         gen_require(`
2728                 type root_t, etc_runtime_t;
2729         ')
2730
2731         delete_files_pattern($1, root_t, etc_runtime_t)
2732 ')
2733
2734 ########################################
2735 ## <summary>
2736 ##      Read files in /etc that are dynamically
2737 ##      created on boot, such as mtab.
2738 ## </summary>
2739 ## <desc>
2740 ##      <p>
2741 ##      Allow the specified domain to read dynamically created
2742 ##      configuration files in /etc. These files are typically
2743 ##      general system configuration files that do
2744 ##      not have more specific SELinux types.  Some
2745 ##      examples of these files are:
2746 ##      </p>
2747 ##      <ul>
2748 ##              <li>/etc/motd</li>
2749 ##              <li>/etc/mtab</li>
2750 ##              <li>/etc/nologin</li>
2751 ##      </ul>
2752 ##      <p>
2753 ##      This interface does not include access to /etc/shadow.
2754 ##      </p>
2755 ## </desc>
2756 ## <param name="domain">
2757 ##      <summary>
2758 ##      Domain allowed access.
2759 ##      </summary>
2760 ## </param>
2761 ## <infoflow type="read" weight="10" />
2762 ## <rolecap/>
2763 #
2764 interface(`files_read_etc_runtime_files',`
2765         gen_require(`
2766                 type etc_t, etc_runtime_t;
2767         ')
2768
2769         allow $1 etc_t:dir list_dir_perms;
2770         read_files_pattern($1, etc_t, etc_runtime_t)
2771         read_lnk_files_pattern($1, etc_t, etc_runtime_t)
2772 ')
2773
2774 ########################################
2775 ## <summary>
2776 ##      Do not audit attempts to set the attributes of the etc_runtime files
2777 ## </summary>
2778 ## <param name="domain">
2779 ##      <summary>
2780 ##      Domain allowed access.
2781 ##      </summary>
2782 ## </param>
2783 #
2784 interface(`files_dontaudit_setattr_etc_runtime_files',`
2785         gen_require(`
2786                 type etc_runtime_t;
2787         ')
2788
2789         dontaudit $1 etc_runtime_t:file setattr;
2790 ')
2791
2792 ########################################
2793 ## <summary>
2794 ##      Do not audit attempts to read files
2795 ##      in /etc that are dynamically
2796 ##      created on boot, such as mtab.
2797 ## </summary>
2798 ## <param name="domain">
2799 ##      <summary>
2800 ##      Domain to not audit.
2801 ##      </summary>
2802 ## </param>
2803 #
2804 interface(`files_dontaudit_read_etc_runtime_files',`
2805         gen_require(`
2806                 type etc_runtime_t;
2807         ')
2808
2809         dontaudit $1 etc_runtime_t:file { getattr read };
2810 ')
2811
2812 ########################################
2813 ## <summary>
2814 ##      Read and write files in /etc that are dynamically
2815 ##      created on boot, such as mtab.
2816 ## </summary>
2817 ## <param name="domain">
2818 ##      <summary>
2819 ##      Domain allowed access.
2820 ##      </summary>
2821 ## </param>
2822 ## <rolecap/>
2823 #
2824 interface(`files_rw_etc_runtime_files',`
2825         gen_require(`
2826                 type etc_t, etc_runtime_t;
2827         ')
2828
2829         allow $1 etc_t:dir list_dir_perms;
2830         rw_files_pattern($1, etc_t, etc_runtime_t)
2831 ')
2832
2833 ########################################
2834 ## <summary>
2835 ##      Create, read, write, and delete files in
2836 ##      /etc that are dynamically created on boot,
2837 ##      such as mtab.
2838 ## </summary>
2839 ## <param name="domain">
2840 ##      <summary>
2841 ##      Domain allowed access.
2842 ##      </summary>
2843 ## </param>
2844 ## <rolecap/>
2845 #
2846 interface(`files_manage_etc_runtime_files',`
2847         gen_require(`
2848                 type etc_t, etc_runtime_t;
2849         ')
2850
2851         manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t)
2852 ')
2853
2854 ########################################
2855 ## <summary>
2856 ##      Create, etc runtime objects with an automatic
2857 ##      type transition.
2858 ## </summary>
2859 ## <param name="domain">
2860 ##      <summary>
2861 ##      Domain allowed access.
2862 ##      </summary>
2863 ## </param>
2864 ## <param name="object">
2865 ##      <summary>
2866 ##      The class of the object being created.
2867 ##      </summary>
2868 ## </param>
2869 #
2870 interface(`files_etc_filetrans_etc_runtime',`
2871         gen_require(`
2872                 type etc_t, etc_runtime_t;
2873         ')
2874
2875         filetrans_pattern($1, etc_t, etc_runtime_t, $2)
2876 ')
2877
2878 ########################################
2879 ## <summary>
2880 ##      Getattr of directories on new filesystems
2881 ##      that have not yet been labeled.
2882 ## </summary>
2883 ## <param name="domain">
2884 ##      <summary>
2885 ##      Domain allowed access.
2886 ##      </summary>
2887 ## </param>
2888 #
2889 interface(`files_getattr_isid_type_dirs',`
2890         gen_require(`
2891                 type file_t;
2892         ')
2893
2894         allow $1 file_t:dir getattr;
2895 ')
2896
2897 ########################################
2898 ## <summary>
2899 ##      Do not audit attempts to search directories on new filesystems
2900 ##      that have not yet been labeled.
2901 ## </summary>
2902 ## <param name="domain">
2903 ##      <summary>
2904 ##      Domain to not audit.
2905 ##      </summary>
2906 ## </param>
2907 #
2908 interface(`files_dontaudit_search_isid_type_dirs',`
2909         gen_require(`
2910                 type file_t;
2911         ')
2912
2913         dontaudit $1 file_t:dir search_dir_perms;
2914 ')
2915
2916 ########################################
2917 ## <summary>
2918 ##      List the contents of directories on new filesystems
2919 ##      that have not yet been labeled.
2920 ## </summary>
2921 ## <param name="domain">
2922 ##      <summary>
2923 ##      Domain allowed access.
2924 ##      </summary>
2925 ## </param>
2926 #
2927 interface(`files_list_isid_type_dirs',`
2928         gen_require(`
2929                 type file_t;
2930         ')
2931
2932         allow $1 file_t:dir list_dir_perms;
2933 ')
2934
2935 ########################################
2936 ## <summary>
2937 ##      Read and write directories on new filesystems
2938 ##      that have not yet been labeled.
2939 ## </summary>
2940 ## <param name="domain">
2941 ##      <summary>
2942 ##      Domain allowed access.
2943 ##      </summary>
2944 ## </param>
2945 #
2946 interface(`files_rw_isid_type_dirs',`
2947         gen_require(`
2948                 type file_t;
2949         ')
2950
2951         allow $1 file_t:dir rw_dir_perms;
2952 ')
2953
2954 ########################################
2955 ## <summary>
2956 ##      Delete directories on new filesystems
2957 ##      that have not yet been labeled.
2958 ## </summary>
2959 ## <param name="domain">
2960 ##      <summary>
2961 ##      Domain allowed access.
2962 ##      </summary>
2963 ## </param>
2964 #
2965 interface(`files_delete_isid_type_dirs',`
2966         gen_require(`
2967                 type file_t;
2968         ')
2969
2970         delete_dirs_pattern($1, file_t, file_t)
2971 ')
2972
2973 ########################################
2974 ## <summary>
2975 ##      Create, read, write, and delete directories
2976 ##      on new filesystems that have not yet been labeled.
2977 ## </summary>
2978 ## <param name="domain">
2979 ##      <summary>
2980 ##      Domain allowed access.
2981 ##      </summary>
2982 ## </param>
2983 #
2984 interface(`files_manage_isid_type_dirs',`
2985         gen_require(`
2986                 type file_t;
2987         ')
2988
2989         allow $1 file_t:dir manage_dir_perms;
2990 ')
2991
2992 ########################################
2993 ## <summary>
2994 ##      Mount a filesystem on a directory on new filesystems
2995 ##      that has not yet been labeled.
2996 ## </summary>
2997 ## <param name="domain">
2998 ##      <summary>
2999 ##      Domain allowed access.
3000 ##      </summary>
3001 ## </param>
3002 #
3003 interface(`files_mounton_isid_type_dirs',`
3004         gen_require(`
3005                 type file_t;
3006         ')
3007
3008         allow $1 file_t:dir { search_dir_perms mounton };
3009 ')
3010
3011 ########################################
3012 ## <summary>
3013 ##      Read files on new filesystems
3014 ##      that have not yet been labeled.
3015 ## </summary>
3016 ## <param name="domain">
3017 ##      <summary>
3018 ##      Domain allowed access.
3019 ##      </summary>
3020 ## </param>
3021 #
3022 interface(`files_read_isid_type_files',`
3023         gen_require(`
3024                 type file_t;
3025         ')
3026
3027         allow $1 file_t:file read_file_perms;
3028 ')
3029
3030 ########################################
3031 ## <summary>
3032 ##      Delete files on new filesystems
3033 ##      that have not yet been labeled.
3034 ## </summary>
3035 ## <param name="domain">
3036 ##      <summary>
3037 ##      Domain allowed access.
3038 ##      </summary>
3039 ## </param>
3040 #
3041 interface(`files_delete_isid_type_files',`
3042         gen_require(`
3043                 type file_t;
3044         ')
3045
3046         delete_files_pattern($1, file_t, file_t)
3047 ')
3048
3049 ########################################
3050 ## <summary>
3051 ##      Delete symbolic links on new filesystems
3052 ##      that have not yet been labeled.
3053 ## </summary>
3054 ## <param name="domain">
3055 ##      <summary>
3056 ##      Domain allowed access.
3057 ##      </summary>
3058 ## </param>
3059 #
3060 interface(`files_delete_isid_type_symlinks',`
3061         gen_require(`
3062                 type file_t;
3063         ')
3064
3065         delete_lnk_files_pattern($1, file_t, file_t)
3066 ')
3067
3068 ########################################
3069 ## <summary>
3070 ##      Delete named pipes on new filesystems
3071 ##      that have not yet been labeled.
3072 ## </summary>
3073 ## <param name="domain">
3074 ##      <summary>
3075 ##      Domain allowed access.
3076 ##      </summary>
3077 ## </param>
3078 #
3079 interface(`files_delete_isid_type_fifo_files',`
3080         gen_require(`
3081                 type file_t;
3082         ')
3083
3084         delete_fifo_files_pattern($1, file_t, file_t)
3085 ')
3086
3087 ########################################
3088 ## <summary>
3089 ##      Delete named sockets on new filesystems
3090 ##      that have not yet been labeled.
3091 ## </summary>
3092 ## <param name="domain">
3093 ##      <summary>
3094 ##      Domain allowed access.
3095 ##      </summary>
3096 ## </param>
3097 #
3098 interface(`files_delete_isid_type_sock_files',`
3099         gen_require(`
3100                 type file_t;
3101         ')
3102
3103         delete_sock_files_pattern($1, file_t, file_t)
3104 ')
3105
3106 ########################################
3107 ## <summary>
3108 ##      Delete block files on new filesystems
3109 ##      that have not yet been labeled.
3110 ## </summary>
3111 ## <param name="domain">
3112 ##      <summary>
3113 ##      Domain allowed access.
3114 ##      </summary>
3115 ## </param>
3116 #
3117 interface(`files_delete_isid_type_blk_files',`
3118         gen_require(`
3119                 type file_t;
3120         ')
3121
3122         delete_blk_files_pattern($1, file_t, file_t)
3123 ')
3124
3125 ########################################
3126 ## <summary>
3127 ##      Do not audit attempts to write to character
3128 ##      files that have not yet been labeled.
3129 ## </summary>
3130 ## <param name="domain">
3131 ##      <summary>
3132 ##      Domain to not audit.
3133 ##      </summary>
3134 ## </param>
3135 #
3136 interface(`files_dontaudit_write_isid_chr_files',`
3137         gen_require(`
3138                 type file_t;
3139         ')
3140
3141         dontaudit $1 file_t:chr_file write;
3142 ')
3143
3144 ########################################
3145 ## <summary>
3146 ##      Delete chr files on new filesystems
3147 ##      that have not yet been labeled.
3148 ## </summary>
3149 ## <param name="domain">
3150 ##      <summary>
3151 ##      Domain allowed access.
3152 ##      </summary>
3153 ## </param>
3154 #
3155 interface(`files_delete_isid_type_chr_files',`
3156         gen_require(`
3157                 type file_t;
3158         ')
3159
3160         delete_chr_files_pattern($1, file_t, file_t)
3161 ')
3162
3163 ########################################
3164 ## <summary>
3165 ##      Create, read, write, and delete files
3166 ##      on new filesystems that have not yet been labeled.
3167 ## </summary>
3168 ## <param name="domain">
3169 ##      <summary>
3170 ##      Domain allowed access.
3171 ##      </summary>
3172 ## </param>
3173 #
3174 interface(`files_manage_isid_type_files',`
3175         gen_require(`
3176                 type file_t;
3177         ')
3178
3179         allow $1 file_t:file manage_file_perms;
3180 ')
3181
3182 ########################################
3183 ## <summary>
3184 ##      Create, read, write, and delete symbolic links
3185 ##      on new filesystems that have not yet been labeled.
3186 ## </summary>
3187 ## <param name="domain">
3188 ##      <summary>
3189 ##      Domain allowed access.
3190 ##      </summary>
3191 ## </param>
3192 #
3193 interface(`files_manage_isid_type_symlinks',`
3194         gen_require(`
3195                 type file_t;
3196         ')
3197
3198         allow $1 file_t:lnk_file manage_lnk_file_perms;
3199 ')
3200
3201 ########################################
3202 ## <summary>
3203 ##      Read and write block device nodes on new filesystems
3204 ##      that have not yet been labeled.
3205 ## </summary>
3206 ## <param name="domain">
3207 ##      <summary>
3208 ##      Domain allowed access.
3209 ##      </summary>
3210 ## </param>
3211 #
3212 interface(`files_rw_isid_type_blk_files',`
3213         gen_require(`
3214                 type file_t;
3215         ')
3216
3217         allow $1 file_t:blk_file rw_blk_file_perms;
3218 ')
3219
3220 ########################################
3221 ## <summary>
3222 ##      Create, read, write, and delete block device nodes
3223 ##      on new filesystems that have not yet been labeled.
3224 ## </summary>
3225 ## <param name="domain">
3226 ##      <summary>
3227 ##      Domain allowed access.
3228 ##      </summary>
3229 ## </param>
3230 #
3231 interface(`files_manage_isid_type_blk_files',`
3232         gen_require(`
3233                 type file_t;
3234         ')
3235
3236         allow $1 file_t:blk_file manage_blk_file_perms;
3237 ')
3238
3239 ########################################
3240 ## <summary>
3241 ##      Create, read, write, and delete character device nodes
3242 ##      on new filesystems that have not yet been labeled.
3243 ## </summary>
3244 ## <param name="domain">
3245 ##      <summary>
3246 ##      Domain allowed access.
3247 ##      </summary>
3248 ## </param>
3249 #
3250 interface(`files_manage_isid_type_chr_files',`
3251         gen_require(`
3252                 type file_t;
3253         ')
3254
3255         allow $1 file_t:chr_file manage_chr_file_perms;
3256 ')
3257
3258 ########################################
3259 ## <summary>
3260 ##      Get the attributes of the home directories root
3261 ##      (/home).
3262 ## </summary>
3263 ## <param name="domain">
3264 ##      <summary>
3265 ##      Domain allowed access.
3266 ##      </summary>
3267 ## </param>
3268 #
3269 interface(`files_getattr_home_dir',`
3270         gen_require(`
3271                 type home_root_t;
3272         ')
3273
3274         allow $1 home_root_t:dir getattr;
3275         allow $1 home_root_t:lnk_file getattr;
3276 ')
3277
3278 ########################################
3279 ## <summary>
3280 ##      Do not audit attempts to get the
3281 ##      attributes of the home directories root
3282 ##      (/home).
3283 ## </summary>
3284 ## <param name="domain">
3285 ##      <summary>
3286 ##      Domain to not audit.
3287 ##      </summary>
3288 ## </param>
3289 #
3290 interface(`files_dontaudit_getattr_home_dir',`
3291         gen_require(`
3292                 type home_root_t;
3293         ')
3294
3295         dontaudit $1 home_root_t:dir getattr;
3296         dontaudit $1 home_root_t:lnk_file getattr;
3297 ')
3298
3299 ########################################
3300 ## <summary>
3301 ##      Search home directories root (/home).
3302 ## </summary>
3303 ## <param name="domain">
3304 ##      <summary>
3305 ##      Domain allowed access.
3306 ##      </summary>
3307 ## </param>
3308 #
3309 interface(`files_search_home',`
3310         gen_require(`
3311                 type home_root_t;
3312         ')
3313
3314         allow $1 home_root_t:dir search_dir_perms;
3315         allow $1 home_root_t:lnk_file read_lnk_file_perms;
3316 ')
3317
3318 ########################################
3319 ## <summary>
3320 ##      Do not audit attempts to search
3321 ##      home directories root (/home).
3322 ## </summary>
3323 ## <param name="domain">
3324 ##      <summary>
3325 ##      Domain to not audit.
3326 ##      </summary>
3327 ## </param>
3328 #
3329 interface(`files_dontaudit_search_home',`
3330         gen_require(`
3331                 type home_root_t;
3332         ')
3333
3334         dontaudit $1 home_root_t:dir search_dir_perms;
3335         dontaudit $1 home_root_t:lnk_file read_lnk_file_perms;
3336 ')
3337
3338 ########################################
3339 ## <summary>
3340 ##      Do not audit attempts to list
3341 ##      home directories root (/home).
3342 ## </summary>
3343 ## <param name="domain">
3344 ##      <summary>
3345 ##      Domain to not audit.
3346 ##      </summary>
3347 ## </param>
3348 #
3349 interface(`files_dontaudit_list_home',`
3350         gen_require(`
3351                 type home_root_t;
3352         ')
3353
3354         dontaudit $1 home_root_t:dir list_dir_perms;
3355         dontaudit $1 home_root_t:lnk_file read_lnk_file_perms;
3356 ')
3357
3358 ########################################
3359 ## <summary>
3360 ##      Get listing of home directories.
3361 ## </summary>
3362 ## <param name="domain">
3363 ##      <summary>
3364 ##      Domain allowed access.
3365 ##      </summary>
3366 ## </param>
3367 #
3368 interface(`files_list_home',`
3369         gen_require(`
3370                 type home_root_t;
3371         ')
3372
3373         allow $1 home_root_t:dir list_dir_perms;
3374         allow $1 home_root_t:lnk_file read_lnk_file_perms;
3375 ')
3376
3377 ########################################
3378 ## <summary>
3379 ##      Relabel to user home root (/home).
3380 ## </summary>
3381 ## <param name="domain">
3382 ##      <summary>
3383 ##      Domain allowed access.
3384 ##      </summary>
3385 ## </param>
3386 #
3387 interface(`files_relabelto_home',`
3388         gen_require(`
3389                 type home_root_t;
3390         ')
3391
3392         allow $1 home_root_t:dir relabelto;
3393 ')
3394
3395 ########################################
3396 ## <summary>
3397 ##      Create objects in /home.
3398 ## </summary>
3399 ## <param name="domain">
3400 ##      <summary>
3401 ##      Domain allowed access.
3402 ##      </summary>
3403 ## </param>
3404 ## <param name="home_type">
3405 ##      <summary>
3406 ##      The private type.
3407 ##      </summary>
3408 ## </param>
3409 ## <param name="object">
3410 ##      <summary>
3411 ##      The class of the object being created.
3412 ##      </summary>
3413 ## </param>
3414 #
3415 interface(`files_home_filetrans',`
3416         gen_require(`
3417                 type home_root_t;
3418         ')
3419
3420         filetrans_pattern($1, home_root_t, $2, $3)
3421 ')
3422
3423 ########################################
3424 ## <summary>
3425 ##      Get the attributes of lost+found directories.
3426 ## </summary>
3427 ## <param name="domain">
3428 ##      <summary>
3429 ##      Domain allowed access.
3430 ##      </summary>
3431 ## </param>
3432 #
3433 interface(`files_getattr_lost_found_dirs',`
3434         gen_require(`
3435                 type lost_found_t;
3436         ')
3437
3438         allow $1 lost_found_t:dir getattr;
3439 ')
3440
3441 ########################################
3442 ## <summary>
3443 ##      Do not audit attempts to get the attributes of
3444 ##      lost+found directories.
3445 ## </summary>
3446 ## <param name="domain">
3447 ##      <summary>
3448 ##      Domain to not audit.
3449 ##      </summary>
3450 ## </param>
3451 #
3452 interface(`files_dontaudit_getattr_lost_found_dirs',`
3453         gen_require(`
3454                 type lost_found_t;
3455         ')
3456
3457         dontaudit $1 lost_found_t:dir getattr;
3458 ')
3459
3460 #######################################
3461 ## <summary>
3462 ##  List the contents of /tmp/lost-found
3463 ## </summary>
3464 ## <param name="domain">
3465 ##  <summary>
3466 ##  Domain allowed access.
3467 ##  </summary>
3468 ## </param>
3469 #
3470 interface(`files_list_lost_found_dirs',`
3471     gen_require(`
3472                 type lost_found_t;
3473         ')
3474
3475         allow $1 lost_found_t:dir list_dir_perms;
3476 ')
3477
3478 ########################################
3479 ## <summary>
3480 ##      Create, read, write, and delete objects in
3481 ##      lost+found directories.
3482 ## </summary>
3483 ## <param name="domain">
3484 ##      <summary>
3485 ##      Domain allowed access.
3486 ##      </summary>
3487 ## </param>
3488 ## <rolecap/>
3489 #
3490 interface(`files_manage_lost_found',`
3491         gen_require(`
3492                 type lost_found_t;
3493         ')
3494
3495         manage_dirs_pattern($1, lost_found_t, lost_found_t)
3496         manage_files_pattern($1, lost_found_t, lost_found_t)
3497         manage_lnk_files_pattern($1, lost_found_t, lost_found_t)
3498         manage_fifo_files_pattern($1, lost_found_t, lost_found_t)
3499         manage_sock_files_pattern($1, lost_found_t, lost_found_t)
3500 ')
3501
3502 ########################################
3503 ## <summary>
3504 ##      Search the contents of /mnt.
3505 ## </summary>
3506 ## <param name="domain">
3507 ##      <summary>
3508 ##      Domain allowed access.
3509 ##      </summary>
3510 ## </param>
3511 #
3512 interface(`files_search_mnt',`
3513         gen_require(`
3514                 type mnt_t;
3515         ')
3516
3517         allow $1 mnt_t:dir search_dir_perms;
3518 ')
3519
3520 ########################################
3521 ## <summary>
3522 ##      Do not audit attempts to search /mnt.
3523 ## </summary>
3524 ## <param name="domain">
3525 ##      <summary>
3526 ##      Domain to not audit.
3527 ##      </summary>
3528 ## </param>
3529 #
3530 interface(`files_dontaudit_search_mnt',`
3531         gen_require(`
3532                 type mnt_t;
3533         ')
3534
3535         dontaudit $1 mnt_t:dir search_dir_perms;
3536 ')
3537
3538 ########################################
3539 ## <summary>
3540 ##      List the contents of /mnt.
3541 ## </summary>
3542 ## <param name="domain">
3543 ##      <summary>
3544 ##      Domain allowed access.
3545 ##      </summary>
3546 ## </param>
3547 #
3548 interface(`files_list_mnt',`
3549         gen_require(`
3550                 type mnt_t;
3551         ')
3552
3553         allow $1 mnt_t:dir list_dir_perms;
3554 ')
3555
3556 ######################################
3557 ## <summary>
3558 ##  dontaudit List the contents of /mnt.
3559 ## </summary>
3560 ## <param name="domain">
3561 ##  <summary>
3562 ##  Domain allowed access.
3563 ##  </summary>
3564 ## </param>
3565 #
3566 interface(`files_dontaudit_list_mnt',`
3567     gen_require(`
3568         type mnt_t;
3569     ')
3570
3571     dontaudit $1 mnt_t:dir list_dir_perms;
3572 ')
3573
3574 ########################################
3575 ## <summary>
3576 ##      Do not audit attempts to check the
3577 ##      write access on mnt files
3578 ## </summary>
3579 ## <param name="domain">
3580 ##      <summary>
3581 ##      Domain to not audit.
3582 ##      </summary>
3583 ## </param>
3584 #
3585 interface(`files_dontaudit_access_check_mnt',`
3586         gen_require(`
3587                 type mnt_t;
3588         ')
3589
3590         dontaudit $1 mnt_t:file_class_set audit_access;
3591 ')
3592
3593 ########################################
3594 ## <summary>
3595 ##      Mount a filesystem on /mnt.
3596 ## </summary>
3597 ## <param name="domain">
3598 ##      <summary>
3599 ##      Domain allowed access.
3600 ##      </summary>
3601 ## </param>
3602 #
3603 interface(`files_mounton_mnt',`
3604         gen_require(`
3605                 type mnt_t;
3606         ')
3607
3608         allow $1 mnt_t:dir { search_dir_perms mounton };
3609 ')
3610
3611 ########################################
3612 ## <summary>
3613 ##      Create, read, write, and delete directories in /mnt.
3614 ## </summary>
3615 ## <param name="domain">
3616 ##      <summary>
3617 ##      Domain allowed access.
3618 ##      </summary>
3619 ## </param>
3620 ## <rolecap/>
3621 #
3622 interface(`files_manage_mnt_dirs',`
3623         gen_require(`
3624                 type mnt_t;
3625         ')
3626
3627         allow $1 mnt_t:dir manage_dir_perms;
3628 ')
3629
3630 ########################################
3631 ## <summary>
3632 ##      Create, read, write, and delete files in /mnt.
3633 ## </summary>
3634 ## <param name="domain">
3635 ##      <summary>
3636 ##      Domain allowed access.
3637 ##      </summary>
3638 ## </param>
3639 #
3640 interface(`files_manage_mnt_files',`
3641         gen_require(`
3642                 type mnt_t;
3643         ')
3644
3645         manage_files_pattern($1, mnt_t, mnt_t)
3646 ')
3647
3648 ########################################
3649 ## <summary>
3650 ##      read files in /mnt.
3651 ## </summary>
3652 ## <param name="domain">
3653 ##      <summary>
3654 ##      Domain allowed access.
3655 ##      </summary>
3656 ## </param>
3657 #
3658 interface(`files_read_mnt_files',`
3659         gen_require(`
3660                 type mnt_t;
3661         ')
3662
3663         read_files_pattern($1, mnt_t, mnt_t)
3664 ')
3665
3666 ######################################
3667 ## <summary>
3668 ##  Read symbolic links in /mnt.
3669 ## </summary>
3670 ## <param name="domain">
3671 ##  <summary>
3672 ##  Domain allowed access.
3673 ##  </summary>
3674 ## </param>
3675 #
3676 interface(`files_read_mnt_symlinks',`
3677     gen_require(`
3678         type mnt_t;
3679     ')
3680
3681     read_lnk_files_pattern($1, mnt_t, mnt_t)
3682 ')
3683
3684 ########################################
3685 ## <summary>
3686 ##      Create, read, write, and delete symbolic links in /mnt.
3687 ## </summary>
3688 ## <param name="domain">
3689 ##      <summary>
3690 ##      Domain allowed access.
3691 ##      </summary>
3692 ## </param>
3693 #
3694 interface(`files_manage_mnt_symlinks',`
3695         gen_require(`
3696                 type mnt_t;
3697         ')
3698
3699         manage_lnk_files_pattern($1, mnt_t, mnt_t)
3700 ')
3701
3702 ########################################
3703 ## <summary>
3704 ##      Search the contents of the kernel module directories.
3705 ## </summary>
3706 ## <param name="domain">
3707 ##      <summary>
3708 ##      Domain allowed access.
3709 ##      </summary>
3710 ## </param>
3711 #
3712 interface(`files_search_kernel_modules',`
3713         gen_require(`
3714                 type modules_object_t;
3715         ')
3716
3717         allow $1 modules_object_t:dir search_dir_perms;
3718         read_lnk_files_pattern($1, modules_object_t, modules_object_t)
3719 ')
3720
3721 ########################################
3722 ## <summary>
3723 ##      List the contents of the kernel module directories.
3724 ## </summary>
3725 ## <param name="domain">
3726 ##      <summary>
3727 ##      Domain allowed access.
3728 ##      </summary>
3729 ## </param>
3730 #
3731 interface(`files_list_kernel_modules',`
3732         gen_require(`
3733                 type modules_object_t;
3734         ')
3735
3736         allow $1 modules_object_t:dir list_dir_perms;
3737 ')
3738
3739 ########################################
3740 ## <summary>
3741 ##      Get the attributes of kernel module files.
3742 ## </summary>
3743 ## <param name="domain">
3744 ##      <summary>
3745 ##      Domain allowed access.
3746 ##      </summary>
3747 ## </param>
3748 #
3749 interface(`files_getattr_kernel_modules',`
3750         gen_require(`
3751                 type modules_object_t;
3752         ')
3753
3754         getattr_files_pattern($1, modules_object_t, modules_object_t)
3755 ')
3756
3757 ########################################
3758 ## <summary>
3759 ##      Read kernel module files.
3760 ## </summary>
3761 ## <param name="domain">
3762 ##      <summary>
3763 ##      Domain allowed access.
3764 ##      </summary>
3765 ## </param>
3766 #
3767 interface(`files_read_kernel_modules',`
3768         gen_require(`
3769                 type modules_object_t;
3770         ')
3771
3772         allow $1 modules_object_t:dir list_dir_perms;
3773         read_files_pattern($1, modules_object_t, modules_object_t)
3774         read_lnk_files_pattern($1, modules_object_t, modules_object_t)
3775 ')
3776
3777 ########################################
3778 ## <summary>
3779 ##      Write kernel module files.
3780 ## </summary>
3781 ## <param name="domain">
3782 ##      <summary>
3783 ##      Domain allowed access.
3784 ##      </summary>
3785 ## </param>
3786 #
3787 interface(`files_write_kernel_modules',`
3788         gen_require(`
3789                 type modules_object_t;
3790         ')
3791
3792         allow $1 modules_object_t:dir list_dir_perms;
3793         write_files_pattern($1, modules_object_t, modules_object_t)
3794 ')
3795
3796 ########################################
3797 ## <summary>
3798 ##      Delete kernel module files.
3799 ## </summary>
3800 ## <param name="domain">
3801 ##      <summary>
3802 ##      Domain allowed access.
3803 ##      </summary>
3804 ## </param>
3805 #
3806 interface(`files_delete_kernel_modules',`
3807         gen_require(`
3808                 type modules_object_t;
3809         ')
3810
3811         delete_files_pattern($1, modules_object_t, modules_object_t)
3812 ')
3813
3814 ########################################
3815 ## <summary>
3816 ##      Create, read, write, and delete
3817 ##      kernel module files.
3818 ## </summary>
3819 ## <param name="domain">
3820 ##      <summary>
3821 ##      Domain allowed access.
3822 ##      </summary>
3823 ## </param>
3824 ## <rolecap/>
3825 #
3826 interface(`files_manage_kernel_modules',`
3827         gen_require(`
3828                 type modules_object_t;
3829         ')
3830
3831         manage_files_pattern($1, modules_object_t, modules_object_t)
3832 ')
3833
3834 ########################################
3835 ## <summary>
3836 ##      Relabel from and to kernel module files.
3837 ## </summary>
3838 ## <param name="domain">
3839 ##      <summary>
3840 ##      Domain allowed access.
3841 ##      </summary>
3842 ## </param>
3843 #
3844 interface(`files_relabel_kernel_modules',`
3845         gen_require(`
3846                 type modules_object_t;
3847         ')
3848
3849         relabel_files_pattern($1, modules_object_t, modules_object_t)
3850         allow $1 modules_object_t:dir list_dir_perms;
3851 ')
3852
3853 ########################################
3854 ## <summary>
3855 ##      Create objects in the kernel module directories
3856 ##      with a private type via an automatic type transition.
3857 ## </summary>
3858 ## <param name="domain">
3859 ##      <summary>
3860 ##      Domain allowed access.
3861 ##      </summary>
3862 ## </param>
3863 ## <param name="private_type">
3864 ##      <summary>
3865 ##      The type of the object to be created.
3866 ##      </summary>
3867 ## </param>
3868 ## <param name="object_class">
3869 ##      <summary>
3870 ##      The object class of the object being created.
3871 ##      </summary>
3872 ## </param>
3873 #
3874 interface(`files_kernel_modules_filetrans',`
3875         gen_require(`
3876                 type modules_object_t;
3877         ')
3878
3879         filetrans_pattern($1, modules_object_t, $2, $3)
3880 ')
3881
3882 ########################################
3883 ## <summary>
3884 ##      List world-readable directories.
3885 ## </summary>
3886 ## <param name="domain">
3887 ##      <summary>
3888 ##      Domain allowed access.
3889 ##      </summary>
3890 ## </param>
3891 ## <rolecap/>
3892 #
3893 interface(`files_list_world_readable',`
3894         gen_require(`
3895                 type readable_t;
3896         ')
3897
3898         allow $1 readable_t:dir list_dir_perms;
3899 ')
3900
3901 ########################################
3902 ## <summary>
3903 ##      Read world-readable files.
3904 ## </summary>
3905 ## <param name="domain">
3906 ##      <summary>
3907 ##      Domain allowed access.
3908 ##      </summary>
3909 ## </param>
3910 ## <rolecap/>
3911 #
3912 interface(`files_read_world_readable_files',`
3913         gen_require(`
3914                 type readable_t;
3915         ')
3916
3917         allow $1 readable_t:file read_file_perms;
3918 ')
3919
3920 ########################################
3921 ## <summary>
3922 ##      Read world-readable symbolic links.
3923 ## </summary>
3924 ## <param name="domain">
3925 ##      <summary>
3926 ##      Domain allowed access.
3927 ##      </summary>
3928 ## </param>
3929 ## <rolecap/>
3930 #
3931 interface(`files_read_world_readable_symlinks',`
3932         gen_require(`
3933                 type readable_t;
3934         ')
3935
3936         allow $1 readable_t:lnk_file read_lnk_file_perms;
3937 ')
3938
3939 ########################################
3940 ## <summary>
3941 ##      Read world-readable named pipes.
3942 ## </summary>
3943 ## <param name="domain">
3944 ##      <summary>
3945 ##      Domain allowed access.
3946 ##      </summary>
3947 ## </param>
3948 #
3949 interface(`files_read_world_readable_pipes',`
3950         gen_require(`
3951                 type readable_t;
3952         ')
3953
3954         allow $1 readable_t:fifo_file read_fifo_file_perms;
3955 ')
3956
3957 ########################################
3958 ## <summary>
3959 ##      Read world-readable sockets.
3960 ## </summary>
3961 ## <param name="domain">
3962 ##      <summary>
3963 ##      Domain allowed access.
3964 ##      </summary>
3965 ## </param>
3966 #
3967 interface(`files_read_world_readable_sockets',`
3968         gen_require(`
3969                 type readable_t;
3970         ')
3971
3972         allow $1 readable_t:sock_file read_sock_file_perms;
3973 ')
3974
3975 #######################################
3976 ## <summary>
3977 ##  Read manageable system configuration files in /etc
3978 ## </summary>
3979 ## <param name="domain">
3980 ##  <summary>
3981 ##  Domain allowed access.
3982 ##  </summary>
3983 ## </param>
3984 #
3985 interface(`files_read_system_conf_files',`
3986     gen_require(`
3987         type etc_t, system_conf_t;
3988     ')
3989
3990     allow $1 etc_t:dir list_dir_perms;
3991     read_files_pattern($1, etc_t, system_conf_t)
3992     read_lnk_files_pattern($1, etc_t, system_conf_t)
3993 ')
3994
3995 ######################################
3996 ## <summary>
3997 ##  Manage manageable system configuration files in /etc.
3998 ## </summary>
3999 ## <param name="domain">
4000 ##  <summary>
4001 ##  Domain allowed access.
4002 ##  </summary>
4003 ## </param>
4004 #
4005 interface(`files_manage_system_conf_files',`
4006     gen_require(`
4007         type etc_t, system_conf_t;
4008     ')
4009
4010     manage_files_pattern($1, { etc_t system_conf_t }, system_conf_t)
4011 ')
4012
4013 ######################################
4014 ## <summary>
4015 ##  Relabel manageable system configuration files in /etc.
4016 ## </summary>
4017 ## <param name="domain">
4018 ##  <summary>
4019 ##  Domain allowed access.
4020 ##  </summary>
4021 ## </param>
4022 #
4023 interface(`files_relabelto_system_conf_files',`
4024     gen_require(`
4025         type usr_t;
4026     ')
4027
4028     relabelto_files_pattern($1, system_conf_t, system_conf_t)
4029 ')
4030
4031 ######################################
4032 ## <summary>
4033 ##  Relabel manageable system configuration files in /etc.
4034 ## </summary>
4035 ## <param name="domain">
4036 ##  <summary>
4037 ##  Domain allowed access.
4038 ##  </summary>
4039 ## </param>
4040 #
4041 interface(`files_relabelfrom_system_conf_files',`
4042     gen_require(`
4043         type usr_t;
4044     ')
4045
4046     relabelfrom_files_pattern($1, system_conf_t, system_conf_t)
4047 ')
4048
4049 ###################################
4050 ## <summary>
4051 ##  Create files in /etc with the type used for
4052 ##  the manageable system config files.
4053 ## </summary>
4054 ## <param name="domain">
4055 ##  <summary>
4056 ##  The type of the process performing this action.
4057 ##  </summary>
4058 ## </param>
4059 #
4060 interface(`files_etc_filetrans_system_conf',`
4061     gen_require(`
4062         type etc_t, system_conf_t;
4063     ')
4064
4065     filetrans_pattern($1, etc_t, system_conf_t, file)
4066 ')
4067
4068 ########################################
4069 ## <summary>
4070 ##      Allow the specified type to associate
4071 ##      to a filesystem with the type of the
4072 ##      temporary directory (/tmp).
4073 ## </summary>
4074 ## <param name="file_type">
4075 ##      <summary>
4076 ##      Type of the file to associate.
4077 ##      </summary>
4078 ## </param>
4079 #
4080 interface(`files_associate_tmp',`
4081         gen_require(`
4082                 type tmp_t;
4083         ')
4084
4085         allow $1 tmp_t:filesystem associate;
4086 ')
4087
4088 ########################################
4089 ## <summary>
4090 ##      Get the attributes of the tmp directory (/tmp).
4091 ## </summary>
4092 ## <param name="domain">
4093 ##      <summary>
4094 ##      Domain allowed access.
4095 ##      </summary>
4096 ## </param>
4097 #
4098 interface(`files_getattr_tmp_dirs',`
4099         gen_require(`
4100                 type tmp_t;
4101         ')
4102
4103         allow $1 tmp_t:dir getattr;
4104 ')
4105
4106 ########################################
4107 ## <summary>
4108 ##      Do not audit attempts to get the
4109 ##      attributes of the tmp directory (/tmp).
4110 ## </summary>
4111 ## <param name="domain">
4112 ##      <summary>
4113 ##      Domain allowed access.
4114 ##      </summary>
4115 ## </param>
4116 #
4117 interface(`files_dontaudit_getattr_tmp_dirs',`
4118         gen_require(`
4119                 type tmp_t;
4120         ')
4121
4122         dontaudit $1 tmp_t:dir getattr;
4123 ')
4124
4125 ########################################
4126 ## <summary>
4127 ##      Search the tmp directory (/tmp).
4128 ## </summary>
4129 ## <param name="domain">
4130 ##      <summary>
4131 ##      Domain allowed access.
4132 ##      </summary>
4133 ## </param>
4134 #
4135 interface(`files_search_tmp',`
4136         gen_require(`
4137                 type tmp_t;
4138         ')
4139
4140         allow $1 tmp_t:dir search_dir_perms;
4141 ')
4142
4143 ########################################
4144 ## <summary>
4145 ##      Do not audit attempts to search the tmp directory (/tmp).
4146 ## </summary>
4147 ## <param name="domain">
4148 ##      <summary>
4149 ##      Domain to not audit.
4150 ##      </summary>
4151 ## </param>
4152 #
4153 interface(`files_dontaudit_search_tmp',`
4154         gen_require(`
4155                 type tmp_t;
4156         ')
4157
4158         dontaudit $1 tmp_t:dir search_dir_perms;
4159 ')
4160
4161 ########################################
4162 ## <summary>
4163 ##      Read the tmp directory (/tmp).
4164 ## </summary>
4165 ## <param name="domain">
4166 ##      <summary>
4167 ##      Domain allowed access.
4168 ##      </summary>
4169 ## </param>
4170 #
4171 interface(`files_list_tmp',`
4172         gen_require(`
4173                 type tmp_t;
4174         ')
4175
4176         allow $1 tmp_t:dir list_dir_perms;
4177 ')
4178
4179 ########################################
4180 ## <summary>
4181 ##      Do not audit listing of the tmp directory (/tmp).
4182 ## </summary>
4183 ## <param name="domain">
4184 ##      <summary>
4185 ##      Domain not to audit.
4186 ##      </summary>
4187 ## </param>
4188 #
4189 interface(`files_dontaudit_list_tmp',`
4190         gen_require(`
4191                 type tmp_t;
4192         ')
4193
4194         dontaudit $1 tmp_t:dir list_dir_perms;
4195 ')
4196
4197 ########################################
4198 ## <summary>
4199 ##      Remove entries from the tmp directory.
4200 ## </summary>
4201 ## <param name="domain">
4202 ##      <summary>
4203 ##      Domain allowed access.
4204 ##      </summary>
4205 ## </param>
4206 #
4207 interface(`files_delete_tmp_dir_entry',`
4208         gen_require(`
4209                 type tmp_t;
4210         ')
4211
4212         allow $1 tmp_t:dir del_entry_dir_perms;
4213 ')
4214
4215 ########################################
4216 ## <summary>
4217 ##      Read files in the tmp directory (/tmp).
4218 ## </summary>
4219 ## <param name="domain">
4220 ##      <summary>
4221 ##      Domain allowed access.
4222 ##      </summary>
4223 ## </param>
4224 #
4225 interface(`files_read_generic_tmp_files',`
4226         gen_require(`
4227                 type tmp_t;
4228         ')
4229
4230         read_files_pattern($1, tmp_t, tmp_t)
4231 ')
4232
4233 ########################################
4234 ## <summary>
4235 ##      Manage temporary directories in /tmp.
4236 ## </summary>
4237 ## <param name="domain">
4238 ##      <summary>
4239 ##      Domain allowed access.
4240 ##      </summary>
4241 ## </param>
4242 #
4243 interface(`files_manage_generic_tmp_dirs',`
4244         gen_require(`
4245                 type tmp_t;
4246         ')
4247
4248         manage_dirs_pattern($1, tmp_t, tmp_t)
4249 ')
4250
4251 ########################################
4252 ## <summary>
4253 ##      Allow shared library text relocations in tmp files.
4254 ## </summary>
4255 ## <desc>
4256 ##      <p>
4257 ##      Allow shared library text relocations in tmp files.
4258 ##      </p>
4259 ##      <p>
4260 ##      This is added to support java policy.
4261 ##      </p>
4262 ## </desc>
4263 ## <param name="domain">
4264 ##      <summary>
4265 ##      Domain allowed access.
4266 ##      </summary>
4267 ## </param>
4268 #
4269 interface(`files_execmod_tmp',`
4270         gen_require(`
4271                 attribute tmpfile;
4272         ')
4273
4274         allow $1 tmpfile:file execmod;
4275 ')
4276
4277 ########################################
4278 ## <summary>
4279 ##      Manage temporary files and directories in /tmp.
4280 ## </summary>
4281 ## <param name="domain">
4282 ##      <summary>
4283 ##      Domain allowed access.
4284 ##      </summary>
4285 ## </param>
4286 #
4287 interface(`files_manage_generic_tmp_files',`
4288         gen_require(`
4289                 type tmp_t;
4290         ')
4291
4292         manage_files_pattern($1, tmp_t, tmp_t)
4293 ')
4294
4295 ########################################
4296 ## <summary>
4297 ##      Read symbolic links in the tmp directory (/tmp).
4298 ## </summary>
4299 ## <param name="domain">
4300 ##      <summary>
4301 ##      Domain allowed access.
4302 ##      </summary>
4303 ## </param>
4304 #
4305 interface(`files_read_generic_tmp_symlinks',`
4306         gen_require(`
4307                 type tmp_t;
4308         ')
4309
4310         read_lnk_files_pattern($1, tmp_t, tmp_t)
4311 ')
4312
4313 ########################################
4314 ## <summary>
4315 ##      Read and write generic named sockets in the tmp directory (/tmp).
4316 ## </summary>
4317 ## <param name="domain">
4318 ##      <summary>
4319 ##      Domain allowed access.
4320 ##      </summary>
4321 ## </param>
4322 #
4323 interface(`files_rw_generic_tmp_sockets',`
4324         gen_require(`
4325                 type tmp_t;
4326         ')
4327
4328         rw_sock_files_pattern($1, tmp_t, tmp_t)
4329 ')
4330
4331 ########################################
4332 ## <summary>
4333 ##      Relabel a dir from the type used in /tmp.
4334 ## </summary>
4335 ## <param name="domain">
4336 ##      <summary>
4337 ##      Domain allowed access.
4338 ##      </summary>
4339 ## </param>
4340 #
4341 interface(`files_relabelfrom_tmp_dirs',`
4342         gen_require(`
4343                 type tmp_t;
4344         ')
4345
4346         relabelfrom_dirs_pattern($1, tmp_t, tmp_t)
4347 ')
4348
4349 ########################################
4350 ## <summary>
4351 ##      Relabel a file from the type used in /tmp.
4352 ## </summary>
4353 ## <param name="domain">
4354 ##      <summary>
4355 ##      Domain allowed access.
4356 ##      </summary>
4357 ## </param>
4358 #
4359 interface(`files_relabelfrom_tmp_files',`
4360         gen_require(`
4361                 type tmp_t;
4362         ')
4363
4364         relabelfrom_files_pattern($1, tmp_t, tmp_t)
4365 ')
4366
4367 ########################################
4368 ## <summary>
4369 ##      Relabel all tmp dirs.
4370 ## </summary>
4371 ## <param name="domain">
4372 ##      <summary>
4373 ##      Domain allowed access.
4374 ##      </summary>
4375 ## </param>
4376 ## <rolecap/>
4377 #
4378 interface(`files_relabel_all_tmp_dirs',`
4379         gen_require(`
4380                 attribute tmpfile;
4381                 type var_t;
4382         ')
4383
4384         allow $1 var_t:dir search_dir_perms;
4385         relabel_dirs_pattern($1, tmpfile, tmpfile)
4386 ')
4387
4388 ########################################
4389 ## <summary>
4390 ##      Relabel all tmp files.
4391 ## </summary>
4392 ## <param name="domain">
4393 ##      <summary>
4394 ##      Domain allowed access.
4395 ##      </summary>
4396 ## </param>
4397 ## <rolecap/>
4398 #
4399 interface(`files_relabel_all_tmp_files',`
4400         gen_require(`
4401                 attribute tmpfile;
4402                 type var_t;
4403         ')
4404
4405         allow $1 var_t:dir search_dir_perms;
4406         relabel_files_pattern($1, tmpfile, tmpfile)
4407 ')
4408
4409 ########################################
4410 ## <summary>
4411 ##      Set the attributes of all tmp directories.
4412 ## </summary>
4413 ## <param name="domain">
4414 ##      <summary>
4415 ##      Domain allowed access.
4416 ##      </summary>
4417 ## </param>
4418 #
4419 interface(`files_setattr_all_tmp_dirs',`
4420         gen_require(`
4421                 attribute tmpfile;
4422         ')
4423
4424         allow $1 tmpfile:dir { search_dir_perms setattr };
4425 ')
4426
4427 ########################################
4428 ## <summary>
4429 ##      List all tmp directories.
4430 ## </summary>
4431 ## <param name="domain">
4432 ##      <summary>
4433 ##      Domain allowed access.
4434 ##      </summary>
4435 ## </param>
4436 #
4437 interface(`files_list_all_tmp',`
4438         gen_require(`
4439                 attribute tmpfile;
4440         ')
4441
4442         allow $1 tmpfile:dir list_dir_perms;
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      Do not audit attempts to get the attributes
4448 ##      of all tmp files.
4449 ## </summary>
4450 ## <param name="domain">
4451 ##      <summary>
4452 ##      Domain not to audit.
4453 ##      </summary>
4454 ## </param>
4455 #
4456 interface(`files_dontaudit_getattr_all_tmp_files',`
4457         gen_require(`
4458                 attribute tmpfile;
4459         ')
4460
4461         dontaudit $1 tmpfile:file getattr;
4462 ')
4463
4464 ########################################
4465 ## <summary>
4466 ##      Allow attempts to get the attributes
4467 ##      of all tmp files.
4468 ## </summary>
4469 ## <param name="domain">
4470 ##      <summary>
4471 ##      Domain allowed access.
4472 ##      </summary>
4473 ## </param>
4474 #
4475 interface(`files_getattr_all_tmp_files',`
4476         gen_require(`
4477                 attribute tmpfile;
4478         ')
4479
4480         allow $1 tmpfile:file getattr;
4481 ')
4482
4483 ########################################
4484 ## <summary>
4485 ##      Do not audit attempts to get the attributes
4486 ##      of all tmp sock_file.
4487 ## </summary>
4488 ## <param name="domain">
4489 ##      <summary>
4490 ##      Domain not to audit.
4491 ##      </summary>
4492 ## </param>
4493 #
4494 interface(`files_dontaudit_getattr_all_tmp_sockets',`
4495         gen_require(`
4496                 attribute tmpfile;
4497         ')
4498
4499         dontaudit $1 tmpfile:sock_file getattr;
4500 ')
4501
4502 ########################################
4503 ## <summary>
4504 ##      Read all tmp files.
4505 ## </summary>
4506 ## <param name="domain">
4507 ##      <summary>
4508 ##      Domain allowed access.
4509 ##      </summary>
4510 ## </param>
4511 #
4512 interface(`files_read_all_tmp_files',`
4513         gen_require(`
4514                 attribute tmpfile;
4515         ')
4516
4517         read_files_pattern($1, tmpfile, tmpfile)
4518 ')
4519
4520 ########################################
4521 ## <summary>
4522 ##      Create an object in the tmp directories, with a private
4523 ##      type using a type transition.
4524 ## </summary>
4525 ## <param name="domain">
4526 ##      <summary>
4527 ##      Domain allowed access.
4528 ##      </summary>
4529 ## </param>
4530 ## <param name="private type">
4531 ##      <summary>
4532 ##      The type of the object to be created.
4533 ##      </summary>
4534 ## </param>
4535 ## <param name="object">
4536 ##      <summary>
4537 ##      The object class of the object being created.
4538 ##      </summary>
4539 ## </param>
4540 #
4541 interface(`files_tmp_filetrans',`
4542         gen_require(`
4543                 type tmp_t;
4544         ')
4545
4546         filetrans_pattern($1, tmp_t, $2, $3)
4547 ')
4548
4549 ########################################
4550 ## <summary>
4551 ##      Delete the contents of /tmp.
4552 ## </summary>
4553 ## <param name="domain">
4554 ##      <summary>
4555 ##      Domain allowed access.
4556 ##      </summary>
4557 ## </param>
4558 #
4559 interface(`files_purge_tmp',`
4560         gen_require(`
4561                 attribute tmpfile;
4562         ')
4563
4564         allow $1 tmpfile:dir list_dir_perms;
4565         delete_dirs_pattern($1, tmpfile, tmpfile)
4566         delete_files_pattern($1, tmpfile, tmpfile)
4567         delete_lnk_files_pattern($1, tmpfile, tmpfile)
4568         delete_fifo_files_pattern($1, tmpfile, tmpfile)
4569         delete_sock_files_pattern($1, tmpfile, tmpfile)
4570         delete_chr_files_pattern($1, tmpfile, tmpfile)
4571         delete_blk_files_pattern($1, tmpfile, tmpfile)
4572         files_delete_isid_type_dirs($1)
4573         files_delete_isid_type_files($1)
4574         files_delete_isid_type_symlinks($1)
4575         files_delete_isid_type_fifo_files($1)
4576         files_delete_isid_type_sock_files($1)
4577         files_delete_isid_type_blk_files($1)
4578         files_delete_isid_type_chr_files($1)
4579 ')
4580
4581 ########################################
4582 ## <summary>
4583 ##      Set the attributes of the /usr directory.
4584 ## </summary>
4585 ## <param name="domain">
4586 ##      <summary>
4587 ##      Domain allowed access.
4588 ##      </summary>
4589 ## </param>
4590 #
4591 interface(`files_setattr_usr_dirs',`
4592         gen_require(`
4593                 type usr_t;
4594         ')
4595
4596         allow $1 usr_t:dir setattr;
4597 ')
4598
4599 ########################################
4600 ## <summary>
4601 ##      Search the content of /usr.
4602 ## </summary>
4603 ## <param name="domain">
4604 ##      <summary>
4605 ##      Domain allowed access.
4606 ##      </summary>
4607 ## </param>
4608 #
4609 interface(`files_search_usr',`
4610         gen_require(`
4611                 type usr_t;
4612         ')
4613
4614         allow $1 usr_t:dir search_dir_perms;
4615 ')
4616
4617 ########################################
4618 ## <summary>
4619 ##      List the contents of generic
4620 ##      directories in /usr.
4621 ## </summary>
4622 ## <param name="domain">
4623 ##      <summary>
4624 ##      Domain allowed access.
4625 ##      </summary>
4626 ## </param>
4627 #
4628 interface(`files_list_usr',`
4629         gen_require(`
4630                 type usr_t;
4631         ')
4632
4633         allow $1 usr_t:dir list_dir_perms;
4634 ')
4635
4636 ########################################
4637 ## <summary>
4638 ##      Do not audit write of /usr dirs
4639 ## </summary>
4640 ## <param name="domain">
4641 ##      <summary>
4642 ##      Domain to not audit.
4643 ##      </summary>
4644 ## </param>
4645 #
4646 interface(`files_dontaudit_write_usr_dirs',`
4647         gen_require(`
4648                 type usr_t;
4649         ')
4650
4651         dontaudit $1 usr_t:dir write;
4652 ')
4653
4654 ########################################
4655 ## <summary>
4656 ##      Add and remove entries from /usr directories.
4657 ## </summary>
4658 ## <param name="domain">
4659 ##      <summary>
4660 ##      Domain allowed access.
4661 ##      </summary>
4662 ## </param>
4663 #
4664 interface(`files_rw_usr_dirs',`
4665         gen_require(`
4666                 type usr_t;
4667         ')
4668
4669         allow $1 usr_t:dir rw_dir_perms;
4670 ')
4671
4672 ########################################
4673 ## <summary>
4674 ##      Do not audit attempts to add and remove
4675 ##      entries from /usr directories.
4676 ## </summary>
4677 ## <param name="domain">
4678 ##      <summary>
4679 ##      Domain to not audit.
4680 ##      </summary>
4681 ## </param>
4682 #
4683 interface(`files_dontaudit_rw_usr_dirs',`
4684         gen_require(`
4685                 type usr_t;
4686         ')
4687
4688         dontaudit $1 usr_t:dir rw_dir_perms;
4689 ')
4690
4691 ########################################
4692 ## <summary>
4693 ##      Delete generic directories in /usr in the caller domain.
4694 ## </summary>
4695 ## <param name="domain">
4696 ##      <summary>
4697 ##      Domain allowed access.
4698 ##      </summary>
4699 ## </param>
4700 #
4701 interface(`files_delete_usr_dirs',`
4702         gen_require(`
4703                 type usr_t;
4704         ')
4705
4706         delete_dirs_pattern($1, usr_t, usr_t)
4707 ')
4708
4709 ########################################
4710 ## <summary>
4711 ##      Delete generic files in /usr in the caller domain.
4712 ## </summary>
4713 ## <param name="domain">
4714 ##      <summary>
4715 ##      Domain allowed access.
4716 ##      </summary>
4717 ## </param>
4718 #
4719 interface(`files_delete_usr_files',`
4720         gen_require(`
4721                 type usr_t;
4722         ')
4723
4724         delete_files_pattern($1, usr_t, usr_t)
4725 ')
4726
4727 ########################################
4728 ## <summary>
4729 ##      Get the attributes of files in /usr.
4730 ## </summary>
4731 ## <param name="domain">
4732 ##      <summary>
4733 ##      Domain allowed access.
4734 ##      </summary>
4735 ## </param>
4736 #
4737 interface(`files_getattr_usr_files',`
4738         gen_require(`
4739                 type usr_t;
4740         ')
4741
4742         getattr_files_pattern($1, usr_t, usr_t)
4743 ')
4744
4745 ########################################
4746 ## <summary>
4747 ##      Read generic files in /usr.
4748 ## </summary>
4749 ## <desc>
4750 ##      <p>
4751 ##      Allow the specified domain to read generic
4752 ##      files in /usr. These files are various program
4753 ##      files that do not have more specific SELinux types.
4754 ##      Some examples of these files are:
4755 ##      </p>
4756 ##      <ul>
4757 ##              <li>/usr/include/*</li>
4758 ##              <li>/usr/share/doc/*</li>
4759 ##              <li>/usr/share/info/*</li>
4760 ##      </ul>
4761 ##      <p>
4762 ##      Generally, it is safe for many domains to have
4763 ##      this access.
4764 ##      </p>
4765 ## </desc>
4766 ## <param name="domain">
4767 ##      <summary>
4768 ##      Domain allowed access.
4769 ##      </summary>
4770 ## </param>
4771 ## <infoflow type="read" weight="10"/>
4772 #
4773 interface(`files_read_usr_files',`
4774         gen_require(`
4775                 type usr_t;
4776         ')
4777
4778         allow $1 usr_t:dir list_dir_perms;
4779         read_files_pattern($1, usr_t, usr_t)
4780         read_lnk_files_pattern($1, usr_t, usr_t)
4781 ')
4782
4783 ########################################
4784 ## <summary>
4785 ##      Execute generic programs in /usr in the caller domain.
4786 ## </summary>
4787 ## <param name="domain">
4788 ##      <summary>
4789 ##      Domain allowed access.
4790 ##      </summary>
4791 ## </param>
4792 #
4793 interface(`files_exec_usr_files',`
4794         gen_require(`
4795                 type usr_t;
4796         ')
4797
4798         allow $1 usr_t:dir list_dir_perms;
4799         exec_files_pattern($1, usr_t, usr_t)
4800         read_lnk_files_pattern($1, usr_t, usr_t)
4801 ')
4802
4803 ########################################
4804 ## <summary>
4805 ##      dontaudit write of /usr files
4806 ## </summary>
4807 ## <param name="domain">
4808 ##      <summary>
4809 ##      Domain to not audit.
4810 ##      </summary>
4811 ## </param>
4812 #
4813 interface(`files_dontaudit_write_usr_files',`
4814         gen_require(`
4815                 type usr_t;
4816         ')
4817
4818         dontaudit $1 usr_t:file write;
4819 ')
4820
4821 ########################################
4822 ## <summary>
4823 ##      Create, read, write, and delete files in the /usr directory.
4824 ## </summary>
4825 ## <param name="domain">
4826 ##      <summary>
4827 ##      Domain allowed access.
4828 ##      </summary>
4829 ## </param>
4830 #
4831 interface(`files_manage_usr_files',`
4832         gen_require(`
4833                 type usr_t;
4834         ')
4835
4836         manage_files_pattern($1, usr_t, usr_t)
4837 ')
4838
4839 ########################################
4840 ## <summary>
4841 ##      Relabel a file to the type used in /usr.
4842 ## </summary>
4843 ## <param name="domain">
4844 ##      <summary>
4845 ##      Domain allowed access.
4846 ##      </summary>
4847 ## </param>
4848 #
4849 interface(`files_relabelto_usr_files',`
4850         gen_require(`
4851                 type usr_t;
4852         ')
4853
4854         relabelto_files_pattern($1, usr_t, usr_t)
4855 ')
4856
4857 ########################################
4858 ## <summary>
4859 ##      Relabel a file from the type used in /usr.
4860 ## </summary>
4861 ## <param name="domain">
4862 ##      <summary>
4863 ##      Domain allowed access.
4864 ##      </summary>
4865 ## </param>
4866 #
4867 interface(`files_relabelfrom_usr_files',`
4868         gen_require(`
4869                 type usr_t;
4870         ')
4871
4872         relabelfrom_files_pattern($1, usr_t, usr_t)
4873 ')
4874
4875 ########################################
4876 ## <summary>
4877 ##      Read symbolic links in /usr.
4878 ## </summary>
4879 ## <param name="domain">
4880 ##      <summary>
4881 ##      Domain allowed access.
4882 ##      </summary>
4883 ## </param>
4884 #
4885 interface(`files_read_usr_symlinks',`
4886         gen_require(`
4887                 type usr_t;
4888         ')
4889
4890         read_lnk_files_pattern($1, usr_t, usr_t)
4891 ')
4892
4893 ########################################
4894 ## <summary>
4895 ##      Create objects in the /usr directory
4896 ## </summary>
4897 ## <param name="domain">
4898 ##      <summary>
4899 ##      Domain allowed access.
4900 ##      </summary>
4901 ## </param>
4902 ## <param name="file_type">
4903 ##      <summary>
4904 ##      The type of the object to be created
4905 ##      </summary>
4906 ## </param>
4907 ## <param name="object_class">
4908 ##      <summary>
4909 ##      The object class.
4910 ##      </summary>
4911 ## </param>
4912 #
4913 interface(`files_usr_filetrans',`
4914         gen_require(`
4915                 type usr_t;
4916         ')
4917
4918         filetrans_pattern($1, usr_t, $2, $3)
4919 ')
4920
4921 ########################################
4922 ## <summary>
4923 ##      Do not audit attempts to search /usr/src.
4924 ## </summary>
4925 ## <param name="domain">
4926 ##      <summary>
4927 ##      Domain to not audit.
4928 ##      </summary>
4929 ## </param>
4930 #
4931 interface(`files_dontaudit_search_src',`
4932         gen_require(`
4933                 type src_t;
4934         ')
4935
4936         dontaudit $1 src_t:dir search_dir_perms;
4937 ')
4938
4939 ########################################
4940 ## <summary>
4941 ##      Get the attributes of files in /usr/src.
4942 ## </summary>
4943 ## <param name="domain">
4944 ##      <summary>
4945 ##      Domain allowed access.
4946 ##      </summary>
4947 ## </param>
4948 #
4949 interface(`files_getattr_usr_src_files',`
4950         gen_require(`
4951                 type usr_t, src_t;
4952         ')
4953
4954         getattr_files_pattern($1, src_t, src_t)
4955
4956         # /usr/src/linux symlink:
4957         read_lnk_files_pattern($1, usr_t, src_t)
4958 ')
4959
4960 ########################################
4961 ## <summary>
4962 ##      Read files in /usr/src.
4963 ## </summary>
4964 ## <param name="domain">
4965 ##      <summary>
4966 ##      Domain allowed access.
4967 ##      </summary>
4968 ## </param>
4969 #
4970 interface(`files_read_usr_src_files',`
4971         gen_require(`
4972                 type usr_t, src_t;
4973         ')
4974
4975         allow $1 usr_t:dir search_dir_perms;
4976         read_files_pattern($1, { usr_t src_t }, src_t)
4977         read_lnk_files_pattern($1, { usr_t src_t }, src_t)
4978         allow $1 src_t:dir list_dir_perms;
4979 ')
4980
4981 ########################################
4982 ## <summary>
4983 ##      Execute programs in /usr/src in the caller domain.
4984 ## </summary>
4985 ## <param name="domain">
4986 ##      <summary>
4987 ##      Domain allowed access.
4988 ##      </summary>
4989 ## </param>
4990 #
4991 interface(`files_exec_usr_src_files',`
4992         gen_require(`
4993                 type usr_t, src_t;
4994         ')
4995
4996         list_dirs_pattern($1, usr_t, src_t)
4997         exec_files_pattern($1, src_t, src_t)
4998         read_lnk_files_pattern($1, src_t, src_t)
4999 ')
5000
5001 ########################################
5002 ## <summary>
5003 ##      Install a system.map into the /boot directory.
5004 ## </summary>
5005 ## <param name="domain">
5006 ##      <summary>
5007 ##      Domain allowed access.
5008 ##      </summary>
5009 ## </param>
5010 #
5011 interface(`files_create_kernel_symbol_table',`
5012         gen_require(`
5013                 type boot_t, system_map_t;
5014         ')
5015
5016         allow $1 boot_t:dir { list_dir_perms add_entry_dir_perms };
5017         allow $1 system_map_t:file { create_file_perms rw_file_perms };
5018 ')
5019
5020 ########################################
5021 ## <summary>
5022 ##      Read system.map in the /boot directory.
5023 ## </summary>
5024 ## <param name="domain">
5025 ##      <summary>
5026 ##      Domain allowed access.
5027 ##      </summary>
5028 ## </param>
5029 #
5030 interface(`files_read_kernel_symbol_table',`
5031         gen_require(`
5032                 type boot_t, system_map_t;
5033         ')
5034
5035         allow $1 boot_t:dir list_dir_perms;
5036         read_files_pattern($1, boot_t, system_map_t)
5037 ')
5038
5039 ########################################
5040 ## <summary>
5041 ##      Delete a system.map in the /boot directory.
5042 ## </summary>
5043 ## <param name="domain">
5044 ##      <summary>
5045 ##      Domain allowed access.
5046 ##      </summary>
5047 ## </param>
5048 #
5049 interface(`files_delete_kernel_symbol_table',`
5050         gen_require(`
5051                 type boot_t, system_map_t;
5052         ')
5053
5054         allow $1 boot_t:dir list_dir_perms;
5055         delete_files_pattern($1, boot_t, system_map_t)
5056 ')
5057
5058 ########################################
5059 ## <summary>
5060 ##      Search the contents of /var.
5061 ## </summary>
5062 ## <param name="domain">
5063 ##      <summary>
5064 ##      Domain allowed access.
5065 ##      </summary>
5066 ## </param>
5067 #
5068 interface(`files_search_var',`
5069         gen_require(`
5070                 type var_t;
5071         ')
5072
5073         allow $1 var_t:dir search_dir_perms;
5074 ')
5075
5076 ########################################
5077 ## <summary>
5078 ##      Do not audit attempts to write to /var.
5079 ## </summary>
5080 ## <param name="domain">
5081 ##      <summary>
5082 ##      Domain to not audit.
5083 ##      </summary>
5084 ## </param>
5085 #
5086 interface(`files_dontaudit_write_var_dirs',`
5087         gen_require(`
5088                 type var_t;
5089         ')
5090
5091         dontaudit $1 var_t:dir write;
5092 ')
5093
5094 ########################################
5095 ## <summary>
5096 ##      Allow attempts to write to /var.dirs
5097 ## </summary>
5098 ## <param name="domain">
5099 ##      <summary>
5100 ##      Domain allowed access.
5101 ##      </summary>
5102 ## </param>
5103 #
5104 interface(`files_write_var_dirs',`
5105         gen_require(`
5106                 type var_t;
5107         ')
5108
5109         allow $1 var_t:dir write;
5110 ')
5111
5112 ########################################
5113 ## <summary>
5114 ##      Do not audit attempts to search
5115 ##      the contents of /var.
5116 ## </summary>
5117 ## <param name="domain">
5118 ##      <summary>
5119 ##      Domain to not audit.
5120 ##      </summary>
5121 ## </param>
5122 #
5123 interface(`files_dontaudit_search_var',`
5124         gen_require(`
5125                 type var_t;
5126         ')
5127
5128         dontaudit $1 var_t:dir search_dir_perms;
5129 ')
5130
5131 ########################################
5132 ## <summary>
5133 ##      List the contents of /var.
5134 ## </summary>
5135 ## <param name="domain">
5136 ##      <summary>
5137 ##      Domain allowed access.
5138 ##      </summary>
5139 ## </param>
5140 #
5141 interface(`files_list_var',`
5142         gen_require(`
5143                 type var_t;
5144         ')
5145
5146         allow $1 var_t:dir list_dir_perms;
5147 ')
5148
5149 ########################################
5150 ## <summary>
5151 ##      Create, read, write, and delete directories
5152 ##      in the /var directory.
5153 ## </summary>
5154 ## <param name="domain">
5155 ##      <summary>
5156 ##      Domain allowed access.
5157 ##      </summary>
5158 ## </param>
5159 #
5160 interface(`files_manage_var_dirs',`
5161         gen_require(`
5162                 type var_t;
5163         ')
5164
5165         allow $1 var_t:dir manage_dir_perms;
5166 ')
5167
5168 ########################################
5169 ## <summary>
5170 ##      Read files in the /var directory.
5171 ## </summary>
5172 ## <param name="domain">
5173 ##      <summary>
5174 ##      Domain allowed access.
5175 ##      </summary>
5176 ## </param>
5177 #
5178 interface(`files_read_var_files',`
5179         gen_require(`
5180                 type var_t;
5181         ')
5182
5183         read_files_pattern($1, var_t, var_t)
5184 ')
5185
5186 ########################################
5187 ## <summary>
5188 ##      Append files in the /var directory.
5189 ## </summary>
5190 ## <param name="domain">
5191 ##      <summary>
5192 ##      Domain allowed access.
5193 ##      </summary>
5194 ## </param>
5195 #
5196 interface(`files_append_var_files',`
5197         gen_require(`
5198                 type var_t;
5199         ')
5200
5201         append_files_pattern($1, var_t, var_t)
5202 ')
5203
5204 ########################################
5205 ## <summary>
5206 ##      Read and write files in the /var directory.
5207 ## </summary>
5208 ## <param name="domain">
5209 ##      <summary>
5210 ##      Domain allowed access.
5211 ##      </summary>
5212 ## </param>
5213 #
5214 interface(`files_rw_var_files',`
5215         gen_require(`
5216                 type var_t;
5217         ')
5218
5219         rw_files_pattern($1, var_t, var_t)
5220 ')
5221
5222 ########################################
5223 ## <summary>
5224 ##      Do not audit attempts to read and write
5225 ##      files in the /var directory.
5226 ## </summary>
5227 ## <param name="domain">
5228 ##      <summary>
5229 ##      Domain to not audit.
5230 ##      </summary>
5231 ## </param>
5232 #
5233 interface(`files_dontaudit_rw_var_files',`
5234         gen_require(`
5235                 type var_t;
5236         ')
5237
5238         dontaudit $1 var_t:file rw_file_perms;
5239 ')
5240
5241 ########################################
5242 ## <summary>
5243 ##      Create, read, write, and delete files in the /var directory.
5244 ## </summary>
5245 ## <param name="domain">
5246 ##      <summary>
5247 ##      Domain allowed access.
5248 ##      </summary>
5249 ## </param>
5250 #
5251 interface(`files_manage_var_files',`
5252         gen_require(`
5253                 type var_t;
5254         ')
5255
5256         manage_files_pattern($1, var_t, var_t)
5257 ')
5258
5259 ########################################
5260 ## <summary>
5261 ##      Read symbolic links in the /var directory.
5262 ## </summary>
5263 ## <param name="domain">
5264 ##      <summary>
5265 ##      Domain allowed access.
5266 ##      </summary>
5267 ## </param>
5268 #
5269 interface(`files_read_var_symlinks',`
5270         gen_require(`
5271                 type var_t;
5272         ')
5273
5274         read_lnk_files_pattern($1, var_t, var_t)
5275 ')
5276
5277 ########################################
5278 ## <summary>
5279 ##      Create, read, write, and delete symbolic
5280 ##      links in the /var directory.
5281 ## </summary>
5282 ## <param name="domain">
5283 ##      <summary>
5284 ##      Domain allowed access.
5285 ##      </summary>
5286 ## </param>
5287 #
5288 interface(`files_manage_var_symlinks',`
5289         gen_require(`
5290                 type var_t;
5291         ')
5292
5293         manage_lnk_files_pattern($1, var_t, var_t)
5294 ')
5295
5296 ########################################
5297 ## <summary>
5298 ##      Create objects in the /var directory
5299 ## </summary>
5300 ## <param name="domain">
5301 ##      <summary>
5302 ##      Domain allowed access.
5303 ##      </summary>
5304 ## </param>
5305 ## <param name="file_type">
5306 ##      <summary>
5307 ##      The type of the object to be created
5308 ##      </summary>
5309 ## </param>
5310 ## <param name="object_class">
5311 ##      <summary>
5312 ##      The object class.
5313 ##      </summary>
5314 ## </param>
5315 #
5316 interface(`files_var_filetrans',`
5317         gen_require(`
5318                 type var_t;
5319         ')
5320
5321         filetrans_pattern($1, var_t, $2, $3)
5322 ')
5323
5324 ########################################
5325 ## <summary>
5326 ##      Get the attributes of the /var/lib directory.
5327 ## </summary>
5328 ## <param name="domain">
5329 ##      <summary>
5330 ##      Domain allowed access.
5331 ##      </summary>
5332 ## </param>
5333 #
5334 interface(`files_getattr_var_lib_dirs',`
5335         gen_require(`
5336                 type var_t, var_lib_t;
5337         ')
5338
5339         getattr_dirs_pattern($1, var_t, var_lib_t)
5340 ')
5341
5342 ########################################
5343 ## <summary>
5344 ##      Search the /var/lib directory.
5345 ## </summary>
5346 ## <desc>
5347 ##      <p>
5348 ##      Search the /var/lib directory.  This is
5349 ##      necessary to access files or directories under
5350 ##      /var/lib that have a private type.  For example, a
5351 ##      domain accessing a private library file in the
5352 ##      /var/lib directory:
5353 ##      </p>
5354 ##      <p>
5355 ##      allow mydomain_t mylibfile_t:file read_file_perms;
5356 ##      files_search_var_lib(mydomain_t)
5357 ##      </p>
5358 ## </desc>
5359 ## <param name="domain">
5360 ##      <summary>
5361 ##      Domain allowed access.
5362 ##      </summary>
5363 ## </param>
5364 ## <infoflow type="read" weight="5"/>
5365 #
5366 interface(`files_search_var_lib',`
5367         gen_require(`
5368                 type var_t, var_lib_t;
5369         ')
5370
5371         search_dirs_pattern($1, var_t, var_lib_t)
5372 ')
5373
5374 ########################################
5375 ## <summary>
5376 ##      Do not audit attempts to search the
5377 ##      contents of /var/lib.
5378 ## </summary>
5379 ## <param name="domain">
5380 ##      <summary>
5381 ##      Domain to not audit.
5382 ##      </summary>
5383 ## </param>
5384 ## <infoflow type="read" weight="5"/>
5385 #
5386 interface(`files_dontaudit_search_var_lib',`
5387         gen_require(`
5388                 type var_lib_t;
5389         ')
5390
5391         dontaudit $1 var_lib_t:dir search_dir_perms;
5392 ')
5393
5394 ########################################
5395 ## <summary>
5396 ##      List the contents of the /var/lib directory.
5397 ## </summary>
5398 ## <param name="domain">
5399 ##      <summary>
5400 ##      Domain allowed access.
5401 ##      </summary>
5402 ## </param>
5403 #
5404 interface(`files_list_var_lib',`
5405         gen_require(`
5406                 type var_t, var_lib_t;
5407         ')
5408
5409         list_dirs_pattern($1, var_t, var_lib_t)
5410 ')
5411
5412 ###########################################
5413 ## <summary>
5414 ##      Read-write /var/lib directories
5415 ## </summary>
5416 ## <param name="domain">
5417 ##      <summary>
5418 ##      Domain allowed access.
5419 ##      </summary>
5420 ## </param>
5421 #
5422 interface(`files_rw_var_lib_dirs',`
5423         gen_require(`
5424                 type var_lib_t;
5425         ')
5426
5427         rw_dirs_pattern($1, var_lib_t, var_lib_t)
5428 ')
5429
5430 ########################################
5431 ## <summary>
5432 ##      Create objects in the /var/lib directory
5433 ## </summary>
5434 ## <param name="domain">
5435 ##      <summary>
5436 ##      Domain allowed access.
5437 ##      </summary>
5438 ## </param>
5439 ## <param name="file_type">
5440 ##      <summary>
5441 ##      The type of the object to be created
5442 ##      </summary>
5443 ## </param>
5444 ## <param name="object_class">
5445 ##      <summary>
5446 ##      The object class.
5447 ##      </summary>
5448 ## </param>
5449 #
5450 interface(`files_var_lib_filetrans',`
5451         gen_require(`
5452                 type var_t, var_lib_t;
5453         ')
5454
5455         allow $1 var_t:dir search_dir_perms;
5456         filetrans_pattern($1, var_lib_t, $2, $3)
5457 ')
5458
5459 ########################################
5460 ## <summary>
5461 ##      Read generic files in /var/lib.
5462 ## </summary>
5463 ## <param name="domain">
5464 ##      <summary>
5465 ##      Domain allowed access.
5466 ##      </summary>
5467 ## </param>
5468 #
5469 interface(`files_read_var_lib_files',`
5470         gen_require(`
5471                 type var_t, var_lib_t;
5472         ')
5473
5474         allow $1 var_lib_t:dir list_dir_perms;
5475         read_files_pattern($1, { var_t var_lib_t }, var_lib_t)
5476 ')
5477
5478 ########################################
5479 ## <summary>
5480 ##      Read generic symbolic links in /var/lib
5481 ## </summary>
5482 ## <param name="domain">
5483 ##      <summary>
5484 ##      Domain allowed access.
5485 ##      </summary>
5486 ## </param>
5487 #
5488 interface(`files_read_var_lib_symlinks',`
5489         gen_require(`
5490                 type var_t, var_lib_t;
5491         ')
5492
5493         read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
5494 ')
5495
5496 # cjp: the next two interfaces really need to be fixed
5497 # in some way.  They really neeed their own types.
5498
5499 ########################################
5500 ## <summary>
5501 ##      Create, read, write, and delete the
5502 ##      pseudorandom number generator seed.
5503 ## </summary>
5504 ## <param name="domain">
5505 ##      <summary>
5506 ##      Domain allowed access.
5507 ##      </summary>
5508 ## </param>
5509 #
5510 interface(`files_manage_urandom_seed',`
5511         gen_require(`
5512                 type var_t, var_lib_t;
5513         ')
5514
5515         allow $1 var_t:dir search_dir_perms;
5516         manage_files_pattern($1, var_lib_t, var_lib_t)
5517 ')
5518
5519 ########################################
5520 ## <summary>
5521 ##      Allow domain to manage mount tables
5522 ##      necessary for rpcd, nfsd, etc.
5523 ## </summary>
5524 ## <param name="domain">
5525 ##      <summary>
5526 ##      Domain allowed access.
5527 ##      </summary>
5528 ## </param>
5529 #
5530 interface(`files_manage_mounttab',`
5531         gen_require(`
5532                 type var_t, var_lib_t;
5533         ')
5534
5535         allow $1 var_t:dir search_dir_perms;
5536         manage_files_pattern($1, var_lib_t, var_lib_t)
5537 ')
5538
5539 ########################################
5540 ## <summary>
5541 ##      List generic lock directories.
5542 ## </summary>
5543 ## <param name="domain">
5544 ##      <summary>
5545 ##      Domain allowed access.
5546 ##      </summary>
5547 ## </param>
5548 #
5549 interface(`files_list_locks',`
5550         gen_require(`
5551                 type var_t, var_lock_t;
5552         ')
5553
5554         files_search_locks($1)
5555         list_dirs_pattern($1, var_t, var_lock_t)
5556 ')
5557
5558 ########################################
5559 ## <summary>
5560 ##      Search the locks directory (/var/lock).
5561 ## </summary>
5562 ## <param name="domain">
5563 ##      <summary>
5564 ##      Domain allowed access.
5565 ##      </summary>
5566 ## </param>
5567 #
5568 interface(`files_search_locks',`
5569         gen_require(`
5570                 type var_t, var_lock_t;
5571         ')
5572
5573         files_search_pids($1)
5574         allow $1 var_lock_t:lnk_file read_lnk_file_perms;
5575         search_dirs_pattern($1, var_t, var_lock_t)
5576 ')
5577
5578 ########################################
5579 ## <summary>
5580 ##      Do not audit attempts to search the
5581 ##      locks directory (/var/lock).
5582 ## </summary>
5583 ## <param name="domain">
5584 ##      <summary>
5585 ##      Domain to not audit.
5586 ##      </summary>
5587 ## </param>
5588 #
5589 interface(`files_dontaudit_search_locks',`
5590         gen_require(`
5591                 type var_lock_t;
5592         ')
5593
5594         dontaudit $1 var_lock_t:lnk_file read_lnk_file_perms;
5595         dontaudit $1 var_lock_t:dir search_dir_perms;
5596 ')
5597
5598 ########################################
5599 ## <summary>
5600 ##      create a directory in the /var/lock
5601 ##      directories.
5602 ## </summary>
5603 ## <param name="domain">
5604 ##      <summary>
5605 ##      Domain allowed access.
5606 ##      </summary>
5607 ## </param>
5608 #
5609 interface(`files_create_lock_dirs',`
5610         gen_require(`
5611                 type var_t, var_lock_t;
5612         ')
5613
5614         files_search_locks($1)
5615                 allow $1 var_lock_t:dir create_dir_perms;
5616 ')
5617
5618 ########################################
5619 ## <summary>
5620 ##      Add and remove entries in the /var/lock
5621 ##      directories.
5622 ## </summary>
5623 ## <param name="domain">
5624 ##      <summary>
5625 ##      Domain allowed access.
5626 ##      </summary>
5627 ## </param>
5628 #
5629 interface(`files_rw_lock_dirs',`
5630         gen_require(`
5631                 type var_t, var_lock_t;
5632         ')
5633
5634         files_search_locks($1)
5635         rw_dirs_pattern($1, var_t, var_lock_t)
5636 ')
5637
5638 ########################################
5639 ## <summary>
5640 ##      Get the attributes of generic lock files.
5641 ## </summary>
5642 ## <param name="domain">
5643 ##      <summary>
5644 ##      Domain allowed access.
5645 ##      </summary>
5646 ## </param>
5647 #
5648 interface(`files_getattr_generic_locks',`
5649         gen_require(`
5650                 type var_t, var_lock_t;
5651         ')
5652
5653         files_search_locks($1)
5654         allow $1 var_lock_t:dir list_dir_perms;
5655         getattr_files_pattern($1, var_lock_t, var_lock_t)
5656 ')
5657
5658 ########################################
5659 ## <summary>
5660 ##      Delete generic lock files.
5661 ## </summary>
5662 ## <param name="domain">
5663 ##      <summary>
5664 ##      Domain allowed access.
5665 ##      </summary>
5666 ## </param>
5667 #
5668 interface(`files_delete_generic_locks',`
5669        gen_require(`
5670                 type var_t, var_lock_t;
5671        ')
5672
5673        files_search_locks($1)
5674        delete_files_pattern($1, var_lock_t, var_lock_t)
5675 ')
5676
5677 ########################################
5678 ## <summary>
5679 ##      Create, read, write, and delete generic
5680 ##      lock files.
5681 ## </summary>
5682 ## <param name="domain">
5683 ##      <summary>
5684 ##      Domain allowed access.
5685 ##      </summary>
5686 ## </param>
5687 #
5688 interface(`files_manage_generic_locks',`
5689         gen_require(`
5690                 type var_t, var_lock_t;
5691         ')
5692
5693         files_search_locks($1)
5694         manage_files_pattern($1, var_lock_t, var_lock_t)
5695 ')
5696
5697 ########################################
5698 ## <summary>
5699 ##      Delete all lock files.
5700 ## </summary>
5701 ## <param name="domain">
5702 ##      <summary>
5703 ##      Domain allowed access.
5704 ##      </summary>
5705 ## </param>
5706 ## <rolecap/>
5707 #
5708 interface(`files_delete_all_locks',`
5709         gen_require(`
5710                 attribute lockfile;
5711                 type var_t;
5712         ')
5713
5714         allow $1 var_t:dir search_dir_perms;
5715         delete_files_pattern($1, lockfile, lockfile)
5716 ')
5717
5718 ########################################
5719 ## <summary>
5720 ##      Relabel all lock files.
5721 ## </summary>
5722 ## <param name="domain">
5723 ##      <summary>
5724 ##      Domain allowed access.
5725 ##      </summary>
5726 ## </param>
5727 ## <rolecap/>
5728 #
5729 interface(`files_relabel_all_lock_dirs',`
5730         gen_require(`
5731                 attribute lockfile;
5732                 type var_t;
5733         ')
5734
5735         allow $1 var_t:dir search_dir_perms;
5736         relabel_dirs_pattern($1, lockfile, lockfile)
5737 ')
5738
5739 ########################################
5740 ## <summary>
5741 ##      Read all lock files.
5742 ## </summary>
5743 ## <param name="domain">
5744 ##      <summary>
5745 ##      Domain allowed access.
5746 ##      </summary>
5747 ## </param>
5748 #
5749 interface(`files_read_all_locks',`
5750         gen_require(`
5751                 attribute lockfile;
5752                 type var_t, var_lock_t;
5753         ')
5754
5755         files_search_locks($1)
5756         allow $1 lockfile:dir list_dir_perms;
5757         read_files_pattern($1, lockfile, lockfile)
5758         read_lnk_files_pattern($1, lockfile, lockfile)
5759 ')
5760
5761 ########################################
5762 ## <summary>
5763 ##      manage all lock files.
5764 ## </summary>
5765 ## <param name="domain">
5766 ##      <summary>
5767 ##      Domain allowed access.
5768 ##      </summary>
5769 ## </param>
5770 #
5771 interface(`files_manage_all_locks',`
5772         gen_require(`
5773                 attribute lockfile;
5774                 type var_t, var_lock_t;
5775         ')
5776
5777         files_search_locks($1)
5778         manage_dirs_pattern($1, lockfile, lockfile)
5779         manage_files_pattern($1, lockfile, lockfile)
5780         manage_lnk_files_pattern($1, lockfile, lockfile)
5781 ')
5782
5783 ########################################
5784 ## <summary>
5785 ##      Create an object in the locks directory, with a private
5786 ##      type using a type transition.
5787 ## </summary>
5788 ## <param name="domain">
5789 ##      <summary>
5790 ##      Domain allowed access.
5791 ##      </summary>
5792 ## </param>
5793 ## <param name="private type">
5794 ##      <summary>
5795 ##      The type of the object to be created.
5796 ##      </summary>
5797 ## </param>
5798 ## <param name="object">
5799 ##      <summary>
5800 ##      The object class of the object being created.
5801 ##      </summary>
5802 ## </param>
5803 #
5804 interface(`files_lock_filetrans',`
5805         gen_require(`
5806                 type var_t, var_lock_t;
5807         ')
5808
5809         files_search_locks($1)
5810         filetrans_pattern($1, var_lock_t, $2, $3)
5811 ')
5812
5813 ########################################
5814 ## <summary>
5815 ##      Do not audit attempts to get the attributes
5816 ##      of the /var/run directory.
5817 ## </summary>
5818 ## <param name="domain">
5819 ##      <summary>
5820 ##      Domain to not audit.
5821 ##      </summary>
5822 ## </param>
5823 #
5824 interface(`files_dontaudit_getattr_pid_dirs',`
5825         gen_require(`
5826                 type var_run_t;
5827         ')
5828
5829         dontaudit $1 var_run_t:dir getattr;
5830 ')
5831
5832 ########################################
5833 ## <summary>
5834 ##      Set the attributes of the /var/run directory.
5835 ## </summary>
5836 ## <param name="domain">
5837 ##      <summary>
5838 ##      Domain allowed access.
5839 ##      </summary>
5840 ## </param>
5841 #
5842 interface(`files_setattr_pid_dirs',`
5843         gen_require(`
5844                 type var_run_t;
5845         ')
5846
5847         allow $1 var_run_t:dir setattr;
5848 ')
5849
5850 ########################################
5851 ## <summary>
5852 ##      Search the contents of runtime process
5853 ##      ID directories (/var/run).
5854 ## </summary>
5855 ## <param name="domain">
5856 ##      <summary>
5857 ##      Domain allowed access.
5858 ##      </summary>
5859 ## </param>
5860 #
5861 interface(`files_search_pids',`
5862         gen_require(`
5863                 type var_t, var_run_t;
5864         ')
5865
5866         allow $1 var_run_t:lnk_file read_lnk_file_perms;
5867         search_dirs_pattern($1, var_t, var_run_t)
5868 ')
5869
5870 ######################################
5871 ## <summary>
5872 ## Add and remove entries from pid directories.
5873 ## </summary>
5874 ## <param name="domain">
5875 ## <summary>
5876 ## Domain allowed access.
5877 ## </summary>
5878 ## </param>
5879 #
5880 interface(`files_rw_pid_dirs',`
5881     gen_require(`
5882         type var_run_t;
5883     ')
5884
5885     allow $1 var_run_t:dir rw_dir_perms;
5886 ')
5887
5888 #######################################
5889 ## <summary>
5890 ##      Create generic pid directory.
5891 ## </summary>
5892 ## <param name="domain">
5893 ##      <summary>
5894 ##      Domain allowed access.
5895 ##      </summary>
5896 ## </param>
5897 #
5898 interface(`files_create_var_run_dirs',`
5899         gen_require(`
5900                 type var_t, var_run_t;
5901         ')
5902
5903         allow $1 var_t:dir search_dir_perms;
5904         allow $1 var_run_t:dir create_dir_perms;
5905 ')
5906
5907 ########################################
5908 ## <summary>
5909 ##      Do not audit attempts to search
5910 ##      the /var/run directory.
5911 ## </summary>
5912 ## <param name="domain">
5913 ##      <summary>
5914 ##      Domain to not audit.
5915 ##      </summary>
5916 ## </param>
5917 #
5918 interface(`files_dontaudit_search_pids',`
5919         gen_require(`
5920                 type var_run_t;
5921         ')
5922
5923         dontaudit $1 var_run_t:dir search_dir_perms;
5924 ')
5925
5926 ########################################
5927 ## <summary>
5928 ##      List the contents of the runtime process
5929 ##      ID directories (/var/run).
5930 ## </summary>
5931 ## <param name="domain">
5932 ##      <summary>
5933 ##      Domain allowed access.
5934 ##      </summary>
5935 ## </param>
5936 #
5937 interface(`files_list_pids',`
5938         gen_require(`
5939                 type var_t, var_run_t;
5940         ')
5941
5942         list_dirs_pattern($1, var_t, var_run_t)
5943 ')
5944
5945 ########################################
5946 ## <summary>
5947 ##      Read generic process ID files.
5948 ## </summary>
5949 ## <param name="domain">
5950 ##      <summary>
5951 ##      Domain allowed access.
5952 ##      </summary>
5953 ## </param>
5954 #
5955 interface(`files_read_generic_pids',`
5956         gen_require(`
5957                 type var_t, var_run_t;
5958         ')
5959
5960         list_dirs_pattern($1, var_t, var_run_t)
5961         read_files_pattern($1, var_run_t, var_run_t)
5962 ')
5963
5964 ########################################
5965 ## <summary>
5966 ##      Write named generic process ID pipes
5967 ## </summary>
5968 ## <param name="domain">
5969 ##      <summary>
5970 ##      Domain allowed access.
5971 ##      </summary>
5972 ## </param>
5973 #
5974 interface(`files_write_generic_pid_pipes',`
5975         gen_require(`
5976                 type var_run_t;
5977         ')
5978
5979         allow $1 var_run_t:fifo_file write;
5980 ')
5981
5982 ########################################
5983 ## <summary>
5984 ##      Create an object in the process ID directory, with a private type.
5985 ## </summary>
5986 ## <desc>
5987 ##      <p>
5988 ##      Create an object in the process ID directory (e.g., /var/run)
5989 ##      with a private type.  Typically this is used for creating
5990 ##      private PID files in /var/run with the private type instead
5991 ##      of the general PID file type. To accomplish this goal,
5992 ##      either the program must be SELinux-aware, or use this interface.
5993 ##      </p>
5994 ##      <p>
5995 ##      Related interfaces:
5996 ##      </p>
5997 ##      <ul>
5998 ##              <li>files_pid_file()</li>
5999 ##      </ul>
6000 ##      <p>
6001 ##      Example usage with a domain that can create and
6002 ##      write its PID file with a private PID file type in the
6003 ##      /var/run directory:
6004 ##      </p>
6005 ##      <p>
6006 ##      type mypidfile_t;
6007 ##      files_pid_file(mypidfile_t)
6008 ##      allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms };
6009 ##      files_pid_filetrans(mydomain_t, mypidfile_t, file)
6010 ##      </p>
6011 ## </desc>
6012 ## <param name="domain">
6013 ##      <summary>
6014 ##      Domain allowed access.
6015 ##      </summary>
6016 ## </param>
6017 ## <param name="private type">
6018 ##      <summary>
6019 ##      The type of the object to be created.
6020 ##      </summary>
6021 ## </param>
6022 ## <param name="object">
6023 ##      <summary>
6024 ##      The object class of the object being created.
6025 ##      </summary>
6026 ## </param>
6027 ## <infoflow type="write" weight="10"/>
6028 #
6029 interface(`files_pid_filetrans',`
6030         gen_require(`
6031                 type var_t, var_run_t;
6032         ')
6033
6034         allow $1 var_t:dir search_dir_perms;
6035         filetrans_pattern($1, var_run_t, $2, $3)
6036 ')
6037
6038 ########################################
6039 ## <summary>
6040 ##      Read and write generic process ID files.
6041 ## </summary>
6042 ## <param name="domain">
6043 ##      <summary>
6044 ##      Domain allowed access.
6045 ##      </summary>
6046 ## </param>
6047 #
6048 interface(`files_rw_generic_pids',`
6049         gen_require(`
6050                 type var_t, var_run_t;
6051         ')
6052
6053         list_dirs_pattern($1, var_t, var_run_t)
6054         rw_files_pattern($1, var_run_t, var_run_t)
6055 ')
6056
6057 ########################################
6058 ## <summary>
6059 ##      Do not audit attempts to get the attributes of
6060 ##      daemon runtime data files.
6061 ## </summary>
6062 ## <param name="domain">
6063 ##      <summary>
6064 ##      Domain to not audit.
6065 ##      </summary>
6066 ## </param>
6067 #
6068 interface(`files_dontaudit_getattr_all_pids',`
6069         gen_require(`
6070                 attribute pidfile;
6071         ')
6072
6073         dontaudit $1 pidfile:file getattr;
6074 ')
6075
6076 ########################################
6077 ## <summary>
6078 ##      Do not audit attempts to write to daemon runtime data files.
6079 ## </summary>
6080 ## <param name="domain">
6081 ##      <summary>
6082 ##      Domain to not audit.
6083 ##      </summary>
6084 ## </param>
6085 #
6086 interface(`files_dontaudit_write_all_pids',`
6087         gen_require(`
6088                 attribute pidfile;
6089         ')
6090
6091         dontaudit $1 pidfile:file write;
6092 ')
6093
6094 ########################################
6095 ## <summary>
6096 ##      Do not audit attempts to ioctl daemon runtime data files.
6097 ## </summary>
6098 ## <param name="domain">
6099 ##      <summary>
6100 ##      Domain to not audit.
6101 ##      </summary>
6102 ## </param>
6103 #
6104 interface(`files_dontaudit_ioctl_all_pids',`
6105         gen_require(`
6106                 attribute pidfile;
6107         ')
6108
6109         dontaudit $1 pidfile:file ioctl;
6110 ')
6111
6112 ########################################
6113 ## <summary>
6114 ##      Relable all pid directories
6115 ## </summary>
6116 ## <param name="domain">
6117 ##      <summary>
6118 ##      Domain allowed access.
6119 ##      </summary>
6120 ## </param>
6121 #
6122 interface(`files_relabel_all_pid_dirs',`
6123         gen_require(`
6124                 attribute pidfile;
6125         ')
6126
6127         relabel_dirs_pattern($1, pidfile, pidfile)
6128 ')
6129
6130 ########################################
6131 ## <summary>
6132 ##      Delete all pid sockets
6133 ## </summary>
6134 ## <param name="domain">
6135 ##      <summary>
6136 ##      Domain allowed access.
6137 ##      </summary>
6138 ## </param>
6139 #
6140 interface(`files_unlink_all_pid_sockets',`
6141         gen_require(`
6142                 attribute pidfile;
6143         ')
6144
6145         allow $1 pidfile:sock_file delete_sock_file_perms;
6146 ')
6147
6148 ########################################
6149 ## <summary>
6150 ##      manage all pidfile directories
6151 ##      in the /var/run directory.
6152 ## </summary>
6153 ## <param name="domain">
6154 ##      <summary>
6155 ##      Domain allowed access.
6156 ##      </summary>
6157 ## </param>
6158 #
6159 interface(`files_manage_all_pid_dirs',`
6160         gen_require(`
6161                 attribute pidfile;
6162         ')
6163
6164         manage_dirs_pattern($1,pidfile,pidfile)
6165 ')
6166
6167
6168 ########################################
6169 ## <summary>
6170 ##      Read all process ID files.
6171 ## </summary>
6172 ## <param name="domain">
6173 ##      <summary>
6174 ##      Domain allowed access.
6175 ##      </summary>
6176 ## </param>
6177 ## <rolecap/>
6178 #
6179 interface(`files_read_all_pids',`
6180         gen_require(`
6181                 attribute pidfile;
6182                 type var_t;
6183         ')
6184
6185         list_dirs_pattern($1, var_t, pidfile)
6186         read_files_pattern($1, pidfile, pidfile)
6187         read_lnk_files_pattern($1, pidfile, pidfile)
6188 ')
6189
6190 ########################################
6191 ## <summary>
6192 ##      Relable all pid files
6193 ## </summary>
6194 ## <param name="domain">
6195 ##      <summary>
6196 ##      Domain allowed access.
6197 ##      </summary>
6198 ## </param>
6199 #
6200 interface(`files_relabel_all_pid_files',`
6201         gen_require(`
6202                 attribute pidfile;
6203         ')
6204
6205         relabel_files_pattern($1, pidfile, pidfile)
6206 ')
6207
6208 ########################################
6209 ## <summary>
6210 ##      manage all pidfiles
6211 ##      in the /var/run directory.
6212 ## </summary>
6213 ## <param name="domain">
6214 ##      <summary>
6215 ##      Domain allowed access.
6216 ##      </summary>
6217 ## </param>
6218 #
6219 interface(`files_manage_all_pids',`
6220         gen_require(`
6221                 attribute pidfile;
6222         ')
6223
6224         manage_files_pattern($1,pidfile,pidfile)
6225 ')
6226
6227 ########################################
6228 ## <summary>
6229 ##      Mount filesystems on all polyinstantiation
6230 ##      member directories.
6231 ## </summary>
6232 ## <param name="domain">
6233 ##      <summary>
6234 ##      Domain allowed access.
6235 ##      </summary>
6236 ## </param>
6237 #
6238 interface(`files_mounton_all_poly_members',`
6239         gen_require(`
6240                 attribute polymember;
6241         ')
6242
6243         allow $1 polymember:dir mounton;
6244 ')
6245
6246 ########################################
6247 ## <summary>
6248 ##      Delete all process IDs.
6249 ## </summary>
6250 ## <param name="domain">
6251 ##      <summary>
6252 ##      Domain allowed access.
6253 ##      </summary>
6254 ## </param>
6255 ## <rolecap/>
6256 #
6257 interface(`files_delete_all_pids',`
6258         gen_require(`
6259                 attribute pidfile;
6260                 type var_t, var_run_t;
6261         ')
6262
6263         allow $1 var_t:dir search_dir_perms;
6264         allow $1 var_run_t:dir rmdir;
6265         allow $1 var_run_t:lnk_file delete_lnk_file_perms;
6266         delete_files_pattern($1, pidfile, pidfile)
6267         delete_fifo_files_pattern($1, pidfile, pidfile)
6268         delete_sock_files_pattern($1, pidfile, { pidfile var_run_t })
6269 ')
6270
6271 ########################################
6272 ## <summary>
6273 ##      Delete all process ID directories.
6274 ## </summary>
6275 ## <param name="domain">
6276 ##      <summary>
6277 ##      Domain allowed access.
6278 ##      </summary>
6279 ## </param>
6280 #
6281 interface(`files_delete_all_pid_dirs',`
6282         gen_require(`
6283                 attribute pidfile;
6284                 type var_t;
6285         ')
6286
6287         allow $1 var_t:dir search_dir_perms;
6288         delete_dirs_pattern($1, pidfile, pidfile)
6289 ')
6290
6291 ########################################
6292 ## <summary>
6293 ##      Search the contents of generic spool
6294 ##      directories (/var/spool).
6295 ## </summary>
6296 ## <param name="domain">
6297 ##      <summary>
6298 ##      Domain allowed access.
6299 ##      </summary>
6300 ## </param>
6301 #
6302 interface(`files_search_spool',`
6303         gen_require(`
6304                 type var_t, var_spool_t;
6305         ')
6306
6307         search_dirs_pattern($1, var_t, var_spool_t)
6308 ')
6309
6310 ########################################
6311 ## <summary>
6312 ##      Do not audit attempts to search generic
6313 ##      spool directories.
6314 ## </summary>
6315 ## <param name="domain">
6316 ##      <summary>
6317 ##      Domain to not audit.
6318 ##      </summary>
6319 ## </param>
6320 #
6321 interface(`files_dontaudit_search_spool',`
6322         gen_require(`
6323                 type var_spool_t;
6324         ')
6325
6326         dontaudit $1 var_spool_t:dir search_dir_perms;
6327 ')
6328
6329 ########################################
6330 ## <summary>
6331 ##      List the contents of generic spool
6332 ##      (/var/spool) directories.
6333 ## </summary>
6334 ## <param name="domain">
6335 ##      <summary>
6336 ##      Domain allowed access.
6337 ##      </summary>
6338 ## </param>
6339 #
6340 interface(`files_list_spool',`
6341         gen_require(`
6342                 type var_t, var_spool_t;
6343         ')
6344
6345         list_dirs_pattern($1, var_t, var_spool_t)
6346 ')
6347
6348 ########################################
6349 ## <summary>
6350 ##      Create, read, write, and delete generic
6351 ##      spool directories (/var/spool).
6352 ## </summary>
6353 ## <param name="domain">
6354 ##      <summary>
6355 ##      Domain allowed access.
6356 ##      </summary>
6357 ## </param>
6358 #
6359 interface(`files_manage_generic_spool_dirs',`
6360         gen_require(`
6361                 type var_t, var_spool_t;
6362         ')
6363
6364         allow $1 var_t:dir search_dir_perms;
6365         manage_dirs_pattern($1, var_spool_t, var_spool_t)
6366 ')
6367
6368 ########################################
6369 ## <summary>
6370 ##      Read generic spool files.
6371 ## </summary>
6372 ## <param name="domain">
6373 ##      <summary>
6374 ##      Domain allowed access.
6375 ##      </summary>
6376 ## </param>
6377 #
6378 interface(`files_read_generic_spool',`
6379         gen_require(`
6380                 type var_t, var_spool_t;
6381         ')
6382
6383         list_dirs_pattern($1, var_t, var_spool_t)
6384         read_files_pattern($1, var_spool_t, var_spool_t)
6385 ')
6386
6387 ########################################
6388 ## <summary>
6389 ##      Create, read, write, and delete generic
6390 ##      spool files.
6391 ## </summary>
6392 ## <param name="domain">
6393 ##      <summary>
6394 ##      Domain allowed access.
6395 ##      </summary>
6396 ## </param>
6397 #
6398 interface(`files_manage_generic_spool',`
6399         gen_require(`
6400                 type var_t, var_spool_t;
6401         ')
6402
6403         allow $1 var_t:dir search_dir_perms;
6404         manage_files_pattern($1, var_spool_t, var_spool_t)
6405 ')
6406
6407 ########################################
6408 ## <summary>
6409 ##      Create objects in the spool directory
6410 ##      with a private type with a type transition.
6411 ## </summary>
6412 ## <param name="domain">
6413 ##      <summary>
6414 ##      Domain allowed access.
6415 ##      </summary>
6416 ## </param>
6417 ## <param name="file">
6418 ##      <summary>
6419 ##      Type to which the created node will be transitioned.
6420 ##      </summary>
6421 ## </param>
6422 ## <param name="class">
6423 ##      <summary>
6424 ##      Object class(es) (single or set including {}) for which this
6425 ##      the transition will occur.
6426 ##      </summary>
6427 ## </param>
6428 #
6429 interface(`files_spool_filetrans',`
6430         gen_require(`
6431                 type var_t, var_spool_t;
6432         ')
6433
6434         allow $1 var_t:dir search_dir_perms;
6435         filetrans_pattern($1, var_spool_t, $2, $3)
6436 ')
6437
6438 ########################################
6439 ## <summary>
6440 ##      Allow access to manage all polyinstantiated
6441 ##      directories on the system.
6442 ## </summary>
6443 ## <param name="domain">
6444 ##      <summary>
6445 ##      Domain allowed access.
6446 ##      </summary>
6447 ## </param>
6448 #
6449 interface(`files_polyinstantiate_all',`
6450         gen_require(`
6451                 attribute polydir, polymember, polyparent;
6452                 type poly_t;
6453         ')
6454
6455         # Need to give access to /selinux/member
6456         selinux_compute_member($1)
6457
6458         # Need sys_admin capability for mounting
6459         allow $1 self:capability { chown fsetid sys_admin fowner };
6460
6461         # Need to give access to the directories to be polyinstantiated
6462         allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
6463
6464         # Need to give access to the polyinstantiated subdirectories
6465         allow $1 polymember:dir search_dir_perms;
6466
6467         # Need to give access to parent directories where original
6468         # is remounted for polyinstantiation aware programs (like gdm)
6469         allow $1 polyparent:dir { getattr mounton };
6470
6471         # Need to give permission to create directories where applicable
6472         allow $1 self:process setfscreate;
6473         allow $1 polymember: dir { create setattr relabelto };
6474         allow $1 polydir: dir { write add_name open };
6475         allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto };
6476
6477         # Default type for mountpoints
6478         allow $1 poly_t:dir { create mounton };
6479         fs_unmount_xattr_fs($1)
6480
6481         fs_mount_tmpfs($1)
6482         fs_unmount_tmpfs($1)
6483
6484         ifdef(`distro_redhat',`
6485                 # namespace.init
6486                 files_search_tmp($1)
6487                 files_search_home($1)
6488                 corecmd_exec_bin($1)
6489                 seutil_domtrans_setfiles($1)
6490         ')
6491 ')
6492
6493 ########################################
6494 ## <summary>
6495 ##      Unconfined access to files.
6496 ## </summary>
6497 ## <param name="domain">
6498 ##      <summary>
6499 ##      Domain allowed access.
6500 ##      </summary>
6501 ## </param>
6502 #
6503 interface(`files_unconfined',`
6504         gen_require(`
6505                 attribute files_unconfined_type;
6506         ')
6507
6508         typeattribute $1 files_unconfined_type;
6509 ')
6510
6511 ########################################
6512 ## <summary>
6513 ##      Create a core files in /
6514 ## </summary>
6515 ## <desc>
6516 ##      <p>
6517 ##      Create a core file in /,
6518 ##      </p>
6519 ## </desc>
6520 ## <param name="domain">
6521 ##      <summary>
6522 ##      Domain allowed access.
6523 ##      </summary>
6524 ## </param>
6525 ## <rolecap/>
6526 #
6527 interface(`files_manage_root_files',`
6528         gen_require(`
6529                 type root_t;
6530         ')
6531
6532         manage_files_pattern($1, root_t, root_t)
6533 ')
6534
6535 ########################################
6536 ## <summary>
6537 ##     Create a default directory
6538 ## </summary>
6539 ## <desc>
6540 ##     <p>
6541 ##     Create a default_t direcrory
6542 ##     </p>
6543 ## </desc>
6544 ## <param name="domain">
6545 ##     <summary>
6546 ##     Domain allowed access.
6547 ##     </summary>
6548 ## </param>
6549 ## <rolecap/>
6550 #
6551 interface(`files_create_default_dir',`
6552        gen_require(`
6553                type default_t;
6554        ')
6555
6556        allow $1 default_t:dir create;
6557 ')
6558
6559 ########################################
6560 ## <summary>
6561 ##      Create, default_t objects with an automatic
6562 ##      type transition.
6563 ## </summary>
6564 ## <param name="domain">
6565 ##      <summary>
6566 ##      Domain allowed access.
6567 ##      </summary>
6568 ## </param>
6569 ## <param name="object">
6570 ##      <summary>
6571 ##      The class of the object being created.
6572 ##      </summary>
6573 ## </param>
6574 #
6575 interface(`files_root_filetrans_default',`
6576        gen_require(`
6577                type root_t, default_t;
6578        ')
6579
6580        filetrans_pattern($1, root_t, default_t, $2)
6581 ')
6582
6583 ########################################
6584 ## <summary>
6585 ##      manage generic symbolic links
6586 ##      in the /var/run directory.
6587 ## </summary>
6588 ## <param name="domain">
6589 ##      <summary>
6590 ##      Domain allowed access.
6591 ##      </summary>
6592 ## </param>
6593 #
6594 interface(`files_manage_generic_pids_symlinks',`
6595         gen_require(`
6596                 type var_run_t;
6597         ')
6598
6599         manage_lnk_files_pattern($1,var_run_t,var_run_t)
6600 ')
6601
6602 ########################################
6603 ## <summary>
6604 ##      Do not audit attempts to getattr
6605 ##      all tmpfs files.
6606 ## </summary>
6607 ## <param name="domain">
6608 ##      <summary>
6609 ##      Domain to not audit.
6610 ##      </summary>
6611 ## </param>
6612 #
6613 interface(`files_dontaudit_getattr_tmpfs_files',`
6614         gen_require(`
6615                 attribute tmpfsfile;
6616         ')
6617
6618         allow $1 tmpfsfile:file getattr;
6619 ')
6620
6621 ########################################
6622 ## <summary>
6623 ##      Allow read write all tmpfs files
6624 ## </summary>
6625 ## <param name="domain">
6626 ##      <summary>
6627 ##      Domain to not audit.
6628 ##      </summary>
6629 ## </param>
6630 #
6631 interface(`files_rw_tmpfs_files',`
6632         gen_require(`
6633                 attribute tmpfsfile;
6634         ')
6635
6636         allow $1 tmpfsfile:file { read write };
6637 ')
6638
6639 ########################################
6640 ## <summary>
6641 ##      Do not audit attempts to read security files
6642 ## </summary>
6643 ## <param name="domain">
6644 ##      <summary>
6645 ##      Domain to not audit.
6646 ##      </summary>
6647 ## </param>
6648 #
6649 interface(`files_dontaudit_read_security_files',`
6650         gen_require(`
6651                 attribute security_file_type;
6652         ')
6653
6654         dontaudit $1 security_file_type:file read_file_perms;
6655 ')
6656
6657 ########################################
6658 ## <summary>
6659 ##      rw any files inherited from another process
6660 ## </summary>
6661 ## <param name="domain">
6662 ##      <summary>
6663 ##      Domain allowed access.
6664 ##      </summary>
6665 ## </param>
6666 ## <rolecap/>
6667 #
6668 interface(`files_rw_all_inherited_files',`
6669         gen_require(`
6670                 attribute file_type;
6671         ')
6672
6673         allow $1 { file_type $2 }:file rw_inherited_file_perms;
6674         allow $1 { file_type $2 }:fifo_file rw_inherited_fifo_file_perms;
6675         allow $1 { file_type $2 }:sock_file rw_inherited_sock_file_perms;
6676         allow $1 { file_type $2 }:chr_file rw_inherited_chr_file_perms;
6677 ')
6678
6679 ########################################
6680 ## <summary>
6681 ##      Allow any file point to be the entrypoint of this domain
6682 ## </summary>
6683 ## <param name="domain">
6684 ##      <summary>
6685 ##      Domain allowed access.
6686 ##      </summary>
6687 ## </param>
6688 ## <rolecap/>
6689 #
6690 interface(`files_entrypoint_all_files',`
6691         gen_require(`
6692                 attribute file_type;
6693         ')
6694         allow $1 file_type:file entrypoint;
6695 ')
6696
6697 ########################################
6698 ## <summary>
6699 ##      Do not audit attempts to rw inherited file perms
6700 ##      of non security files.
6701 ## </summary>
6702 ## <param name="domain">
6703 ##      <summary>
6704 ##      Domain to not audit.
6705 ##      </summary>
6706 ## </param>
6707 #
6708 interface(`files_dontaudit_all_non_security_leaks',`
6709         gen_require(`
6710                 attribute non_security_file_type;
6711         ')
6712
6713         dontaudit $1 non_security_file_type:file_class_set rw_inherited_file_perms;
6714 ')
6715
6716 ########################################
6717 ## <summary>
6718 ##      Do not audit attempts to read or write
6719 ##      all leaked files.
6720 ## </summary>
6721 ## <param name="domain">
6722 ##      <summary>
6723 ##      Domain allowed access.
6724 ##      </summary>
6725 ## </param>
6726 #
6727 interface(`files_dontaudit_leaks',`
6728         gen_require(`
6729                 attribute file_type;
6730         ')
6731
6732         dontaudit $1 file_type:file rw_inherited_file_perms;
6733         dontaudit $1 file_type:lnk_file { read };
6734 ')
6735
6736 ########################################
6737 ## <summary>
6738 ##      Allow domain to create_file_ass all types
6739 ## </summary>
6740 ## <param name="domain">
6741 ##      <summary>
6742 ##      Domain allowed access.
6743 ##      </summary>
6744 ## </param>
6745 #
6746 interface(`files_create_as_is_all_files',`
6747         gen_require(`
6748                 attribute file_type;
6749                 class kernel_service create_files_as;
6750         ')
6751
6752         allow $1 file_type:kernel_service create_files_as;
6753 ')
6754
6755 ########################################
6756 ## <summary>
6757 ##      Do not audit attempts to check the
6758 ##      write access on all files
6759 ## </summary>
6760 ## <param name="domain">
6761 ##      <summary>
6762 ##      Domain to not audit.
6763 ##      </summary>
6764 ## </param>
6765 #
6766 interface(`files_dontaudit_all_access_check',`
6767         gen_require(`
6768                 attribute file_type;
6769         ')
6770
6771         dontaudit $1 file_type:file_class_set audit_access;
6772 ')
6773
6774 ########################################
6775 ## <summary>
6776 ##      Do not audit attempts to write to all files
6777 ## </summary>
6778 ## <param name="domain">
6779 ##      <summary>
6780 ##      Domain to not audit.
6781 ##      </summary>
6782 ## </param>
6783 #
6784 interface(`files_dontaudit_write_all_files',`
6785         gen_require(`
6786                 attribute file_type;
6787         ')
6788
6789         dontaudit $1 file_type:dir_file_class_set write;
6790 ')