policy/modules/kernel/kernel.if

   1 ## <summary>
   2 ##      Policy for kernel threads, proc filesystem,
   3 ##      and unlabeled processes and objects.
   4 ## </summary>
   5 ## <required val="true">
   6 ##      This module has initial SIDs.
   7 ## </required>
   8
   9 ########################################
  10 ## <summary>
  11 ##      Allows to start userland processes
  12 ##      by transitioning to the specified domain.
  13 ## </summary>
  14 ## <param name="domain">
  15 ##      <summary>
  16 ##      The process type entered by kernel.
  17 ##      </summary>
  18 ## </param>
  19 ## <param name="entrypoint">
  20 ##      <summary>
  21 ##      The executable type for the entrypoint.
  22 ##      </summary>
  23 ## </param>
  24 #
  25 interface(`kernel_domtrans_to',`
  26         gen_require(`
  27                 type kernel_t;
  28         ')
  29
  30         domtrans_pattern(kernel_t, $2, $1)
  31 ')
  32
  33 ########################################
  34 ## <summary>
  35 ##      Allows to start userland processes
  36 ##      by transitioning to the specified domain,
  37 ##      with a range transition.
  38 ## </summary>
  39 ## <param name="domain">
  40 ##      <summary>
  41 ##      The process type entered by kernel.
  42 ##      </summary>
  43 ## </param>
  44 ## <param name="entrypoint">
  45 ##      <summary>
  46 ##      The executable type for the entrypoint.
  47 ##      </summary>
  48 ## </param>
  49 ## <param name="range">
  50 ##      <summary>
  51 ##      Range for the domain.
  52 ##      </summary>
  53 ## </param>
  54 #
  55 interface(`kernel_ranged_domtrans_to',`
  56         gen_require(`
  57                 type kernel_t;
  58         ')
  59
  60         kernel_domtrans_to($1, $2)
  61
  62         ifdef(`enable_mcs',`
  63                 range_transition kernel_t $2:process $3;
  64         ')
  65
  66         ifdef(`enable_mls',`
  67                 range_transition kernel_t $2:process $3;
  68                 mls_rangetrans_target($1)
  69         ')
  70 ')
  71
  72 ########################################
  73 ## <summary>
  74 ##      Allows the kernel to mount filesystems on
  75 ##      the specified directory type.
  76 ## </summary>
  77 ## <param name="directory_type">
  78 ##      <summary>
  79 ##      The type of the directory to use as a mountpoint.
  80 ##      </summary>
  81 ## </param>
  82 #
  83 interface(`kernel_rootfs_mountpoint',`
  84         gen_require(`
  85                 type kernel_t;
  86         ')
  87
  88         allow kernel_t $1:dir mounton;
  89 ')
  90
  91 ########################################
  92 ## <summary>
  93 ##      Set the process group of kernel threads.
  94 ## </summary>
  95 ## <param name="domain">
  96 ##      <summary>
  97 ##      Domain allowed access.
  98 ##      </summary>
  99 ## </param>
 100 #
 101 interface(`kernel_setpgid',`
 102         gen_require(`
 103                 type kernel_t;
 104         ')
 105
 106         allow $1 kernel_t:process setpgid;
 107 ')
 108
 109 ########################################
 110 ## <summary>
 111 ##      Set the priority of kernel threads.
 112 ## </summary>
 113 ## <param name="domain">
 114 ##      <summary>
 115 ##      Domain allowed access.
 116 ##      </summary>
 117 ## </param>
 118 #
 119 interface(`kernel_setsched',`
 120         gen_require(`
 121                 type kernel_t;
 122         ')
 123
 124         allow $1 kernel_t:process setsched;
 125 ')
 126
 127 ########################################
 128 ## <summary>
 129 ##      Send a SIGCHLD signal to kernel threads.
 130 ## </summary>
 131 ## <param name="domain">
 132 ##      <summary>
 133 ##      Domain allowed access.
 134 ##      </summary>
 135 ## </param>
 136 #
 137 interface(`kernel_sigchld',`
 138         gen_require(`
 139                 type kernel_t;
 140         ')
 141
 142         allow $1 kernel_t:process sigchld;
 143 ')
 144
 145 ########################################
 146 ## <summary>
 147 ##      Send a kill signal to kernel threads.
 148 ## </summary>
 149 ## <param name="domain">
 150 ##      <summary>
 151 ##      Domain allowed access.
 152 ##      </summary>
 153 ## </param>
 154 #
 155 interface(`kernel_kill',`
 156         gen_require(`
 157                 type kernel_t;
 158         ')
 159
 160         allow $1 kernel_t:process sigkill;
 161 ')
 162
 163 ########################################
 164 ## <summary>
 165 ##      Send a generic signal to kernel threads.
 166 ## </summary>
 167 ## <param name="domain">
 168 ##      <summary>
 169 ##      Domain allowed access.
 170 ##      </summary>
 171 ## </param>
 172 #
 173 interface(`kernel_signal',`
 174         gen_require(`
 175                 type kernel_t;
 176         ')
 177
 178         allow $1 kernel_t:process signal;
 179 ')
 180
 181 ########################################
 182 ## <summary>
 183 ##      Allows the kernel to share state information with
 184 ##      the caller.
 185 ## </summary>
 186 ## <param name="domain">
 187 ##      <summary>
 188 ##      The type of the process with which to share state information.
 189 ##      </summary>
 190 ## </param>
 191 #
 192 interface(`kernel_share_state',`
 193         gen_require(`
 194                 type kernel_t;
 195         ')
 196
 197         allow kernel_t $1:process share;
 198 ')
 199
 200 ########################################
 201 ## <summary>
 202 ##      Permits caller to use kernel file descriptors.
 203 ## </summary>
 204 ## <param name="domain">
 205 ##      <summary>
 206 ##      Domain allowed access.
 207 ##      </summary>
 208 ## </param>
 209 #
 210 interface(`kernel_use_fds',`
 211         gen_require(`
 212                 type kernel_t;
 213         ')
 214
 215         allow $1 kernel_t:fd use;
 216 ')
 217
 218 ########################################
 219 ## <summary>
 220 ##      Do not audit attempts to use
 221 ##      kernel file descriptors.
 222 ## </summary>
 223 ## <param name="domain">
 224 ##      <summary>
 225 ##      Domain to not audit.
 226 ##      </summary>
 227 ## </param>
 228 #
 229 interface(`kernel_dontaudit_use_fds',`
 230         gen_require(`
 231                 type kernel_t;
 232         ')
 233
 234         dontaudit $1 kernel_t:fd use;
 235 ')
 236
 237 ########################################
 238 ## <summary>
 239 ##      Read and write kernel unnamed pipes.
 240 ## </summary>
 241 ## <param name="domain">
 242 ##      <summary>
 243 ##      Domain allowed access.
 244 ##      </summary>
 245 ## </param>
 246 #
 247 interface(`kernel_rw_pipes',`
 248         gen_require(`
 249                 type kernel_t;
 250         ')
 251
 252         allow $1 kernel_t:fifo_file { read write };
 253 ')
 254
 255 ########################################
 256 ## <summary>
 257 ##      Read and write kernel unix datagram sockets.
 258 ## </summary>
 259 ## <param name="domain">
 260 ##      <summary>
 261 ##      Domain allowed access.
 262 ##      </summary>
 263 ## </param>
 264 #
 265 interface(`kernel_rw_unix_dgram_sockets',`
 266         gen_require(`
 267                 type kernel_t;
 268         ')
 269
 270         allow $1 kernel_t:unix_dgram_socket { read write ioctl };
 271 ')
 272
 273 ########################################
 274 ## <summary>
 275 ##      Send messages to kernel unix datagram sockets.
 276 ## </summary>
 277 ## <param name="domain">
 278 ##      <summary>
 279 ##      Domain allowed access.
 280 ##      </summary>
 281 ## </param>
 282 #
 283 interface(`kernel_dgram_send',`
 284         gen_require(`
 285                 type kernel_t;
 286         ')
 287
 288         allow $1 kernel_t:unix_dgram_socket sendto;
 289 ')
 290
 291 ########################################
 292 ## <summary>
 293 ##      Receive messages from kernel TCP sockets.  (Deprecated)
 294 ## </summary>
 295 ## <param name="domain">
 296 ##      <summary>
 297 ##      Domain allowed access.
 298 ##      </summary>
 299 ## </param>
 300 #
 301 interface(`kernel_tcp_recvfrom',`
 302         refpolicywarn(`$0($*) has been deprecated.')
 303 ')
 304
 305 ########################################
 306 ## <summary>
 307 ##      Send UDP network traffic to the kernel.  (Deprecated)
 308 ## </summary>
 309 ## <param name="domain">
 310 ##      <summary>
 311 ##      Domain allowed access.
 312 ##      </summary>
 313 ## </param>
 314 #
 315 interface(`kernel_udp_send',`
 316         refpolicywarn(`$0($*) has been deprecated.')
 317 ')
 318
 319 ########################################
 320 ## <summary>
 321 ##      Receive messages from kernel UDP sockets.  (Deprecated)
 322 ## </summary>
 323 ## <param name="domain">
 324 ##      <summary>
 325 ##      Domain allowed access.
 326 ##      </summary>
 327 ## </param>
 328 #
 329 interface(`kernel_udp_recvfrom',`
 330         refpolicywarn(`$0($*) has been deprecated.')
 331 ')
 332
 333 ########################################
 334 ## <summary>
 335 ##      Allows caller to load kernel modules
 336 ## </summary>
 337 ## <param name="domain">
 338 ##      <summary>
 339 ##      Domain allowed access.
 340 ##      </summary>
 341 ## </param>
 342 #
 343 interface(`kernel_load_module',`
 344         gen_require(`
 345                 attribute can_load_kernmodule;
 346         ')
 347
 348         allow $1 self:capability sys_module;
 349         typeattribute $1 can_load_kernmodule;
 350
 351         # load_module() calls stop_machine() which
 352         # calls sched_setscheduler()
 353         allow $1 self:capability sys_nice;
 354         kernel_setsched($1)
 355 ')
 356
 357 ########################################
 358 ## <summary>
 359 ##      Allow search the kernel key ring.
 360 ## </summary>
 361 ## <param name="domain">
 362 ##      <summary>
 363 ##      Domain allowed access.
 364 ##      </summary>
 365 ## </param>
 366 #
 367 interface(`kernel_search_key',`
 368         gen_require(`
 369                 type kernel_t;
 370         ')
 371
 372         allow $1 kernel_t:key search;
 373 ')
 374
 375 ########################################
 376 ## <summary>
 377 ##      dontaudit search the kernel key ring.
 378 ## </summary>
 379 ## <param name="domain">
 380 ##      <summary>
 381 ##      Domain to not audit.
 382 ##      </summary>
 383 ## </param>
 384 #
 385 interface(`kernel_dontaudit_search_key',`
 386         gen_require(`
 387                 type kernel_t;
 388         ')
 389
 390         dontaudit $1 kernel_t:key search;
 391 ')
 392
 393 ########################################
 394 ## <summary>
 395 ##      Allow link to the kernel key ring.
 396 ## </summary>
 397 ## <param name="domain">
 398 ##      <summary>
 399 ##      Domain allowed access.
 400 ##      </summary>
 401 ## </param>
 402 #
 403 interface(`kernel_link_key',`
 404         gen_require(`
 405                 type kernel_t;
 406         ')
 407
 408         allow $1 kernel_t:key link;
 409 ')
 410
 411 ########################################
 412 ## <summary>
 413 ##      dontaudit link to the kernel key ring.
 414 ## </summary>
 415 ## <param name="domain">
 416 ##      <summary>
 417 ##      Domain to not audit.
 418 ##      </summary>
 419 ## </param>
 420 #
 421 interface(`kernel_dontaudit_link_key',`
 422         gen_require(`
 423                 type kernel_t;
 424         ')
 425
 426         dontaudit $1 kernel_t:key link;
 427 ')
 428
 429 ########################################
 430 ## <summary>
 431 ##      Allows caller to read the ring buffer.
 432 ## </summary>
 433 ## <param name="domain">
 434 ##      <summary>
 435 ##      Domain allowed access.
 436 ##      </summary>
 437 ## </param>
 438 ## <rolecap/>
 439 #
 440 interface(`kernel_read_ring_buffer',`
 441         gen_require(`
 442                 type kernel_t;
 443         ')
 444
 445         allow $1 kernel_t:system syslog_read;
 446 ')
 447
 448 ########################################
 449 ## <summary>
 450 ##      Do not audit attempts to read the ring buffer.
 451 ## </summary>
 452 ## <param name="domain">
 453 ##      <summary>
 454 ##      Domain to not audit.
 455 ##      </summary>
 456 ## </param>
 457 #
 458 interface(`kernel_dontaudit_read_ring_buffer',`
 459         gen_require(`
 460                 type kernel_t;
 461         ')
 462
 463         dontaudit $1 kernel_t:system syslog_read;
 464 ')
 465
 466 ########################################
 467 ## <summary>
 468 ##      Change the level of kernel messages logged to the console.
 469 ## </summary>
 470 ## <param name="domain">
 471 ##      <summary>
 472 ##      Domain allowed access.
 473 ##      </summary>
 474 ## </param>
 475 ## <rolecap/>
 476 #
 477 interface(`kernel_change_ring_buffer_level',`
 478         gen_require(`
 479                 type kernel_t;
 480         ')
 481
 482         allow $1 kernel_t:system syslog_console;
 483 ')
 484
 485 ########################################
 486 ## <summary>
 487 ##      Allows the caller to clear the ring buffer.
 488 ## </summary>
 489 ## <param name="domain">
 490 ##      <summary>
 491 ##      Domain allowed access.
 492 ##      </summary>
 493 ## </param>
 494 ## <rolecap/>
 495 #
 496 interface(`kernel_clear_ring_buffer',`
 497         gen_require(`
 498                 type kernel_t;
 499         ')
 500
 501         allow $1 kernel_t:system syslog_mod;
 502 ')
 503
 504 ########################################
 505 ## <summary>
 506 ##      Allows caller to request the kernel to load a module
 507 ## </summary>
 508 ## <desc>
 509 ##      <p>
 510 ##      Allow the specified domain to request that the kernel
 511 ##      load a kernel module.  An example of this is the
 512 ##      auto-loading of network drivers when doing an
 513 ##      ioctl() on a network interface.
 514 ##      </p>
 515 ##      <p>
 516 ##      In the specific case of a module loading request
 517 ##      on a network interface, the domain will also
 518 ##      need the net_admin capability.
 519 ##      </p>
 520 ## </desc>
 521 ## <param name="domain">
 522 ##      <summary>
 523 ##      Domain allowed access.
 524 ##      </summary>
 525 ## </param>
 526 #
 527 interface(`kernel_request_load_module',`
 528         gen_require(`
 529                 type kernel_t;
 530         ')
 531
 532         allow $1 kernel_t:system module_request;
 533 ')
 534
 535 ########################################
 536 ## <summary>
 537 ##      Do not audit requests to the kernel to load a module.
 538 ## </summary>
 539 ## <param name="domain">
 540 ##      <summary>
 541 ##      Domain to not audit.
 542 ##      </summary>
 543 ## </param>
 544 #
 545 interface(`kernel_dontaudit_request_load_module',`
 546         gen_require(`
 547                 type kernel_t;
 548         ')
 549
 550         dontaudit $1 kernel_t:system module_request;
 551 ')
 552
 553 ########################################
 554 ## <summary>
 555 ##      Get information on all System V IPC objects.
 556 ## </summary>
 557 ## <param name="domain">
 558 ##      <summary>
 559 ##      Domain allowed access.
 560 ##      </summary>
 561 ## </param>
 562 #
 563 interface(`kernel_get_sysvipc_info',`
 564         gen_require(`
 565                 type kernel_t;
 566         ')
 567
 568         allow $1 kernel_t:system ipc_info;
 569 ')
 570
 571 ########################################
 572 ## <summary>
 573 ##      Get the attributes of a kernel debugging filesystem.
 574 ## </summary>
 575 ## <param name="domain">
 576 ##      <summary>
 577 ##      Domain allowed access.
 578 ##      </summary>
 579 ## </param>
 580 #
 581 interface(`kernel_getattr_debugfs',`
 582         gen_require(`
 583                 type debugfs_t;
 584         ')
 585
 586         allow $1 debugfs_t:filesystem getattr;
 587 ')
 588
 589 ########################################
 590 ## <summary>
 591 ##      Mount a kernel debugging filesystem.
 592 ## </summary>
 593 ## <param name="domain">
 594 ##      <summary>
 595 ##      Domain allowed access.
 596 ##      </summary>
 597 ## </param>
 598 #
 599 interface(`kernel_mount_debugfs',`
 600         gen_require(`
 601                 type debugfs_t;
 602         ')
 603
 604         allow $1 debugfs_t:filesystem mount;
 605 ')
 606
 607 ########################################
 608 ## <summary>
 609 ##      Unmount a kernel debugging filesystem.
 610 ## </summary>
 611 ## <param name="domain">
 612 ##      <summary>
 613 ##      Domain allowed access.
 614 ##      </summary>
 615 ## </param>
 616 #
 617 interface(`kernel_unmount_debugfs',`
 618         gen_require(`
 619                 type debugfs_t;
 620         ')
 621
 622         allow $1 debugfs_t:filesystem unmount;
 623 ')
 624
 625 ########################################
 626 ## <summary>
 627 ##      Remount a kernel debugging filesystem.
 628 ## </summary>
 629 ## <param name="domain">
 630 ##      <summary>
 631 ##      Domain allowed access.
 632 ##      </summary>
 633 ## </param>
 634 #
 635 interface(`kernel_remount_debugfs',`
 636         gen_require(`
 637                 type debugfs_t;
 638         ')
 639
 640         allow $1 debugfs_t:filesystem remount;
 641 ')
 642
 643 ########################################
 644 ## <summary>
 645 ##      Search the contents of a kernel debugging filesystem.
 646 ## </summary>
 647 ## <param name="domain">
 648 ##      <summary>
 649 ##      Domain allowed access.
 650 ##      </summary>
 651 ## </param>
 652 #
 653 interface(`kernel_search_debugfs',`
 654         gen_require(`
 655                 type debugfs_t;
 656         ')
 657
 658         search_dirs_pattern($1, debugfs_t, debugfs_t)
 659 ')
 660
 661 ########################################
 662 ## <summary>
 663 ##      Do not audit attempts to search the kernel debugging filesystem.
 664 ## </summary>
 665 ## <param name="domain">
 666 ##      <summary>
 667 ##      Domain to not audit.
 668 ##      </summary>
 669 ## </param>
 670 #
 671 interface(`kernel_dontaudit_search_debugfs',`
 672         gen_require(`
 673                 type debugfs_t;
 674         ')
 675
 676         dontaudit $1 debugfs_t:dir search_dir_perms;
 677 ')
 678
 679 ########################################
 680 ## <summary>
 681 ##      Read information from the debugging filesystem.
 682 ## </summary>
 683 ## <param name="domain">
 684 ##      <summary>
 685 ##      Domain allowed access.
 686 ##      </summary>
 687 ## </param>
 688 #
 689 interface(`kernel_read_debugfs',`
 690         gen_require(`
 691                 type debugfs_t;
 692         ')
 693
 694         read_files_pattern($1, debugfs_t, debugfs_t)
 695         read_lnk_files_pattern($1, debugfs_t, debugfs_t)
 696         list_dirs_pattern($1, debugfs_t, debugfs_t)
 697 ')
 698
 699 ########################################
 700 ## <summary>
 701 ##      Read/Write information from the debugging filesystem.
 702 ## </summary>
 703 ## <param name="domain">
 704 ##      <summary>
 705 ##      Domain allowed access.
 706 ##      </summary>
 707 ## </param>
 708 #
 709 interface(`kernel_rw_debugfs',`
 710         gen_require(`
 711                 type debugfs_t;
 712         ')
 713
 714         rw_files_pattern($1, debugfs_t, debugfs_t)
 715         read_lnk_files_pattern($1, debugfs_t, debugfs_t)
 716         list_dirs_pattern($1, debugfs_t, debugfs_t)
 717 ')
 718
 719 ########################################
 720 ## <summary>
 721 ##      Manage information from the debugging filesystem.
 722 ## </summary>
 723 ## <param name="domain">
 724 ##      <summary>
 725 ##      Domain allowed access.
 726 ##      </summary>
 727 ## </param>
 728 #
 729 interface(`kernel_manage_debugfs',`
 730         gen_require(`
 731                 type debugfs_t;
 732         ')
 733
 734         manage_files_pattern($1, debugfs_t, debugfs_t)
 735         read_lnk_files_pattern($1, debugfs_t, debugfs_t)
 736         list_dirs_pattern($1, debugfs_t, debugfs_t)
 737 ')
 738
 739 ########################################
 740 ## <summary>
 741 ##      Mount a kernel VM filesystem.
 742 ## </summary>
 743 ## <param name="domain">
 744 ##      <summary>
 745 ##      Domain allowed access.
 746 ##      </summary>
 747 ## </param>
 748 #
 749 interface(`kernel_mount_kvmfs',`
 750         gen_require(`
 751                 type kvmfs_t;
 752         ')
 753
 754         allow $1 kvmfs_t:filesystem mount;
 755 ')
 756
 757 ########################################
 758 ## <summary>
 759 ##      Unmount the proc filesystem.
 760 ## </summary>
 761 ## <param name="domain">
 762 ##      <summary>
 763 ##      Domain allowed access.
 764 ##      </summary>
 765 ## </param>
 766 #
 767 interface(`kernel_unmount_proc',`
 768         gen_require(`
 769                 type proc_t;
 770         ')
 771
 772         allow $1 proc_t:filesystem unmount;
 773 ')
 774
 775 ########################################
 776 ## <summary>
 777 ##      Get the attributes of the proc filesystem.
 778 ## </summary>
 779 ## <param name="domain">
 780 ##      <summary>
 781 ##      Domain allowed access.
 782 ##      </summary>
 783 ## </param>
 784 #
 785 interface(`kernel_getattr_proc',`
 786         gen_require(`
 787                 type proc_t;
 788         ')
 789
 790         allow $1 proc_t:filesystem getattr;
 791 ')
 792
 793 ########################################
 794 ## <summary>
 795 ##      Search directories in /proc.
 796 ## </summary>
 797 ## <param name="domain">
 798 ##      <summary>
 799 ##      Domain allowed access.
 800 ##      </summary>
 801 ## </param>
 802 #
 803 interface(`kernel_search_proc',`
 804         gen_require(`
 805                 type proc_t;
 806         ')
 807
 808         search_dirs_pattern($1, proc_t, proc_t)
 809 ')
 810
 811 ########################################
 812 ## <summary>
 813 ##      List the contents of directories in /proc.
 814 ## </summary>
 815 ## <param name="domain">
 816 ##      <summary>
 817 ##      Domain allowed access.
 818 ##      </summary>
 819 ## </param>
 820 #
 821 interface(`kernel_list_proc',`
 822         gen_require(`
 823                 type proc_t;
 824         ')
 825
 826         list_dirs_pattern($1, proc_t, proc_t)
 827 ')
 828
 829 ########################################
 830 ## <summary>
 831 ##      Do not audit attempts to list the
 832 ##      contents of directories in /proc.
 833 ## </summary>
 834 ## <param name="domain">
 835 ##      <summary>
 836 ##      Domain to not audit.
 837 ##      </summary>
 838 ## </param>
 839 #
 840 interface(`kernel_dontaudit_list_proc',`
 841         gen_require(`
 842                 type proc_t;
 843         ')
 844
 845         dontaudit $1 proc_t:dir list_dir_perms;
 846 ')
 847
 848 ########################################
 849 ## <summary>
 850 ##      Get the attributes of files in /proc.
 851 ## </summary>
 852 ## <param name="domain">
 853 ##      <summary>
 854 ##      Domain allowed access.
 855 ##      </summary>
 856 ## </param>
 857 #
 858 interface(`kernel_getattr_proc_files',`
 859         gen_require(`
 860                 type proc_t;
 861         ')
 862
 863         getattr_files_pattern($1, proc_t, proc_t)
 864 ')
 865
 866 ########################################
 867 ## <summary>
 868 ##      Read generic symbolic links in /proc.
 869 ## </summary>
 870 ## <desc>
 871 ##      <p>
 872 ##      Allow the specified domain to read (follow) generic
 873 ##      symbolic links (symlinks) in the proc filesystem (/proc).
 874 ##      This interface does not include access to the targets of
 875 ##      these links.  An example symlink is /proc/self.
 876 ##      </p>
 877 ## </desc>
 878 ## <param name="domain">
 879 ##      <summary>
 880 ##      Domain allowed access.
 881 ##      </summary>
 882 ## </param>
 883 ## <infoflow type="read" weight="10"/>
 884 #
 885 interface(`kernel_read_proc_symlinks',`
 886         gen_require(`
 887                 type proc_t;
 888         ')
 889
 890         read_lnk_files_pattern($1, proc_t, proc_t)
 891 ')
 892
 893 ########################################
 894 ## <summary>
 895 ##      Allows caller to read system state information in /proc.
 896 ## </summary>
 897 ## <desc>
 898 ##      <p>
 899 ##      Allow the specified domain to read general system
 900 ##      state information from the proc filesystem (/proc).
 901 ##      </p>
 902 ##      <p>
 903 ##      Generally it should be safe to allow this access.  Some
 904 ##      example files that can be read based on this interface:
 905 ##      </p>
 906 ##      <ul>
 907 ##              <li>/proc/cpuinfo</li>
 908 ##              <li>/proc/meminfo</li>
 909 ##              <li>/proc/uptime</li>
 910 ##      </ul>
 911 ##      <p>
 912 ##      This does not allow access to sysctl entries (/proc/sys/*)
 913 ##      nor process state information (/proc/pid).
 914 ##      </p>
 915 ## </desc>
 916 ## <param name="domain">
 917 ##      <summary>
 918 ##      Domain allowed access.
 919 ##      </summary>
 920 ## </param>
 921 ## <infoflow type="read" weight="10"/>
 922 ## <rolecap/>
 923 #
 924 interface(`kernel_read_system_state',`
 925         gen_require(`
 926                 type proc_t;
 927         ')
 928
 929         read_files_pattern($1, proc_t, proc_t)
 930         read_lnk_files_pattern($1, proc_t, proc_t)
 931
 932         list_dirs_pattern($1, proc_t, proc_t)
 933 ')
 934
 935 ########################################
 936 ## <summary>
 937 ##      Write to generic proc entries.
 938 ## </summary>
 939 ## <param name="domain">
 940 ##      <summary>
 941 ##      Domain allowed access.
 942 ##      </summary>
 943 ## </param>
 944 ## <rolecap/>
 945 #
 946 # cjp: this should probably go away.  any
 947 # file thats writable in proc should really
 948 # have its own label.
 949 #
 950 interface(`kernel_write_proc_files',`
 951         gen_require(`
 952                 type proc_t;
 953         ')
 954
 955         write_files_pattern($1, proc_t, proc_t)
 956 ')
 957
 958 ########################################
 959 ## <summary>
 960 ##      Do not audit attempts by caller to
 961 ##      read system state information in proc.
 962 ## </summary>
 963 ## <param name="domain">
 964 ##      <summary>
 965 ##      Domain to not audit.
 966 ##      </summary>
 967 ## </param>
 968 #
 969 interface(`kernel_dontaudit_read_system_state',`
 970         gen_require(`
 971                 type proc_t;
 972         ')
 973
 974         dontaudit $1 proc_t:file read_file_perms;
 975 ')
 976
 977 ########################################
 978 ## <summary>
 979 ##      Do not audit attempts by caller to
 980 ##      read system state information in proc.
 981 ## </summary>
 982 ## <param name="domain">
 983 ##      <summary>
 984 ##      Domain to not audit.
 985 ##      </summary>
 986 ## </param>
 987 #
 988 interface(`kernel_dontaudit_read_proc_symlinks',`
 989         gen_require(`
 990                 type proc_t;
 991         ')
 992
 993         dontaudit $1 proc_t:lnk_file read;
 994 ')
 995
 996 #######################################
 997 ## <summary>
 998 ##      Allow caller to read and write state information for AFS.
 999 ## </summary>
1000 ## <param name="domain">
1001 ##      <summary>
1002 ##      Domain allowed access.
1003 ##      </summary>
1004 ## </param>
1005 ## <rolecap/>
1006 #
1007 interface(`kernel_rw_afs_state',`
1008         gen_require(`
1009                 type proc_t, proc_afs_t;
1010         ')
1011
1012         list_dirs_pattern($1, proc_t, proc_t)
1013         rw_files_pattern($1, proc_afs_t, proc_afs_t)
1014 ')
1015
1016 #######################################
1017 ## <summary>
1018 ##      Allow caller to read the state information for software raid.
1019 ## </summary>
1020 ## <param name="domain">
1021 ##      <summary>
1022 ##      Domain allowed access.
1023 ##      </summary>
1024 ## </param>
1025 ## <rolecap/>
1026 #
1027 interface(`kernel_read_software_raid_state',`
1028         gen_require(`
1029                 type proc_t, proc_mdstat_t;
1030         ')
1031
1032         read_files_pattern($1, proc_t, proc_mdstat_t)
1033
1034         list_dirs_pattern($1, proc_t, proc_t)
1035 ')
1036
1037 #######################################
1038 ## <summary>
1039 ##      Allow caller to read and set the state information for software raid.
1040 ## </summary>
1041 ## <param name="domain">
1042 ##      <summary>
1043 ##      Domain allowed access.
1044 ##      </summary>
1045 ## </param>
1046 #
1047 interface(`kernel_rw_software_raid_state',`
1048         gen_require(`
1049                 type proc_t, proc_mdstat_t;
1050         ')
1051
1052         rw_files_pattern($1, proc_t, proc_mdstat_t)
1053
1054         list_dirs_pattern($1, proc_t, proc_t)
1055 ')
1056
1057 ########################################
1058 ## <summary>
1059 ##      Allows caller to get attribues of core kernel interface.
1060 ## </summary>
1061 ## <param name="domain">
1062 ##      <summary>
1063 ##      Domain allowed access.
1064 ##      </summary>
1065 ## </param>
1066 #
1067 interface(`kernel_getattr_core_if',`
1068         gen_require(`
1069                 type proc_t, proc_kcore_t;
1070         ')
1071
1072         getattr_files_pattern($1, proc_t, proc_kcore_t)
1073
1074         list_dirs_pattern($1, proc_t, proc_t)
1075 ')
1076
1077 ########################################
1078 ## <summary>
1079 ##      Do not audit attempts to get the attributes of
1080 ##      core kernel interfaces.
1081 ## </summary>
1082 ## <param name="domain">
1083 ##      <summary>
1084 ##      Domain to not audit.
1085 ##      </summary>
1086 ## </param>
1087 #
1088 interface(`kernel_dontaudit_getattr_core_if',`
1089         gen_require(`
1090                 type proc_kcore_t;
1091         ')
1092
1093         dontaudit $1 proc_kcore_t:file getattr;
1094 ')
1095
1096 ########################################
1097 ## <summary>
1098 ##      Allows caller to read the core kernel interface.
1099 ## </summary>
1100 ## <param name="domain">
1101 ##      <summary>
1102 ##      Domain allowed access.
1103 ##      </summary>
1104 ## </param>
1105 #
1106 interface(`kernel_read_core_if',`
1107         gen_require(`
1108                 type proc_t, proc_kcore_t;
1109                 attribute can_dump_kernel;
1110         ')
1111
1112         allow $1 self:capability sys_rawio;
1113         read_files_pattern($1, proc_t, proc_kcore_t)
1114         list_dirs_pattern($1, proc_t, proc_t)
1115
1116         typeattribute $1 can_dump_kernel;
1117 ')
1118
1119 ########################################
1120 ## <summary>
1121 ##      Allow caller to read kernel messages
1122 ##      using the /proc/kmsg interface.
1123 ## </summary>
1124 ## <param name="domain">
1125 ##      <summary>
1126 ##      Domain allowed access.
1127 ##      </summary>
1128 ## </param>
1129 #
1130 interface(`kernel_read_messages',`
1131         gen_require(`
1132                 attribute can_receive_kernel_messages;
1133                 type proc_kmsg_t, proc_t;
1134         ')
1135
1136         read_files_pattern($1, proc_t, proc_kmsg_t)
1137
1138         typeattribute $1 can_receive_kernel_messages;
1139 ')
1140
1141 ########################################
1142 ## <summary>
1143 ##      Allow caller to get the attributes of kernel message
1144 ##      interface (/proc/kmsg).
1145 ## </summary>
1146 ## <param name="domain">
1147 ##      <summary>
1148 ##      Domain allowed access.
1149 ##      </summary>
1150 ## </param>
1151 #
1152 interface(`kernel_getattr_message_if',`
1153         gen_require(`
1154                 type proc_kmsg_t, proc_t;
1155         ')
1156
1157         getattr_files_pattern($1, proc_t, proc_kmsg_t)
1158 ')
1159
1160 ########################################
1161 ## <summary>
1162 ##      Do not audit attempts by caller to get the attributes of kernel
1163 ##      message interfaces.
1164 ## </summary>
1165 ## <param name="domain">
1166 ##      <summary>
1167 ##      Domain to not audit.
1168 ##      </summary>
1169 ## </param>
1170 #
1171 interface(`kernel_dontaudit_getattr_message_if',`
1172         gen_require(`
1173                 type proc_kmsg_t, proc_t;
1174         ')
1175
1176         dontaudit $1 proc_kmsg_t:file getattr;
1177 ')
1178
1179 ########################################
1180 ## <summary>
1181 ##      Do not audit attempts to search the network
1182 ##      state directory.
1183 ## </summary>
1184 ## <param name="domain">
1185 ##      <summary>
1186 ##      Domain to not audit.
1187 ##      </summary>
1188 ## </param>
1189 ##
1190 #
1191 interface(`kernel_dontaudit_search_network_state',`
1192         gen_require(`
1193                 type proc_net_t;
1194         ')
1195
1196         dontaudit $1 proc_net_t:dir search;
1197 ')
1198
1199 ########################################
1200 ## <summary>
1201 ##      Allow searching of network state directory.
1202 ## </summary>
1203 ## <param name="domain">
1204 ##      <summary>
1205 ##      Domain allowed access.
1206 ##      </summary>
1207 ## </param>
1208 ##
1209 #
1210 interface(`kernel_search_network_state',`
1211         gen_require(`
1212                 type proc_net_t;
1213         ')
1214
1215         search_dirs_pattern($1, proc_t, proc_net_t)
1216 ')
1217
1218 ########################################
1219 ## <summary>
1220 ##      Read the network state information.
1221 ## </summary>
1222 ## <desc>
1223 ##      <p>
1224 ##      Allow the specified domain to read the networking
1225 ##      state information. This includes several pieces
1226 ##      of networking information, such as network interface
1227 ##      names, netfilter (iptables) statistics, protocol
1228 ##      information, routes, and remote procedure call (RPC)
1229 ##      information.
1230 ##      </p>
1231 ## </desc>
1232 ## <param name="domain">
1233 ##      <summary>
1234 ##      Domain allowed access.
1235 ##      </summary>
1236 ## </param>
1237 ## <infoflow type="read" weight="10"/>
1238 ## <rolecap/>
1239 #
1240 interface(`kernel_read_network_state',`
1241         gen_require(`
1242                 type proc_t, proc_net_t;
1243         ')
1244
1245         read_files_pattern($1, { proc_t proc_net_t }, proc_net_t)
1246         read_lnk_files_pattern($1, { proc_t proc_net_t }, proc_net_t)
1247
1248         list_dirs_pattern($1, proc_t, proc_net_t)
1249 ')
1250
1251 ########################################
1252 ## <summary>
1253 ##      Allow caller to read the network state symbolic links.
1254 ## </summary>
1255 ## <param name="domain">
1256 ##      <summary>
1257 ##      Domain allowed access.
1258 ##      </summary>
1259 ## </param>
1260 #
1261 interface(`kernel_read_network_state_symlinks',`
1262         gen_require(`
1263                 type proc_t, proc_net_t;
1264         ')
1265
1266         read_lnk_files_pattern($1, { proc_t proc_net_t }, proc_net_t)
1267
1268         list_dirs_pattern($1, proc_t, proc_net_t)
1269 ')
1270
1271 ########################################
1272 ## <summary>
1273 ##      Allow searching of xen state directory.
1274 ## </summary>
1275 ## <param name="domain">
1276 ##      <summary>
1277 ##      Domain allowed access.
1278 ##      </summary>
1279 ## </param>
1280 ##
1281 #
1282 interface(`kernel_search_xen_state',`
1283         gen_require(`
1284                 type proc_t, proc_xen_t;
1285         ')
1286
1287         search_dirs_pattern($1, proc_t, proc_xen_t)
1288 ')
1289
1290 ########################################
1291 ## <summary>
1292 ##      Do not audit attempts to search the xen
1293 ##      state directory.
1294 ## </summary>
1295 ## <param name="domain">
1296 ##      <summary>
1297 ##      Domain to not audit.
1298 ##      </summary>
1299 ## </param>
1300 ##
1301 #
1302 interface(`kernel_dontaudit_search_xen_state',`
1303         gen_require(`
1304                 type proc_xen_t;
1305         ')
1306
1307         dontaudit $1 proc_xen_t:dir search;
1308 ')
1309
1310 ########################################
1311 ## <summary>
1312 ##      Allow caller to read the xen state information.
1313 ## </summary>
1314 ## <param name="domain">
1315 ##      <summary>
1316 ##      Domain allowed access.
1317 ##      </summary>
1318 ## </param>
1319 ##
1320 #
1321 interface(`kernel_read_xen_state',`
1322         gen_require(`
1323                 type proc_t, proc_xen_t;
1324         ')
1325
1326         read_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
1327         read_lnk_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
1328
1329         list_dirs_pattern($1, proc_t, proc_xen_t)
1330 ')
1331
1332 ########################################
1333 ## <summary>
1334 ##      Allow caller to read the xen state symbolic links.
1335 ## </summary>
1336 ## <param name="domain">
1337 ##      <summary>
1338 ##      Domain allowed access.
1339 ##      </summary>
1340 ## </param>
1341 ##
1342 #
1343 interface(`kernel_read_xen_state_symlinks',`
1344         gen_require(`
1345                 type proc_t, proc_xen_t;
1346         ')
1347
1348         read_lnk_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
1349
1350         list_dirs_pattern($1, proc_t, proc_xen_t)
1351 ')
1352
1353 ########################################
1354 ## <summary>
1355 ##      Allow caller to write xen state information.
1356 ## </summary>
1357 ## <param name="domain">
1358 ##      <summary>
1359 ##      Domain allowed access.
1360 ##      </summary>
1361 ## </param>
1362 ##
1363 #
1364 interface(`kernel_write_xen_state',`
1365         gen_require(`
1366                 type proc_t, proc_xen_t;
1367         ')
1368
1369         write_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
1370 ')
1371
1372 ########################################
1373 ## <summary>
1374 ##      Allow attempts to list all proc directories.
1375 ## </summary>
1376 ## <param name="domain">
1377 ##      <summary>
1378 ##      Domain allowed access.
1379 ##      </summary>
1380 ## </param>
1381 #
1382 interface(`kernel_list_all_proc',`
1383         gen_require(`
1384                 attribute proc_type;
1385         ')
1386
1387         allow $1 proc_type:dir list_dir_perms;
1388         allow $1 proc_type:file getattr;
1389 ')
1390
1391 ########################################
1392 ## <summary>
1393 ##      Do not audit attempts to list all proc directories.
1394 ## </summary>
1395 ## <param name="domain">
1396 ##      <summary>
1397 ##      Domain to not audit.
1398 ##      </summary>
1399 ## </param>
1400 #
1401 interface(`kernel_dontaudit_list_all_proc',`
1402         gen_require(`
1403                 attribute proc_type;
1404         ')
1405
1406         dontaudit $1 proc_type:dir list_dir_perms;
1407         dontaudit $1 proc_type:file getattr;
1408 ')
1409
1410 ########################################
1411 ## <summary>
1412 ##      Do not audit attempts by caller to search
1413 ##      the base directory of sysctls.
1414 ## </summary>
1415 ## <param name="domain">
1416 ##      <summary>
1417 ##      Domain to not audit.
1418 ##      </summary>
1419 ## </param>
1420 ##
1421 #
1422 interface(`kernel_dontaudit_search_sysctl',`
1423         gen_require(`
1424                 type sysctl_t;
1425         ')
1426
1427         dontaudit $1 sysctl_t:dir search;
1428 ')
1429
1430 ########################################
1431 ## <summary>
1432 ##      Allow access to read sysctl directories.
1433 ## </summary>
1434 ## <param name="domain">
1435 ##      <summary>
1436 ##      Domain allowed access.
1437 ##      </summary>
1438 ## </param>
1439 ##
1440 #
1441 interface(`kernel_read_sysctl',`
1442         gen_require(`
1443                 type sysctl_t, proc_t;
1444         ')
1445
1446         list_dirs_pattern($1, proc_t, sysctl_t)
1447         read_files_pattern($1, sysctl_t, sysctl_t)
1448 ')
1449
1450 ########################################
1451 ## <summary>
1452 ##      Allow caller to read the device sysctls.
1453 ## </summary>
1454 ## <param name="domain">
1455 ##      <summary>
1456 ##      Domain allowed access.
1457 ##      </summary>
1458 ## </param>
1459 ## <rolecap/>
1460 #
1461 interface(`kernel_read_device_sysctls',`
1462         gen_require(`
1463                 type proc_t, sysctl_t, sysctl_dev_t;
1464         ')
1465
1466         read_files_pattern($1, { proc_t sysctl_t sysctl_dev_t }, sysctl_dev_t)
1467
1468         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_dev_t)
1469 ')
1470
1471 ########################################
1472 ## <summary>
1473 ##      Read and write device sysctls.
1474 ## </summary>
1475 ## <param name="domain">
1476 ##      <summary>
1477 ##      Domain allowed access.
1478 ##      </summary>
1479 ## </param>
1480 ## <rolecap/>
1481 #
1482 interface(`kernel_rw_device_sysctls',`
1483         gen_require(`
1484                 type proc_t, sysctl_t, sysctl_dev_t;
1485         ')
1486
1487         rw_files_pattern($1, { proc_t sysctl_t sysctl_dev_t }, sysctl_dev_t)
1488
1489         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_dev_t)
1490 ')
1491
1492 ########################################
1493 ## <summary>
1494 ##      Allow caller to search virtual memory sysctls.
1495 ## </summary>
1496 ## <param name="domain">
1497 ##      <summary>
1498 ##      Domain allowed access.
1499 ##      </summary>
1500 ## </param>
1501 #
1502 interface(`kernel_search_vm_sysctl',`
1503         gen_require(`
1504                 type proc_t, sysctl_t, sysctl_vm_t;
1505         ')
1506
1507         search_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_t)
1508 ')
1509
1510 ########################################
1511 ## <summary>
1512 ##      Allow caller to read virtual memory sysctls.
1513 ## </summary>
1514 ## <param name="domain">
1515 ##      <summary>
1516 ##      Domain allowed access.
1517 ##      </summary>
1518 ## </param>
1519 ## <rolecap/>
1520 #
1521 interface(`kernel_read_vm_sysctls',`
1522         gen_require(`
1523                 type proc_t, sysctl_t, sysctl_vm_t;
1524         ')
1525
1526         read_files_pattern($1, { proc_t sysctl_t sysctl_vm_t }, sysctl_vm_t)
1527
1528         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_t)
1529 ')
1530
1531 ########################################
1532 ## <summary>
1533 ##      Read and write virtual memory sysctls.
1534 ## </summary>
1535 ## <param name="domain">
1536 ##      <summary>
1537 ##      Domain allowed access.
1538 ##      </summary>
1539 ## </param>
1540 ## <rolecap/>
1541 #
1542 interface(`kernel_rw_vm_sysctls',`
1543         gen_require(`
1544                 type proc_t, sysctl_t, sysctl_vm_t;
1545         ')
1546
1547         rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_t }, sysctl_vm_t)
1548         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_t)
1549
1550         # hal needs this
1551         allow $1 sysctl_vm_t:dir write;
1552 ')
1553
1554 ########################################
1555 ## <summary>
1556 ##      Search network sysctl directories.
1557 ## </summary>
1558 ## <param name="domain">
1559 ##      <summary>
1560 ##      Domain allowed access.
1561 ##      </summary>
1562 ## </param>
1563 #
1564 interface(`kernel_search_network_sysctl',`
1565         gen_require(`
1566                 type proc_t, sysctl_t, sysctl_net_t;
1567         ')
1568
1569         search_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
1570 ')
1571
1572 ########################################
1573 ## <summary>
1574 ##      Do not audit attempts by caller to search network sysctl directories.
1575 ## </summary>
1576 ## <param name="domain">
1577 ##      <summary>
1578 ##      Domain to not audit.
1579 ##      </summary>
1580 ## </param>
1581 #
1582 interface(`kernel_dontaudit_search_network_sysctl',`
1583         gen_require(`
1584                 type sysctl_net_t;
1585         ')
1586
1587         dontaudit $1 sysctl_net_t:dir search;
1588 ')
1589
1590 ########################################
1591 ## <summary>
1592 ##      Allow caller to read network sysctls.
1593 ## </summary>
1594 ## <param name="domain">
1595 ##      <summary>
1596 ##      Domain allowed access.
1597 ##      </summary>
1598 ## </param>
1599 ## <rolecap/>
1600 #
1601 interface(`kernel_read_net_sysctls',`
1602         gen_require(`
1603                 type proc_t, sysctl_t, sysctl_net_t;
1604         ')
1605
1606         read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
1607
1608         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
1609 ')
1610
1611 ########################################
1612 ## <summary>
1613 ##      Allow caller to modiry contents of sysctl network files.
1614 ## </summary>
1615 ## <param name="domain">
1616 ##      <summary>
1617 ##      Domain allowed access.
1618 ##      </summary>
1619 ## </param>
1620 ## <rolecap/>
1621 #
1622 interface(`kernel_rw_net_sysctls',`
1623         gen_require(`
1624                 type proc_t, sysctl_t, sysctl_net_t;
1625         ')
1626
1627         rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
1628
1629         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
1630 ')
1631
1632 ########################################
1633 ## <summary>
1634 ##      Allow caller to read unix domain
1635 ##      socket sysctls.
1636 ## </summary>
1637 ## <param name="domain">
1638 ##      <summary>
1639 ##      Domain allowed access.
1640 ##      </summary>
1641 ## </param>
1642 ## <rolecap/>
1643 #
1644 interface(`kernel_read_unix_sysctls',`
1645         gen_require(`
1646                 type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t;
1647         ')
1648
1649         read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
1650
1651         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
1652 ')
1653
1654 ########################################
1655 ## <summary>
1656 ##      Read and write unix domain
1657 ##      socket sysctls.
1658 ## </summary>
1659 ## <param name="domain">
1660 ##      <summary>
1661 ##      Domain allowed access.
1662 ##      </summary>
1663 ## </param>
1664 ## <rolecap/>
1665 #
1666 interface(`kernel_rw_unix_sysctls',`
1667         gen_require(`
1668                 type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t;
1669         ')
1670
1671         rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
1672
1673         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
1674 ')
1675
1676 ########################################
1677 ## <summary>
1678 ##      Read the hotplug sysctl.
1679 ## </summary>
1680 ## <param name="domain">
1681 ##      <summary>
1682 ##      Domain allowed access.
1683 ##      </summary>
1684 ## </param>
1685 ## <rolecap/>
1686 #
1687 interface(`kernel_read_hotplug_sysctls',`
1688         gen_require(`
1689                 type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t;
1690         ')
1691
1692         read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t)
1693
1694         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
1695 ')
1696
1697 ########################################
1698 ## <summary>
1699 ##      Read and write the hotplug sysctl.
1700 ## </summary>
1701 ## <param name="domain">
1702 ##      <summary>
1703 ##      Domain allowed access.
1704 ##      </summary>
1705 ## </param>
1706 ## <rolecap/>
1707 #
1708 interface(`kernel_rw_hotplug_sysctls',`
1709         gen_require(`
1710                 type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t;
1711         ')
1712
1713         rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t)
1714
1715         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
1716 ')
1717
1718 ########################################
1719 ## <summary>
1720 ##      Read the modprobe sysctl.
1721 ## </summary>
1722 ## <param name="domain">
1723 ##      <summary>
1724 ##      Domain allowed access.
1725 ##      </summary>
1726 ## </param>
1727 ## <rolecap/>
1728 #
1729 interface(`kernel_read_modprobe_sysctls',`
1730         gen_require(`
1731                 type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t;
1732         ')
1733
1734         read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t)
1735
1736         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
1737 ')
1738
1739 ########################################
1740 ## <summary>
1741 ##      Read and write the modprobe sysctl.
1742 ## </summary>
1743 ## <param name="domain">
1744 ##      <summary>
1745 ##      Domain allowed access.
1746 ##      </summary>
1747 ## </param>
1748 ## <rolecap/>
1749 #
1750 interface(`kernel_rw_modprobe_sysctls',`
1751         gen_require(`
1752                 type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t;
1753         ')
1754
1755         rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t)
1756
1757         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
1758 ')
1759
1760 ########################################
1761 ## <summary>
1762 ##      Do not audit attempts to search generic kernel sysctls.
1763 ## </summary>
1764 ## <param name="domain">
1765 ##      <summary>
1766 ##      Domain to not audit.
1767 ##      </summary>
1768 ## </param>
1769 #
1770 interface(`kernel_dontaudit_search_kernel_sysctl',`
1771         gen_require(`
1772                 type sysctl_kernel_t;
1773         ')
1774
1775         dontaudit $1 sysctl_kernel_t:dir search;
1776 ')
1777
1778 ########################################
1779 ## <summary>
1780 ##      Read generic crypto sysctls.
1781 ## </summary>
1782 ## <param name="domain">
1783 ##      <summary>
1784 ##      Domain allowed access.
1785 ##      </summary>
1786 ## </param>
1787 #
1788 interface(`kernel_read_crypto_sysctls',`
1789         gen_require(`
1790                 type proc_t, sysctl_t, sysctl_crypto_t;
1791         ')
1792
1793         read_files_pattern($1, { proc_t sysctl_t sysctl_crypto_t }, sysctl_crypto_t)
1794         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_crypto_t)
1795 ')
1796
1797 ########################################
1798 ## <summary>
1799 ##      Read general kernel sysctls.
1800 ## </summary>
1801 ## <desc>
1802 ##      <p>
1803 ##      Allow the specified domain to read general
1804 ##      kernel sysctl settings. These settings are typically
1805 ##      read using the sysctl program.  The settings
1806 ##      that are included by this interface are prefixed
1807 ##      with "kernel.", for example, kernel.sysrq.
1808 ##      </p>
1809 ##      <p>
1810 ##      This does not include access to the hotplug
1811 ##      handler setting (kernel.hotplug)
1812 ##      nor the module installer handler setting
1813 ##      (kernel.modprobe).
1814 ##      </p>
1815 ##      <p>
1816 ##      Related interfaces:
1817 ##      </p>
1818 ##      <ul>
1819 ##              <li>kernel_rw_kernel_sysctl()</li>
1820 ##      </ul>
1821 ## </desc>
1822 ## <param name="domain">
1823 ##      <summary>
1824 ##      Domain allowed access.
1825 ##      </summary>
1826 ## </param>
1827 ## <infoflow type="read" weight="10"/>
1828 #
1829 interface(`kernel_read_kernel_sysctls',`
1830         gen_require(`
1831                 type proc_t, sysctl_t, sysctl_kernel_t;
1832         ')
1833
1834         read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_kernel_t)
1835
1836         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
1837 ')
1838
1839 ########################################
1840 ## <summary>
1841 ##      Do not audit attempts to write generic kernel sysctls.
1842 ## </summary>
1843 ## <param name="domain">
1844 ##      <summary>
1845 ##      Domain to not audit.
1846 ##      </summary>
1847 ## </param>
1848 #
1849 interface(`kernel_dontaudit_write_kernel_sysctl',`
1850         gen_require(`
1851                 type sysctl_kernel_t;
1852         ')
1853
1854         dontaudit $1 sysctl_kernel_t:file write;
1855 ')
1856
1857 ########################################
1858 ## <summary>
1859 ##      Read and write generic kernel sysctls.
1860 ## </summary>
1861 ## <param name="domain">
1862 ##      <summary>
1863 ##      Domain allowed access.
1864 ##      </summary>
1865 ## </param>
1866 ## <rolecap/>
1867 #
1868 interface(`kernel_rw_kernel_sysctl',`
1869         gen_require(`
1870                 type proc_t, sysctl_t, sysctl_kernel_t;
1871         ')
1872
1873         rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_kernel_t)
1874
1875         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
1876 ')
1877
1878 ########################################
1879 ## <summary>
1880 ##      Read filesystem sysctls.
1881 ## </summary>
1882 ## <param name="domain">
1883 ##      <summary>
1884 ##      Domain allowed access.
1885 ##      </summary>
1886 ## </param>
1887 ## <rolecap/>
1888 #
1889 interface(`kernel_read_fs_sysctls',`
1890         gen_require(`
1891                 type proc_t, sysctl_t, sysctl_fs_t;
1892         ')
1893
1894         read_files_pattern($1, { proc_t sysctl_t sysctl_fs_t }, sysctl_fs_t)
1895
1896         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_fs_t)
1897 ')
1898
1899 ########################################
1900 ## <summary>
1901 ##      Read and write fileystem sysctls.
1902 ## </summary>
1903 ## <param name="domain">
1904 ##      <summary>
1905 ##      Domain allowed access.
1906 ##      </summary>
1907 ## </param>
1908 ## <rolecap/>
1909 #
1910 interface(`kernel_rw_fs_sysctls',`
1911         gen_require(`
1912                 type proc_t, sysctl_t, sysctl_fs_t;
1913         ')
1914
1915         rw_files_pattern($1, { proc_t sysctl_t sysctl_fs_t }, sysctl_fs_t)
1916
1917         list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_fs_t)
1918 ')
1919
1920 ########################################
1921 ## <summary>
1922 ##      Read IRQ sysctls.
1923 ## </summary>
1924 ## <param name="domain">
1925 ##      <summary>
1926 ##      Domain allowed access.
1927 ##      </summary>
1928 ## </param>
1929 ## <rolecap/>
1930 #
1931 interface(`kernel_read_irq_sysctls',`
1932         gen_require(`
1933                 type proc_t, sysctl_irq_t;
1934         ')
1935
1936         read_files_pattern($1, { proc_t sysctl_irq_t }, sysctl_irq_t)
1937
1938         list_dirs_pattern($1, proc_t, sysctl_irq_t)
1939 ')
1940
1941 ########################################
1942 ## <summary>
1943 ##      Read and write IRQ sysctls.
1944 ## </summary>
1945 ## <param name="domain">
1946 ##      <summary>
1947 ##      Domain allowed access.
1948 ##      </summary>
1949 ## </param>
1950 ## <rolecap/>
1951 #
1952 interface(`kernel_rw_irq_sysctls',`
1953         gen_require(`
1954                 type proc_t, sysctl_irq_t;
1955         ')
1956
1957         rw_files_pattern($1, { proc_t sysctl_irq_t }, sysctl_irq_t)
1958
1959         list_dirs_pattern($1, proc_t, sysctl_irq_t)
1960 ')
1961
1962 ########################################
1963 ## <summary>
1964 ##      Read RPC sysctls.
1965 ## </summary>
1966 ## <param name="domain">
1967 ##      <summary>
1968 ##      Domain allowed access.
1969 ##      </summary>
1970 ## </param>
1971 ## <rolecap/>
1972 #
1973 interface(`kernel_read_rpc_sysctls',`
1974         gen_require(`
1975                 type proc_t, proc_net_t, sysctl_rpc_t;
1976         ')
1977
1978         read_files_pattern($1, { proc_t proc_net_t sysctl_rpc_t }, sysctl_rpc_t)
1979
1980         list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_rpc_t)
1981 ')
1982
1983 ########################################
1984 ## <summary>
1985 ##      Read and write RPC sysctls.
1986 ## </summary>
1987 ## <param name="domain">
1988 ##      <summary>
1989 ##      Domain allowed access.
1990 ##      </summary>
1991 ## </param>
1992 ## <rolecap/>
1993 #
1994 interface(`kernel_rw_rpc_sysctls',`
1995         gen_require(`
1996                 type proc_t, proc_net_t, sysctl_rpc_t;
1997         ')
1998
1999         rw_files_pattern($1, { proc_t proc_net_t sysctl_rpc_t }, sysctl_rpc_t)
2000
2001         list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_rpc_t)
2002 ')
2003
2004 ########################################
2005 ## <summary>
2006 ##      Do not audit attempts to list all sysctl directories.
2007 ## </summary>
2008 ## <param name="domain">
2009 ##      <summary>
2010 ##      Domain to not audit.
2011 ##      </summary>
2012 ## </param>
2013 #
2014 interface(`kernel_dontaudit_list_all_sysctls',`
2015         gen_require(`
2016                 attribute sysctl_type;
2017         ')
2018
2019         dontaudit $1 sysctl_type:dir list_dir_perms;
2020         dontaudit $1 sysctl_type:file read_file_perms;
2021 ')
2022
2023 ########################################
2024 ## <summary>
2025 ##      Allow caller to read all sysctls.
2026 ## </summary>
2027 ## <param name="domain">
2028 ##      <summary>
2029 ##      Domain allowed access.
2030 ##      </summary>
2031 ## </param>
2032 ## <rolecap/>
2033 #
2034 interface(`kernel_read_all_sysctls',`
2035         gen_require(`
2036                 attribute sysctl_type;
2037                 type proc_t, proc_net_t;
2038         ')
2039
2040         # proc_net_t for /proc/net/rpc sysctls
2041         read_files_pattern($1, { proc_t proc_net_t sysctl_type }, sysctl_type)
2042
2043         list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_type)
2044 ')
2045
2046 ########################################
2047 ## <summary>
2048 ##      Read and write all sysctls.
2049 ## </summary>
2050 ## <param name="domain">
2051 ##      <summary>
2052 ##      Domain allowed access.
2053 ##      </summary>
2054 ## </param>
2055 ## <rolecap/>
2056 #
2057 interface(`kernel_rw_all_sysctls',`
2058         gen_require(`
2059                 attribute sysctl_type;
2060                 type proc_t, proc_net_t;
2061         ')
2062
2063         # proc_net_t for /proc/net/rpc sysctls
2064         rw_files_pattern($1, { proc_t proc_net_t sysctl_type }, sysctl_type)
2065
2066         allow $1 sysctl_type:dir list_dir_perms;
2067         # why is setattr needed?
2068         allow $1 sysctl_type:file setattr;
2069 ')
2070
2071 ########################################
2072 ## <summary>
2073 ##      Send a kill signal to unlabeled processes.
2074 ## </summary>
2075 ## <param name="domain">
2076 ##      <summary>
2077 ##      Domain allowed access.
2078 ##      </summary>
2079 ## </param>
2080 #
2081 interface(`kernel_kill_unlabeled',`
2082         gen_require(`
2083                 type unlabeled_t;
2084         ')
2085
2086         allow $1 unlabeled_t:process sigkill;
2087 ')
2088
2089 ########################################
2090 ## <summary>
2091 ##      Mount a kernel unlabeled filesystem.
2092 ## </summary>
2093 ## <param name="domain">
2094 ##      <summary>
2095 ##      Domain allowed access.
2096 ##      </summary>
2097 ## </param>
2098 #
2099 interface(`kernel_mount_unlabeled',`
2100         gen_require(`
2101                 type unlabeled_t;
2102         ')
2103
2104         allow $1 unlabeled_t:filesystem mount;
2105 ')
2106
2107 ########################################
2108 ## <summary>
2109 ##      Unmount a kernel unlabeled filesystem.
2110 ## </summary>
2111 ## <param name="domain">
2112 ##      <summary>
2113 ##      Domain allowed access.
2114 ##      </summary>
2115 ## </param>
2116 #
2117 interface(`kernel_unmount_unlabeled',`
2118         gen_require(`
2119                 type unlabeled_t;
2120         ')
2121
2122         allow $1 unlabeled_t:filesystem unmount;
2123 ')
2124
2125 ########################################
2126 ## <summary>
2127 ##      Send general signals to unlabeled processes.
2128 ## </summary>
2129 ## <param name="domain">
2130 ##      <summary>
2131 ##      Domain allowed access.
2132 ##      </summary>
2133 ## </param>
2134 #
2135 interface(`kernel_signal_unlabeled',`
2136         gen_require(`
2137                 type unlabeled_t;
2138         ')
2139
2140         allow $1 unlabeled_t:process signal;
2141 ')
2142
2143 ########################################
2144 ## <summary>
2145 ##      Send a null signal to unlabeled processes.
2146 ## </summary>
2147 ## <param name="domain">
2148 ##      <summary>
2149 ##      Domain allowed access.
2150 ##      </summary>
2151 ## </param>
2152 #
2153 interface(`kernel_signull_unlabeled',`
2154         gen_require(`
2155                 type unlabeled_t;
2156         ')
2157
2158         allow $1 unlabeled_t:process signull;
2159 ')
2160
2161 ########################################
2162 ## <summary>
2163 ##      Send a stop signal to unlabeled processes.
2164 ## </summary>
2165 ## <param name="domain">
2166 ##      <summary>
2167 ##      Domain allowed access.
2168 ##      </summary>
2169 ## </param>
2170 #
2171 interface(`kernel_sigstop_unlabeled',`
2172         gen_require(`
2173                 type unlabeled_t;
2174         ')
2175
2176         allow $1 unlabeled_t:process sigstop;
2177 ')
2178
2179 ########################################
2180 ## <summary>
2181 ##      Send a child terminated signal to unlabeled processes.
2182 ## </summary>
2183 ## <param name="domain">
2184 ##      <summary>
2185 ##      Domain allowed access.
2186 ##      </summary>
2187 ## </param>
2188 #
2189 interface(`kernel_sigchld_unlabeled',`
2190         gen_require(`
2191                 type unlabeled_t;
2192         ')
2193
2194         allow $1 unlabeled_t:process sigchld;
2195 ')
2196
2197 ########################################
2198 ## <summary>
2199 ##      List unlabeled directories.
2200 ## </summary>
2201 ## <param name="domain">
2202 ##      <summary>
2203 ##      Domain allowed access.
2204 ##      </summary>
2205 ## </param>
2206 #
2207 interface(`kernel_list_unlabeled',`
2208         gen_require(`
2209                 type unlabeled_t;
2210         ')
2211
2212         allow $1 unlabeled_t:dir list_dir_perms;
2213 ')
2214
2215 ########################################
2216 ## <summary>
2217 ##      Read the process state (/proc/pid) of all unlabeled_t.
2218 ## </summary>
2219 ## <param name="domain">
2220 ##      <summary>
2221 ##      Domain allowed access.
2222 ##      </summary>
2223 ## </param>
2224 #
2225 interface(`kernel_read_unlabeled_state',`
2226         gen_require(`
2227                 type unlabeled_t;
2228         ')
2229
2230         allow $1 unlabeled_t:dir list_dir_perms;
2231         read_files_pattern($1, unlabeled_t, unlabeled_t)
2232         read_lnk_files_pattern($1, unlabeled_t, unlabeled_t)
2233 ')
2234
2235 ########################################
2236 ## <summary>
2237 ##      Do not audit attempts to list unlabeled directories.
2238 ## </summary>
2239 ## <param name="domain">
2240 ##      <summary>
2241 ##      Domain allowed access.
2242 ##      </summary>
2243 ## </param>
2244 #
2245 interface(`kernel_dontaudit_list_unlabeled',`
2246         gen_require(`
2247                 type unlabeled_t;
2248         ')
2249
2250         dontaudit $1 unlabeled_t:dir list_dir_perms;
2251 ')
2252
2253 ########################################
2254 ## <summary>
2255 ##      Read and write unlabeled directories.
2256 ## </summary>
2257 ## <param name="domain">
2258 ##      <summary>
2259 ##      Domain allowed access.
2260 ##      </summary>
2261 ## </param>
2262 #
2263 interface(`kernel_rw_unlabeled_dirs',`
2264         gen_require(`
2265                 type unlabeled_t;
2266         ')
2267
2268         allow $1 unlabeled_t:dir rw_dir_perms;
2269 ')
2270
2271 ########################################
2272 ## <summary>
2273 ##      Read and write unlabeled files.
2274 ## </summary>
2275 ## <param name="domain">
2276 ##      <summary>
2277 ##      Domain allowed access.
2278 ##      </summary>
2279 ## </param>
2280 #
2281 interface(`kernel_rw_unlabeled_files',`
2282         gen_require(`
2283                 type unlabeled_t;
2284         ')
2285
2286         allow $1 unlabeled_t:file rw_file_perms;
2287 ')
2288
2289 ########################################
2290 ## <summary>
2291 ##      Do not audit attempts by caller to get the
2292 ##      attributes of an unlabeled file.
2293 ## </summary>
2294 ## <param name="domain">
2295 ##      <summary>
2296 ##      Domain to not audit.
2297 ##      </summary>
2298 ## </param>
2299 #
2300 interface(`kernel_dontaudit_getattr_unlabeled_files',`
2301         gen_require(`
2302                 type unlabeled_t;
2303         ')
2304
2305         dontaudit $1 unlabeled_t:file getattr;
2306 ')
2307
2308 ########################################
2309 ## <summary>
2310 ##      Do not audit attempts by caller to
2311 ##      read an unlabeled file.
2312 ## </summary>
2313 ## <param name="domain">
2314 ##      <summary>
2315 ##      Domain to not audit.
2316 ##      </summary>
2317 ## </param>
2318 #
2319 interface(`kernel_dontaudit_read_unlabeled_files',`
2320         gen_require(`
2321                 type unlabeled_t;
2322         ')
2323
2324         dontaudit $1 unlabeled_t:file { getattr read };
2325 ')
2326
2327 ########################################
2328 ## <summary>
2329 ##      Do not audit attempts by caller to get the
2330 ##      attributes of unlabeled symbolic links.
2331 ## </summary>
2332 ## <param name="domain">
2333 ##      <summary>
2334 ##      Domain to not audit.
2335 ##      </summary>
2336 ## </param>
2337 #
2338 interface(`kernel_dontaudit_getattr_unlabeled_symlinks',`
2339         gen_require(`
2340                 type unlabeled_t;
2341         ')
2342
2343         dontaudit $1 unlabeled_t:lnk_file getattr;
2344 ')
2345
2346 ########################################
2347 ## <summary>
2348 ##      Do not audit attempts by caller to get the
2349 ##      attributes of unlabeled named pipes.
2350 ## </summary>
2351 ## <param name="domain">
2352 ##      <summary>
2353 ##      Domain to not audit.
2354 ##      </summary>
2355 ## </param>
2356 #
2357 interface(`kernel_dontaudit_getattr_unlabeled_pipes',`
2358         gen_require(`
2359                 type unlabeled_t;
2360         ')
2361
2362         dontaudit $1 unlabeled_t:fifo_file getattr;
2363 ')
2364
2365 ########################################
2366 ## <summary>
2367 ##      Do not audit attempts by caller to get the
2368 ##      attributes of unlabeled named sockets.
2369 ## </summary>
2370 ## <param name="domain">
2371 ##      <summary>
2372 ##      Domain to not audit.
2373 ##      </summary>
2374 ## </param>
2375 #
2376 interface(`kernel_dontaudit_getattr_unlabeled_sockets',`
2377         gen_require(`
2378                 type unlabeled_t;
2379         ')
2380
2381         dontaudit $1 unlabeled_t:sock_file getattr;
2382 ')
2383
2384 ########################################
2385 ## <summary>
2386 ##      Do not audit attempts by caller to get attributes for
2387 ##      unlabeled block devices.
2388 ## </summary>
2389 ## <param name="domain">
2390 ##      <summary>
2391 ##      Domain to not audit.
2392 ##      </summary>
2393 ## </param>
2394 #
2395 interface(`kernel_dontaudit_getattr_unlabeled_blk_files',`
2396         gen_require(`
2397                 type unlabeled_t;
2398         ')
2399
2400         dontaudit $1 unlabeled_t:blk_file getattr;
2401 ')
2402
2403 ########################################
2404 ## <summary>
2405 ##      Read and write unlabeled block device nodes.
2406 ## </summary>
2407 ## <param name="domain">
2408 ##      <summary>
2409 ##      Domain allowed access.
2410 ##      </summary>
2411 ## </param>
2412 #
2413 interface(`kernel_rw_unlabeled_blk_files',`
2414         gen_require(`
2415                 type unlabeled_t;
2416         ')
2417
2418         allow $1 unlabeled_t:blk_file getattr;
2419 ')
2420
2421 ########################################
2422 ## <summary>
2423 ##      Do not audit attempts by caller to get attributes for
2424 ##      unlabeled character devices.
2425 ## </summary>
2426 ## <param name="domain">
2427 ##      <summary>
2428 ##      Domain to not audit.
2429 ##      </summary>
2430 ## </param>
2431 #
2432 interface(`kernel_dontaudit_getattr_unlabeled_chr_files',`
2433         gen_require(`
2434                 type unlabeled_t;
2435         ')
2436
2437         dontaudit $1 unlabeled_t:chr_file getattr;
2438 ')
2439
2440 ########################################
2441 ## <summary>
2442 ##      Allow caller to relabel unlabeled directories.
2443 ## </summary>
2444 ## <param name="domain">
2445 ##      <summary>
2446 ##      Domain allowed access.
2447 ##      </summary>
2448 ## </param>
2449 #
2450 interface(`kernel_relabelfrom_unlabeled_dirs',`
2451         gen_require(`
2452                 type unlabeled_t;
2453         ')
2454
2455         allow $1 unlabeled_t:dir { list_dir_perms relabelfrom };
2456 ')
2457
2458 ########################################
2459 ## <summary>
2460 ##      Allow caller to relabel unlabeled files.
2461 ## </summary>
2462 ## <param name="domain">
2463 ##      <summary>
2464 ##      Domain allowed access.
2465 ##      </summary>
2466 ## </param>
2467 #
2468 interface(`kernel_relabelfrom_unlabeled_files',`
2469         gen_require(`
2470                 type unlabeled_t;
2471         ')
2472
2473         kernel_list_unlabeled($1)
2474         allow $1 unlabeled_t:file { getattr relabelfrom };
2475 ')
2476
2477 ########################################
2478 ## <summary>
2479 ##      Allow caller to relabel unlabeled symbolic links.
2480 ## </summary>
2481 ## <param name="domain">
2482 ##      <summary>
2483 ##      Domain allowed access.
2484 ##      </summary>
2485 ## </param>
2486 #
2487 interface(`kernel_relabelfrom_unlabeled_symlinks',`
2488         gen_require(`
2489                 type unlabeled_t;
2490         ')
2491
2492         kernel_list_unlabeled($1)
2493         allow $1 unlabeled_t:lnk_file { getattr relabelfrom };
2494 ')
2495
2496 ########################################
2497 ## <summary>
2498 ##      Allow caller to relabel unlabeled named pipes.
2499 ## </summary>
2500 ## <param name="domain">
2501 ##      <summary>
2502 ##      Domain allowed access.
2503 ##      </summary>
2504 ## </param>
2505 #
2506 interface(`kernel_relabelfrom_unlabeled_pipes',`
2507         gen_require(`
2508                 type unlabeled_t;
2509         ')
2510
2511         kernel_list_unlabeled($1)
2512         allow $1 unlabeled_t:fifo_file { getattr relabelfrom };
2513 ')
2514
2515 ########################################
2516 ## <summary>
2517 ##      Allow caller to relabel unlabeled named sockets.
2518 ## </summary>
2519 ## <param name="domain">
2520 ##      <summary>
2521 ##      Domain allowed access.
2522 ##      </summary>
2523 ## </param>
2524 #
2525 interface(`kernel_relabelfrom_unlabeled_sockets',`
2526         gen_require(`
2527                 type unlabeled_t;
2528         ')
2529
2530         kernel_list_unlabeled($1)
2531         allow $1 unlabeled_t:sock_file { getattr relabelfrom };
2532 ')
2533
2534 ########################################
2535 ## <summary>
2536 ##      Send and receive messages from an
2537 ##      unlabeled IPSEC association.
2538 ## </summary>
2539 ## <desc>
2540 ##      <p>
2541 ##      Send and receive messages from an
2542 ##      unlabeled IPSEC association.  Network
2543 ##      connections that are not protected
2544 ##      by IPSEC have use an unlabeled
2545 ##      assocation.
2546 ##      </p>
2547 ##      <p>
2548 ##      The corenetwork interface
2549 ##      corenet_non_ipsec_sendrecv() should
2550 ##      be used instead of this one.
2551 ##      </p>
2552 ## </desc>
2553 ## <param name="domain">
2554 ##      <summary>
2555 ##      Domain allowed access.
2556 ##      </summary>
2557 ## </param>
2558 #
2559 interface(`kernel_sendrecv_unlabeled_association',`
2560         gen_require(`
2561                 type unlabeled_t;
2562         ')
2563
2564         allow $1 unlabeled_t:association { sendto recvfrom };
2565
2566         # temporary hack until labeling on packets is supported
2567         allow $1 unlabeled_t:packet { send recv };
2568 ')
2569
2570 ########################################
2571 ## <summary>
2572 ##      Do not audit attempts to send and receive messages
2573 ##      from an unlabeled IPSEC association.
2574 ## </summary>
2575 ## <desc>
2576 ##      <p>
2577 ##      Do not audit attempts to send and receive messages
2578 ##      from an unlabeled IPSEC association.  Network
2579 ##      connections that are not protected
2580 ##      by IPSEC have use an unlabeled
2581 ##      assocation.
2582 ##      </p>
2583 ##      <p>
2584 ##      The corenetwork interface
2585 ##      corenet_dontaudit_non_ipsec_sendrecv() should
2586 ##      be used instead of this one.
2587 ##      </p>
2588 ## </desc>
2589 ## <param name="domain">
2590 ##      <summary>
2591 ##      Domain to not audit.
2592 ##      </summary>
2593 ## </param>
2594 #
2595 interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
2596         gen_require(`
2597                 type unlabeled_t;
2598         ')
2599
2600         dontaudit $1 unlabeled_t:association { sendto recvfrom };
2601 ')
2602
2603 ########################################
2604 ## <summary>
2605 ##      Receive TCP packets from an unlabeled connection.
2606 ## </summary>
2607 ## <desc>
2608 ##      <p>
2609 ##      Receive TCP packets from an unlabeled connection.
2610 ##      </p>
2611 ##      <p>
2612 ##      The corenetwork interface corenet_tcp_recv_unlabeled() should
2613 ##      be used instead of this one.
2614 ##      </p>
2615 ## </desc>
2616 ## <param name="domain">
2617 ##      <summary>
2618 ##      Domain allowed access.
2619 ##      </summary>
2620 ## </param>
2621 #
2622 interface(`kernel_tcp_recvfrom_unlabeled',`
2623         gen_require(`
2624                 type unlabeled_t;
2625         ')
2626
2627         allow $1 unlabeled_t:tcp_socket recvfrom;
2628 ')
2629
2630 ########################################
2631 ## <summary>
2632 ##      Do not audit attempts to receive TCP packets from an unlabeled
2633 ##      connection.
2634 ## </summary>
2635 ## <desc>
2636 ##      <p>
2637 ##      Do not audit attempts to receive TCP packets from an unlabeled
2638 ##      connection.
2639 ##      </p>
2640 ##      <p>
2641 ##      The corenetwork interface corenet_dontaudit_tcp_recv_unlabeled()
2642 ##      should be used instead of this one.
2643 ##      </p>
2644 ## </desc>
2645 ## <param name="domain">
2646 ##      <summary>
2647 ##      Domain to not audit.
2648 ##      </summary>
2649 ## </param>
2650 #
2651 interface(`kernel_dontaudit_tcp_recvfrom_unlabeled',`
2652         gen_require(`
2653                 type unlabeled_t;
2654         ')
2655
2656         dontaudit $1 unlabeled_t:tcp_socket recvfrom;
2657 ')
2658
2659 ########################################
2660 ## <summary>
2661 ##      Receive UDP packets from an unlabeled connection.
2662 ## </summary>
2663 ## <desc>
2664 ##      <p>
2665 ##      Receive UDP packets from an unlabeled connection.
2666 ##      </p>
2667 ##      <p>
2668 ##      The corenetwork interface corenet_udp_recv_unlabeled() should
2669 ##      be used instead of this one.
2670 ##      </p>
2671 ## </desc>
2672 ## <param name="domain">
2673 ##      <summary>
2674 ##      Domain allowed access.
2675 ##      </summary>
2676 ## </param>
2677 #
2678 interface(`kernel_udp_recvfrom_unlabeled',`
2679         gen_require(`
2680                 type unlabeled_t;
2681         ')
2682
2683         allow $1 unlabeled_t:udp_socket recvfrom;
2684 ')
2685
2686 ########################################
2687 ## <summary>
2688 ##      Do not audit attempts to receive UDP packets from an unlabeled
2689 ##      connection.
2690 ## </summary>
2691 ## <desc>
2692 ##      <p>
2693 ##      Do not audit attempts to receive UDP packets from an unlabeled
2694 ##      connection.
2695 ##      </p>
2696 ##      <p>
2697 ##      The corenetwork interface corenet_dontaudit_udp_recv_unlabeled()
2698 ##      should be used instead of this one.
2699 ##      </p>
2700 ## </desc>
2701 ## <param name="domain">
2702 ##      <summary>
2703 ##      Domain to not audit.
2704 ##      </summary>
2705 ## </param>
2706 #
2707 interface(`kernel_dontaudit_udp_recvfrom_unlabeled',`
2708         gen_require(`
2709                 type unlabeled_t;
2710         ')
2711
2712         dontaudit $1 unlabeled_t:udp_socket recvfrom;
2713 ')
2714
2715 ########################################
2716 ## <summary>
2717 ##      Receive Raw IP packets from an unlabeled connection.
2718 ## </summary>
2719 ## <desc>
2720 ##      <p>
2721 ##      Receive Raw IP packets from an unlabeled connection.
2722 ##      </p>
2723 ##      <p>
2724 ##      The corenetwork interface corenet_raw_recv_unlabeled() should
2725 ##      be used instead of this one.
2726 ##      </p>
2727 ## </desc>
2728 ## <param name="domain">
2729 ##      <summary>
2730 ##      Domain allowed access.
2731 ##      </summary>
2732 ## </param>
2733 #
2734 interface(`kernel_raw_recvfrom_unlabeled',`
2735         gen_require(`
2736                 type unlabeled_t;
2737         ')
2738
2739         allow $1 unlabeled_t:rawip_socket recvfrom;
2740 ')
2741
2742 ########################################
2743 ## <summary>
2744 ##      Do not audit attempts to receive Raw IP packets from an unlabeled
2745 ##      connection.
2746 ## </summary>
2747 ## <desc>
2748 ##      <p>
2749 ##      Do not audit attempts to receive Raw IP packets from an unlabeled
2750 ##      connection.
2751 ##      </p>
2752 ##      <p>
2753 ##      The corenetwork interface corenet_dontaudit_raw_recv_unlabeled()
2754 ##      should be used instead of this one.
2755 ##      </p>
2756 ## </desc>
2757 ## <param name="domain">
2758 ##      <summary>
2759 ##      Domain to not audit.
2760 ##      </summary>
2761 ## </param>
2762 #
2763 interface(`kernel_dontaudit_raw_recvfrom_unlabeled',`
2764         gen_require(`
2765                 type unlabeled_t;
2766         ')
2767
2768         dontaudit $1 unlabeled_t:rawip_socket recvfrom;
2769 ')
2770
2771 ########################################
2772 ## <summary>
2773 ##      Send and receive unlabeled packets.
2774 ## </summary>
2775 ## <desc>
2776 ##      <p>
2777 ##      Send and receive unlabeled packets.
2778 ##      These packets do not match any netfilter
2779 ##      SECMARK rules.
2780 ##      </p>
2781 ##      <p>
2782 ##      The corenetwork interface
2783 ##      corenet_sendrecv_unlabeled_packets() should
2784 ##      be used instead of this one.
2785 ##      </p>
2786 ## </desc>
2787 ## <param name="domain">
2788 ##      <summary>
2789 ##      Domain allowed access.
2790 ##      </summary>
2791 ## </param>
2792 #
2793 interface(`kernel_sendrecv_unlabeled_packets',`
2794         gen_require(`
2795                 type unlabeled_t;
2796         ')
2797
2798         allow $1 unlabeled_t:packet { send recv };
2799 ')
2800
2801 ########################################
2802 ## <summary>
2803 ##      Receive packets from an unlabeled peer.
2804 ## </summary>
2805 ## <desc>
2806 ##      <p>
2807 ##      Receive packets from an unlabeled peer, these packets do not have any
2808 ##      peer labeling information present.
2809 ##      </p>
2810 ##      <p>
2811 ##      The corenetwork interface corenet_recvfrom_unlabeled_peer() should
2812 ##      be used instead of this one.
2813 ##      </p>
2814 ## </desc>
2815 ## <param name="domain">
2816 ##      <summary>
2817 ##      Domain allowed access.
2818 ##      </summary>
2819 ## </param>
2820 #
2821 interface(`kernel_recvfrom_unlabeled_peer',`
2822         gen_require(`
2823                 type unlabeled_t;
2824         ')
2825
2826         allow $1 unlabeled_t:peer recv;
2827 ')
2828
2829 ########################################
2830 ## <summary>
2831 ##      Do not audit attempts to receive packets from an unlabeled peer.
2832 ## </summary>
2833 ## <desc>
2834 ##      <p>
2835 ##      Do not audit attempts to receive packets from an unlabeled peer,
2836 ##      these packets do not have any peer labeling information present.
2837 ##      </p>
2838 ##      <p>
2839 ##      The corenetwork interface corenet_dontaudit_*_recvfrom_unlabeled()
2840 ##      should be used instead of this one.
2841 ##      </p>
2842 ## </desc>
2843 ## <param name="domain">
2844 ##      <summary>
2845 ##      Domain to not audit.
2846 ##      </summary>
2847 ## </param>
2848 #
2849 interface(`kernel_dontaudit_recvfrom_unlabeled_peer',`
2850         gen_require(`
2851                 type unlabeled_t;
2852         ')
2853
2854         dontaudit $1 unlabeled_t:peer recv;
2855 ')
2856
2857 ########################################
2858 ## <summary>
2859 ##      Relabel from unlabeled database objects.
2860 ## </summary>
2861 ## <param name="domain">
2862 ##      <summary>
2863 ##      Domain allowed access.
2864 ##      </summary>
2865 ## </param>
2866 #
2867 interface(`kernel_relabelfrom_unlabeled_database',`
2868         gen_require(`
2869                 type unlabeled_t;
2870                 class db_database { setattr relabelfrom };
2871                 class db_table { setattr relabelfrom };
2872                 class db_procedure { setattr relabelfrom };
2873                 class db_column { setattr relabelfrom };
2874                 class db_tuple { update relabelfrom };
2875                 class db_blob { setattr relabelfrom };
2876         ')
2877
2878         allow $1 unlabeled_t:db_database { setattr relabelfrom };
2879         allow $1 unlabeled_t:db_table { setattr relabelfrom };
2880         allow $1 unlabeled_t:db_procedure { setattr relabelfrom };
2881         allow $1 unlabeled_t:db_column { setattr relabelfrom };
2882         allow $1 unlabeled_t:db_tuple { update relabelfrom };
2883         allow $1 unlabeled_t:db_blob { setattr relabelfrom };
2884 ')
2885
2886 ########################################
2887 ## <summary>
2888 ##      Relabel to unlabeled context .
2889 ## </summary>
2890 ## <param name="domain">
2891 ##      <summary>
2892 ##      Domain allowed access.
2893 ##      </summary>
2894 ## </param>
2895 #
2896 interface(`kernel_relabelto_unlabeled',`
2897         gen_require(`
2898                 type unlabeled_t;
2899         ')
2900
2901         allow $1 unlabeled_t:dir_file_class_set relabelto;
2902 ')
2903
2904 ########################################
2905 ## <summary>
2906 ##      Unconfined access to kernel module resources.
2907 ## </summary>
2908 ## <param name="domain">
2909 ##      <summary>
2910 ##      Domain allowed access.
2911 ##      </summary>
2912 ## </param>
2913 #
2914 interface(`kernel_unconfined',`
2915         gen_require(`
2916                 attribute kern_unconfined;
2917         ')
2918
2919         typeattribute $1 kern_unconfined;
2920 ')
2921
2922 ########################################
2923 ## <summary>
2924 ##      Allow the specified domain to connect to
2925 ##      the kernel with a unix socket.
2926 ## </summary>
2927 ## <param name="domain">
2928 ##      <summary>
2929 ##      Domain allowed access.
2930 ##      </summary>
2931 ## </param>
2932 #
2933 interface(`kernel_stream_connect',`
2934         gen_require(`
2935                 type kernel_t;
2936         ')
2937
2938         allow $1 kernel_t:unix_stream_socket connectto;
2939 ')
2940