policy/modules/services/gpm.te

   1
   2 policy_module(gpm, 1.8.0)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type gpm_t;
  10 type gpm_exec_t;
  11 init_daemon_domain(gpm_t, gpm_exec_t)
  12
  13 type gpm_conf_t;
  14 files_type(gpm_conf_t)
  15
  16 type gpm_tmp_t;
  17 files_tmp_file(gpm_tmp_t)
  18
  19 type gpm_var_run_t;
  20 files_pid_file(gpm_var_run_t)
  21
  22 type gpmctl_t;
  23 files_type(gpmctl_t)
  24
  25 ########################################
  26 #
  27 # Local policy
  28 #
  29
  30 allow gpm_t self:capability { setpcap setuid dac_override sys_admin sys_tty_config };
  31 allow gpm_t self:process { getcap setcap };
  32 allow gpm_t self:unix_stream_socket create_stream_socket_perms;
  33
  34 allow gpm_t gpm_conf_t:dir list_dir_perms;
  35 read_files_pattern(gpm_t, gpm_conf_t, gpm_conf_t)
  36 read_lnk_files_pattern(gpm_t, gpm_conf_t, gpm_conf_t)
  37
  38 manage_dirs_pattern(gpm_t, gpm_tmp_t, gpm_tmp_t)
  39 manage_files_pattern(gpm_t, gpm_tmp_t, gpm_tmp_t)
  40 files_tmp_filetrans(gpm_t, gpm_tmp_t, { file dir })
  41
  42 allow gpm_t gpm_var_run_t:file manage_file_perms;
  43 files_pid_filetrans(gpm_t, gpm_var_run_t, file)
  44
  45 allow gpm_t gpmctl_t:sock_file manage_sock_file_perms;
  46 allow gpm_t gpmctl_t:fifo_file manage_fifo_file_perms;
  47 dev_filetrans(gpm_t, gpmctl_t, { sock_file fifo_file })
  48
  49 kernel_read_kernel_sysctls(gpm_t)
  50 kernel_list_proc(gpm_t)
  51 kernel_read_proc_symlinks(gpm_t)
  52
  53 dev_read_sysfs(gpm_t)
  54 # Access the mouse.
  55 dev_rw_input_dev(gpm_t)
  56 dev_rw_mouse(gpm_t)
  57
  58 files_read_etc_files(gpm_t)
  59
  60 fs_getattr_all_fs(gpm_t)
  61 fs_search_auto_mountpoints(gpm_t)
  62
  63 term_use_unallocated_ttys(gpm_t)
  64
  65 domain_use_interactive_fds(gpm_t)
  66
  67 logging_send_syslog_msg(gpm_t)
  68
  69 miscfiles_read_localization(gpm_t)
  70
  71 userdom_dontaudit_use_unpriv_user_fds(gpm_t)
  72 userdom_dontaudit_search_user_home_dirs(gpm_t)
  73
  74 optional_policy(`
  75         seutil_sigchld_newrole(gpm_t)
  76 ')
  77
  78 optional_policy(`
  79         udev_read_db(gpm_t)
  80 ')