1 policy_module(plymouthd, 1.0.1)
3 ########################################
10 application_domain(plymouth_t, plymouth_exec_t)
11 role system_r types plymouth_t;
14 type plymouthd_exec_t;
15 init_daemon_domain(plymouthd_t, plymouthd_exec_t)
17 type plymouthd_spool_t;
18 files_spool_file(plymouthd_spool_t)
20 type plymouthd_var_lib_t;
21 files_type(plymouthd_var_lib_t)
23 type plymouthd_var_log_t;
24 logging_log_file(plymouthd_var_log_t)
26 type plymouthd_var_run_t;
27 files_pid_file(plymouthd_var_run_t)
29 ########################################
31 # Plymouthd private policy
34 allow plymouthd_t self:capability { sys_admin sys_tty_config };
35 dontaudit plymouthd_t self:capability dac_override;
36 allow plymouthd_t self:process { signal getsched };
37 allow plymouthd_t self:fifo_file rw_fifo_file_perms;
38 allow plymouthd_t self:unix_stream_socket create_stream_socket_perms;
40 manage_dirs_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t)
41 manage_files_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t)
42 manage_sock_files_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t)
43 files_spool_filetrans(plymouthd_t, plymouthd_spool_t, { file dir sock_file })
45 manage_dirs_pattern(plymouthd_t, plymouthd_var_lib_t, plymouthd_var_lib_t)
46 manage_files_pattern(plymouthd_t, plymouthd_var_lib_t, plymouthd_var_lib_t)
47 files_var_lib_filetrans(plymouthd_t, plymouthd_var_lib_t, { file dir })
49 manage_dirs_pattern(plymouthd_t, plymouthd_var_log_t, plymouthd_var_log_t)
50 manage_files_pattern(plymouthd_t, plymouthd_var_log_t, plymouthd_var_log_t)
51 logging_log_filetrans(plymouthd_t, plymouthd_var_log_t, { file dir })
53 manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t)
54 manage_files_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t)
55 files_pid_filetrans(plymouthd_t, plymouthd_var_run_t, { file dir })
57 kernel_read_system_state(plymouthd_t)
58 kernel_request_load_module(plymouthd_t)
59 kernel_change_ring_buffer_level(plymouthd_t)
61 dev_rw_dri(plymouthd_t)
62 dev_read_sysfs(plymouthd_t)
63 dev_read_framebuffer(plymouthd_t)
64 dev_write_framebuffer(plymouthd_t)
66 domain_use_interactive_fds(plymouthd_t)
68 files_read_etc_files(plymouthd_t)
69 files_read_usr_files(plymouthd_t)
71 term_use_unallocated_ttys(plymouthd_t)
73 init_signal(plymouthd_t)
75 logging_link_generic_logs(plymouthd_t)
76 logging_delete_generic_logs(plymouthd_t)
78 auth_read_passwd(plymouthd_t)
80 miscfiles_read_localization(plymouthd_t)
81 miscfiles_read_fonts(plymouthd_t)
82 miscfiles_manage_fonts_cache(plymouthd_t)
84 userdom_read_admin_home_files(plymouthd_t)
87 sssd_stream_connect(plymouthd_t)
91 xserver_xdm_manage_spool(plymouthd_t)
92 xserver_read_state_xdm(plymouthd_t)
95 term_use_unallocated_ttys(plymouthd_t)
97 ########################################
99 # Plymouth private policy
102 allow plymouth_t self:process signal;
103 allow plymouth_t self:fifo_file rw_file_perms;
104 allow plymouth_t self:unix_stream_socket create_stream_socket_perms;
106 kernel_read_system_state(plymouth_t)
107 kernel_stream_connect(plymouth_t)
109 domain_use_interactive_fds(plymouth_t)
111 files_read_etc_files(plymouth_t)
113 term_use_ptmx(plymouth_t)
115 miscfiles_read_localization(plymouth_t)
117 sysnet_read_config(plymouth_t)
119 plymouthd_stream_connect(plymouth_t)
121 ifdef(`hide_broken_symptoms',`
123 hal_dontaudit_write_log(plymouth_t)
124 hal_dontaudit_rw_pipes(plymouth_t)
129 lvm_domtrans(plymouth_t)