policy/modules/services/virt.if

   1 ## <summary>Libvirt virtualization API</summary>
   2
   3 ########################################
   4 ## <summary>
   5 ##      Creates types and rules for a basic
   6 ##      qemu process domain.
   7 ## </summary>
   8 ## <param name="prefix">
   9 ##      <summary>
  10 ##      Prefix for the domain.
  11 ##      </summary>
  12 ## </param>
  13 #
  14 template(`virt_domain_template',`
  15         gen_require(`
  16                 attribute virt_image_type, virt_domain;
  17                 attribute virt_tmpfs_type;
  18                 attribute virt_ptynode;
  19                 type qemu_exec_t;
  20         ')
  21
  22         type $1_t, virt_domain;
  23         application_domain($1_t, qemu_exec_t)
  24         domain_user_exemption_target($1_t)
  25         mls_rangetrans_target($1_t)
  26         mcs_untrusted_proc($1_t)
  27         role system_r types $1_t;
  28
  29         type $1_devpts_t, virt_ptynode;
  30         term_pty($1_devpts_t)
  31
  32         type $1_tmp_t;
  33         files_tmp_file($1_tmp_t)
  34
  35         type $1_tmpfs_t, virt_tmpfs_type;
  36         files_tmpfs_file($1_tmpfs_t)
  37
  38         type $1_image_t, virt_image_type;
  39         files_type($1_image_t)
  40         dev_node($1_image_t)
  41         dev_associate_sysfs($1_image_t)
  42
  43         auth_use_nsswitch($1_t)
  44
  45         allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr_chr_file_perms };
  46         term_create_pty($1_t, $1_devpts_t)
  47
  48         manage_dirs_pattern($1_t, $1_image_t, $1_image_t)
  49         manage_files_pattern($1_t, $1_image_t, $1_image_t)
  50         manage_fifo_files_pattern($1_t, $1_image_t, $1_image_t)
  51         read_lnk_files_pattern($1_t, $1_image_t, $1_image_t)
  52         rw_chr_files_pattern($1_t, $1_image_t, $1_image_t)
  53         rw_blk_files_pattern($1_t, $1_image_t, $1_image_t)
  54         fs_hugetlbfs_filetrans($1_t, $1_image_t, file)
  55
  56         manage_dirs_pattern($1_t, $1_tmp_t, $1_tmp_t)
  57         manage_files_pattern($1_t, $1_tmp_t, $1_tmp_t)
  58         manage_lnk_files_pattern($1_t, $1_tmp_t, $1_tmp_t)
  59         files_tmp_filetrans($1_t, $1_tmp_t, { file dir })
  60
  61         manage_dirs_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
  62         manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
  63         manage_lnk_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
  64         fs_tmpfs_filetrans($1_t, $1_tmpfs_t, { dir file lnk_file })
  65
  66         optional_policy(`
  67                 xserver_rw_shm($1_t)
  68         ')
  69 ')
  70
  71 ########################################
  72 ## <summary>
  73 ##      Make the specified type usable as a virt image
  74 ## </summary>
  75 ## <param name="type">
  76 ##      <summary>
  77 ##      Type to be used as a virtual image
  78 ##      </summary>
  79 ## </param>
  80 #
  81 interface(`virt_image',`
  82         gen_require(`
  83                 attribute virt_image_type;
  84         ')
  85
  86         typeattribute $1 virt_image_type;
  87         files_type($1)
  88
  89         # virt images can be assigned to blk devices
  90         dev_node($1)
  91 ')
  92
  93 #######################################
  94 ## <summary>
  95 ##  Getattr on virt executable.
  96 ## </summary>
  97 ## <param name="domain">
  98 ##  <summary>
  99 ##  Domain allowed to transition.
 100 ##  </summary>
 101 ## </param>
 102 #
 103 interface(`virt_getattr_exec',`
 104     gen_require(`
 105         type virtd_exec_t;
 106     ')
 107
 108         allow $1 virtd_exec_t:file getattr;
 109 ')
 110
 111 ########################################
 112 ## <summary>
 113 ##      Execute a domain transition to run virt.
 114 ## </summary>
 115 ## <param name="domain">
 116 ##      <summary>
 117 ##      Domain allowed to transition.
 118 ##      </summary>
 119 ## </param>
 120 #
 121 interface(`virt_domtrans',`
 122         gen_require(`
 123                 type virtd_t, virtd_exec_t;
 124         ')
 125
 126         domtrans_pattern($1, virtd_exec_t, virtd_t)
 127 ')
 128
 129 ########################################
 130 ## <summary>
 131 ##      Transition to virt_qmf.
 132 ## </summary>
 133 ## <param name="domain">
 134 ## <summary>
 135 ##      Domain allowed to transition.
 136 ## </summary>
 137 ## </param>
 138 #
 139 interface(`virt_domtrans_qmf',`
 140         gen_require(`
 141                 type virt_qmf_t, virt_qmf_exec_t;
 142         ')
 143
 144         corecmd_search_bin($1)
 145         domtrans_pattern($1, virt_qmf_exec_t, virt_qmf_t)
 146 ')
 147
 148 #######################################
 149 ## <summary>
 150 ##      Connect to virt over an unix domain stream socket.
 151 ## </summary>
 152 ## <param name="domain">
 153 ##      <summary>
 154 ##      Domain allowed access.
 155 ##      </summary>
 156 ## </param>
 157 #
 158 interface(`virt_stream_connect',`
 159         gen_require(`
 160                 type virtd_t, virt_var_run_t;
 161         ')
 162
 163         files_search_pids($1)
 164         stream_connect_pattern($1, virt_var_run_t, virt_var_run_t, virtd_t)
 165 ')
 166
 167 ########################################
 168 ## <summary>
 169 ##      Allow domain to attach to virt TUN devices
 170 ## </summary>
 171 ## <param name="domain">
 172 ##      <summary>
 173 ##      Domain allowed access.
 174 ##      </summary>
 175 ## </param>
 176 #
 177 interface(`virt_attach_tun_iface',`
 178         gen_require(`
 179                 type virtd_t;
 180         ')
 181
 182         allow $1 virtd_t:tun_socket relabelfrom;
 183         allow $1 self:tun_socket relabelto;
 184 ')
 185
 186 ########################################
 187 ## <summary>
 188 ##      Read virt config files.
 189 ## </summary>
 190 ## <param name="domain">
 191 ##      <summary>
 192 ##      Domain allowed access.
 193 ##      </summary>
 194 ## </param>
 195 #
 196 interface(`virt_read_config',`
 197         gen_require(`
 198                 type virt_etc_t, virt_etc_rw_t;
 199         ')
 200
 201         files_search_etc($1)
 202         read_files_pattern($1, virt_etc_t, virt_etc_t)
 203         read_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t)
 204         read_lnk_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t)
 205 ')
 206
 207 ########################################
 208 ## <summary>
 209 ##      manage virt config files.
 210 ## </summary>
 211 ## <param name="domain">
 212 ##      <summary>
 213 ##      Domain allowed access.
 214 ##      </summary>
 215 ## </param>
 216 #
 217 interface(`virt_manage_config',`
 218         gen_require(`
 219                 type virt_etc_t, virt_etc_rw_t;
 220         ')
 221
 222         files_search_etc($1)
 223         manage_files_pattern($1, virt_etc_t, virt_etc_t)
 224         manage_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t)
 225         manage_lnk_files_pattern($1, virt_etc_rw_t, virt_etc_rw_t)
 226 ')
 227
 228 ########################################
 229 ## <summary>
 230 ##      Allow domain to manage virt image files
 231 ## </summary>
 232 ## <param name="domain">
 233 ##      <summary>
 234 ##      Domain allowed access.
 235 ##      </summary>
 236 ## </param>
 237 #
 238 interface(`virt_read_content',`
 239         gen_require(`
 240                 type virt_content_t;
 241         ')
 242
 243         virt_search_lib($1)
 244         allow $1 virt_content_t:dir list_dir_perms;
 245         list_dirs_pattern($1, virt_content_t, virt_content_t)
 246         read_files_pattern($1, virt_content_t, virt_content_t)
 247         read_lnk_files_pattern($1, virt_content_t, virt_content_t)
 248         read_blk_files_pattern($1, virt_content_t, virt_content_t)
 249
 250         tunable_policy(`virt_use_nfs',`
 251                 fs_list_nfs($1)
 252                 fs_read_nfs_files($1)
 253                 fs_read_nfs_symlinks($1)
 254         ')
 255
 256         tunable_policy(`virt_use_samba',`
 257                 fs_list_cifs($1)
 258                 fs_read_cifs_files($1)
 259                 fs_read_cifs_symlinks($1)
 260         ')
 261 ')
 262
 263 ########################################
 264 ## <summary>
 265 ##      Allow domain to write virt image files
 266 ## </summary>
 267 ## <param name="domain">
 268 ##      <summary>
 269 ##      Domain allowed access.
 270 ##      </summary>
 271 ## </param>
 272 #
 273 interface(`virt_write_content',`
 274         gen_require(`
 275                 type virt_content_t;
 276         ')
 277
 278         allow $1 virt_content_t:file write_file_perms;
 279 ')
 280
 281 ########################################
 282 ## <summary>
 283 ##      Read virt PID files.
 284 ## </summary>
 285 ## <param name="domain">
 286 ##      <summary>
 287 ##      Domain allowed access.
 288 ##      </summary>
 289 ## </param>
 290 #
 291 interface(`virt_read_pid_files',`
 292         gen_require(`
 293                 type virt_var_run_t;
 294         ')
 295
 296         files_search_pids($1)
 297         read_files_pattern($1, virt_var_run_t, virt_var_run_t)
 298 ')
 299
 300 ########################################
 301 ## <summary>
 302 ##      Manage virt pid files.
 303 ## </summary>
 304 ## <param name="domain">
 305 ##      <summary>
 306 ##      Domain allowed access.
 307 ##      </summary>
 308 ## </param>
 309 #
 310 interface(`virt_manage_pid_files',`
 311         gen_require(`
 312                 type virt_var_run_t;
 313         ')
 314
 315         files_search_pids($1)
 316         manage_files_pattern($1, virt_var_run_t, virt_var_run_t)
 317 ')
 318
 319 ########################################
 320 ## <summary>
 321 ##      Create objects in the pid directory
 322 ##      with a private type with a type transition.
 323 ## </summary>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <param name="file">
 330 ##      <summary>
 331 ##      Type to which the created node will be transitioned.
 332 ##      </summary>
 333 ## </param>
 334 ## <param name="class">
 335 ##      <summary>
 336 ##      Object class(es) (single or set including {}) for which this
 337 ##      the transition will occur.
 338 ##      </summary>
 339 ## </param>
 340 #
 341 interface(`virt_pid_filetrans',`
 342         gen_require(`
 343                 type virt_var_run_t;
 344         ')
 345
 346         filetrans_pattern($1, virt_var_run_t, $2, $3, $4)
 347 ')
 348
 349 ########################################
 350 ## <summary>
 351 ##      Search virt lib directories.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain allowed access.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`virt_search_lib',`
 360         gen_require(`
 361                 type virt_var_lib_t;
 362         ')
 363
 364         allow $1 virt_var_lib_t:dir search_dir_perms;
 365         files_search_var_lib($1)
 366 ')
 367
 368 ########################################
 369 ## <summary>
 370 ##      Read virt lib files.
 371 ## </summary>
 372 ## <param name="domain">
 373 ##      <summary>
 374 ##      Domain allowed access.
 375 ##      </summary>
 376 ## </param>
 377 #
 378 interface(`virt_read_lib_files',`
 379         gen_require(`
 380                 type virt_var_lib_t;
 381         ')
 382
 383         files_search_var_lib($1)
 384         read_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
 385         read_lnk_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
 386 ')
 387
 388 ########################################
 389 ## <summary>
 390 ##      Dontaudit inherited read virt lib files.
 391 ## </summary>
 392 ## <param name="domain">
 393 ##      <summary>
 394 ##      Domain to not audit.
 395 ##      </summary>
 396 ## </param>
 397 #
 398 interface(`virt_dontaudit_read_lib_files',`
 399         gen_require(`
 400                 type virt_var_lib_t;
 401         ')
 402
 403         dontaudit $1 virt_var_lib_t:file read_inherited_file_perms;
 404 ')
 405
 406 ########################################
 407 ## <summary>
 408 ##      Create, read, write, and delete
 409 ##      virt lib files.
 410 ## </summary>
 411 ## <param name="domain">
 412 ##      <summary>
 413 ##      Domain allowed access.
 414 ##      </summary>
 415 ## </param>
 416 #
 417 interface(`virt_manage_lib_files',`
 418         gen_require(`
 419                 type virt_var_lib_t;
 420         ')
 421
 422         files_search_var_lib($1)
 423         manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
 424 ')
 425
 426 ########################################
 427 ## <summary>
 428 ##      Allow the specified domain to read virt's log files.
 429 ## </summary>
 430 ## <param name="domain">
 431 ##      <summary>
 432 ##      Domain allowed access.
 433 ##      </summary>
 434 ## </param>
 435 ## <rolecap/>
 436 #
 437 interface(`virt_read_log',`
 438         gen_require(`
 439                 type virt_log_t;
 440         ')
 441
 442         logging_search_logs($1)
 443         read_files_pattern($1, virt_log_t, virt_log_t)
 444 ')
 445
 446 ########################################
 447 ## <summary>
 448 ##      Allow the specified domain to append
 449 ##      virt log files.
 450 ## </summary>
 451 ## <param name="domain">
 452 ##      <summary>
 453 ##      Domain allowed access.
 454 ##      </summary>
 455 ## </param>
 456 #
 457 interface(`virt_append_log',`
 458         gen_require(`
 459                 type virt_log_t;
 460         ')
 461
 462         logging_search_logs($1)
 463         append_files_pattern($1, virt_log_t, virt_log_t)
 464 ')
 465
 466 ########################################
 467 ## <summary>
 468 ##      Allow domain to manage virt log files
 469 ## </summary>
 470 ## <param name="domain">
 471 ##      <summary>
 472 ##      Domain allowed access.
 473 ##      </summary>
 474 ## </param>
 475 #
 476 interface(`virt_manage_log',`
 477         gen_require(`
 478                 type virt_log_t;
 479         ')
 480
 481         manage_dirs_pattern($1, virt_log_t, virt_log_t)
 482         manage_files_pattern($1, virt_log_t, virt_log_t)
 483         manage_lnk_files_pattern($1, virt_log_t, virt_log_t)
 484 ')
 485
 486 ########################################
 487 ## <summary>
 488 ##      Allow domain to read virt image files
 489 ## </summary>
 490 ## <param name="domain">
 491 ##      <summary>
 492 ##      Domain allowed access.
 493 ##      </summary>
 494 ## </param>
 495 #
 496 interface(`virt_read_images',`
 497         gen_require(`
 498                 type virt_var_lib_t;
 499                 attribute virt_image_type;
 500         ')
 501
 502         virt_search_lib($1)
 503         allow $1 virt_image_type:dir list_dir_perms;
 504         list_dirs_pattern($1, virt_image_type, virt_image_type)
 505         read_files_pattern($1, virt_image_type, virt_image_type)
 506         read_lnk_files_pattern($1, virt_image_type, virt_image_type)
 507         read_blk_files_pattern($1, virt_image_type, virt_image_type)
 508         read_chr_files_pattern($1, virt_image_type, virt_image_type)
 509
 510         tunable_policy(`virt_use_nfs',`
 511                 fs_list_nfs($1)
 512                 fs_read_nfs_files($1)
 513                 fs_read_nfs_symlinks($1)
 514         ')
 515
 516         tunable_policy(`virt_use_samba',`
 517                 fs_list_cifs($1)
 518                 fs_read_cifs_files($1)
 519                 fs_read_cifs_symlinks($1)
 520         ')
 521 ')
 522
 523 ########################################
 524 ## <summary>
 525 ##      Allow domain to read virt blk image files
 526 ## </summary>
 527 ## <param name="domain">
 528 ##      <summary>
 529 ##      Domain allowed access.
 530 ##      </summary>
 531 ## </param>
 532 #
 533 interface(`virt_read_blk_images',`
 534         gen_require(`
 535                 attribute virt_image_type;
 536         ')
 537
 538         read_blk_files_pattern($1, virt_image_type, virt_image_type)
 539 ')
 540
 541 ########################################
 542 ## <summary>
 543 ##      Create, read, write, and delete
 544 ##      svirt cache files.
 545 ## </summary>
 546 ## <param name="domain">
 547 ##      <summary>
 548 ##      Domain allowed access.
 549 ##      </summary>
 550 ## </param>
 551 #
 552 interface(`virt_manage_cache',`
 553         gen_require(`
 554                 type virt_cache_t;
 555         ')
 556
 557         files_search_var($1)
 558         manage_dirs_pattern($1, virt_cache_t, virt_cache_t)
 559         manage_files_pattern($1, virt_cache_t, virt_cache_t)
 560         manage_lnk_files_pattern($1, virt_cache_t, virt_cache_t)
 561 ')
 562
 563 ########################################
 564 ## <summary>
 565 ##      Allow domain to manage virt image files
 566 ## </summary>
 567 ## <param name="domain">
 568 ##      <summary>
 569 ##      Domain allowed access.
 570 ##      </summary>
 571 ## </param>
 572 #
 573 interface(`virt_manage_images',`
 574         gen_require(`
 575                 type virt_var_lib_t;
 576                 attribute virt_image_type;
 577         ')
 578
 579         virt_search_lib($1)
 580         allow $1 virt_image_type:dir list_dir_perms;
 581         manage_dirs_pattern($1, virt_image_type, virt_image_type)
 582         manage_files_pattern($1, virt_image_type, virt_image_type)
 583         read_lnk_files_pattern($1, virt_image_type, virt_image_type)
 584         rw_blk_files_pattern($1, virt_image_type, virt_image_type)
 585         rw_chr_files_pattern($1, virt_image_type, virt_image_type)
 586
 587         tunable_policy(`virt_use_nfs',`
 588                 fs_manage_nfs_dirs($1)
 589                 fs_manage_nfs_files($1)
 590                 fs_read_nfs_symlinks($1)
 591         ')
 592
 593         tunable_policy(`virt_use_samba',`
 594                 fs_manage_cifs_files($1)
 595                 fs_manage_cifs_files($1)
 596                 fs_read_cifs_symlinks($1)
 597         ')
 598 ')
 599
 600 ########################################
 601 ## <summary>
 602 ##      All of the rules required to administrate
 603 ##      an virt environment
 604 ## </summary>
 605 ## <param name="domain">
 606 ##      <summary>
 607 ##      Domain allowed access.
 608 ##      </summary>
 609 ## </param>
 610 ## <param name="role">
 611 ##      <summary>
 612 ##      Role allowed access.
 613 ##      </summary>
 614 ## </param>
 615 ## <rolecap/>
 616 #
 617 interface(`virt_admin',`
 618         gen_require(`
 619                 type virtd_t, virtd_initrc_exec_t;
 620                 attribute virt_domain;
 621                 type virt_lxc_t;
 622         ')
 623
 624         allow $1 virtd_t:process signal_perms;
 625         ps_process_pattern($1, virtd_t)
 626         tunable_policy(`deny_ptrace',`',`
 627                 allow $1 virtd_t:process ptrace;
 628                 allow $1 virt_lxc_t:process ptrace;
 629         ')
 630
 631         allow $1 virt_lxc_t:process signal_perms;
 632         ps_process_pattern($1, virt_lxc_t)
 633
 634         init_labeled_script_domtrans($1, virtd_initrc_exec_t)
 635         domain_system_change_exemption($1)
 636         role_transition $2 virtd_initrc_exec_t system_r;
 637         allow $2 system_r;
 638
 639         virt_manage_pid_files($1)
 640
 641         virt_manage_lib_files($1)
 642
 643         virt_manage_log($1)
 644
 645         virt_manage_images($1)
 646
 647         allow $1 virt_domain:process signal_perms;
 648 ')
 649
 650 ########################################
 651 ## <summary>
 652 ##      Execute qemu in the svirt domain, and
 653 ##      allow the specified role the svirt domain.
 654 ## </summary>
 655 ## <param name="domain">
 656 ##      <summary>
 657 ##      Domain allowed access
 658 ##      </summary>
 659 ## </param>
 660 ## <param name="role">
 661 ##      <summary>
 662 ##      The role to be allowed the sandbox domain.
 663 ##      </summary>
 664 ## </param>
 665 ## <rolecap/>
 666 #
 667 interface(`virt_transition_svirt',`
 668         gen_require(`
 669                 type svirt_t;
 670         ')
 671
 672         allow $1 svirt_t:process transition;
 673         role $2 types svirt_t;
 674
 675         optional_policy(`
 676                 ptchown_run(svirt_t, $2)
 677         ')
 678 ')
 679
 680 ########################################
 681 ## <summary>
 682 ##      Do not audit attempts to write virt daemon unnamed pipes.
 683 ## </summary>
 684 ## <param name="domain">
 685 ##      <summary>
 686 ##      Domain to not audit.
 687 ##      </summary>
 688 ## </param>
 689 #
 690 interface(`virt_dontaudit_write_pipes',`
 691         gen_require(`
 692                 type virtd_t;
 693         ')
 694
 695         dontaudit $1 virtd_t:fd use;
 696         dontaudit $1 virtd_t:fifo_file write_fifo_file_perms;
 697 ')
 698
 699 ########################################
 700 ## <summary>
 701 ##      Send a sigkill to virtual machines
 702 ## </summary>
 703 ## <param name="domain">
 704 ##      <summary>
 705 ##      Domain allowed access.
 706 ##      </summary>
 707 ## </param>
 708 #
 709 interface(`virt_kill_svirt',`
 710         gen_require(`
 711                 attribute virt_domain;
 712         ')
 713
 714         allow $1 virt_domain:process sigkill;
 715 ')
 716
 717 ########################################
 718 ## <summary>
 719 ##      Send a signal to virtual machines
 720 ## </summary>
 721 ## <param name="domain">
 722 ##      <summary>
 723 ##      Domain allowed access.
 724 ##      </summary>
 725 ## </param>
 726 #
 727 interface(`virt_signal_svirt',`
 728         gen_require(`
 729                 attribute virt_domain;
 730         ')
 731
 732         allow $1 virt_domain:process signal;
 733 ')
 734
 735 ########################################
 736 ## <summary>
 737 ##      Manage virt home files.
 738 ## </summary>
 739 ## <param name="domain">
 740 ##      <summary>
 741 ##      Domain allowed access.
 742 ##      </summary>
 743 ## </param>
 744 #
 745 interface(`virt_manage_home_files',`
 746         gen_require(`
 747                 type virt_home_t;
 748         ')
 749
 750         userdom_search_user_home_dirs($1)
 751         manage_files_pattern($1, virt_home_t, virt_home_t)
 752 ')
 753
 754 ########################################
 755 ## <summary>
 756 ##      allow domain to read
 757 ##      virt tmpfs files
 758 ## </summary>
 759 ## <param name="domain">
 760 ##      <summary>
 761 ##      Domain allowed access
 762 ##      </summary>
 763 ## </param>
 764 #
 765 interface(`virt_read_tmpfs_files',`
 766         gen_require(`
 767                 attribute virt_tmpfs_type;
 768         ')
 769
 770         allow $1 virt_tmpfs_type:file read_file_perms;
 771 ')
 772
 773 ########################################
 774 ## <summary>
 775 ##      allow domain to manage
 776 ##      virt tmpfs files
 777 ## </summary>
 778 ## <param name="domain">
 779 ##      <summary>
 780 ##      Domain allowed access
 781 ##      </summary>
 782 ## </param>
 783 #
 784 interface(`virt_manage_tmpfs_files',`
 785         gen_require(`
 786                 attribute virt_tmpfs_type;
 787         ')
 788
 789         allow $1 virt_tmpfs_type:file manage_file_perms;
 790 ')
 791
 792 ########################################
 793 ## <summary>
 794 ##      Create .virt directory in the user home directory
 795 ##      with an correct label.
 796 ## </summary>
 797 ## <param name="domain">
 798 ##      <summary>
 799 ##      Domain allowed access.
 800 ##      </summary>
 801 ## </param>
 802 #
 803 interface(`virt_filetrans_home_content',`
 804         gen_require(`
 805                 type virt_home_t;
 806         ')
 807
 808         userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".libvirt")
 809         userdom_user_home_dir_filetrans($1, virt_home_t, dir, ".virtinst")
 810 ')
 811
 812 ########################################
 813 ## <summary>
 814 ##      Dontaudit attempts to Read virt_image_type devices.
 815 ## </summary>
 816 ## <param name="domain">
 817 ##      <summary>
 818 ##      Domain allowed access.
 819 ##      </summary>
 820 ## </param>
 821 #
 822 interface(`virt_dontaudit_read_chr_dev',`
 823         gen_require(`
 824                 attribute virt_image_type;
 825         ')
 826
 827         dontaudit $1 virt_image_type:chr_file read_chr_file_perms;
 828 ')
 829
 830 ########################################
 831 ## <summary>
 832 ##      Creates types and rules for a basic
 833 ##      virt_lxc process domain.
 834 ## </summary>
 835 ## <param name="prefix">
 836 ##      <summary>
 837 ##      Prefix for the domain.
 838 ##      </summary>
 839 ## </param>
 840 #
 841 template(`virt_lxc_domain_template',`
 842         gen_require(`
 843                 attribute svirt_lxc_domain;
 844         ')
 845
 846         type $1_t, svirt_lxc_domain;
 847         domain_type($1_t)
 848         domain_user_exemption_target($1_t)
 849         mls_rangetrans_target($1_t)
 850         mcs_untrusted_proc($1_t)
 851         role system_r types $1_t;
 852 ')
 853
 854 ########################################
 855 ## <summary>
 856 ##      Execute a qemu_exec_t in the callers domain
 857 ## </summary>
 858 ## <param name="domain">
 859 ## <summary>
 860 ##      Domain allowed access.
 861 ## </summary>
 862 ## </param>
 863 #
 864 interface(`virt_exec_qemu',`
 865         gen_require(`
 866                 type qemu_exec_t;
 867         ')
 868
 869         can_exec($1, qemu_exec_t)
 870 ')
 871