policy/support/misc_patterns.spt

   1 #
   2 # Specified domain transition patterns
   3 #
   4 define(`domain_transition_pattern',`
   5         allow $1 $2:file { getattr open read execute };
   6         allow $1 $3:process transition;
   7         dontaudit $1 $3:process { noatsecure siginh rlimitinh };
   8 ')
   9
  10 # compatibility:
  11 define(`domain_trans',`domain_transition_pattern($*)')
  12
  13 define(`spec_domtrans_pattern',`
  14         allow $1 self:process setexec;
  15         domain_transition_pattern($1,$2,$3)
  16
  17         allow $3 $1:fd use;
  18         allow $3 $1:fifo_file rw_inherited_fifo_file_perms;
  19         allow $3 $1:process sigchld;
  20 ')
  21
  22 #
  23 # Automatic domain transition patterns
  24 #
  25 define(`domain_auto_transition_pattern',`
  26         domain_transition_pattern($1,$2,$3)
  27         type_transition $1 $2:process $3;
  28 ')
  29
  30 # compatibility:
  31 define(`domain_auto_trans',`domain_auto_transition_pattern($*)')
  32
  33 define(`domtrans_pattern',`
  34         domain_auto_transition_pattern($1,$2,$3)
  35
  36         allow $3 $1:fd use;
  37         allow $3 $1:fifo_file rw_inherited_fifo_file_perms;
  38         allow $3 $1:process sigchld;
  39
  40         ifdef(`hide_broken_symptoms', `
  41                 dontaudit $3 $1:socket_class_set { read write };
  42         ')
  43 ')
  44
  45 #
  46 # Dynamic transition pattern
  47 #
  48 define(`dyntrans_pattern',`
  49         allow $1 self:process setcurrent;
  50         allow $1 $2:process dyntransition;
  51         allow $2 $1:process sigchld;
  52 ')
  53
  54 #
  55 # Other process permissions
  56 #
  57 define(`send_audit_msgs_pattern',`
  58         refpolicywarn(`$0($*) has been deprecated, please use logging_send_audit_msgs($1) instead.')
  59         allow $1 self:capability audit_write;
  60         allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
  61 ')
  62
  63 define(`ps_process_pattern',`
  64         allow $1 $2:dir list_dir_perms;
  65         allow $1 $2:file read_file_perms;
  66         allow $1 $2:lnk_file read_lnk_file_perms;
  67         allow $1 $2:process getattr;
  68 ')