policy/modules/kernel/files.if

   1 ## <summary>
   2 ## Basic filesystem types and interfaces.
   3 ## </summary>
   4 ## <desc>
   5 ## <p>
   6 ## This module contains basic filesystem types and interfaces. This
   7 ## includes:
   8 ## <ul>
   9 ##      <li>The concept of different file types including basic
  10 ##      files, mount points, tmp files, etc.</li>
  11 ##      <li>Access to groups of files and all files.</li>
  12 ##      <li>Types and interfaces for the basic filesystem layout
  13 ##      (/, /etc, /tmp, /usr, etc.).</li>
  14 ## </ul>
  15 ## </p>
  16 ## </desc>
  17 ## <required val="true">
  18 ##      Contains the concept of a file.
  19 ##      Comains the file initial SID.
  20 ## </required>
  21
  22 ########################################
  23 ## <summary>
  24 ##      Make the specified type usable for files
  25 ##      in a filesystem.
  26 ## </summary>
  27 ## <desc>
  28 ##      <p>
  29 ##      Make the specified type usable for files
  30 ##      in a filesystem.  Types used for files that
  31 ##      do not use this interface, or an interface that
  32 ##      calls this one, will have unexpected behaviors
  33 ##      while the system is running. If the type is used
  34 ##      for device nodes (character or block files), then
  35 ##      the dev_node() interface is more appropriate.
  36 ##      </p>
  37 ##      <p>
  38 ##      Related interfaces:
  39 ##      </p>
  40 ##      <ul>
  41 ##              <li>application_domain()</li>
  42 ##              <li>application_executable_file()</li>
  43 ##              <li>corecmd_executable_file()</li>
  44 ##              <li>init_daemon_domain()</li>
  45 ##              <li>init_domaion()</li>
  46 ##              <li>init_ranged_daemon_domain()</li>
  47 ##              <li>init_ranged_domain()</li>
  48 ##              <li>init_ranged_system_domain()</li>
  49 ##              <li>init_script_file()</li>
  50 ##              <li>init_script_domain()</li>
  51 ##              <li>init_system_domain()</li>
  52 ##              <li>files_config_files()</li>
  53 ##              <li>files_lock_file()</li>
  54 ##              <li>files_mountpoint()</li>
  55 ##              <li>files_pid_file()</li>
  56 ##              <li>files_security_file()</li>
  57 ##              <li>files_security_mountpoint()</li>
  58 ##              <li>files_spool_file()</li>
  59 ##              <li>files_tmp_file()</li>
  60 ##              <li>files_tmpfs_file()</li>
  61 ##              <li>logging_log_file()</li>
  62 ##              <li>userdom_user_home_content()</li>
  63 ##      </ul>
  64 ##      <p>
  65 ##      Example:
  66 ##      </p>
  67 ##      <p>
  68 ##      type myfile_t;
  69 ##      files_type(myfile_t)
  70 ##      allow mydomain_t myfile_t:file read_file_perms;
  71 ##      </p>
  72 ## </desc>
  73 ## <param name="type">
  74 ##      <summary>
  75 ##      Type to be used for files.
  76 ##      </summary>
  77 ## </param>
  78 ## <infoflow type="none"/>
  79 #
  80 interface(`files_type',`
  81         gen_require(`
  82                 attribute file_type, non_security_file_type;
  83         ')
  84
  85         typeattribute $1 file_type, non_security_file_type;
  86 ')
  87
  88 ########################################
  89 ## <summary>
  90 ##      Make the specified type a file that
  91 ##      should not be dontaudited from
  92 ##      browsing from user domains.
  93 ## </summary>
  94 ## <param name="file_type">
  95 ##      <summary>
  96 ##      Type of the file to be used as a
  97 ##      member directory.
  98 ##      </summary>
  99 ## </param>
 100 #
 101 interface(`files_security_file',`
 102         gen_require(`
 103                 attribute file_type, security_file_type;
 104         ')
 105
 106         typeattribute $1 file_type, security_file_type;
 107 ')
 108
 109 ########################################
 110 ## <summary>
 111 ##      Make the specified type usable for
 112 ##      lock files.
 113 ## </summary>
 114 ## <param name="type">
 115 ##      <summary>
 116 ##      Type to be used for lock files.
 117 ##      </summary>
 118 ## </param>
 119 #
 120 interface(`files_lock_file',`
 121         gen_require(`
 122                 attribute lockfile;
 123         ')
 124
 125         files_type($1)
 126         typeattribute $1 lockfile;
 127 ')
 128
 129 ########################################
 130 ## <summary>
 131 ##      Make the specified type usable for
 132 ##      filesystem mount points.
 133 ## </summary>
 134 ## <param name="type">
 135 ##      <summary>
 136 ##      Type to be used for mount points.
 137 ##      </summary>
 138 ## </param>
 139 #
 140 interface(`files_mountpoint',`
 141         gen_require(`
 142                 attribute mountpoint;
 143         ')
 144
 145         files_type($1)
 146         typeattribute $1 mountpoint;
 147 ')
 148
 149 ########################################
 150 ## <summary>
 151 ##      Make the specified type usable for
 152 ##      security file filesystem mount points.
 153 ## </summary>
 154 ## <param name="type">
 155 ##      <summary>
 156 ##      Type to be used for mount points.
 157 ##      </summary>
 158 ## </param>
 159 #
 160 interface(`files_security_mountpoint',`
 161         gen_require(`
 162                 attribute mountpoint;
 163         ')
 164
 165         files_security_file($1)
 166         typeattribute $1 mountpoint;
 167 ')
 168
 169 ########################################
 170 ## <summary>
 171 ##      Make the specified type usable for
 172 ##      runtime process ID files.
 173 ## </summary>
 174 ## <desc>
 175 ##      <p>
 176 ##      Make the specified type usable for runtime process ID files,
 177 ##      typically found in /var/run.
 178 ##      This will also make the type usable for files, making
 179 ##      calls to files_type() redundant.  Failure to use this interface
 180 ##      for a PID file type may result in problems with starting
 181 ##      or stopping services.
 182 ##      </p>
 183 ##      <p>
 184 ##      Related interfaces:
 185 ##      </p>
 186 ##      <ul>
 187 ##              <li>files_pid_filetrans()</li>
 188 ##      </ul>
 189 ##      <p>
 190 ##      Example usage with a domain that can create and
 191 ##      write its PID file with a private PID file type in the
 192 ##      /var/run directory:
 193 ##      </p>
 194 ##      <p>
 195 ##      type mypidfile_t;
 196 ##      files_pid_file(mypidfile_t)
 197 ##      allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms };
 198 ##      files_pid_filetrans(mydomain_t, mypidfile_t, file)
 199 ##      </p>
 200 ## </desc>
 201 ## <param name="type">
 202 ##      <summary>
 203 ##      Type to be used for PID files.
 204 ##      </summary>
 205 ## </param>
 206 ## <infoflow type="none"/>
 207 #
 208 interface(`files_pid_file',`
 209         gen_require(`
 210                 attribute pidfile;
 211         ')
 212
 213         files_type($1)
 214         typeattribute $1 pidfile;
 215 ')
 216
 217 ########################################
 218 ## <summary>
 219 ##      Make the specified type a
 220 ##      configuration file.
 221 ## </summary>
 222 ## <desc>
 223 ##      <p>
 224 ##      Make the specified type usable for configuration files.
 225 ##      This will also make the type usable for files, making
 226 ##      calls to files_type() redundant.  Failure to use this interface
 227 ##      for a temporary file may result in problems with
 228 ##      configuration management tools.
 229 ##      </p>
 230 ##      <p>
 231 ##      Example usage with a domain that can read
 232 ##      its configuration file /etc:
 233 ##      </p>
 234 ##      <p>
 235 ##      type myconffile_t;
 236 ##      files_config_file(myconffile_t)
 237 ##      allow mydomain_t myconffile_t:file read_file_perms;
 238 ##      files_search_etc(mydomain_t)
 239 ##      </p>
 240 ## </desc>
 241 ## <param name="file_type">
 242 ##      <summary>
 243 ##      Type to be used as a configuration file.
 244 ##      </summary>
 245 ## </param>
 246 ## <infoflow type="none"/>
 247 #
 248 interface(`files_config_file',`
 249         gen_require(`
 250                 attribute configfile;
 251         ')
 252         files_type($1)
 253         typeattribute $1 configfile;
 254 ')
 255
 256 ########################################
 257 ## <summary>
 258 ##      Make the specified type a
 259 ##      polyinstantiated directory.
 260 ## </summary>
 261 ## <param name="file_type">
 262 ##      <summary>
 263 ##      Type of the file to be used as a
 264 ##      polyinstantiated directory.
 265 ##      </summary>
 266 ## </param>
 267 #
 268 interface(`files_poly',`
 269         gen_require(`
 270                 attribute polydir;
 271         ')
 272
 273         files_type($1)
 274         typeattribute $1 polydir;
 275 ')
 276
 277 ########################################
 278 ## <summary>
 279 ##      Make the specified type a parent
 280 ##      of a polyinstantiated directory.
 281 ## </summary>
 282 ## <param name="file_type">
 283 ##      <summary>
 284 ##      Type of the file to be used as a
 285 ##      parent directory.
 286 ##      </summary>
 287 ## </param>
 288 #
 289 interface(`files_poly_parent',`
 290         gen_require(`
 291                 attribute polyparent;
 292         ')
 293
 294         files_type($1)
 295         typeattribute $1 polyparent;
 296 ')
 297
 298 ########################################
 299 ## <summary>
 300 ##      Make the specified type a
 301 ##      polyinstantiation member directory.
 302 ## </summary>
 303 ## <param name="file_type">
 304 ##      <summary>
 305 ##      Type of the file to be used as a
 306 ##      member directory.
 307 ##      </summary>
 308 ## </param>
 309 #
 310 interface(`files_poly_member',`
 311         gen_require(`
 312                 attribute polymember;
 313         ')
 314
 315         files_type($1)
 316         typeattribute $1 polymember;
 317 ')
 318
 319 ########################################
 320 ## <summary>
 321 ##      Make the domain use the specified
 322 ##      type of polyinstantiated directory.
 323 ## </summary>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain using the polyinstantiated
 327 ##      directory.
 328 ##      </summary>
 329 ## </param>
 330 ## <param name="file_type">
 331 ##      <summary>
 332 ##      Type of the file to be used as a
 333 ##      member directory.
 334 ##      </summary>
 335 ## </param>
 336 #
 337 interface(`files_poly_member_tmp',`
 338         gen_require(`
 339                 type tmp_t;
 340         ')
 341
 342         type_member $1 tmp_t:dir $2;
 343 ')
 344
 345 ########################################
 346 ## <summary>
 347 ##      Make the specified type a file
 348 ##      used for temporary files.
 349 ## </summary>
 350 ## <desc>
 351 ##      <p>
 352 ##      Make the specified type usable for temporary files.
 353 ##      This will also make the type usable for files, making
 354 ##      calls to files_type() redundant.  Failure to use this interface
 355 ##      for a temporary file may result in problems with
 356 ##      purging temporary files.
 357 ##      </p>
 358 ##      <p>
 359 ##      Related interfaces:
 360 ##      </p>
 361 ##      <ul>
 362 ##              <li>files_tmp_filetrans()</li>
 363 ##      </ul>
 364 ##      <p>
 365 ##      Example usage with a domain that can create and
 366 ##      write its temporary file in the system temporary file
 367 ##      directories (/tmp or /var/tmp):
 368 ##      </p>
 369 ##      <p>
 370 ##      type mytmpfile_t;
 371 ##      files_tmp_file(mytmpfile_t)
 372 ##      allow mydomain_t mytmpfile_t:file { create_file_perms write_file_perms };
 373 ##      files_tmp_filetrans(mydomain_t, mytmpfile_t, file)
 374 ##      </p>
 375 ## </desc>
 376 ## <param name="file_type">
 377 ##      <summary>
 378 ##      Type of the file to be used as a
 379 ##      temporary file.
 380 ##      </summary>
 381 ## </param>
 382 ## <infoflow type="none"/>
 383 #
 384 interface(`files_tmp_file',`
 385         gen_require(`
 386                 attribute tmpfile;
 387                 type tmp_t;
 388         ')
 389
 390         files_type($1)
 391         files_poly_member($1)
 392         typeattribute $1 tmpfile;
 393 ')
 394
 395 ########################################
 396 ## <summary>
 397 ##      Transform the type into a file, for use on a
 398 ##      virtual memory filesystem (tmpfs).
 399 ## </summary>
 400 ## <param name="type">
 401 ##      <summary>
 402 ##      The type to be transformed.
 403 ##      </summary>
 404 ## </param>
 405 #
 406 interface(`files_tmpfs_file',`
 407         gen_require(`
 408                 attribute tmpfsfile;
 409         ')
 410
 411         files_type($1)
 412         typeattribute $1 tmpfsfile;
 413 ')
 414
 415 ########################################
 416 ## <summary>
 417 ##      Get the attributes of all directories.
 418 ## </summary>
 419 ## <param name="domain">
 420 ##      <summary>
 421 ##      Domain allowed access.
 422 ##      </summary>
 423 ## </param>
 424 #
 425 interface(`files_getattr_all_dirs',`
 426         gen_require(`
 427                 attribute file_type;
 428         ')
 429
 430         getattr_dirs_pattern($1, file_type, file_type)
 431 ')
 432
 433 ########################################
 434 ## <summary>
 435 ##      Do not audit attempts to get the attributes
 436 ##      of all directories.
 437 ## </summary>
 438 ## <param name="domain">
 439 ##      <summary>
 440 ##      Domain to not audit.
 441 ##      </summary>
 442 ## </param>
 443 #
 444 interface(`files_dontaudit_getattr_all_dirs',`
 445         gen_require(`
 446                 attribute file_type;
 447         ')
 448
 449         dontaudit $1 file_type:dir getattr;
 450 ')
 451
 452 ########################################
 453 ## <summary>
 454 ##      List all non-security directories.
 455 ## </summary>
 456 ## <param name="domain">
 457 ##      <summary>
 458 ##      Domain allowed access.
 459 ##      </summary>
 460 ## </param>
 461 #
 462 interface(`files_list_non_security',`
 463         gen_require(`
 464                 attribute non_security_file_type;
 465         ')
 466
 467         list_dirs_pattern($1, non_security_file_type, non_security_file_type)
 468 ')
 469
 470 ########################################
 471 ## <summary>
 472 ##      Do not audit attempts to list all
 473 ##      non-security directories.
 474 ## </summary>
 475 ## <param name="domain">
 476 ##      <summary>
 477 ##      Domain to not audit.
 478 ##      </summary>
 479 ## </param>
 480 #
 481 interface(`files_dontaudit_list_non_security',`
 482         gen_require(`
 483                 attribute non_security_file_type;
 484         ')
 485
 486         dontaudit $1 non_security_file_type:dir list_dir_perms;
 487 ')
 488
 489 ########################################
 490 ## <summary>
 491 ##      Mount a filesystem on all non-security
 492 ##      directories and files.
 493 ## </summary>
 494 ## <param name="domain">
 495 ##      <summary>
 496 ##      Domain allowed access.
 497 ##      </summary>
 498 ## </param>
 499 #
 500 interface(`files_mounton_non_security',`
 501         gen_require(`
 502                 attribute non_security_file_type;
 503         ')
 504
 505         allow $1 non_security_file_type:dir mounton;
 506         allow $1 non_security_file_type:file mounton;
 507 ')
 508
 509 ########################################
 510 ## <summary>
 511 ##      Allow attempts to modify any directory
 512 ## </summary>
 513 ## <param name="domain">
 514 ##      <summary>
 515 ##      Domain allowed access.
 516 ##      </summary>
 517 ## </param>
 518 #
 519 interface(`files_write_non_security_dirs',`
 520         gen_require(`
 521                 attribute non_security_file_type;
 522         ')
 523
 524         allow $1 non_security_file_type:dir write;
 525 ')
 526
 527 ########################################
 528 ## <summary>
 529 ##      Allow attempts to manage non-security directories
 530 ## </summary>
 531 ## <param name="domain">
 532 ##      <summary>
 533 ##      Domain allowed access.
 534 ##      </summary>
 535 ## </param>
 536 #
 537 interface(`files_manage_non_security_dirs',`
 538         gen_require(`
 539                 attribute non_security_file_type;
 540         ')
 541
 542         allow $1 non_security_file_type:dir manage_dir_perms;
 543 ')
 544
 545 ########################################
 546 ## <summary>
 547 ##      Get the attributes of all files.
 548 ## </summary>
 549 ## <param name="domain">
 550 ##      <summary>
 551 ##      Domain allowed access.
 552 ##      </summary>
 553 ## </param>
 554 #
 555 interface(`files_getattr_all_files',`
 556         gen_require(`
 557                 attribute file_type;
 558         ')
 559
 560         getattr_files_pattern($1, file_type, file_type)
 561         getattr_lnk_files_pattern($1, file_type, file_type)
 562 ')
 563
 564 ########################################
 565 ## <summary>
 566 ##      Do not audit attempts to get the attributes
 567 ##      of all files.
 568 ## </summary>
 569 ## <param name="domain">
 570 ##      <summary>
 571 ##      Domain to not audit.
 572 ##      </summary>
 573 ## </param>
 574 #
 575 interface(`files_dontaudit_getattr_all_files',`
 576         gen_require(`
 577                 attribute file_type;
 578         ')
 579
 580         dontaudit $1 file_type:file getattr;
 581 ')
 582
 583 ########################################
 584 ## <summary>
 585 ##      Do not audit attempts to get the attributes
 586 ##      of non security files.
 587 ## </summary>
 588 ## <param name="domain">
 589 ##      <summary>
 590 ##      Domain to not audit.
 591 ##      </summary>
 592 ## </param>
 593 #
 594 interface(`files_dontaudit_getattr_non_security_files',`
 595         gen_require(`
 596                 attribute non_security_file_type;
 597         ')
 598
 599         dontaudit $1 non_security_file_type:file getattr;
 600 ')
 601
 602 ########################################
 603 ## <summary>
 604 ##      Read all files.
 605 ## </summary>
 606 ## <param name="domain">
 607 ##      <summary>
 608 ##      Domain allowed access.
 609 ##      </summary>
 610 ## </param>
 611 #
 612 interface(`files_read_all_files',`
 613         gen_require(`
 614                 attribute file_type;
 615         ')
 616
 617         allow $1 file_type:dir list_dir_perms;
 618         read_files_pattern($1, file_type, file_type)
 619
 620         optional_policy(`
 621                 auth_read_shadow($1)
 622         ')
 623 ')
 624
 625 ########################################
 626 ## <summary>
 627 ##      Allow shared library text relocations in all files.
 628 ## </summary>
 629 ## <desc>
 630 ##      <p>
 631 ##      Allow shared library text relocations in all files.
 632 ##      </p>
 633 ##      <p>
 634 ##      This is added to support WINE policy.
 635 ##      </p>
 636 ## </desc>
 637 ## <param name="domain">
 638 ##      <summary>
 639 ##      Domain allowed access.
 640 ##      </summary>
 641 ## </param>
 642 #
 643 interface(`files_execmod_all_files',`
 644         gen_require(`
 645                 attribute file_type;
 646         ')
 647
 648         allow $1 file_type:file execmod;
 649 ')
 650
 651 ########################################
 652 ## <summary>
 653 ##      Read all non-security files.
 654 ## </summary>
 655 ## <param name="domain">
 656 ##      <summary>
 657 ##      Domain allowed access.
 658 ##      </summary>
 659 ## </param>
 660 ## <rolecap/>
 661 #
 662 interface(`files_read_non_security_files',`
 663         gen_require(`
 664                 attribute non_security_file_type;
 665         ')
 666
 667         list_dirs_pattern($1, non_security_file_type, non_security_file_type)
 668         read_files_pattern($1, non_security_file_type, non_security_file_type)
 669         read_lnk_files_pattern($1, non_security_file_type, non_security_file_type)
 670 ')
 671
 672 ########################################
 673 ## <summary>
 674 ##      Manage all non-security files.
 675 ## </summary>
 676 ## <param name="domain">
 677 ##      <summary>
 678 ##      Domain allowed access.
 679 ##      </summary>
 680 ## </param>
 681 ## <rolecap/>
 682 #
 683 interface(`files_manage_non_security_files',`
 684         gen_require(`
 685                 attribute non_security_file_type;
 686         ')
 687
 688         manage_files_pattern($1, non_security_file_type, non_security_file_type)
 689         manage_lnk_files_pattern($1, non_security_file_type, non_security_file_type)
 690 ')
 691
 692 ########################################
 693 ## <summary>
 694 ##      Relabel all non-security files.
 695 ## </summary>
 696 ## <param name="domain">
 697 ##      <summary>
 698 ##      Domain allowed access.
 699 ##      </summary>
 700 ## </param>
 701 ## <rolecap/>
 702 #
 703 interface(`files_relabel_non_security_files',`
 704         gen_require(`
 705                 attribute non_security_file_type;
 706         ')
 707
 708         relabel_files_pattern($1, non_security_file_type, non_security_file_type)
 709         allow $1 { non_security_file_type }:dir list_dir_perms;
 710         relabel_dirs_pattern($1, { non_security_file_type }, { non_security_file_type })
 711         relabel_files_pattern($1, { non_security_file_type }, { non_security_file_type })
 712         relabel_lnk_files_pattern($1, { non_security_file_type }, { non_security_file_type })
 713         relabel_fifo_files_pattern($1, { non_security_file_type }, { non_security_file_type })
 714         relabel_sock_files_pattern($1, { non_security_file_type }, { non_security_file_type })
 715         relabel_blk_files_pattern($1, { non_security_file_type }, { non_security_file_type })
 716         relabel_chr_files_pattern($1, { non_security_file_type }, { non_security_file_type })
 717
 718         # satisfy the assertions:
 719         seutil_relabelto_bin_policy($1)
 720 ')
 721
 722 ########################################
 723 ## <summary>
 724 ##      Read all directories on the filesystem, except
 725 ##      the listed exceptions.
 726 ## </summary>
 727 ## <param name="domain">
 728 ##      <summary>
 729 ##      Domain allowed access.
 730 ##      </summary>
 731 ## </param>
 732 ## <param name="exception_types" optional="true">
 733 ##      <summary>
 734 ##      The types to be excluded.  Each type or attribute
 735 ##      must be negated by the caller.
 736 ##      </summary>
 737 ## </param>
 738 #
 739 interface(`files_read_all_dirs_except',`
 740         gen_require(`
 741                 attribute file_type;
 742         ')
 743
 744         allow $1 { file_type $2 }:dir list_dir_perms;
 745 ')
 746
 747 ########################################
 748 ## <summary>
 749 ##      Read all files on the filesystem, except
 750 ##      the listed exceptions.
 751 ## </summary>
 752 ## <param name="domain">
 753 ##      <summary>
 754 ##      Domain allowed access.
 755 ##      </summary>
 756 ## </param>
 757 ## <param name="exception_types" optional="true">
 758 ##      <summary>
 759 ##      The types to be excluded.  Each type or attribute
 760 ##      must be negated by the caller.
 761 ##      </summary>
 762 ## </param>
 763 #
 764 interface(`files_read_all_files_except',`
 765         gen_require(`
 766                 attribute file_type;
 767         ')
 768
 769         read_files_pattern($1, { file_type $2 }, { file_type $2 })
 770 ')
 771
 772 ########################################
 773 ## <summary>
 774 ##      Read all symbolic links on the filesystem, except
 775 ##      the listed exceptions.
 776 ## </summary>
 777 ## <param name="domain">
 778 ##      <summary>
 779 ##      Domain allowed access.
 780 ##      </summary>
 781 ## </param>
 782 ## <param name="exception_types" optional="true">
 783 ##      <summary>
 784 ##      The types to be excluded.  Each type or attribute
 785 ##      must be negated by the caller.
 786 ##      </summary>
 787 ## </param>
 788 #
 789 interface(`files_read_all_symlinks_except',`
 790         gen_require(`
 791                 attribute file_type;
 792         ')
 793
 794         read_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
 795 ')
 796
 797 ########################################
 798 ## <summary>
 799 ##      Get the attributes of all symbolic links.
 800 ## </summary>
 801 ## <param name="domain">
 802 ##      <summary>
 803 ##      Domain allowed access.
 804 ##      </summary>
 805 ## </param>
 806 #
 807 interface(`files_getattr_all_symlinks',`
 808         gen_require(`
 809                 attribute file_type;
 810         ')
 811
 812         getattr_lnk_files_pattern($1, file_type, file_type)
 813 ')
 814
 815 ########################################
 816 ## <summary>
 817 ##      Do not audit attempts to get the attributes
 818 ##      of all symbolic links.
 819 ## </summary>
 820 ## <param name="domain">
 821 ##      <summary>
 822 ##      Domain to not audit.
 823 ##      </summary>
 824 ## </param>
 825 #
 826 interface(`files_dontaudit_getattr_all_symlinks',`
 827         gen_require(`
 828                 attribute file_type;
 829         ')
 830
 831         dontaudit $1 file_type:lnk_file getattr;
 832 ')
 833
 834 ########################################
 835 ## <summary>
 836 ##      Do not audit attempts to read all symbolic links.
 837 ## </summary>
 838 ## <param name="domain">
 839 ##      <summary>
 840 ##      Domain to not audit.
 841 ##      </summary>
 842 ## </param>
 843 #
 844 interface(`files_dontaudit_read_all_symlinks',`
 845         gen_require(`
 846                 attribute file_type;
 847         ')
 848
 849         dontaudit $1 file_type:lnk_file read;
 850 ')
 851
 852 ########################################
 853 ## <summary>
 854 ##      Do not audit attempts to get the attributes
 855 ##      of non security symbolic links.
 856 ## </summary>
 857 ## <param name="domain">
 858 ##      <summary>
 859 ##      Domain to not audit.
 860 ##      </summary>
 861 ## </param>
 862 #
 863 interface(`files_dontaudit_getattr_non_security_symlinks',`
 864         gen_require(`
 865                 attribute non_security_file_type;
 866         ')
 867
 868         dontaudit $1 non_security_file_type:lnk_file getattr;
 869 ')
 870
 871 ########################################
 872 ## <summary>
 873 ##      Do not audit attempts to get the attributes
 874 ##      of non security block devices.
 875 ## </summary>
 876 ## <param name="domain">
 877 ##      <summary>
 878 ##      Domain to not audit.
 879 ##      </summary>
 880 ## </param>
 881 #
 882 interface(`files_dontaudit_getattr_non_security_blk_files',`
 883         gen_require(`
 884                 attribute non_security_file_type;
 885         ')
 886
 887         dontaudit $1 non_security_file_type:blk_file getattr;
 888 ')
 889
 890 ########################################
 891 ## <summary>
 892 ##      Do not audit attempts to get the attributes
 893 ##      of non security character devices.
 894 ## </summary>
 895 ## <param name="domain">
 896 ##      <summary>
 897 ##      Domain to not audit.
 898 ##      </summary>
 899 ## </param>
 900 #
 901 interface(`files_dontaudit_getattr_non_security_chr_files',`
 902         gen_require(`
 903                 attribute non_security_file_type;
 904         ')
 905
 906         dontaudit $1 non_security_file_type:chr_file getattr;
 907 ')
 908
 909 ########################################
 910 ## <summary>
 911 ##      Read all symbolic links.
 912 ## </summary>
 913 ## <param name="domain">
 914 ##      <summary>
 915 ##      Domain allowed access.
 916 ##      </summary>
 917 ## </param>
 918 ## <rolecap/>
 919 #
 920 interface(`files_read_all_symlinks',`
 921         gen_require(`
 922                 attribute file_type;
 923         ')
 924
 925         allow $1 file_type:dir list_dir_perms;
 926         read_lnk_files_pattern($1, file_type, file_type)
 927 ')
 928
 929 ########################################
 930 ## <summary>
 931 ##      Get the attributes of all named pipes.
 932 ## </summary>
 933 ## <param name="domain">
 934 ##      <summary>
 935 ##      Domain allowed access.
 936 ##      </summary>
 937 ## </param>
 938 #
 939 interface(`files_getattr_all_pipes',`
 940         gen_require(`
 941                 attribute file_type;
 942         ')
 943
 944         allow $1 file_type:dir list_dir_perms;
 945         getattr_fifo_files_pattern($1, file_type, file_type)
 946 ')
 947
 948 ########################################
 949 ## <summary>
 950 ##      Do not audit attempts to get the attributes
 951 ##      of all named pipes.
 952 ## </summary>
 953 ## <param name="domain">
 954 ##      <summary>
 955 ##      Domain to not audit.
 956 ##      </summary>
 957 ## </param>
 958 #
 959 interface(`files_dontaudit_getattr_all_pipes',`
 960         gen_require(`
 961                 attribute file_type;
 962         ')
 963
 964         dontaudit $1 file_type:fifo_file getattr;
 965 ')
 966
 967 ########################################
 968 ## <summary>
 969 ##      Do not audit attempts to get the attributes
 970 ##      of non security named pipes.
 971 ## </summary>
 972 ## <param name="domain">
 973 ##      <summary>
 974 ##      Domain to not audit.
 975 ##      </summary>
 976 ## </param>
 977 #
 978 interface(`files_dontaudit_getattr_non_security_pipes',`
 979         gen_require(`
 980                 attribute non_security_file_type;
 981         ')
 982
 983         dontaudit $1 non_security_file_type:fifo_file getattr;
 984 ')
 985
 986 ########################################
 987 ## <summary>
 988 ##      Get the attributes of all named sockets.
 989 ## </summary>
 990 ## <param name="domain">
 991 ##      <summary>
 992 ##      Domain allowed access.
 993 ##      </summary>
 994 ## </param>
 995 #
 996 interface(`files_getattr_all_sockets',`
 997         gen_require(`
 998                 attribute file_type;
 999         ')
1000
1001         allow $1 file_type:dir list_dir_perms;
1002         getattr_sock_files_pattern($1, file_type, file_type)
1003 ')
1004
1005 ########################################
1006 ## <summary>
1007 ##      Do not audit attempts to get the attributes
1008 ##      of all named sockets.
1009 ## </summary>
1010 ## <param name="domain">
1011 ##      <summary>
1012 ##      Domain to not audit.
1013 ##      </summary>
1014 ## </param>
1015 #
1016 interface(`files_dontaudit_getattr_all_sockets',`
1017         gen_require(`
1018                 attribute file_type;
1019         ')
1020
1021         dontaudit $1 file_type:sock_file getattr;
1022 ')
1023
1024 ########################################
1025 ## <summary>
1026 ##      Do not audit attempts to get the attributes
1027 ##      of non security named sockets.
1028 ## </summary>
1029 ## <param name="domain">
1030 ##      <summary>
1031 ##      Domain to not audit.
1032 ##      </summary>
1033 ## </param>
1034 #
1035 interface(`files_dontaudit_getattr_non_security_sockets',`
1036         gen_require(`
1037                 attribute non_security_file_type;
1038         ')
1039
1040         dontaudit $1 non_security_file_type:sock_file getattr;
1041 ')
1042
1043 ########################################
1044 ## <summary>
1045 ##      Read all block nodes with file types.
1046 ## </summary>
1047 ## <param name="domain">
1048 ##      <summary>
1049 ##      Domain allowed access.
1050 ##      </summary>
1051 ## </param>
1052 #
1053 interface(`files_read_all_blk_files',`
1054         gen_require(`
1055                 attribute file_type;
1056         ')
1057
1058         read_blk_files_pattern($1, file_type, file_type)
1059 ')
1060
1061 ########################################
1062 ## <summary>
1063 ##      Read all character nodes with file types.
1064 ## </summary>
1065 ## <param name="domain">
1066 ##      <summary>
1067 ##      Domain allowed access.
1068 ##      </summary>
1069 ## </param>
1070 #
1071 interface(`files_read_all_chr_files',`
1072         gen_require(`
1073                 attribute file_type;
1074         ')
1075
1076         read_chr_files_pattern($1, file_type, file_type)
1077 ')
1078
1079 ########################################
1080 ## <summary>
1081 ##      Relabel all files on the filesystem, except
1082 ##      the listed exceptions.
1083 ## </summary>
1084 ## <param name="domain">
1085 ##      <summary>
1086 ##      Domain allowed access.
1087 ##      </summary>
1088 ## </param>
1089 ## <param name="exception_types" optional="true">
1090 ##      <summary>
1091 ##      The types to be excluded.  Each type or attribute
1092 ##      must be negated by the caller.
1093 ##      </summary>
1094 ## </param>
1095 ## <rolecap/>
1096 #
1097 interface(`files_relabel_all_files',`
1098         gen_require(`
1099                 attribute file_type;
1100         ')
1101
1102         allow $1 { file_type $2 }:dir list_dir_perms;
1103         relabel_dirs_pattern($1, { file_type $2 }, { file_type $2 })
1104         relabel_files_pattern($1, { file_type $2 }, { file_type $2 })
1105         relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
1106         relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
1107         relabel_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
1108         relabel_blk_files_pattern($1, { file_type $2 }, { file_type $2 })
1109         relabel_chr_files_pattern($1, { file_type $2 }, { file_type $2 })
1110
1111         # satisfy the assertions:
1112         seutil_relabelto_bin_policy($1)
1113 ')
1114
1115 ########################################
1116 ## <summary>
1117 ##      rw all files on the filesystem, except
1118 ##      the listed exceptions.
1119 ## </summary>
1120 ## <param name="domain">
1121 ##      <summary>
1122 ##      Domain allowed access.
1123 ##      </summary>
1124 ## </param>
1125 ## <param name="exception_types" optional="true">
1126 ##      <summary>
1127 ##      The types to be excluded.  Each type or attribute
1128 ##      must be negated by the caller.
1129 ##      </summary>
1130 ## </param>
1131 ## <rolecap/>
1132 #
1133 interface(`files_rw_all_files',`
1134         gen_require(`
1135                 attribute file_type;
1136         ')
1137
1138         rw_files_pattern($1, { file_type $2 }, { file_type $2 })
1139 ')
1140
1141 ########################################
1142 ## <summary>
1143 ##      Manage all files on the filesystem, except
1144 ##      the listed exceptions.
1145 ## </summary>
1146 ## <param name="domain">
1147 ##      <summary>
1148 ##      Domain allowed access.
1149 ##      </summary>
1150 ## </param>
1151 ## <param name="exception_types" optional="true">
1152 ##      <summary>
1153 ##      The types to be excluded.  Each type or attribute
1154 ##      must be negated by the caller.
1155 ##      </summary>
1156 ## </param>
1157 ## <rolecap/>
1158 #
1159 interface(`files_manage_all_files',`
1160         gen_require(`
1161                 attribute file_type;
1162         ')
1163
1164         manage_dirs_pattern($1, { file_type $2 }, { file_type $2 })
1165         manage_files_pattern($1, { file_type $2 }, { file_type $2 })
1166         manage_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
1167         manage_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
1168         manage_sock_files_pattern($1, { file_type $2 }, { file_type $2 })
1169
1170         # satisfy the assertions:
1171         seutil_create_bin_policy($1)
1172         files_manage_kernel_modules($1)
1173 ')
1174
1175 ########################################
1176 ## <summary>
1177 ##      Search the contents of all directories on
1178 ##      extended attribute filesystems.
1179 ## </summary>
1180 ## <param name="domain">
1181 ##      <summary>
1182 ##      Domain allowed access.
1183 ##      </summary>
1184 ## </param>
1185 #
1186 interface(`files_search_all',`
1187         gen_require(`
1188                 attribute file_type;
1189         ')
1190
1191         allow $1 file_type:dir search_dir_perms;
1192 ')
1193
1194 ########################################
1195 ## <summary>
1196 ##      List the contents of all directories on
1197 ##      extended attribute filesystems.
1198 ## </summary>
1199 ## <param name="domain">
1200 ##      <summary>
1201 ##      Domain allowed access.
1202 ##      </summary>
1203 ## </param>
1204 #
1205 interface(`files_list_all',`
1206         gen_require(`
1207                 attribute file_type;
1208         ')
1209
1210         allow $1 file_type:dir list_dir_perms;
1211 ')
1212
1213 ########################################
1214 ## <summary>
1215 ##      Do not audit attempts to search the
1216 ##      contents of any directories on extended
1217 ##      attribute filesystems.
1218 ## </summary>
1219 ## <param name="domain">
1220 ##      <summary>
1221 ##      Domain to not audit.
1222 ##      </summary>
1223 ## </param>
1224 #
1225 interface(`files_dontaudit_search_all_dirs',`
1226         gen_require(`
1227                 attribute file_type;
1228         ')
1229
1230         dontaudit $1 file_type:dir search_dir_perms;
1231 ')
1232
1233 ########################################
1234 ## <summary>
1235 ##      Get the attributes of all filesystems
1236 ##      with the type of a file.
1237 ## </summary>
1238 ## <param name="domain">
1239 ##      <summary>
1240 ##      Domain allowed access.
1241 ##      </summary>
1242 ## </param>
1243 #
1244 # dwalsh: This interface is to allow quotacheck to work on a
1245 # a filesystem mounted with the --context switch
1246 # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212957
1247 #
1248 interface(`files_getattr_all_file_type_fs',`
1249         gen_require(`
1250                 attribute file_type;
1251         ')
1252
1253         allow $1 file_type:filesystem getattr;
1254 ')
1255
1256 ########################################
1257 ## <summary>
1258 ##      Relabel a filesystem to the type of a file.
1259 ## </summary>
1260 ## <param name="domain">
1261 ##      <summary>
1262 ##      Domain allowed access.
1263 ##      </summary>
1264 ## </param>
1265 #
1266 interface(`files_relabelto_all_file_type_fs',`
1267         gen_require(`
1268                 attribute file_type;
1269         ')
1270
1271         allow $1 file_type:filesystem relabelto;
1272 ')
1273
1274 ########################################
1275 ## <summary>
1276 ##      Relabel a filesystem to the type of a file.
1277 ## </summary>
1278 ## <param name="domain">
1279 ##      <summary>
1280 ##      Domain allowed access.
1281 ##      </summary>
1282 ## </param>
1283 #
1284 interface(`files_relabel_all_file_type_fs',`
1285         gen_require(`
1286                 attribute file_type;
1287         ')
1288
1289         allow $1 file_type:filesystem { relabelfrom relabelto };
1290 ')
1291
1292 ########################################
1293 ## <summary>
1294 ##      Mount all filesystems with the type of a file.
1295 ## </summary>
1296 ## <param name="domain">
1297 ##      <summary>
1298 ##      Domain allowed access.
1299 ##      </summary>
1300 ## </param>
1301 #
1302 interface(`files_mount_all_file_type_fs',`
1303         gen_require(`
1304                 attribute file_type;
1305         ')
1306
1307         allow $1 file_type:filesystem mount;
1308 ')
1309
1310 ########################################
1311 ## <summary>
1312 ##      Unmount all filesystems with the type of a file.
1313 ## </summary>
1314 ## <param name="domain">
1315 ##      <summary>
1316 ##      Domain allowed access.
1317 ##      </summary>
1318 ## </param>
1319 #
1320 interface(`files_unmount_all_file_type_fs',`
1321         gen_require(`
1322                 attribute file_type;
1323         ')
1324
1325         allow $1 file_type:filesystem unmount;
1326 ')
1327
1328 #############################################
1329 ## <summary>
1330 ##      Manage all configuration directories on filesystem
1331 ## </summary>
1332 ## <param name="domain">
1333 ##      <summary>
1334 ##      Domain allowed access.
1335 ##      </summary>
1336 ## </param>
1337 ##
1338 #
1339 interface(`files_manage_config_dirs',`
1340         gen_require(`
1341                 attribute configfile;
1342         ')
1343
1344         manage_dirs_pattern($1, configfile, configfile)
1345 ')
1346
1347 #########################################
1348 ## <summary>
1349 ##      Relabel configuration directories
1350 ## </summary>
1351 ## <param name="domain">
1352 ##      <summary>
1353 ##      Domain allowed access.
1354 ##      </summary>
1355 ## </param>
1356 ##
1357 #
1358 interface(`files_relabel_config_dirs',`
1359         gen_require(`
1360                 attribute configfile;
1361         ')
1362
1363         relabel_dirs_pattern($1, configfile, configfile)
1364 ')
1365
1366 ########################################
1367 ## <summary>
1368 ##      Read config files in /etc.
1369 ## </summary>
1370 ## <param name="domain">
1371 ##      <summary>
1372 ##      Domain allowed access.
1373 ##      </summary>
1374 ## </param>
1375 #
1376 interface(`files_read_config_files',`
1377         gen_require(`
1378                 attribute configfile;
1379         ')
1380
1381         allow $1 configfile:dir list_dir_perms;
1382         read_files_pattern($1, configfile, configfile)
1383         read_lnk_files_pattern($1, configfile, configfile)
1384 ')
1385
1386 ###########################################
1387 ## <summary>
1388 ##      Manage all configuration files on filesystem
1389 ## </summary>
1390 ## <param name="domain">
1391 ##      <summary>
1392 ##      Domain allowed access.
1393 ##      </summary>
1394 ## </param>
1395 ##
1396 #
1397 interface(`files_manage_config_files',`
1398         gen_require(`
1399                 attribute configfile;
1400         ')
1401
1402         manage_files_pattern($1, configfile, configfile)
1403 ')
1404
1405 #######################################
1406 ## <summary>
1407 ##      Relabel configuration files
1408 ## </summary>
1409 ## <param name="domain">
1410 ##      <summary>
1411 ##      Domain allowed access.
1412 ##      </summary>
1413 ## </param>
1414 ##
1415 #
1416 interface(`files_relabel_config_files',`
1417         gen_require(`
1418                 attribute configfile;
1419         ')
1420
1421         relabel_files_pattern($1, configfile, configfile)
1422 ')
1423
1424 ########################################
1425 ## <summary>
1426 ##      Mount a filesystem on all mount points.
1427 ## </summary>
1428 ## <param name="domain">
1429 ##      <summary>
1430 ##      Domain allowed access.
1431 ##      </summary>
1432 ## </param>
1433 #
1434 interface(`files_mounton_all_mountpoints',`
1435         gen_require(`
1436                 attribute mountpoint;
1437         ')
1438
1439         allow $1 mountpoint:dir { search_dir_perms mounton };
1440         allow $1 mountpoint:file { getattr mounton };
1441 ')
1442
1443 ########################################
1444 ## <summary>
1445 ##      Get the attributes of all mount points.
1446 ## </summary>
1447 ## <param name="domain">
1448 ##      <summary>
1449 ##      Domain allowed access.
1450 ##      </summary>
1451 ## </param>
1452 #
1453 interface(`files_getattr_all_mountpoints',`
1454         gen_require(`
1455                 attribute mountpoint;
1456         ')
1457
1458         allow $1 mountpoint:dir getattr;
1459 ')
1460
1461 ########################################
1462 ## <summary>
1463 ##      Set the attributes of all mount points.
1464 ## </summary>
1465 ## <param name="domain">
1466 ##      <summary>
1467 ##      Domain allowed access.
1468 ##      </summary>
1469 ## </param>
1470 #
1471 interface(`files_setattr_all_mountpoints',`
1472         gen_require(`
1473                 attribute mountpoint;
1474         ')
1475
1476         allow $1 mountpoint:dir setattr;
1477 ')
1478
1479 ########################################
1480 ## <summary>
1481 ##      Search all mount points.
1482 ## </summary>
1483 ## <param name="domain">
1484 ##      <summary>
1485 ##      Domain allowed access.
1486 ##      </summary>
1487 ## </param>
1488 #
1489 interface(`files_search_all_mountpoints',`
1490         gen_require(`
1491                 attribute mountpoint;
1492         ')
1493
1494         allow $1 mountpoint:dir search_dir_perms;
1495 ')
1496
1497 ########################################
1498 ## <summary>
1499 ##      Do not audit searching of all mount points.
1500 ## </summary>
1501 ## <param name="domain">
1502 ##      <summary>
1503 ##      Domain to not audit.
1504 ##      </summary>
1505 ## </param>
1506 #
1507 interface(`files_dontaudit_search_all_mountpoints',`
1508         gen_require(`
1509                 attribute mountpoint;
1510         ')
1511
1512         dontaudit $1 mountpoint:dir search_dir_perms;
1513 ')
1514
1515 ########################################
1516 ## <summary>
1517 ##      Do not audit listing of all mount points.
1518 ## </summary>
1519 ## <param name="domain">
1520 ##      <summary>
1521 ##      Domain to not audit.
1522 ##      </summary>
1523 ## </param>
1524 #
1525 interface(`files_dontaudit_list_all_mountpoints',`
1526         gen_require(`
1527                 attribute mountpoint;
1528         ')
1529
1530         dontaudit $1 mountpoint:dir list_dir_perms;
1531 ')
1532
1533 ########################################
1534 ## <summary>
1535 ##      Write all mount points.
1536 ## </summary>
1537 ## <param name="domain">
1538 ##      <summary>
1539 ##      Domain allowed access.
1540 ##      </summary>
1541 ## </param>
1542 #
1543 interface(`files_write_all_mountpoints',`
1544         gen_require(`
1545                 attribute mountpoint;
1546         ')
1547
1548         allow $1 mountpoint:dir write;
1549 ')
1550
1551 ########################################
1552 ## <summary>
1553 ##      Write all file type directories.
1554 ## </summary>
1555 ## <param name="domain">
1556 ##      <summary>
1557 ##      Domain allowed access.
1558 ##      </summary>
1559 ## </param>
1560 #
1561 interface(`files_write_all_dirs',`
1562         gen_require(`
1563                 attribute file_type;
1564         ')
1565
1566         allow $1 file_type:dir write;
1567 ')
1568
1569 ########################################
1570 ## <summary>
1571 ##      List the contents of the root directory.
1572 ## </summary>
1573 ## <param name="domain">
1574 ##      <summary>
1575 ##      Domain allowed access.
1576 ##      </summary>
1577 ## </param>
1578 #
1579 interface(`files_list_root',`
1580         gen_require(`
1581                 type root_t;
1582         ')
1583
1584         allow $1 root_t:dir list_dir_perms;
1585         allow $1 root_t:lnk_file { read_lnk_file_perms ioctl lock };
1586 ')
1587
1588 ########################################
1589 ## <summary>
1590 ##      Do not audit attempts to write to / dirs.
1591 ## </summary>
1592 ## <param name="domain">
1593 ##      <summary>
1594 ##      Domain to not audit.
1595 ##      </summary>
1596 ## </param>
1597 #
1598 interface(`files_dontaudit_write_root_dirs',`
1599         gen_require(`
1600                 type root_t;
1601         ')
1602
1603         dontaudit $1 root_t:dir write;
1604 ')
1605
1606 ###################
1607 ## <summary>
1608 ##      Do not audit attempts to write
1609 ##      files in the root directory.
1610 ## </summary>
1611 ## <param name="domain">
1612 ##      <summary>
1613 ##      Domain to not audit.
1614 ##      </summary>
1615 ## </param>
1616 #
1617 interface(`files_dontaudit_rw_root_dir',`
1618         gen_require(`
1619                 type root_t;
1620         ')
1621
1622         dontaudit $1 root_t:dir rw_dir_perms;
1623 ')
1624
1625 ########################################
1626 ## <summary>
1627 ##      Create an object in the root directory, with a private
1628 ##      type using a type transition.
1629 ## </summary>
1630 ## <param name="domain">
1631 ##      <summary>
1632 ##      Domain allowed access.
1633 ##      </summary>
1634 ## </param>
1635 ## <param name="private type">
1636 ##      <summary>
1637 ##      The type of the object to be created.
1638 ##      </summary>
1639 ## </param>
1640 ## <param name="object">
1641 ##      <summary>
1642 ##      The object class of the object being created.
1643 ##      </summary>
1644 ## </param>
1645 #
1646 interface(`files_root_filetrans',`
1647         gen_require(`
1648                 type root_t;
1649         ')
1650
1651         filetrans_pattern($1, root_t, $2, $3, $4)
1652 ')
1653
1654 ########################################
1655 ## <summary>
1656 ##      Do not audit attempts to read files in
1657 ##      the root directory.
1658 ## </summary>
1659 ## <param name="domain">
1660 ##      <summary>
1661 ##      Domain to not audit.
1662 ##      </summary>
1663 ## </param>
1664 #
1665 interface(`files_dontaudit_read_root_files',`
1666         gen_require(`
1667                 type root_t;
1668         ')
1669
1670         dontaudit $1 root_t:file { getattr read };
1671 ')
1672
1673 ########################################
1674 ## <summary>
1675 ##      Do not audit attempts to read or write
1676 ##      files in the root directory.
1677 ## </summary>
1678 ## <param name="domain">
1679 ##      <summary>
1680 ##      Domain to not audit.
1681 ##      </summary>
1682 ## </param>
1683 #
1684 interface(`files_dontaudit_rw_root_files',`
1685         gen_require(`
1686                 type root_t;
1687         ')
1688
1689         dontaudit $1 root_t:file { read write };
1690 ')
1691
1692 ########################################
1693 ## <summary>
1694 ##      Do not audit attempts to read or write
1695 ##      character device nodes in the root directory.
1696 ## </summary>
1697 ## <param name="domain">
1698 ##      <summary>
1699 ##      Domain to not audit.
1700 ##      </summary>
1701 ## </param>
1702 #
1703 interface(`files_dontaudit_rw_root_chr_files',`
1704         gen_require(`
1705                 type root_t;
1706         ')
1707
1708         dontaudit $1 root_t:chr_file { read write };
1709 ')
1710
1711 ########################################
1712 ## <summary>
1713 ##      Delete files in the root directory.
1714 ## </summary>
1715 ## <param name="domain">
1716 ##      <summary>
1717 ##      Domain allowed access.
1718 ##      </summary>
1719 ## </param>
1720 #
1721 interface(`files_delete_root_files',`
1722         gen_require(`
1723                 type root_t;
1724         ')
1725
1726         allow $1 root_t:file unlink;
1727 ')
1728
1729 ########################################
1730 ## <summary>
1731 ##      Remove entries from the root directory.
1732 ## </summary>
1733 ## <param name="domain">
1734 ##      <summary>
1735 ##      Domain allowed access.
1736 ##      </summary>
1737 ## </param>
1738 #
1739 interface(`files_delete_root_dir_entry',`
1740         gen_require(`
1741                 type root_t;
1742         ')
1743
1744         allow $1 root_t:dir rw_dir_perms;
1745 ')
1746
1747 ########################################
1748 ## <summary>
1749 ##      Set attributes of the root directory.
1750 ## </summary>
1751 ## <param name="domain">
1752 ##      <summary>
1753 ##      Domain allowed access.
1754 ##      </summary>
1755 ## </param>
1756 #
1757 interface(`files_setattr_root_dirs',`
1758         gen_require(`
1759                 type root_t;
1760         ')
1761
1762         allow $1 root_t:dir setattr_dir_perms;
1763 ')
1764
1765 ########################################
1766 ## <summary>
1767 ##      Unmount a rootfs filesystem.
1768 ## </summary>
1769 ## <param name="domain">
1770 ##      <summary>
1771 ##      Domain allowed access.
1772 ##      </summary>
1773 ## </param>
1774 #
1775 interface(`files_unmount_rootfs',`
1776         gen_require(`
1777                 type root_t;
1778         ')
1779
1780         allow $1 root_t:filesystem unmount;
1781 ')
1782
1783 ########################################
1784 ## <summary>
1785 ##      Get attributes of the /boot directory.
1786 ## </summary>
1787 ## <param name="domain">
1788 ##      <summary>
1789 ##      Domain allowed access.
1790 ##      </summary>
1791 ## </param>
1792 #
1793 interface(`files_getattr_boot_dirs',`
1794         gen_require(`
1795                 type boot_t;
1796         ')
1797
1798         allow $1 boot_t:dir getattr;
1799 ')
1800
1801 ########################################
1802 ## <summary>
1803 ##      Do not audit attempts to get attributes
1804 ##      of the /boot directory.
1805 ## </summary>
1806 ## <param name="domain">
1807 ##      <summary>
1808 ##      Domain to not audit.
1809 ##      </summary>
1810 ## </param>
1811 #
1812 interface(`files_dontaudit_getattr_boot_dirs',`
1813         gen_require(`
1814                 type boot_t;
1815         ')
1816
1817         dontaudit $1 boot_t:dir getattr;
1818 ')
1819
1820 ########################################
1821 ## <summary>
1822 ##      Search the /boot directory.
1823 ## </summary>
1824 ## <param name="domain">
1825 ##      <summary>
1826 ##      Domain allowed access.
1827 ##      </summary>
1828 ## </param>
1829 #
1830 interface(`files_search_boot',`
1831         gen_require(`
1832                 type boot_t;
1833         ')
1834
1835         allow $1 boot_t:dir search_dir_perms;
1836 ')
1837
1838 ########################################
1839 ## <summary>
1840 ##      Do not audit attempts to search the /boot directory.
1841 ## </summary>
1842 ## <param name="domain">
1843 ##      <summary>
1844 ##      Domain to not audit.
1845 ##      </summary>
1846 ## </param>
1847 #
1848 interface(`files_dontaudit_search_boot',`
1849         gen_require(`
1850                 type boot_t;
1851         ')
1852
1853         dontaudit $1 boot_t:dir search_dir_perms;
1854 ')
1855
1856 ########################################
1857 ## <summary>
1858 ##      List the /boot directory.
1859 ## </summary>
1860 ## <param name="domain">
1861 ##      <summary>
1862 ##      Domain allowed access.
1863 ##      </summary>
1864 ## </param>
1865 #
1866 interface(`files_list_boot',`
1867         gen_require(`
1868                 type boot_t;
1869         ')
1870
1871         allow $1 boot_t:dir list_dir_perms;
1872 ')
1873
1874 #######################################
1875 ## <summary>
1876 ##      Do not audit attempts to list the /boot directory.
1877 ## </summary>
1878 ## <param name="domain">
1879 ##      <summary>
1880 ##      Domain allowed access.
1881 ##      </summary>
1882 ## </param>
1883 #
1884 interface(`files_dontaudit_list_boot',`
1885         gen_require(`
1886                 type boot_t;
1887         ')
1888
1889         dontaudit $1 boot_t:dir list_dir_perms;
1890 ')
1891
1892 ########################################
1893 ## <summary>
1894 ##      Create directories in /boot
1895 ## </summary>
1896 ## <param name="domain">
1897 ##      <summary>
1898 ##      Domain allowed access.
1899 ##      </summary>
1900 ## </param>
1901 #
1902 interface(`files_create_boot_dirs',`
1903         gen_require(`
1904                 type boot_t;
1905         ')
1906
1907         allow $1 boot_t:dir { create rw_dir_perms };
1908 ')
1909
1910 ########################################
1911 ## <summary>
1912 ##      Create, read, write, and delete
1913 ##      directories in /boot.
1914 ## </summary>
1915 ## <param name="domain">
1916 ##      <summary>
1917 ##      Domain allowed access.
1918 ##      </summary>
1919 ## </param>
1920 #
1921 interface(`files_manage_boot_dirs',`
1922         gen_require(`
1923                 type boot_t;
1924         ')
1925
1926         allow $1 boot_t:dir manage_dir_perms;
1927 ')
1928
1929 ########################################
1930 ## <summary>
1931 ##      Create a private type object in boot
1932 ##      with an automatic type transition
1933 ## </summary>
1934 ## <param name="domain">
1935 ##      <summary>
1936 ##      Domain allowed access.
1937 ##      </summary>
1938 ## </param>
1939 ## <param name="private_type">
1940 ##      <summary>
1941 ##      The type of the object to be created.
1942 ##      </summary>
1943 ## </param>
1944 ## <param name="object_class">
1945 ##      <summary>
1946 ##      The object class of the object being created.
1947 ##      </summary>
1948 ## </param>
1949 #
1950 interface(`files_boot_filetrans',`
1951         gen_require(`
1952                 type boot_t;
1953         ')
1954
1955         filetrans_pattern($1, boot_t, $2, $3, $4)
1956 ')
1957
1958 ########################################
1959 ## <summary>
1960 ##      read files in the /boot directory.
1961 ## </summary>
1962 ## <param name="domain">
1963 ##      <summary>
1964 ##      Domain allowed access.
1965 ##      </summary>
1966 ## </param>
1967 ## <rolecap/>
1968 #
1969 interface(`files_read_boot_files',`
1970         gen_require(`
1971                 type boot_t;
1972         ')
1973
1974         read_files_pattern($1, boot_t, boot_t)
1975 ')
1976
1977 ########################################
1978 ## <summary>
1979 ##      Create, read, write, and delete files
1980 ##      in the /boot directory.
1981 ## </summary>
1982 ## <param name="domain">
1983 ##      <summary>
1984 ##      Domain allowed access.
1985 ##      </summary>
1986 ## </param>
1987 ## <rolecap/>
1988 #
1989 interface(`files_manage_boot_files',`
1990         gen_require(`
1991                 type boot_t;
1992         ')
1993
1994         manage_files_pattern($1, boot_t, boot_t)
1995 ')
1996
1997 ########################################
1998 ## <summary>
1999 ##      Relabel from files in the /boot directory.
2000 ## </summary>
2001 ## <param name="domain">
2002 ##      <summary>
2003 ##      Domain allowed access.
2004 ##      </summary>
2005 ## </param>
2006 #
2007 interface(`files_relabelfrom_boot_files',`
2008         gen_require(`
2009                 type boot_t;
2010         ')
2011
2012         relabelfrom_files_pattern($1, boot_t, boot_t)
2013 ')
2014
2015 ######################################
2016 ## <summary>
2017 ##      Read symbolic links in the /boot directory.
2018 ## </summary>
2019 ## <param name="domain">
2020 ##      <summary>
2021 ##      Domain allowed access.
2022 ##      </summary>
2023 ## </param>
2024 #
2025 interface(`files_read_boot_symlinks',`
2026         gen_require(`
2027                 type boot_t;
2028         ')
2029
2030         read_lnk_files_pattern($1, boot_t, boot_t)
2031 ')
2032
2033 ########################################
2034 ## <summary>
2035 ##      Read and write symbolic links
2036 ##      in the /boot directory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`files_rw_boot_symlinks',`
2045         gen_require(`
2046                 type boot_t;
2047         ')
2048
2049         allow $1 boot_t:dir list_dir_perms;
2050         rw_lnk_files_pattern($1, boot_t, boot_t)
2051 ')
2052
2053 ########################################
2054 ## <summary>
2055 ##      Create, read, write, and delete symbolic links
2056 ##      in the /boot directory.
2057 ## </summary>
2058 ## <param name="domain">
2059 ##      <summary>
2060 ##      Domain allowed access.
2061 ##      </summary>
2062 ## </param>
2063 #
2064 interface(`files_manage_boot_symlinks',`
2065         gen_require(`
2066                 type boot_t;
2067         ')
2068
2069         manage_lnk_files_pattern($1, boot_t, boot_t)
2070 ')
2071
2072 ########################################
2073 ## <summary>
2074 ##      Read kernel files in the /boot directory.
2075 ## </summary>
2076 ## <param name="domain">
2077 ##      <summary>
2078 ##      Domain allowed access.
2079 ##      </summary>
2080 ## </param>
2081 #
2082 interface(`files_read_kernel_img',`
2083         gen_require(`
2084                 type boot_t;
2085         ')
2086
2087         allow $1 boot_t:dir list_dir_perms;
2088         read_files_pattern($1, boot_t, boot_t)
2089         read_lnk_files_pattern($1, boot_t, boot_t)
2090 ')
2091
2092 ########################################
2093 ## <summary>
2094 ##      Install a kernel into the /boot directory.
2095 ## </summary>
2096 ## <param name="domain">
2097 ##      <summary>
2098 ##      Domain allowed access.
2099 ##      </summary>
2100 ## </param>
2101 ## <rolecap/>
2102 #
2103 interface(`files_create_kernel_img',`
2104         gen_require(`
2105                 type boot_t;
2106         ')
2107
2108         allow $1 boot_t:file { create_file_perms rw_file_perms };
2109         manage_lnk_files_pattern($1, boot_t, boot_t)
2110 ')
2111
2112 ########################################
2113 ## <summary>
2114 ##      Delete a kernel from /boot.
2115 ## </summary>
2116 ## <param name="domain">
2117 ##      <summary>
2118 ##      Domain allowed access.
2119 ##      </summary>
2120 ## </param>
2121 ## <rolecap/>
2122 #
2123 interface(`files_delete_kernel',`
2124         gen_require(`
2125                 type boot_t;
2126         ')
2127
2128         delete_files_pattern($1, boot_t, boot_t)
2129 ')
2130
2131 ########################################
2132 ## <summary>
2133 ##      Getattr of directories with the default file type.
2134 ## </summary>
2135 ## <param name="domain">
2136 ##      <summary>
2137 ##      Domain allowed access.
2138 ##      </summary>
2139 ## </param>
2140 #
2141 interface(`files_getattr_default_dirs',`
2142         gen_require(`
2143                 type default_t;
2144         ')
2145
2146         allow $1 default_t:dir getattr;
2147 ')
2148
2149 ########################################
2150 ## <summary>
2151 ##      Do not audit attempts to get the attributes of
2152 ##      directories with the default file type.
2153 ## </summary>
2154 ## <param name="domain">
2155 ##      <summary>
2156 ##      Domain to not audit.
2157 ##      </summary>
2158 ## </param>
2159 #
2160 interface(`files_dontaudit_getattr_default_dirs',`
2161         gen_require(`
2162                 type default_t;
2163         ')
2164
2165         dontaudit $1 default_t:dir getattr;
2166 ')
2167
2168 ########################################
2169 ## <summary>
2170 ##      Search the contents of directories with the default file type.
2171 ## </summary>
2172 ## <param name="domain">
2173 ##      <summary>
2174 ##      Domain allowed access.
2175 ##      </summary>
2176 ## </param>
2177 #
2178 interface(`files_search_default',`
2179         gen_require(`
2180                 type default_t;
2181         ')
2182
2183         allow $1 default_t:dir search_dir_perms;
2184 ')
2185
2186 ########################################
2187 ## <summary>
2188 ##      List contents of directories with the default file type.
2189 ## </summary>
2190 ## <param name="domain">
2191 ##      <summary>
2192 ##      Domain allowed access.
2193 ##      </summary>
2194 ## </param>
2195 #
2196 interface(`files_list_default',`
2197         gen_require(`
2198                 type default_t;
2199         ')
2200
2201         allow $1 default_t:dir list_dir_perms;
2202 ')
2203
2204 ########################################
2205 ## <summary>
2206 ##      Do not audit attempts to list contents of
2207 ##      directories with the default file type.
2208 ## </summary>
2209 ## <param name="domain">
2210 ##      <summary>
2211 ##      Domain to not audit.
2212 ##      </summary>
2213 ## </param>
2214 #
2215 interface(`files_dontaudit_list_default',`
2216         gen_require(`
2217                 type default_t;
2218         ')
2219
2220         dontaudit $1 default_t:dir list_dir_perms;
2221 ')
2222
2223 ########################################
2224 ## <summary>
2225 ##      Create, read, write, and delete directories with
2226 ##      the default file type.
2227 ## </summary>
2228 ## <param name="domain">
2229 ##      <summary>
2230 ##      Domain allowed access.
2231 ##      </summary>
2232 ## </param>
2233 #
2234 interface(`files_manage_default_dirs',`
2235         gen_require(`
2236                 type default_t;
2237         ')
2238
2239         manage_dirs_pattern($1, default_t, default_t)
2240 ')
2241
2242 ########################################
2243 ## <summary>
2244 ##      Mount a filesystem on a directory with the default file type.
2245 ## </summary>
2246 ## <param name="domain">
2247 ##      <summary>
2248 ##      Domain allowed access.
2249 ##      </summary>
2250 ## </param>
2251 #
2252 interface(`files_mounton_default',`
2253         gen_require(`
2254                 type default_t;
2255         ')
2256
2257         allow $1 default_t:dir { search_dir_perms mounton };
2258 ')
2259
2260 ########################################
2261 ## <summary>
2262 ##      Do not audit attempts to get the attributes of
2263 ##      files with the default file type.
2264 ## </summary>
2265 ## <param name="domain">
2266 ##      <summary>
2267 ##      Domain to not audit.
2268 ##      </summary>
2269 ## </param>
2270 #
2271 interface(`files_dontaudit_getattr_default_files',`
2272         gen_require(`
2273                 type default_t;
2274         ')
2275
2276         dontaudit $1 default_t:file getattr;
2277 ')
2278
2279 ########################################
2280 ## <summary>
2281 ##      Read files with the default file type.
2282 ## </summary>
2283 ## <param name="domain">
2284 ##      <summary>
2285 ##      Domain allowed access.
2286 ##      </summary>
2287 ## </param>
2288 #
2289 interface(`files_read_default_files',`
2290         gen_require(`
2291                 type default_t;
2292         ')
2293
2294         allow $1 default_t:file read_file_perms;
2295 ')
2296
2297 ########################################
2298 ## <summary>
2299 ##      Do not audit attempts to read files
2300 ##      with the default file type.
2301 ## </summary>
2302 ## <param name="domain">
2303 ##      <summary>
2304 ##      Domain to not audit.
2305 ##      </summary>
2306 ## </param>
2307 #
2308 interface(`files_dontaudit_read_default_files',`
2309         gen_require(`
2310                 type default_t;
2311         ')
2312
2313         dontaudit $1 default_t:file read_file_perms;
2314 ')
2315
2316 ########################################
2317 ## <summary>
2318 ##      Create, read, write, and delete files with
2319 ##      the default file type.
2320 ## </summary>
2321 ## <param name="domain">
2322 ##      <summary>
2323 ##      Domain allowed access.
2324 ##      </summary>
2325 ## </param>
2326 #
2327 interface(`files_manage_default_files',`
2328         gen_require(`
2329                 type default_t;
2330         ')
2331
2332         manage_files_pattern($1, default_t, default_t)
2333 ')
2334
2335 ########################################
2336 ## <summary>
2337 ##      Read symbolic links with the default file type.
2338 ## </summary>
2339 ## <param name="domain">
2340 ##      <summary>
2341 ##      Domain allowed access.
2342 ##      </summary>
2343 ## </param>
2344 #
2345 interface(`files_read_default_symlinks',`
2346         gen_require(`
2347                 type default_t;
2348         ')
2349
2350         allow $1 default_t:lnk_file read_lnk_file_perms;
2351 ')
2352
2353 ########################################
2354 ## <summary>
2355 ##      Read sockets with the default file type.
2356 ## </summary>
2357 ## <param name="domain">
2358 ##      <summary>
2359 ##      Domain allowed access.
2360 ##      </summary>
2361 ## </param>
2362 #
2363 interface(`files_read_default_sockets',`
2364         gen_require(`
2365                 type default_t;
2366         ')
2367
2368         allow $1 default_t:sock_file read_sock_file_perms;
2369 ')
2370
2371 ########################################
2372 ## <summary>
2373 ##      Read named pipes with the default file type.
2374 ## </summary>
2375 ## <param name="domain">
2376 ##      <summary>
2377 ##      Domain allowed access.
2378 ##      </summary>
2379 ## </param>
2380 #
2381 interface(`files_read_default_pipes',`
2382         gen_require(`
2383                 type default_t;
2384         ')
2385
2386         allow $1 default_t:fifo_file read_fifo_file_perms;
2387 ')
2388
2389 ########################################
2390 ## <summary>
2391 ##      Search the contents of /etc directories.
2392 ## </summary>
2393 ## <param name="domain">
2394 ##      <summary>
2395 ##      Domain allowed access.
2396 ##      </summary>
2397 ## </param>
2398 #
2399 interface(`files_search_etc',`
2400         gen_require(`
2401                 type etc_t;
2402         ')
2403
2404         allow $1 etc_t:dir search_dir_perms;
2405 ')
2406
2407 ########################################
2408 ## <summary>
2409 ##      Set the attributes of the /etc directories.
2410 ## </summary>
2411 ## <param name="domain">
2412 ##      <summary>
2413 ##      Domain allowed access.
2414 ##      </summary>
2415 ## </param>
2416 #
2417 interface(`files_setattr_etc_dirs',`
2418         gen_require(`
2419                 type etc_t;
2420         ')
2421
2422         allow $1 etc_t:dir setattr;
2423 ')
2424
2425 ########################################
2426 ## <summary>
2427 ##      List the contents of /etc directories.
2428 ## </summary>
2429 ## <param name="domain">
2430 ##      <summary>
2431 ##      Domain allowed access.
2432 ##      </summary>
2433 ## </param>
2434 #
2435 interface(`files_list_etc',`
2436         gen_require(`
2437                 type etc_t;
2438         ')
2439
2440         allow $1 etc_t:dir list_dir_perms;
2441 ')
2442
2443 ########################################
2444 ## <summary>
2445 ##      Do not audit attempts to write to /etc dirs.
2446 ## </summary>
2447 ## <param name="domain">
2448 ##      <summary>
2449 ##      Domain to not audit.
2450 ##      </summary>
2451 ## </param>
2452 #
2453 interface(`files_dontaudit_write_etc_dirs',`
2454         gen_require(`
2455                 type etc_t;
2456         ')
2457
2458         dontaudit $1 etc_t:dir write;
2459 ')
2460
2461 ########################################
2462 ## <summary>
2463 ##      Add and remove entries from /etc directories.
2464 ## </summary>
2465 ## <param name="domain">
2466 ##      <summary>
2467 ##      Domain allowed access.
2468 ##      </summary>
2469 ## </param>
2470 #
2471 interface(`files_rw_etc_dirs',`
2472         gen_require(`
2473                 type etc_t;
2474         ')
2475
2476         allow $1 etc_t:dir rw_dir_perms;
2477 ')
2478
2479 #######################################
2480 ## <summary>
2481 ##      Dontaudit remove dir /etc directories.
2482 ## </summary>
2483 ## <param name="domain">
2484 ##      <summary>
2485 ##      Domain to not audit.
2486 ##      </summary>
2487 ## </param>
2488 #
2489 interface(`files_dontaudit_remove_etc_dir',`
2490         gen_require(`
2491                 type etc_t;
2492         ')
2493
2494         dontaudit $1 etc_t:dir rmdir;
2495 ')
2496
2497 ##########################################
2498 ## <summary>
2499 ##      Manage generic directories in /etc
2500 ## </summary>
2501 ## <param name="domain">
2502 ##      <summary>
2503 ##      Domain allowed access
2504 ##      </summary>
2505 ## </param>
2506 ##
2507 #
2508 interface(`files_manage_etc_dirs',`
2509         gen_require(`
2510                 type etc_t;
2511         ')
2512
2513         manage_dirs_pattern($1, etc_t, etc_t)
2514 ')
2515
2516 ########################################
2517 ## <summary>
2518 ##      Read generic files in /etc.
2519 ## </summary>
2520 ## <desc>
2521 ##      <p>
2522 ##      Allow the specified domain to read generic
2523 ##      files in /etc. These files are typically
2524 ##      general system configuration files that do
2525 ##      not have more specific SELinux types.  Some
2526 ##      examples of these files are:
2527 ##      </p>
2528 ##      <ul>
2529 ##              <li>/etc/fstab</li>
2530 ##              <li>/etc/passwd</li>
2531 ##              <li>/etc/services</li>
2532 ##              <li>/etc/shells</li>
2533 ##      </ul>
2534 ##      <p>
2535 ##      This interface does not include access to /etc/shadow.
2536 ##      </p>
2537 ##      <p>
2538 ##      Generally, it is safe for many domains to have
2539 ##      this access.  However, since this interface provides
2540 ##      access to the /etc/passwd file, caution must be
2541 ##      exercised, as user account names can be leaked
2542 ##      through this access.
2543 ##      </p>
2544 ##      <p>
2545 ##      Related interfaces:
2546 ##      </p>
2547 ##      <ul>
2548 ##              <li>auth_read_shadow()</li>
2549 ##              <li>files_read_etc_runtime_files()</li>
2550 ##              <li>seutil_read_config()</li>
2551 ##      </ul>
2552 ## </desc>
2553 ## <param name="domain">
2554 ##      <summary>
2555 ##      Domain allowed access.
2556 ##      </summary>
2557 ## </param>
2558 ## <infoflow type="read" weight="10"/>
2559 #
2560 interface(`files_read_etc_files',`
2561         gen_require(`
2562                 type etc_t;
2563         ')
2564
2565         allow $1 etc_t:dir list_dir_perms;
2566         read_files_pattern($1, etc_t, etc_t)
2567         read_lnk_files_pattern($1, etc_t, etc_t)
2568 ')
2569
2570 ########################################
2571 ## <summary>
2572 ##      Do not audit attempts to write generic files in /etc.
2573 ## </summary>
2574 ## <param name="domain">
2575 ##      <summary>
2576 ##      Domain to not audit.
2577 ##      </summary>
2578 ## </param>
2579 #
2580 interface(`files_dontaudit_write_etc_files',`
2581         gen_require(`
2582                 type etc_t;
2583         ')
2584
2585         dontaudit $1 etc_t:file write;
2586 ')
2587
2588 ########################################
2589 ## <summary>
2590 ##      Read and write generic files in /etc.
2591 ## </summary>
2592 ## <param name="domain">
2593 ##      <summary>
2594 ##      Domain allowed access.
2595 ##      </summary>
2596 ## </param>
2597 ## <rolecap/>
2598 #
2599 interface(`files_rw_etc_files',`
2600         gen_require(`
2601                 type etc_t;
2602         ')
2603
2604         allow $1 etc_t:dir list_dir_perms;
2605         rw_files_pattern($1, etc_t, etc_t)
2606         read_lnk_files_pattern($1, etc_t, etc_t)
2607 ')
2608
2609 ########################################
2610 ## <summary>
2611 ##      Create, read, write, and delete generic
2612 ##      files in /etc.
2613 ## </summary>
2614 ## <param name="domain">
2615 ##      <summary>
2616 ##      Domain allowed access.
2617 ##      </summary>
2618 ## </param>
2619 ## <rolecap/>
2620 #
2621 interface(`files_manage_etc_files',`
2622         gen_require(`
2623                 type etc_t;
2624         ')
2625
2626         manage_files_pattern($1, etc_t, etc_t)
2627         read_lnk_files_pattern($1, etc_t, etc_t)
2628 ')
2629
2630 ########################################
2631 ## <summary>
2632 ##      Do not audit attempts to check the
2633 ##      access on etc files
2634 ## </summary>
2635 ## <param name="domain">
2636 ##      <summary>
2637 ##      Domain to not audit.
2638 ##      </summary>
2639 ## </param>
2640 #
2641 interface(`files_dontaudit_access_check_etc',`
2642         gen_require(`
2643                 type etc_t;
2644         ')
2645
2646         dontaudit $1 etc_t:file_class_set audit_access;
2647 ')
2648
2649 ########################################
2650 ## <summary>
2651 ##      Delete system configuration files in /etc.
2652 ## </summary>
2653 ## <param name="domain">
2654 ##      <summary>
2655 ##      Domain allowed access.
2656 ##      </summary>
2657 ## </param>
2658 #
2659 interface(`files_delete_etc_files',`
2660         gen_require(`
2661                 type etc_t;
2662         ')
2663
2664         delete_files_pattern($1, etc_t, etc_t)
2665 ')
2666
2667 ########################################
2668 ## <summary>
2669 ##      Remove entries from the etc directory.
2670 ## </summary>
2671 ## <param name="domain">
2672 ##      <summary>
2673 ##      Domain allowed access.
2674 ##      </summary>
2675 ## </param>
2676 #
2677 interface(`files_delete_etc_dir_entry',`
2678         gen_require(`
2679                 type etc_t;
2680         ')
2681
2682         allow $1 etc_t:dir del_entry_dir_perms;
2683 ')
2684
2685 ########################################
2686 ## <summary>
2687 ##      Execute generic files in /etc.
2688 ## </summary>
2689 ## <param name="domain">
2690 ##      <summary>
2691 ##      Domain allowed access.
2692 ##      </summary>
2693 ## </param>
2694 #
2695 interface(`files_exec_etc_files',`
2696         gen_require(`
2697                 type etc_t;
2698         ')
2699
2700         allow $1 etc_t:dir list_dir_perms;
2701         read_lnk_files_pattern($1, etc_t, etc_t)
2702         exec_files_pattern($1, etc_t, etc_t)
2703 ')
2704
2705 #######################################
2706 ## <summary>
2707 ##      Relabel from and to generic files in /etc.
2708 ## </summary>
2709 ## <param name="domain">
2710 ##      <summary>
2711 ##      Domain allowed access.
2712 ##      </summary>
2713 ## </param>
2714 #
2715 interface(`files_relabel_etc_files',`
2716         gen_require(`
2717                 type etc_t;
2718         ')
2719
2720         allow $1 etc_t:dir list_dir_perms;
2721         relabel_files_pattern($1, etc_t, etc_t)
2722 ')
2723
2724 ########################################
2725 ## <summary>
2726 ##      Read symbolic links in /etc.
2727 ## </summary>
2728 ## <param name="domain">
2729 ##      <summary>
2730 ##      Domain allowed access.
2731 ##      </summary>
2732 ## </param>
2733 #
2734 interface(`files_read_etc_symlinks',`
2735         gen_require(`
2736                 type etc_t;
2737         ')
2738
2739         read_lnk_files_pattern($1, etc_t, etc_t)
2740 ')
2741
2742 ########################################
2743 ## <summary>
2744 ##      Create, read, write, and delete symbolic links in /etc.
2745 ## </summary>
2746 ## <param name="domain">
2747 ##      <summary>
2748 ##      Domain allowed access.
2749 ##      </summary>
2750 ## </param>
2751 #
2752 interface(`files_manage_etc_symlinks',`
2753         gen_require(`
2754                 type etc_t;
2755         ')
2756
2757         manage_lnk_files_pattern($1, etc_t, etc_t)
2758 ')
2759
2760 ########################################
2761 ## <summary>
2762 ##      Create objects in /etc with a private
2763 ##      type using a type_transition.
2764 ## </summary>
2765 ## <param name="domain">
2766 ##      <summary>
2767 ##      Domain allowed access.
2768 ##      </summary>
2769 ## </param>
2770 ## <param name="file_type">
2771 ##      <summary>
2772 ##      Private file type.
2773 ##      </summary>
2774 ## </param>
2775 ## <param name="class">
2776 ##      <summary>
2777 ##      Object classes to be created.
2778 ##      </summary>
2779 ## </param>
2780 #
2781 interface(`files_etc_filetrans',`
2782         gen_require(`
2783                 type etc_t;
2784         ')
2785
2786         filetrans_pattern($1, etc_t, $2, $3, $4)
2787 ')
2788
2789 ########################################
2790 ## <summary>
2791 ##      Create a boot flag.
2792 ## </summary>
2793 ## <desc>
2794 ##      <p>
2795 ##      Create a boot flag, such as
2796 ##      /.autorelabel and /.autofsck.
2797 ##      </p>
2798 ## </desc>
2799 ## <param name="domain">
2800 ##      <summary>
2801 ##      Domain allowed access.
2802 ##      </summary>
2803 ## </param>
2804 ## <rolecap/>
2805 #
2806 interface(`files_create_boot_flag',`
2807         gen_require(`
2808                 type root_t, etc_runtime_t;
2809         ')
2810
2811         allow $1 etc_runtime_t:file manage_file_perms;
2812         filetrans_pattern($1, root_t, etc_runtime_t, file)
2813 ')
2814
2815 ########################################
2816 ## <summary>
2817 ##      Delete a boot flag.
2818 ## </summary>
2819 ## <desc>
2820 ##      <p>
2821 ##      Delete a boot flag, such as
2822 ##      /.autorelabel and /.autofsck.
2823 ##      </p>
2824 ## </desc>
2825 ## <param name="domain">
2826 ##      <summary>
2827 ##      Domain allowed access.
2828 ##      </summary>
2829 ## </param>
2830 ## <rolecap/>
2831 #
2832 interface(`files_delete_boot_flag',`
2833         gen_require(`
2834                 type root_t, etc_runtime_t;
2835         ')
2836
2837         delete_files_pattern($1, root_t, etc_runtime_t)
2838 ')
2839
2840 ########################################
2841 ## <summary>
2842 ##      Read files in /etc that are dynamically
2843 ##      created on boot, such as mtab.
2844 ## </summary>
2845 ## <desc>
2846 ##      <p>
2847 ##      Allow the specified domain to read dynamically created
2848 ##      configuration files in /etc. These files are typically
2849 ##      general system configuration files that do
2850 ##      not have more specific SELinux types.  Some
2851 ##      examples of these files are:
2852 ##      </p>
2853 ##      <ul>
2854 ##              <li>/etc/motd</li>
2855 ##              <li>/etc/mtab</li>
2856 ##              <li>/etc/nologin</li>
2857 ##      </ul>
2858 ##      <p>
2859 ##      This interface does not include access to /etc/shadow.
2860 ##      </p>
2861 ## </desc>
2862 ## <param name="domain">
2863 ##      <summary>
2864 ##      Domain allowed access.
2865 ##      </summary>
2866 ## </param>
2867 ## <infoflow type="read" weight="10" />
2868 ## <rolecap/>
2869 #
2870 interface(`files_read_etc_runtime_files',`
2871         gen_require(`
2872                 type etc_t, etc_runtime_t;
2873         ')
2874
2875         allow $1 etc_t:dir list_dir_perms;
2876         read_files_pattern($1, etc_t, etc_runtime_t)
2877         read_lnk_files_pattern($1, etc_t, etc_runtime_t)
2878 ')
2879
2880 ########################################
2881 ## <summary>
2882 ##      Do not audit attempts to set the attributes of the etc_runtime files
2883 ## </summary>
2884 ## <param name="domain">
2885 ##      <summary>
2886 ##      Domain to not audit.
2887 ##      </summary>
2888 ## </param>
2889 #
2890 interface(`files_dontaudit_setattr_etc_runtime_files',`
2891         gen_require(`
2892                 type etc_runtime_t;
2893         ')
2894
2895         dontaudit $1 etc_runtime_t:file setattr;
2896 ')
2897
2898 ########################################
2899 ## <summary>
2900 ##      Do not audit attempts to read files
2901 ##      in /etc that are dynamically
2902 ##      created on boot, such as mtab.
2903 ## </summary>
2904 ## <param name="domain">
2905 ##      <summary>
2906 ##      Domain to not audit.
2907 ##      </summary>
2908 ## </param>
2909 #
2910 interface(`files_dontaudit_read_etc_runtime_files',`
2911         gen_require(`
2912                 type etc_runtime_t;
2913         ')
2914
2915         dontaudit $1 etc_runtime_t:file { getattr read };
2916 ')
2917
2918 ########################################
2919 ## <summary>
2920 ##      Read and write files in /etc that are dynamically
2921 ##      created on boot, such as mtab.
2922 ## </summary>
2923 ## <param name="domain">
2924 ##      <summary>
2925 ##      Domain allowed access.
2926 ##      </summary>
2927 ## </param>
2928 ## <rolecap/>
2929 #
2930 interface(`files_rw_etc_runtime_files',`
2931         gen_require(`
2932                 type etc_t, etc_runtime_t;
2933         ')
2934
2935         allow $1 etc_t:dir list_dir_perms;
2936         rw_files_pattern($1, etc_t, etc_runtime_t)
2937         read_lnk_files_pattern($1, etc_t, etc_t)
2938 ')
2939
2940 ########################################
2941 ## <summary>
2942 ##      Create, read, write, and delete files in
2943 ##      /etc that are dynamically created on boot,
2944 ##      such as mtab.
2945 ## </summary>
2946 ## <param name="domain">
2947 ##      <summary>
2948 ##      Domain allowed access.
2949 ##      </summary>
2950 ## </param>
2951 ## <rolecap/>
2952 #
2953 interface(`files_manage_etc_runtime_files',`
2954         gen_require(`
2955                 type etc_t, etc_runtime_t;
2956         ')
2957
2958         manage_files_pattern($1, { etc_t etc_runtime_t }, etc_runtime_t)
2959         read_lnk_files_pattern($1, etc_t, etc_runtime_t)
2960 ')
2961
2962 ########################################
2963 ## <summary>
2964 ##      Create, etc runtime objects with an automatic
2965 ##      type transition.
2966 ## </summary>
2967 ## <param name="domain">
2968 ##      <summary>
2969 ##      Domain allowed access.
2970 ##      </summary>
2971 ## </param>
2972 ## <param name="object">
2973 ##      <summary>
2974 ##      The class of the object being created.
2975 ##      </summary>
2976 ## </param>
2977 #
2978 interface(`files_etc_filetrans_etc_runtime',`
2979         gen_require(`
2980                 type etc_t, etc_runtime_t;
2981         ')
2982
2983         filetrans_pattern($1, etc_t, etc_runtime_t, $2)
2984 ')
2985
2986 ########################################
2987 ## <summary>
2988 ##      Getattr of directories on new filesystems
2989 ##      that have not yet been labeled.
2990 ## </summary>
2991 ## <param name="domain">
2992 ##      <summary>
2993 ##      Domain allowed access.
2994 ##      </summary>
2995 ## </param>
2996 #
2997 interface(`files_getattr_isid_type_dirs',`
2998         gen_require(`
2999                 type file_t;
3000         ')
3001
3002         allow $1 file_t:dir getattr;
3003 ')
3004
3005 ########################################
3006 ## <summary>
3007 ##      Do not audit attempts to search directories on new filesystems
3008 ##      that have not yet been labeled.
3009 ## </summary>
3010 ## <param name="domain">
3011 ##      <summary>
3012 ##      Domain to not audit.
3013 ##      </summary>
3014 ## </param>
3015 #
3016 interface(`files_dontaudit_search_isid_type_dirs',`
3017         gen_require(`
3018                 type file_t;
3019         ')
3020
3021         dontaudit $1 file_t:dir search_dir_perms;
3022 ')
3023
3024 ########################################
3025 ## <summary>
3026 ##      List the contents of directories on new filesystems
3027 ##      that have not yet been labeled.
3028 ## </summary>
3029 ## <param name="domain">
3030 ##      <summary>
3031 ##      Domain allowed access.
3032 ##      </summary>
3033 ## </param>
3034 #
3035 interface(`files_list_isid_type_dirs',`
3036         gen_require(`
3037                 type file_t;
3038         ')
3039
3040         allow $1 file_t:dir list_dir_perms;
3041 ')
3042
3043 ########################################
3044 ## <summary>
3045 ##      Read and write directories on new filesystems
3046 ##      that have not yet been labeled.
3047 ## </summary>
3048 ## <param name="domain">
3049 ##      <summary>
3050 ##      Domain allowed access.
3051 ##      </summary>
3052 ## </param>
3053 #
3054 interface(`files_rw_isid_type_dirs',`
3055         gen_require(`
3056                 type file_t;
3057         ')
3058
3059         allow $1 file_t:dir rw_dir_perms;
3060 ')
3061
3062 ########################################
3063 ## <summary>
3064 ##      Delete directories on new filesystems
3065 ##      that have not yet been labeled.
3066 ## </summary>
3067 ## <param name="domain">
3068 ##      <summary>
3069 ##      Domain allowed access.
3070 ##      </summary>
3071 ## </param>
3072 #
3073 interface(`files_delete_isid_type_dirs',`
3074         gen_require(`
3075                 type file_t;
3076         ')
3077
3078         delete_dirs_pattern($1, file_t, file_t)
3079 ')
3080
3081 ########################################
3082 ## <summary>
3083 ##      Create, read, write, and delete directories
3084 ##      on new filesystems that have not yet been labeled.
3085 ## </summary>
3086 ## <param name="domain">
3087 ##      <summary>
3088 ##      Domain allowed access.
3089 ##      </summary>
3090 ## </param>
3091 #
3092 interface(`files_manage_isid_type_dirs',`
3093         gen_require(`
3094                 type file_t;
3095         ')
3096
3097         allow $1 file_t:dir manage_dir_perms;
3098 ')
3099
3100 ########################################
3101 ## <summary>
3102 ##      Mount a filesystem on a directory on new filesystems
3103 ##      that has not yet been labeled.
3104 ## </summary>
3105 ## <param name="domain">
3106 ##      <summary>
3107 ##      Domain allowed access.
3108 ##      </summary>
3109 ## </param>
3110 #
3111 interface(`files_mounton_isid_type_dirs',`
3112         gen_require(`
3113                 type file_t;
3114         ')
3115
3116         allow $1 file_t:dir { search_dir_perms mounton };
3117 ')
3118
3119 ########################################
3120 ## <summary>
3121 ##      Read files on new filesystems
3122 ##      that have not yet been labeled.
3123 ## </summary>
3124 ## <param name="domain">
3125 ##      <summary>
3126 ##      Domain allowed access.
3127 ##      </summary>
3128 ## </param>
3129 #
3130 interface(`files_read_isid_type_files',`
3131         gen_require(`
3132                 type file_t;
3133         ')
3134
3135         allow $1 file_t:file read_file_perms;
3136 ')
3137
3138 ########################################
3139 ## <summary>
3140 ##      Delete files on new filesystems
3141 ##      that have not yet been labeled.
3142 ## </summary>
3143 ## <param name="domain">
3144 ##      <summary>
3145 ##      Domain allowed access.
3146 ##      </summary>
3147 ## </param>
3148 #
3149 interface(`files_delete_isid_type_files',`
3150         gen_require(`
3151                 type file_t;
3152         ')
3153
3154         delete_files_pattern($1, file_t, file_t)
3155 ')
3156
3157 ########################################
3158 ## <summary>
3159 ##      Delete symbolic links on new filesystems
3160 ##      that have not yet been labeled.
3161 ## </summary>
3162 ## <param name="domain">
3163 ##      <summary>
3164 ##      Domain allowed access.
3165 ##      </summary>
3166 ## </param>
3167 #
3168 interface(`files_delete_isid_type_symlinks',`
3169         gen_require(`
3170                 type file_t;
3171         ')
3172
3173         delete_lnk_files_pattern($1, file_t, file_t)
3174 ')
3175
3176 ########################################
3177 ## <summary>
3178 ##      Delete named pipes on new filesystems
3179 ##      that have not yet been labeled.
3180 ## </summary>
3181 ## <param name="domain">
3182 ##      <summary>
3183 ##      Domain allowed access.
3184 ##      </summary>
3185 ## </param>
3186 #
3187 interface(`files_delete_isid_type_fifo_files',`
3188         gen_require(`
3189                 type file_t;
3190         ')
3191
3192         delete_fifo_files_pattern($1, file_t, file_t)
3193 ')
3194
3195 ########################################
3196 ## <summary>
3197 ##      Delete named sockets on new filesystems
3198 ##      that have not yet been labeled.
3199 ## </summary>
3200 ## <param name="domain">
3201 ##      <summary>
3202 ##      Domain allowed access.
3203 ##      </summary>
3204 ## </param>
3205 #
3206 interface(`files_delete_isid_type_sock_files',`
3207         gen_require(`
3208                 type file_t;
3209         ')
3210
3211         delete_sock_files_pattern($1, file_t, file_t)
3212 ')
3213
3214 ########################################
3215 ## <summary>
3216 ##      Delete block files on new filesystems
3217 ##      that have not yet been labeled.
3218 ## </summary>
3219 ## <param name="domain">
3220 ##      <summary>
3221 ##      Domain allowed access.
3222 ##      </summary>
3223 ## </param>
3224 #
3225 interface(`files_delete_isid_type_blk_files',`
3226         gen_require(`
3227                 type file_t;
3228         ')
3229
3230         delete_blk_files_pattern($1, file_t, file_t)
3231 ')
3232
3233 ########################################
3234 ## <summary>
3235 ##      Do not audit attempts to write to character
3236 ##      files that have not yet been labeled.
3237 ## </summary>
3238 ## <param name="domain">
3239 ##      <summary>
3240 ##      Domain to not audit.
3241 ##      </summary>
3242 ## </param>
3243 #
3244 interface(`files_dontaudit_write_isid_chr_files',`
3245         gen_require(`
3246                 type file_t;
3247         ')
3248
3249         dontaudit $1 file_t:chr_file write;
3250 ')
3251
3252 ########################################
3253 ## <summary>
3254 ##      Delete chr files on new filesystems
3255 ##      that have not yet been labeled.
3256 ## </summary>
3257 ## <param name="domain">
3258 ##      <summary>
3259 ##      Domain allowed access.
3260 ##      </summary>
3261 ## </param>
3262 #
3263 interface(`files_delete_isid_type_chr_files',`
3264         gen_require(`
3265                 type file_t;
3266         ')
3267
3268         delete_chr_files_pattern($1, file_t, file_t)
3269 ')
3270
3271 ########################################
3272 ## <summary>
3273 ##      Create, read, write, and delete files
3274 ##      on new filesystems that have not yet been labeled.
3275 ## </summary>
3276 ## <param name="domain">
3277 ##      <summary>
3278 ##      Domain allowed access.
3279 ##      </summary>
3280 ## </param>
3281 #
3282 interface(`files_manage_isid_type_files',`
3283         gen_require(`
3284                 type file_t;
3285         ')
3286
3287         allow $1 file_t:file manage_file_perms;
3288 ')
3289
3290 ########################################
3291 ## <summary>
3292 ##      Create, read, write, and delete symbolic links
3293 ##      on new filesystems that have not yet been labeled.
3294 ## </summary>
3295 ## <param name="domain">
3296 ##      <summary>
3297 ##      Domain allowed access.
3298 ##      </summary>
3299 ## </param>
3300 #
3301 interface(`files_manage_isid_type_symlinks',`
3302         gen_require(`
3303                 type file_t;
3304         ')
3305
3306         allow $1 file_t:lnk_file manage_lnk_file_perms;
3307 ')
3308
3309 ########################################
3310 ## <summary>
3311 ##      Read and write block device nodes on new filesystems
3312 ##      that have not yet been labeled.
3313 ## </summary>
3314 ## <param name="domain">
3315 ##      <summary>
3316 ##      Domain allowed access.
3317 ##      </summary>
3318 ## </param>
3319 #
3320 interface(`files_rw_isid_type_blk_files',`
3321         gen_require(`
3322                 type file_t;
3323         ')
3324
3325         allow $1 file_t:blk_file rw_blk_file_perms;
3326 ')
3327
3328 ########################################
3329 ## <summary>
3330 ##      Create, read, write, and delete block device nodes
3331 ##      on new filesystems that have not yet been labeled.
3332 ## </summary>
3333 ## <param name="domain">
3334 ##      <summary>
3335 ##      Domain allowed access.
3336 ##      </summary>
3337 ## </param>
3338 #
3339 interface(`files_manage_isid_type_blk_files',`
3340         gen_require(`
3341                 type file_t;
3342         ')
3343
3344         allow $1 file_t:blk_file manage_blk_file_perms;
3345 ')
3346
3347 ########################################
3348 ## <summary>
3349 ##      Create, read, write, and delete character device nodes
3350 ##      on new filesystems that have not yet been labeled.
3351 ## </summary>
3352 ## <param name="domain">
3353 ##      <summary>
3354 ##      Domain allowed access.
3355 ##      </summary>
3356 ## </param>
3357 #
3358 interface(`files_manage_isid_type_chr_files',`
3359         gen_require(`
3360                 type file_t;
3361         ')
3362
3363         allow $1 file_t:chr_file manage_chr_file_perms;
3364 ')
3365
3366 ########################################
3367 ## <summary>
3368 ##      Get the attributes of the home directories root
3369 ##      (/home).
3370 ## </summary>
3371 ## <param name="domain">
3372 ##      <summary>
3373 ##      Domain allowed access.
3374 ##      </summary>
3375 ## </param>
3376 #
3377 interface(`files_getattr_home_dir',`
3378         gen_require(`
3379                 type home_root_t;
3380         ')
3381
3382         allow $1 home_root_t:dir getattr;
3383         allow $1 home_root_t:lnk_file getattr;
3384 ')
3385
3386 ########################################
3387 ## <summary>
3388 ##      Do not audit attempts to get the
3389 ##      attributes of the home directories root
3390 ##      (/home).
3391 ## </summary>
3392 ## <param name="domain">
3393 ##      <summary>
3394 ##      Domain to not audit.
3395 ##      </summary>
3396 ## </param>
3397 #
3398 interface(`files_dontaudit_getattr_home_dir',`
3399         gen_require(`
3400                 type home_root_t;
3401         ')
3402
3403         dontaudit $1 home_root_t:dir getattr;
3404         dontaudit $1 home_root_t:lnk_file getattr;
3405 ')
3406
3407 ########################################
3408 ## <summary>
3409 ##      Search home directories root (/home).
3410 ## </summary>
3411 ## <param name="domain">
3412 ##      <summary>
3413 ##      Domain allowed access.
3414 ##      </summary>
3415 ## </param>
3416 #
3417 interface(`files_search_home',`
3418         gen_require(`
3419                 type home_root_t;
3420         ')
3421
3422         allow $1 home_root_t:dir search_dir_perms;
3423         allow $1 home_root_t:lnk_file read_lnk_file_perms;
3424 ')
3425
3426 ########################################
3427 ## <summary>
3428 ##      Do not audit attempts to search
3429 ##      home directories root (/home).
3430 ## </summary>
3431 ## <param name="domain">
3432 ##      <summary>
3433 ##      Domain to not audit.
3434 ##      </summary>
3435 ## </param>
3436 #
3437 interface(`files_dontaudit_search_home',`
3438         gen_require(`
3439                 type home_root_t;
3440         ')
3441
3442         dontaudit $1 home_root_t:dir search_dir_perms;
3443         dontaudit $1 home_root_t:lnk_file read_lnk_file_perms;
3444 ')
3445
3446 ########################################
3447 ## <summary>
3448 ##      Do not audit attempts to list
3449 ##      home directories root (/home).
3450 ## </summary>
3451 ## <param name="domain">
3452 ##      <summary>
3453 ##      Domain to not audit.
3454 ##      </summary>
3455 ## </param>
3456 #
3457 interface(`files_dontaudit_list_home',`
3458         gen_require(`
3459                 type home_root_t;
3460         ')
3461
3462         dontaudit $1 home_root_t:dir list_dir_perms;
3463         dontaudit $1 home_root_t:lnk_file read_lnk_file_perms;
3464 ')
3465
3466 ########################################
3467 ## <summary>
3468 ##      Get listing of home directories.
3469 ## </summary>
3470 ## <param name="domain">
3471 ##      <summary>
3472 ##      Domain allowed access.
3473 ##      </summary>
3474 ## </param>
3475 #
3476 interface(`files_list_home',`
3477         gen_require(`
3478                 type home_root_t;
3479         ')
3480
3481         allow $1 home_root_t:dir list_dir_perms;
3482         allow $1 home_root_t:lnk_file read_lnk_file_perms;
3483 ')
3484
3485 ########################################
3486 ## <summary>
3487 ##      Relabel to user home root (/home).
3488 ## </summary>
3489 ## <param name="domain">
3490 ##      <summary>
3491 ##      Domain allowed access.
3492 ##      </summary>
3493 ## </param>
3494 #
3495 interface(`files_relabelto_home',`
3496         gen_require(`
3497                 type home_root_t;
3498         ')
3499
3500         allow $1 home_root_t:dir relabelto;
3501 ')
3502
3503 ########################################
3504 ## <summary>
3505 ##      Create objects in /home.
3506 ## </summary>
3507 ## <param name="domain">
3508 ##      <summary>
3509 ##      Domain allowed access.
3510 ##      </summary>
3511 ## </param>
3512 ## <param name="home_type">
3513 ##      <summary>
3514 ##      The private type.
3515 ##      </summary>
3516 ## </param>
3517 ## <param name="object">
3518 ##      <summary>
3519 ##      The class of the object being created.
3520 ##      </summary>
3521 ## </param>
3522 #
3523 interface(`files_home_filetrans',`
3524         gen_require(`
3525                 type home_root_t;
3526         ')
3527
3528         filetrans_pattern($1, home_root_t, $2, $3, $4)
3529 ')
3530
3531 ########################################
3532 ## <summary>
3533 ##      Get the attributes of lost+found directories.
3534 ## </summary>
3535 ## <param name="domain">
3536 ##      <summary>
3537 ##      Domain allowed access.
3538 ##      </summary>
3539 ## </param>
3540 #
3541 interface(`files_getattr_lost_found_dirs',`
3542         gen_require(`
3543                 type lost_found_t;
3544         ')
3545
3546         allow $1 lost_found_t:dir getattr;
3547 ')
3548
3549 ########################################
3550 ## <summary>
3551 ##      Do not audit attempts to get the attributes of
3552 ##      lost+found directories.
3553 ## </summary>
3554 ## <param name="domain">
3555 ##      <summary>
3556 ##      Domain to not audit.
3557 ##      </summary>
3558 ## </param>
3559 #
3560 interface(`files_dontaudit_getattr_lost_found_dirs',`
3561         gen_require(`
3562                 type lost_found_t;
3563         ')
3564
3565         dontaudit $1 lost_found_t:dir getattr;
3566 ')
3567
3568 #######################################
3569 ## <summary>
3570 ##      List the contents of lost+found directories.
3571 ## </summary>
3572 ## <param name="domain">
3573 ##      <summary>
3574 ##      Domain allowed access.
3575 ##      </summary>
3576 ## </param>
3577 #
3578 interface(`files_list_lost_found',`
3579         gen_require(`
3580                 type lost_found_t;
3581         ')
3582
3583         allow $1 lost_found_t:dir list_dir_perms;
3584 ')
3585
3586 ########################################
3587 ## <summary>
3588 ##      Create, read, write, and delete objects in
3589 ##      lost+found directories.
3590 ## </summary>
3591 ## <param name="domain">
3592 ##      <summary>
3593 ##      Domain allowed access.
3594 ##      </summary>
3595 ## </param>
3596 ## <rolecap/>
3597 #
3598 interface(`files_manage_lost_found',`
3599         gen_require(`
3600                 type lost_found_t;
3601         ')
3602
3603         manage_dirs_pattern($1, lost_found_t, lost_found_t)
3604         manage_files_pattern($1, lost_found_t, lost_found_t)
3605         manage_lnk_files_pattern($1, lost_found_t, lost_found_t)
3606         manage_fifo_files_pattern($1, lost_found_t, lost_found_t)
3607         manage_sock_files_pattern($1, lost_found_t, lost_found_t)
3608 ')
3609
3610 ########################################
3611 ## <summary>
3612 ##      Search the contents of /mnt.
3613 ## </summary>
3614 ## <param name="domain">
3615 ##      <summary>
3616 ##      Domain allowed access.
3617 ##      </summary>
3618 ## </param>
3619 #
3620 interface(`files_search_mnt',`
3621         gen_require(`
3622                 type mnt_t;
3623         ')
3624
3625         allow $1 mnt_t:dir search_dir_perms;
3626 ')
3627
3628 ########################################
3629 ## <summary>
3630 ##      Do not audit attempts to search /mnt.
3631 ## </summary>
3632 ## <param name="domain">
3633 ##      <summary>
3634 ##      Domain to not audit.
3635 ##      </summary>
3636 ## </param>
3637 #
3638 interface(`files_dontaudit_search_mnt',`
3639         gen_require(`
3640                 type mnt_t;
3641         ')
3642
3643         dontaudit $1 mnt_t:dir search_dir_perms;
3644 ')
3645
3646 ########################################
3647 ## <summary>
3648 ##      List the contents of /mnt.
3649 ## </summary>
3650 ## <param name="domain">
3651 ##      <summary>
3652 ##      Domain allowed access.
3653 ##      </summary>
3654 ## </param>
3655 #
3656 interface(`files_list_mnt',`
3657         gen_require(`
3658                 type mnt_t;
3659         ')
3660
3661         allow $1 mnt_t:dir list_dir_perms;
3662 ')
3663
3664 ######################################
3665 ## <summary>
3666 ##  dontaudit List the contents of /mnt.
3667 ## </summary>
3668 ## <param name="domain">
3669 ##  <summary>
3670 ##      Domain to not audit.
3671 ##  </summary>
3672 ## </param>
3673 #
3674 interface(`files_dontaudit_list_mnt',`
3675     gen_require(`
3676         type mnt_t;
3677     ')
3678
3679     dontaudit $1 mnt_t:dir list_dir_perms;
3680 ')
3681
3682 ########################################
3683 ## <summary>
3684 ##      Do not audit attempts to check the
3685 ##      write access on mnt files
3686 ## </summary>
3687 ## <param name="domain">
3688 ##      <summary>
3689 ##      Domain to not audit.
3690 ##      </summary>
3691 ## </param>
3692 #
3693 interface(`files_dontaudit_access_check_mnt',`
3694         gen_require(`
3695                 type mnt_t;
3696         ')
3697         dontaudit $1 mnt_t:file_class_set audit_access;
3698 ')
3699
3700 ########################################
3701 ## <summary>
3702 ##      Mount a filesystem on /mnt.
3703 ## </summary>
3704 ## <param name="domain">
3705 ##      <summary>
3706 ##      Domain allowed access.
3707 ##      </summary>
3708 ## </param>
3709 #
3710 interface(`files_mounton_mnt',`
3711         gen_require(`
3712                 type mnt_t;
3713         ')
3714
3715         allow $1 mnt_t:dir { search_dir_perms mounton };
3716 ')
3717
3718 ########################################
3719 ## <summary>
3720 ##      Create, read, write, and delete directories in /mnt.
3721 ## </summary>
3722 ## <param name="domain">
3723 ##      <summary>
3724 ##      Domain allowed access.
3725 ##      </summary>
3726 ## </param>
3727 ## <rolecap/>
3728 #
3729 interface(`files_manage_mnt_dirs',`
3730         gen_require(`
3731                 type mnt_t;
3732         ')
3733
3734         allow $1 mnt_t:dir manage_dir_perms;
3735 ')
3736
3737 ########################################
3738 ## <summary>
3739 ##      Create, read, write, and delete files in /mnt.
3740 ## </summary>
3741 ## <param name="domain">
3742 ##      <summary>
3743 ##      Domain allowed access.
3744 ##      </summary>
3745 ## </param>
3746 #
3747 interface(`files_manage_mnt_files',`
3748         gen_require(`
3749                 type mnt_t;
3750         ')
3751
3752         manage_files_pattern($1, mnt_t, mnt_t)
3753 ')
3754
3755 ########################################
3756 ## <summary>
3757 ##      read files in /mnt.
3758 ## </summary>
3759 ## <param name="domain">
3760 ##      <summary>
3761 ##      Domain allowed access.
3762 ##      </summary>
3763 ## </param>
3764 #
3765 interface(`files_read_mnt_files',`
3766         gen_require(`
3767                 type mnt_t;
3768         ')
3769
3770         read_files_pattern($1, mnt_t, mnt_t)
3771 ')
3772
3773 ######################################
3774 ## <summary>
3775 ##      Read symbolic links in /mnt.
3776 ## </summary>
3777 ## <param name="domain">
3778 ##      <summary>
3779 ##      Domain allowed access.
3780 ##      </summary>
3781 ## </param>
3782 #
3783 interface(`files_read_mnt_symlinks',`
3784         gen_require(`
3785                 type mnt_t;
3786         ')
3787
3788         read_lnk_files_pattern($1, mnt_t, mnt_t)
3789 ')
3790
3791 ########################################
3792 ## <summary>
3793 ##      Create, read, write, and delete symbolic links in /mnt.
3794 ## </summary>
3795 ## <param name="domain">
3796 ##      <summary>
3797 ##      Domain allowed access.
3798 ##      </summary>
3799 ## </param>
3800 #
3801 interface(`files_manage_mnt_symlinks',`
3802         gen_require(`
3803                 type mnt_t;
3804         ')
3805
3806         manage_lnk_files_pattern($1, mnt_t, mnt_t)
3807 ')
3808
3809 ########################################
3810 ## <summary>
3811 ##      Search the contents of the kernel module directories.
3812 ## </summary>
3813 ## <param name="domain">
3814 ##      <summary>
3815 ##      Domain allowed access.
3816 ##      </summary>
3817 ## </param>
3818 #
3819 interface(`files_search_kernel_modules',`
3820         gen_require(`
3821                 type modules_object_t;
3822         ')
3823
3824         allow $1 modules_object_t:dir search_dir_perms;
3825         read_lnk_files_pattern($1, modules_object_t, modules_object_t)
3826 ')
3827
3828 ########################################
3829 ## <summary>
3830 ##      List the contents of the kernel module directories.
3831 ## </summary>
3832 ## <param name="domain">
3833 ##      <summary>
3834 ##      Domain allowed access.
3835 ##      </summary>
3836 ## </param>
3837 #
3838 interface(`files_list_kernel_modules',`
3839         gen_require(`
3840                 type modules_object_t;
3841         ')
3842
3843         allow $1 modules_object_t:dir list_dir_perms;
3844 ')
3845
3846 ########################################
3847 ## <summary>
3848 ##      Get the attributes of kernel module files.
3849 ## </summary>
3850 ## <param name="domain">
3851 ##      <summary>
3852 ##      Domain allowed access.
3853 ##      </summary>
3854 ## </param>
3855 #
3856 interface(`files_getattr_kernel_modules',`
3857         gen_require(`
3858                 type modules_object_t;
3859         ')
3860
3861         getattr_files_pattern($1, modules_object_t, modules_object_t)
3862 ')
3863
3864 ########################################
3865 ## <summary>
3866 ##      Read kernel module files.
3867 ## </summary>
3868 ## <param name="domain">
3869 ##      <summary>
3870 ##      Domain allowed access.
3871 ##      </summary>
3872 ## </param>
3873 #
3874 interface(`files_read_kernel_modules',`
3875         gen_require(`
3876                 type modules_object_t;
3877         ')
3878
3879         allow $1 modules_object_t:dir list_dir_perms;
3880         read_files_pattern($1, modules_object_t, modules_object_t)
3881         read_lnk_files_pattern($1, modules_object_t, modules_object_t)
3882 ')
3883
3884 ########################################
3885 ## <summary>
3886 ##      Write kernel module files.
3887 ## </summary>
3888 ## <param name="domain">
3889 ##      <summary>
3890 ##      Domain allowed access.
3891 ##      </summary>
3892 ## </param>
3893 #
3894 interface(`files_write_kernel_modules',`
3895         gen_require(`
3896                 type modules_object_t;
3897         ')
3898
3899         allow $1 modules_object_t:dir list_dir_perms;
3900         write_files_pattern($1, modules_object_t, modules_object_t)
3901 ')
3902
3903 ########################################
3904 ## <summary>
3905 ##      Delete kernel module files.
3906 ## </summary>
3907 ## <param name="domain">
3908 ##      <summary>
3909 ##      Domain allowed access.
3910 ##      </summary>
3911 ## </param>
3912 #
3913 interface(`files_delete_kernel_modules',`
3914         gen_require(`
3915                 type modules_object_t;
3916         ')
3917
3918         delete_files_pattern($1, modules_object_t, modules_object_t)
3919 ')
3920
3921 ########################################
3922 ## <summary>
3923 ##      Create, read, write, and delete
3924 ##      kernel module files.
3925 ## </summary>
3926 ## <param name="domain">
3927 ##      <summary>
3928 ##      Domain allowed access.
3929 ##      </summary>
3930 ## </param>
3931 ## <rolecap/>
3932 #
3933 interface(`files_manage_kernel_modules',`
3934         gen_require(`
3935                 type modules_object_t;
3936         ')
3937
3938         manage_files_pattern($1, modules_object_t, modules_object_t)
3939 ')
3940
3941 ########################################
3942 ## <summary>
3943 ##      Relabel from and to kernel module files.
3944 ## </summary>
3945 ## <param name="domain">
3946 ##      <summary>
3947 ##      Domain allowed access.
3948 ##      </summary>
3949 ## </param>
3950 #
3951 interface(`files_relabel_kernel_modules',`
3952         gen_require(`
3953                 type modules_object_t;
3954         ')
3955
3956         relabel_files_pattern($1, modules_object_t, modules_object_t)
3957         allow $1 modules_object_t:dir list_dir_perms;
3958 ')
3959
3960 ########################################
3961 ## <summary>
3962 ##      Create objects in the kernel module directories
3963 ##      with a private type via an automatic type transition.
3964 ## </summary>
3965 ## <param name="domain">
3966 ##      <summary>
3967 ##      Domain allowed access.
3968 ##      </summary>
3969 ## </param>
3970 ## <param name="private_type">
3971 ##      <summary>
3972 ##      The type of the object to be created.
3973 ##      </summary>
3974 ## </param>
3975 ## <param name="object_class">
3976 ##      <summary>
3977 ##      The object class of the object being created.
3978 ##      </summary>
3979 ## </param>
3980 #
3981 interface(`files_kernel_modules_filetrans',`
3982         gen_require(`
3983                 type modules_object_t;
3984         ')
3985
3986         filetrans_pattern($1, modules_object_t, $2, $3, $4)
3987 ')
3988
3989 ########################################
3990 ## <summary>
3991 ##      List world-readable directories.
3992 ## </summary>
3993 ## <param name="domain">
3994 ##      <summary>
3995 ##      Domain allowed access.
3996 ##      </summary>
3997 ## </param>
3998 ## <rolecap/>
3999 #
4000 interface(`files_list_world_readable',`
4001         gen_require(`
4002                 type readable_t;
4003         ')
4004
4005         allow $1 readable_t:dir list_dir_perms;
4006 ')
4007
4008 ########################################
4009 ## <summary>
4010 ##      Read world-readable files.
4011 ## </summary>
4012 ## <param name="domain">
4013 ##      <summary>
4014 ##      Domain allowed access.
4015 ##      </summary>
4016 ## </param>
4017 ## <rolecap/>
4018 #
4019 interface(`files_read_world_readable_files',`
4020         gen_require(`
4021                 type readable_t;
4022         ')
4023
4024         allow $1 readable_t:file read_file_perms;
4025 ')
4026
4027 ########################################
4028 ## <summary>
4029 ##      Read world-readable symbolic links.
4030 ## </summary>
4031 ## <param name="domain">
4032 ##      <summary>
4033 ##      Domain allowed access.
4034 ##      </summary>
4035 ## </param>
4036 ## <rolecap/>
4037 #
4038 interface(`files_read_world_readable_symlinks',`
4039         gen_require(`
4040                 type readable_t;
4041         ')
4042
4043         allow $1 readable_t:lnk_file read_lnk_file_perms;
4044 ')
4045
4046 ########################################
4047 ## <summary>
4048 ##      Read world-readable named pipes.
4049 ## </summary>
4050 ## <param name="domain">
4051 ##      <summary>
4052 ##      Domain allowed access.
4053 ##      </summary>
4054 ## </param>
4055 #
4056 interface(`files_read_world_readable_pipes',`
4057         gen_require(`
4058                 type readable_t;
4059         ')
4060
4061         allow $1 readable_t:fifo_file read_fifo_file_perms;
4062 ')
4063
4064 ########################################
4065 ## <summary>
4066 ##      Read world-readable sockets.
4067 ## </summary>
4068 ## <param name="domain">
4069 ##      <summary>
4070 ##      Domain allowed access.
4071 ##      </summary>
4072 ## </param>
4073 #
4074 interface(`files_read_world_readable_sockets',`
4075         gen_require(`
4076                 type readable_t;
4077         ')
4078
4079         allow $1 readable_t:sock_file read_sock_file_perms;
4080 ')
4081
4082 #######################################
4083 ## <summary>
4084 ##  Read manageable system configuration files in /etc
4085 ## </summary>
4086 ## <param name="domain">
4087 ##  <summary>
4088 ##  Domain allowed access.
4089 ##  </summary>
4090 ## </param>
4091 #
4092 interface(`files_read_system_conf_files',`
4093     gen_require(`
4094         type etc_t, system_conf_t;
4095     ')
4096
4097     allow $1 etc_t:dir list_dir_perms;
4098     read_files_pattern($1, etc_t, system_conf_t)
4099     read_lnk_files_pattern($1, etc_t, system_conf_t)
4100 ')
4101
4102 ######################################
4103 ## <summary>
4104 ##  Manage manageable system configuration files in /etc.
4105 ## </summary>
4106 ## <param name="domain">
4107 ##  <summary>
4108 ##  Domain allowed access.
4109 ##  </summary>
4110 ## </param>
4111 #
4112 interface(`files_manage_system_conf_files',`
4113     gen_require(`
4114         type etc_t, system_conf_t;
4115     ')
4116
4117     manage_files_pattern($1, { etc_t system_conf_t }, system_conf_t)
4118 ')
4119
4120 ######################################
4121 ## <summary>
4122 ##  Relabel manageable system configuration files in /etc.
4123 ## </summary>
4124 ## <param name="domain">
4125 ##  <summary>
4126 ##  Domain allowed access.
4127 ##  </summary>
4128 ## </param>
4129 #
4130 interface(`files_relabelto_system_conf_files',`
4131     gen_require(`
4132         type usr_t;
4133     ')
4134
4135     relabelto_files_pattern($1, system_conf_t, system_conf_t)
4136 ')
4137
4138 ######################################
4139 ## <summary>
4140 ##  Relabel manageable system configuration files in /etc.
4141 ## </summary>
4142 ## <param name="domain">
4143 ##  <summary>
4144 ##  Domain allowed access.
4145 ##  </summary>
4146 ## </param>
4147 #
4148 interface(`files_relabelfrom_system_conf_files',`
4149     gen_require(`
4150         type usr_t;
4151     ')
4152
4153     relabelfrom_files_pattern($1, system_conf_t, system_conf_t)
4154 ')
4155
4156 ###################################
4157 ## <summary>
4158 ##  Create files in /etc with the type used for
4159 ##  the manageable system config files.
4160 ## </summary>
4161 ## <param name="domain">
4162 ##  <summary>
4163 ##  The type of the process performing this action.
4164 ##  </summary>
4165 ## </param>
4166 #
4167 interface(`files_etc_filetrans_system_conf',`
4168     gen_require(`
4169         type etc_t, system_conf_t;
4170     ')
4171
4172     filetrans_pattern($1, etc_t, system_conf_t, file)
4173 ')
4174
4175 ########################################
4176 ## <summary>
4177 ##      Allow the specified type to associate
4178 ##      to a filesystem with the type of the
4179 ##      temporary directory (/tmp).
4180 ## </summary>
4181 ## <param name="file_type">
4182 ##      <summary>
4183 ##      Type of the file to associate.
4184 ##      </summary>
4185 ## </param>
4186 #
4187 interface(`files_associate_tmp',`
4188         gen_require(`
4189                 type tmp_t;
4190         ')
4191
4192         allow $1 tmp_t:filesystem associate;
4193 ')
4194
4195 ########################################
4196 ## <summary>
4197 ##      Get the attributes of the tmp directory (/tmp).
4198 ## </summary>
4199 ## <param name="domain">
4200 ##      <summary>
4201 ##      Domain allowed access.
4202 ##      </summary>
4203 ## </param>
4204 #
4205 interface(`files_getattr_tmp_dirs',`
4206         gen_require(`
4207                 type tmp_t;
4208         ')
4209
4210         allow $1 tmp_t:dir getattr;
4211 ')
4212
4213 ########################################
4214 ## <summary>
4215 ##      Do not audit attempts to get the
4216 ##      attributes of the tmp directory (/tmp).
4217 ## </summary>
4218 ## <param name="domain">
4219 ##      <summary>
4220 ##      Domain to not audit.
4221 ##      </summary>
4222 ## </param>
4223 #
4224 interface(`files_dontaudit_getattr_tmp_dirs',`
4225         gen_require(`
4226                 type tmp_t;
4227         ')
4228
4229         dontaudit $1 tmp_t:dir getattr;
4230 ')
4231
4232 ########################################
4233 ## <summary>
4234 ##      Search the tmp directory (/tmp).
4235 ## </summary>
4236 ## <param name="domain">
4237 ##      <summary>
4238 ##      Domain allowed access.
4239 ##      </summary>
4240 ## </param>
4241 #
4242 interface(`files_search_tmp',`
4243         gen_require(`
4244                 type tmp_t;
4245         ')
4246
4247         allow $1 tmp_t:dir search_dir_perms;
4248 ')
4249
4250 ########################################
4251 ## <summary>
4252 ##      Do not audit attempts to search the tmp directory (/tmp).
4253 ## </summary>
4254 ## <param name="domain">
4255 ##      <summary>
4256 ##      Domain to not audit.
4257 ##      </summary>
4258 ## </param>
4259 #
4260 interface(`files_dontaudit_search_tmp',`
4261         gen_require(`
4262                 type tmp_t;
4263         ')
4264
4265         dontaudit $1 tmp_t:dir search_dir_perms;
4266 ')
4267
4268 ########################################
4269 ## <summary>
4270 ##      Read the tmp directory (/tmp).
4271 ## </summary>
4272 ## <param name="domain">
4273 ##      <summary>
4274 ##      Domain allowed access.
4275 ##      </summary>
4276 ## </param>
4277 #
4278 interface(`files_list_tmp',`
4279         gen_require(`
4280                 type tmp_t;
4281         ')
4282
4283         allow $1 tmp_t:dir list_dir_perms;
4284 ')
4285
4286 ########################################
4287 ## <summary>
4288 ##      Do not audit listing of the tmp directory (/tmp).
4289 ## </summary>
4290 ## <param name="domain">
4291 ##      <summary>
4292 ##      Domain to not audit.
4293 ##      </summary>
4294 ## </param>
4295 #
4296 interface(`files_dontaudit_list_tmp',`
4297         gen_require(`
4298                 type tmp_t;
4299         ')
4300
4301         dontaudit $1 tmp_t:dir list_dir_perms;
4302 ')
4303
4304 #######################################
4305 ## <summary>
4306 ##  Allow read and write to the tmp directory (/tmp).
4307 ## </summary>
4308 ## <param name="domain">
4309 ##  <summary>
4310 ##  Domain not to audit.
4311 ##  </summary>
4312 ## </param>
4313 #
4314 interface(`files_rw_generic_tmp_dir',`
4315     gen_require(`
4316         type tmp_t;
4317     ')
4318
4319     allow $1 tmp_t:dir rw_dir_perms;
4320 ')
4321
4322 ########################################
4323 ## <summary>
4324 ##      Remove entries from the tmp directory.
4325 ## </summary>
4326 ## <param name="domain">
4327 ##      <summary>
4328 ##      Domain allowed access.
4329 ##      </summary>
4330 ## </param>
4331 #
4332 interface(`files_delete_tmp_dir_entry',`
4333         gen_require(`
4334                 type tmp_t;
4335         ')
4336
4337         allow $1 tmp_t:dir del_entry_dir_perms;
4338 ')
4339
4340 ########################################
4341 ## <summary>
4342 ##      Read files in the tmp directory (/tmp).
4343 ## </summary>
4344 ## <param name="domain">
4345 ##      <summary>
4346 ##      Domain allowed access.
4347 ##      </summary>
4348 ## </param>
4349 #
4350 interface(`files_read_generic_tmp_files',`
4351         gen_require(`
4352                 type tmp_t;
4353         ')
4354
4355         read_files_pattern($1, tmp_t, tmp_t)
4356 ')
4357
4358 ########################################
4359 ## <summary>
4360 ##      Manage temporary directories in /tmp.
4361 ## </summary>
4362 ## <param name="domain">
4363 ##      <summary>
4364 ##      Domain allowed access.
4365 ##      </summary>
4366 ## </param>
4367 #
4368 interface(`files_manage_generic_tmp_dirs',`
4369         gen_require(`
4370                 type tmp_t;
4371         ')
4372
4373         manage_dirs_pattern($1, tmp_t, tmp_t)
4374 ')
4375
4376 ########################################
4377 ## <summary>
4378 ##      Allow shared library text relocations in tmp files.
4379 ## </summary>
4380 ## <desc>
4381 ##      <p>
4382 ##      Allow shared library text relocations in tmp files.
4383 ##      </p>
4384 ##      <p>
4385 ##      This is added to support java policy.
4386 ##      </p>
4387 ## </desc>
4388 ## <param name="domain">
4389 ##      <summary>
4390 ##      Domain allowed access.
4391 ##      </summary>
4392 ## </param>
4393 #
4394 interface(`files_execmod_tmp',`
4395         gen_require(`
4396                 attribute tmpfile;
4397         ')
4398
4399         allow $1 tmpfile:file execmod;
4400 ')
4401
4402 ########################################
4403 ## <summary>
4404 ##      Manage temporary files and directories in /tmp.
4405 ## </summary>
4406 ## <param name="domain">
4407 ##      <summary>
4408 ##      Domain allowed access.
4409 ##      </summary>
4410 ## </param>
4411 #
4412 interface(`files_manage_generic_tmp_files',`
4413         gen_require(`
4414                 type tmp_t;
4415         ')
4416
4417         manage_files_pattern($1, tmp_t, tmp_t)
4418 ')
4419
4420 ########################################
4421 ## <summary>
4422 ##      Read symbolic links in the tmp directory (/tmp).
4423 ## </summary>
4424 ## <param name="domain">
4425 ##      <summary>
4426 ##      Domain allowed access.
4427 ##      </summary>
4428 ## </param>
4429 #
4430 interface(`files_read_generic_tmp_symlinks',`
4431         gen_require(`
4432                 type tmp_t;
4433         ')
4434
4435         read_lnk_files_pattern($1, tmp_t, tmp_t)
4436 ')
4437
4438 ########################################
4439 ## <summary>
4440 ##      Read and write generic named sockets in the tmp directory (/tmp).
4441 ## </summary>
4442 ## <param name="domain">
4443 ##      <summary>
4444 ##      Domain allowed access.
4445 ##      </summary>
4446 ## </param>
4447 #
4448 interface(`files_rw_generic_tmp_sockets',`
4449         gen_require(`
4450                 type tmp_t;
4451         ')
4452
4453         rw_sock_files_pattern($1, tmp_t, tmp_t)
4454 ')
4455
4456 ########################################
4457 ## <summary>
4458 ##      Relabel a dir from the type used in /tmp.
4459 ## </summary>
4460 ## <param name="domain">
4461 ##      <summary>
4462 ##      Domain allowed access.
4463 ##      </summary>
4464 ## </param>
4465 #
4466 interface(`files_relabelfrom_tmp_dirs',`
4467         gen_require(`
4468                 type tmp_t;
4469         ')
4470
4471         relabelfrom_dirs_pattern($1, tmp_t, tmp_t)
4472 ')
4473
4474 ########################################
4475 ## <summary>
4476 ##      Relabel a file from the type used in /tmp.
4477 ## </summary>
4478 ## <param name="domain">
4479 ##      <summary>
4480 ##      Domain allowed access.
4481 ##      </summary>
4482 ## </param>
4483 #
4484 interface(`files_relabelfrom_tmp_files',`
4485         gen_require(`
4486                 type tmp_t;
4487         ')
4488
4489         relabelfrom_files_pattern($1, tmp_t, tmp_t)
4490 ')
4491
4492 ########################################
4493 ## <summary>
4494 ##      Set the attributes of all tmp directories.
4495 ## </summary>
4496 ## <param name="domain">
4497 ##      <summary>
4498 ##      Domain allowed access.
4499 ##      </summary>
4500 ## </param>
4501 #
4502 interface(`files_setattr_all_tmp_dirs',`
4503         gen_require(`
4504                 attribute tmpfile;
4505         ')
4506
4507         allow $1 tmpfile:dir { search_dir_perms setattr };
4508 ')
4509
4510 ########################################
4511 ## <summary>
4512 ##      List all tmp directories.
4513 ## </summary>
4514 ## <param name="domain">
4515 ##      <summary>
4516 ##      Domain allowed access.
4517 ##      </summary>
4518 ## </param>
4519 #
4520 interface(`files_list_all_tmp',`
4521         gen_require(`
4522                 attribute tmpfile;
4523         ')
4524
4525         allow $1 tmpfile:dir list_dir_perms;
4526 ')
4527
4528 ########################################
4529 ## <summary>
4530 ##      Relabel to and from all temporary
4531 ##      directory types.
4532 ## </summary>
4533 ## <param name="domain">
4534 ##      <summary>
4535 ##      Domain allowed access.
4536 ##      </summary>
4537 ## </param>
4538 ## <rolecap/>
4539 #
4540 interface(`files_relabel_all_tmp_dirs',`
4541         gen_require(`
4542                 attribute tmpfile;
4543                 type var_t;
4544         ')
4545
4546         allow $1 var_t:dir search_dir_perms;
4547         relabel_dirs_pattern($1, tmpfile, tmpfile)
4548 ')
4549
4550 ########################################
4551 ## <summary>
4552 ##      Do not audit attempts to get the attributes
4553 ##      of all tmp files.
4554 ## </summary>
4555 ## <param name="domain">
4556 ##      <summary>
4557 ##      Domain to not audit.
4558 ##      </summary>
4559 ## </param>
4560 #
4561 interface(`files_dontaudit_getattr_all_tmp_files',`
4562         gen_require(`
4563                 attribute tmpfile;
4564         ')
4565
4566         dontaudit $1 tmpfile:file getattr;
4567 ')
4568
4569 ########################################
4570 ## <summary>
4571 ##      Allow attempts to get the attributes
4572 ##      of all tmp files.
4573 ## </summary>
4574 ## <param name="domain">
4575 ##      <summary>
4576 ##      Domain allowed access.
4577 ##      </summary>
4578 ## </param>
4579 #
4580 interface(`files_getattr_all_tmp_files',`
4581         gen_require(`
4582                 attribute tmpfile;
4583         ')
4584
4585         allow $1 tmpfile:file getattr;
4586 ')
4587
4588 ########################################
4589 ## <summary>
4590 ##      Relabel to and from all temporary
4591 ##      file types.
4592 ## </summary>
4593 ## <param name="domain">
4594 ##      <summary>
4595 ##      Domain allowed access.
4596 ##      </summary>
4597 ## </param>
4598 ## <rolecap/>
4599 #
4600 interface(`files_relabel_all_tmp_files',`
4601         gen_require(`
4602                 attribute tmpfile;
4603                 type var_t;
4604         ')
4605
4606         allow $1 var_t:dir search_dir_perms;
4607         relabel_files_pattern($1, tmpfile, tmpfile)
4608 ')
4609
4610 ########################################
4611 ## <summary>
4612 ##      Do not audit attempts to get the attributes
4613 ##      of all tmp sock_file.
4614 ## </summary>
4615 ## <param name="domain">
4616 ##      <summary>
4617 ##      Domain to not audit.
4618 ##      </summary>
4619 ## </param>
4620 #
4621 interface(`files_dontaudit_getattr_all_tmp_sockets',`
4622         gen_require(`
4623                 attribute tmpfile;
4624         ')
4625
4626         dontaudit $1 tmpfile:sock_file getattr;
4627 ')
4628
4629 ########################################
4630 ## <summary>
4631 ##      Read all tmp files.
4632 ## </summary>
4633 ## <param name="domain">
4634 ##      <summary>
4635 ##      Domain allowed access.
4636 ##      </summary>
4637 ## </param>
4638 #
4639 interface(`files_read_all_tmp_files',`
4640         gen_require(`
4641                 attribute tmpfile;
4642         ')
4643
4644         read_files_pattern($1, tmpfile, tmpfile)
4645 ')
4646
4647 ########################################
4648 ## <summary>
4649 ##      Create an object in the tmp directories, with a private
4650 ##      type using a type transition.
4651 ## </summary>
4652 ## <param name="domain">
4653 ##      <summary>
4654 ##      Domain allowed access.
4655 ##      </summary>
4656 ## </param>
4657 ## <param name="private type">
4658 ##      <summary>
4659 ##      The type of the object to be created.
4660 ##      </summary>
4661 ## </param>
4662 ## <param name="object">
4663 ##      <summary>
4664 ##      The object class of the object being created.
4665 ##      </summary>
4666 ## </param>
4667 #
4668 interface(`files_tmp_filetrans',`
4669         gen_require(`
4670                 type tmp_t;
4671         ')
4672
4673         filetrans_pattern($1, tmp_t, $2, $3, $4)
4674 ')
4675
4676 ########################################
4677 ## <summary>
4678 ##      Delete the contents of /tmp.
4679 ## </summary>
4680 ## <param name="domain">
4681 ##      <summary>
4682 ##      Domain allowed access.
4683 ##      </summary>
4684 ## </param>
4685 #
4686 interface(`files_purge_tmp',`
4687         gen_require(`
4688                 attribute tmpfile;
4689         ')
4690
4691         allow $1 tmpfile:dir list_dir_perms;
4692         delete_dirs_pattern($1, tmpfile, tmpfile)
4693         delete_files_pattern($1, tmpfile, tmpfile)
4694         delete_lnk_files_pattern($1, tmpfile, tmpfile)
4695         delete_fifo_files_pattern($1, tmpfile, tmpfile)
4696         delete_sock_files_pattern($1, tmpfile, tmpfile)
4697         delete_chr_files_pattern($1, tmpfile, tmpfile)
4698         delete_blk_files_pattern($1, tmpfile, tmpfile)
4699         files_list_isid_type_dirs($1)
4700         files_delete_isid_type_dirs($1)
4701         files_delete_isid_type_files($1)
4702         files_delete_isid_type_symlinks($1)
4703         files_delete_isid_type_fifo_files($1)
4704         files_delete_isid_type_sock_files($1)
4705         files_delete_isid_type_blk_files($1)
4706         files_delete_isid_type_chr_files($1)
4707 ')
4708
4709 ########################################
4710 ## <summary>
4711 ##      Set the attributes of the /usr directory.
4712 ## </summary>
4713 ## <param name="domain">
4714 ##      <summary>
4715 ##      Domain allowed access.
4716 ##      </summary>
4717 ## </param>
4718 #
4719 interface(`files_setattr_usr_dirs',`
4720         gen_require(`
4721                 type usr_t;
4722         ')
4723
4724         allow $1 usr_t:dir setattr;
4725 ')
4726
4727 ########################################
4728 ## <summary>
4729 ##      Search the content of /usr.
4730 ## </summary>
4731 ## <param name="domain">
4732 ##      <summary>
4733 ##      Domain allowed access.
4734 ##      </summary>
4735 ## </param>
4736 #
4737 interface(`files_search_usr',`
4738         gen_require(`
4739                 type usr_t;
4740         ')
4741
4742         allow $1 usr_t:dir search_dir_perms;
4743 ')
4744
4745 ########################################
4746 ## <summary>
4747 ##      List the contents of generic
4748 ##      directories in /usr.
4749 ## </summary>
4750 ## <param name="domain">
4751 ##      <summary>
4752 ##      Domain allowed access.
4753 ##      </summary>
4754 ## </param>
4755 #
4756 interface(`files_list_usr',`
4757         gen_require(`
4758                 type usr_t;
4759         ')
4760
4761         allow $1 usr_t:dir list_dir_perms;
4762 ')
4763
4764 ########################################
4765 ## <summary>
4766 ##      Do not audit write of /usr dirs
4767 ## </summary>
4768 ## <param name="domain">
4769 ##      <summary>
4770 ##      Domain to not audit.
4771 ##      </summary>
4772 ## </param>
4773 #
4774 interface(`files_dontaudit_write_usr_dirs',`
4775         gen_require(`
4776                 type usr_t;
4777         ')
4778
4779         dontaudit $1 usr_t:dir write;
4780 ')
4781
4782 ########################################
4783 ## <summary>
4784 ##      Add and remove entries from /usr directories.
4785 ## </summary>
4786 ## <param name="domain">
4787 ##      <summary>
4788 ##      Domain allowed access.
4789 ##      </summary>
4790 ## </param>
4791 #
4792 interface(`files_rw_usr_dirs',`
4793         gen_require(`
4794                 type usr_t;
4795         ')
4796
4797         allow $1 usr_t:dir rw_dir_perms;
4798 ')
4799
4800 ########################################
4801 ## <summary>
4802 ##      Do not audit attempts to add and remove
4803 ##      entries from /usr directories.
4804 ## </summary>
4805 ## <param name="domain">
4806 ##      <summary>
4807 ##      Domain to not audit.
4808 ##      </summary>
4809 ## </param>
4810 #
4811 interface(`files_dontaudit_rw_usr_dirs',`
4812         gen_require(`
4813                 type usr_t;
4814         ')
4815
4816         dontaudit $1 usr_t:dir rw_dir_perms;
4817 ')
4818
4819 ########################################
4820 ## <summary>
4821 ##      Delete generic directories in /usr in the caller domain.
4822 ## </summary>
4823 ## <param name="domain">
4824 ##      <summary>
4825 ##      Domain allowed access.
4826 ##      </summary>
4827 ## </param>
4828 #
4829 interface(`files_delete_usr_dirs',`
4830         gen_require(`
4831                 type usr_t;
4832         ')
4833
4834         delete_dirs_pattern($1, usr_t, usr_t)
4835 ')
4836
4837 ########################################
4838 ## <summary>
4839 ##      Delete generic files in /usr in the caller domain.
4840 ## </summary>
4841 ## <param name="domain">
4842 ##      <summary>
4843 ##      Domain allowed access.
4844 ##      </summary>
4845 ## </param>
4846 #
4847 interface(`files_delete_usr_files',`
4848         gen_require(`
4849                 type usr_t;
4850         ')
4851
4852         delete_files_pattern($1, usr_t, usr_t)
4853 ')
4854
4855 ########################################
4856 ## <summary>
4857 ##      Get the attributes of files in /usr.
4858 ## </summary>
4859 ## <param name="domain">
4860 ##      <summary>
4861 ##      Domain allowed access.
4862 ##      </summary>
4863 ## </param>
4864 #
4865 interface(`files_getattr_usr_files',`
4866         gen_require(`
4867                 type usr_t;
4868         ')
4869
4870         getattr_files_pattern($1, usr_t, usr_t)
4871 ')
4872
4873 ########################################
4874 ## <summary>
4875 ##      Read generic files in /usr.
4876 ## </summary>
4877 ## <desc>
4878 ##      <p>
4879 ##      Allow the specified domain to read generic
4880 ##      files in /usr. These files are various program
4881 ##      files that do not have more specific SELinux types.
4882 ##      Some examples of these files are:
4883 ##      </p>
4884 ##      <ul>
4885 ##              <li>/usr/include/*</li>
4886 ##              <li>/usr/share/doc/*</li>
4887 ##              <li>/usr/share/info/*</li>
4888 ##      </ul>
4889 ##      <p>
4890 ##      Generally, it is safe for many domains to have
4891 ##      this access.
4892 ##      </p>
4893 ## </desc>
4894 ## <param name="domain">
4895 ##      <summary>
4896 ##      Domain allowed access.
4897 ##      </summary>
4898 ## </param>
4899 ## <infoflow type="read" weight="10"/>
4900 #
4901 interface(`files_read_usr_files',`
4902         gen_require(`
4903                 type usr_t;
4904         ')
4905
4906         allow $1 usr_t:dir list_dir_perms;
4907         read_files_pattern($1, usr_t, usr_t)
4908         read_lnk_files_pattern($1, usr_t, usr_t)
4909 ')
4910
4911 ########################################
4912 ## <summary>
4913 ##      Execute generic programs in /usr in the caller domain.
4914 ## </summary>
4915 ## <param name="domain">
4916 ##      <summary>
4917 ##      Domain allowed access.
4918 ##      </summary>
4919 ## </param>
4920 #
4921 interface(`files_exec_usr_files',`
4922         gen_require(`
4923                 type usr_t;
4924         ')
4925
4926         allow $1 usr_t:dir list_dir_perms;
4927         exec_files_pattern($1, usr_t, usr_t)
4928         read_lnk_files_pattern($1, usr_t, usr_t)
4929 ')
4930
4931 ########################################
4932 ## <summary>
4933 ##      dontaudit write of /usr files
4934 ## </summary>
4935 ## <param name="domain">
4936 ##      <summary>
4937 ##      Domain to not audit.
4938 ##      </summary>
4939 ## </param>
4940 #
4941 interface(`files_dontaudit_write_usr_files',`
4942         gen_require(`
4943                 type usr_t;
4944         ')
4945
4946         dontaudit $1 usr_t:file write;
4947 ')
4948
4949 ########################################
4950 ## <summary>
4951 ##      Create, read, write, and delete files in the /usr directory.
4952 ## </summary>
4953 ## <param name="domain">
4954 ##      <summary>
4955 ##      Domain allowed access.
4956 ##      </summary>
4957 ## </param>
4958 #
4959 interface(`files_manage_usr_files',`
4960         gen_require(`
4961                 type usr_t;
4962         ')
4963
4964         manage_files_pattern($1, usr_t, usr_t)
4965 ')
4966
4967 ########################################
4968 ## <summary>
4969 ##      Relabel a file to the type used in /usr.
4970 ## </summary>
4971 ## <param name="domain">
4972 ##      <summary>
4973 ##      Domain allowed access.
4974 ##      </summary>
4975 ## </param>
4976 #
4977 interface(`files_relabelto_usr_files',`
4978         gen_require(`
4979                 type usr_t;
4980         ')
4981
4982         relabelto_files_pattern($1, usr_t, usr_t)
4983 ')
4984
4985 ########################################
4986 ## <summary>
4987 ##      Relabel a file from the type used in /usr.
4988 ## </summary>
4989 ## <param name="domain">
4990 ##      <summary>
4991 ##      Domain allowed access.
4992 ##      </summary>
4993 ## </param>
4994 #
4995 interface(`files_relabelfrom_usr_files',`
4996         gen_require(`
4997                 type usr_t;
4998         ')
4999
5000         relabelfrom_files_pattern($1, usr_t, usr_t)
5001 ')
5002
5003 ########################################
5004 ## <summary>
5005 ##      Read symbolic links in /usr.
5006 ## </summary>
5007 ## <param name="domain">
5008 ##      <summary>
5009 ##      Domain allowed access.
5010 ##      </summary>
5011 ## </param>
5012 #
5013 interface(`files_read_usr_symlinks',`
5014         gen_require(`
5015                 type usr_t;
5016         ')
5017
5018         read_lnk_files_pattern($1, usr_t, usr_t)
5019 ')
5020
5021 ########################################
5022 ## <summary>
5023 ##      Create objects in the /usr directory
5024 ## </summary>
5025 ## <param name="domain">
5026 ##      <summary>
5027 ##      Domain allowed access.
5028 ##      </summary>
5029 ## </param>
5030 ## <param name="file_type">
5031 ##      <summary>
5032 ##      The type of the object to be created
5033 ##      </summary>
5034 ## </param>
5035 ## <param name="object_class">
5036 ##      <summary>
5037 ##      The object class.
5038 ##      </summary>
5039 ## </param>
5040 #
5041 interface(`files_usr_filetrans',`
5042         gen_require(`
5043                 type usr_t;
5044         ')
5045
5046         filetrans_pattern($1, usr_t, $2, $3, $4)
5047 ')
5048
5049 ########################################
5050 ## <summary>
5051 ##      Do not audit attempts to search /usr/src.
5052 ## </summary>
5053 ## <param name="domain">
5054 ##      <summary>
5055 ##      Domain to not audit.
5056 ##      </summary>
5057 ## </param>
5058 #
5059 interface(`files_dontaudit_search_src',`
5060         gen_require(`
5061                 type src_t;
5062         ')
5063
5064         dontaudit $1 src_t:dir search_dir_perms;
5065 ')
5066
5067 ########################################
5068 ## <summary>
5069 ##      Get the attributes of files in /usr/src.
5070 ## </summary>
5071 ## <param name="domain">
5072 ##      <summary>
5073 ##      Domain allowed access.
5074 ##      </summary>
5075 ## </param>
5076 #
5077 interface(`files_getattr_usr_src_files',`
5078         gen_require(`
5079                 type usr_t, src_t;
5080         ')
5081
5082         getattr_files_pattern($1, src_t, src_t)
5083
5084         # /usr/src/linux symlink:
5085         read_lnk_files_pattern($1, usr_t, src_t)
5086 ')
5087
5088 ########################################
5089 ## <summary>
5090 ##      Read files in /usr/src.
5091 ## </summary>
5092 ## <param name="domain">
5093 ##      <summary>
5094 ##      Domain allowed access.
5095 ##      </summary>
5096 ## </param>
5097 #
5098 interface(`files_read_usr_src_files',`
5099         gen_require(`
5100                 type usr_t, src_t;
5101         ')
5102
5103         allow $1 usr_t:dir search_dir_perms;
5104         read_files_pattern($1, { usr_t src_t }, src_t)
5105         read_lnk_files_pattern($1, { usr_t src_t }, src_t)
5106         allow $1 src_t:dir list_dir_perms;
5107 ')
5108
5109 ########################################
5110 ## <summary>
5111 ##      Execute programs in /usr/src in the caller domain.
5112 ## </summary>
5113 ## <param name="domain">
5114 ##      <summary>
5115 ##      Domain allowed access.
5116 ##      </summary>
5117 ## </param>
5118 #
5119 interface(`files_exec_usr_src_files',`
5120         gen_require(`
5121                 type usr_t, src_t;
5122         ')
5123
5124         list_dirs_pattern($1, usr_t, src_t)
5125         exec_files_pattern($1, src_t, src_t)
5126         read_lnk_files_pattern($1, src_t, src_t)
5127 ')
5128
5129 ########################################
5130 ## <summary>
5131 ##      Install a system.map into the /boot directory.
5132 ## </summary>
5133 ## <param name="domain">
5134 ##      <summary>
5135 ##      Domain allowed access.
5136 ##      </summary>
5137 ## </param>
5138 #
5139 interface(`files_create_kernel_symbol_table',`
5140         gen_require(`
5141                 type boot_t, system_map_t;
5142         ')
5143
5144         allow $1 boot_t:dir { list_dir_perms add_entry_dir_perms };
5145         allow $1 system_map_t:file { create_file_perms rw_file_perms };
5146 ')
5147
5148 ########################################
5149 ## <summary>
5150 ##      Read system.map in the /boot directory.
5151 ## </summary>
5152 ## <param name="domain">
5153 ##      <summary>
5154 ##      Domain allowed access.
5155 ##      </summary>
5156 ## </param>
5157 #
5158 interface(`files_read_kernel_symbol_table',`
5159         gen_require(`
5160                 type boot_t, system_map_t;
5161         ')
5162
5163         allow $1 boot_t:dir list_dir_perms;
5164         read_files_pattern($1, boot_t, system_map_t)
5165 ')
5166
5167 ########################################
5168 ## <summary>
5169 ##      Delete a system.map in the /boot directory.
5170 ## </summary>
5171 ## <param name="domain">
5172 ##      <summary>
5173 ##      Domain allowed access.
5174 ##      </summary>
5175 ## </param>
5176 #
5177 interface(`files_delete_kernel_symbol_table',`
5178         gen_require(`
5179                 type boot_t, system_map_t;
5180         ')
5181
5182         allow $1 boot_t:dir list_dir_perms;
5183         delete_files_pattern($1, boot_t, system_map_t)
5184 ')
5185
5186 ########################################
5187 ## <summary>
5188 ##      Search the contents of /var.
5189 ## </summary>
5190 ## <param name="domain">
5191 ##      <summary>
5192 ##      Domain allowed access.
5193 ##      </summary>
5194 ## </param>
5195 #
5196 interface(`files_search_var',`
5197         gen_require(`
5198                 type var_t;
5199         ')
5200
5201         allow $1 var_t:dir search_dir_perms;
5202 ')
5203
5204 ########################################
5205 ## <summary>
5206 ##      Do not audit attempts to write to /var.
5207 ## </summary>
5208 ## <param name="domain">
5209 ##      <summary>
5210 ##      Domain to not audit.
5211 ##      </summary>
5212 ## </param>
5213 #
5214 interface(`files_dontaudit_write_var_dirs',`
5215         gen_require(`
5216                 type var_t;
5217         ')
5218
5219         dontaudit $1 var_t:dir write;
5220 ')
5221
5222 ########################################
5223 ## <summary>
5224 ##      Allow attempts to write to /var.dirs
5225 ## </summary>
5226 ## <param name="domain">
5227 ##      <summary>
5228 ##      Domain allowed access.
5229 ##      </summary>
5230 ## </param>
5231 #
5232 interface(`files_write_var_dirs',`
5233         gen_require(`
5234                 type var_t;
5235         ')
5236
5237         allow $1 var_t:dir write;
5238 ')
5239
5240 ########################################
5241 ## <summary>
5242 ##      Do not audit attempts to search
5243 ##      the contents of /var.
5244 ## </summary>
5245 ## <param name="domain">
5246 ##      <summary>
5247 ##      Domain to not audit.
5248 ##      </summary>
5249 ## </param>
5250 #
5251 interface(`files_dontaudit_search_var',`
5252         gen_require(`
5253                 type var_t;
5254         ')
5255
5256         dontaudit $1 var_t:dir search_dir_perms;
5257 ')
5258
5259 ########################################
5260 ## <summary>
5261 ##      List the contents of /var.
5262 ## </summary>
5263 ## <param name="domain">
5264 ##      <summary>
5265 ##      Domain allowed access.
5266 ##      </summary>
5267 ## </param>
5268 #
5269 interface(`files_list_var',`
5270         gen_require(`
5271                 type var_t;
5272         ')
5273
5274         allow $1 var_t:dir list_dir_perms;
5275 ')
5276
5277 ########################################
5278 ## <summary>
5279 ##      Create, read, write, and delete directories
5280 ##      in the /var directory.
5281 ## </summary>
5282 ## <param name="domain">
5283 ##      <summary>
5284 ##      Domain allowed access.
5285 ##      </summary>
5286 ## </param>
5287 #
5288 interface(`files_manage_var_dirs',`
5289         gen_require(`
5290                 type var_t;
5291         ')
5292
5293         allow $1 var_t:dir manage_dir_perms;
5294 ')
5295
5296 ########################################
5297 ## <summary>
5298 ##      Read files in the /var directory.
5299 ## </summary>
5300 ## <param name="domain">
5301 ##      <summary>
5302 ##      Domain allowed access.
5303 ##      </summary>
5304 ## </param>
5305 #
5306 interface(`files_read_var_files',`
5307         gen_require(`
5308                 type var_t;
5309         ')
5310
5311         read_files_pattern($1, var_t, var_t)
5312 ')
5313
5314 ########################################
5315 ## <summary>
5316 ##      Append files in the /var directory.
5317 ## </summary>
5318 ## <param name="domain">
5319 ##      <summary>
5320 ##      Domain allowed access.
5321 ##      </summary>
5322 ## </param>
5323 #
5324 interface(`files_append_var_files',`
5325         gen_require(`
5326                 type var_t;
5327         ')
5328
5329         append_files_pattern($1, var_t, var_t)
5330 ')
5331
5332 ########################################
5333 ## <summary>
5334 ##      Read and write files in the /var directory.
5335 ## </summary>
5336 ## <param name="domain">
5337 ##      <summary>
5338 ##      Domain allowed access.
5339 ##      </summary>
5340 ## </param>
5341 #
5342 interface(`files_rw_var_files',`
5343         gen_require(`
5344                 type var_t;
5345         ')
5346
5347         rw_files_pattern($1, var_t, var_t)
5348 ')
5349
5350 ########################################
5351 ## <summary>
5352 ##      Do not audit attempts to read and write
5353 ##      files in the /var directory.
5354 ## </summary>
5355 ## <param name="domain">
5356 ##      <summary>
5357 ##      Domain to not audit.
5358 ##      </summary>
5359 ## </param>
5360 #
5361 interface(`files_dontaudit_rw_var_files',`
5362         gen_require(`
5363                 type var_t;
5364         ')
5365
5366         dontaudit $1 var_t:file rw_file_perms;
5367 ')
5368
5369 ########################################
5370 ## <summary>
5371 ##      Create, read, write, and delete files in the /var directory.
5372 ## </summary>
5373 ## <param name="domain">
5374 ##      <summary>
5375 ##      Domain allowed access.
5376 ##      </summary>
5377 ## </param>
5378 #
5379 interface(`files_manage_var_files',`
5380         gen_require(`
5381                 type var_t;
5382         ')
5383
5384         manage_files_pattern($1, var_t, var_t)
5385 ')
5386
5387 ########################################
5388 ## <summary>
5389 ##      Read symbolic links in the /var directory.
5390 ## </summary>
5391 ## <param name="domain">
5392 ##      <summary>
5393 ##      Domain allowed access.
5394 ##      </summary>
5395 ## </param>
5396 #
5397 interface(`files_read_var_symlinks',`
5398         gen_require(`
5399                 type var_t;
5400         ')
5401
5402         read_lnk_files_pattern($1, var_t, var_t)
5403 ')
5404
5405 ########################################
5406 ## <summary>
5407 ##      Create, read, write, and delete symbolic
5408 ##      links in the /var directory.
5409 ## </summary>
5410 ## <param name="domain">
5411 ##      <summary>
5412 ##      Domain allowed access.
5413 ##      </summary>
5414 ## </param>
5415 #
5416 interface(`files_manage_var_symlinks',`
5417         gen_require(`
5418                 type var_t;
5419         ')
5420
5421         manage_lnk_files_pattern($1, var_t, var_t)
5422 ')
5423
5424 ########################################
5425 ## <summary>
5426 ##      Create objects in the /var directory
5427 ## </summary>
5428 ## <param name="domain">
5429 ##      <summary>
5430 ##      Domain allowed access.
5431 ##      </summary>
5432 ## </param>
5433 ## <param name="file_type">
5434 ##      <summary>
5435 ##      The type of the object to be created
5436 ##      </summary>
5437 ## </param>
5438 ## <param name="object_class">
5439 ##      <summary>
5440 ##      The object class.
5441 ##      </summary>
5442 ## </param>
5443 #
5444 interface(`files_var_filetrans',`
5445         gen_require(`
5446                 type var_t;
5447         ')
5448
5449         filetrans_pattern($1, var_t, $2, $3, $4)
5450 ')
5451
5452 ########################################
5453 ## <summary>
5454 ##      Get the attributes of the /var/lib directory.
5455 ## </summary>
5456 ## <param name="domain">
5457 ##      <summary>
5458 ##      Domain allowed access.
5459 ##      </summary>
5460 ## </param>
5461 #
5462 interface(`files_getattr_var_lib_dirs',`
5463         gen_require(`
5464                 type var_t, var_lib_t;
5465         ')
5466
5467         getattr_dirs_pattern($1, var_t, var_lib_t)
5468 ')
5469
5470 ########################################
5471 ## <summary>
5472 ##      Search the /var/lib directory.
5473 ## </summary>
5474 ## <desc>
5475 ##      <p>
5476 ##      Search the /var/lib directory.  This is
5477 ##      necessary to access files or directories under
5478 ##      /var/lib that have a private type.  For example, a
5479 ##      domain accessing a private library file in the
5480 ##      /var/lib directory:
5481 ##      </p>
5482 ##      <p>
5483 ##      allow mydomain_t mylibfile_t:file read_file_perms;
5484 ##      files_search_var_lib(mydomain_t)
5485 ##      </p>
5486 ## </desc>
5487 ## <param name="domain">
5488 ##      <summary>
5489 ##      Domain allowed access.
5490 ##      </summary>
5491 ## </param>
5492 ## <infoflow type="read" weight="5"/>
5493 #
5494 interface(`files_search_var_lib',`
5495         gen_require(`
5496                 type var_t, var_lib_t;
5497         ')
5498
5499         search_dirs_pattern($1, var_t, var_lib_t)
5500 ')
5501
5502 ########################################
5503 ## <summary>
5504 ##      Do not audit attempts to search the
5505 ##      contents of /var/lib.
5506 ## </summary>
5507 ## <param name="domain">
5508 ##      <summary>
5509 ##      Domain to not audit.
5510 ##      </summary>
5511 ## </param>
5512 ## <infoflow type="read" weight="5"/>
5513 #
5514 interface(`files_dontaudit_search_var_lib',`
5515         gen_require(`
5516                 type var_lib_t;
5517         ')
5518
5519         dontaudit $1 var_lib_t:dir search_dir_perms;
5520 ')
5521
5522 ########################################
5523 ## <summary>
5524 ##      List the contents of the /var/lib directory.
5525 ## </summary>
5526 ## <param name="domain">
5527 ##      <summary>
5528 ##      Domain allowed access.
5529 ##      </summary>
5530 ## </param>
5531 #
5532 interface(`files_list_var_lib',`
5533         gen_require(`
5534                 type var_t, var_lib_t;
5535         ')
5536
5537         list_dirs_pattern($1, var_t, var_lib_t)
5538 ')
5539
5540 ###########################################
5541 ## <summary>
5542 ##      Read-write /var/lib directories
5543 ## </summary>
5544 ## <param name="domain">
5545 ##      <summary>
5546 ##      Domain allowed access.
5547 ##      </summary>
5548 ## </param>
5549 #
5550 interface(`files_rw_var_lib_dirs',`
5551         gen_require(`
5552                 type var_lib_t;
5553         ')
5554
5555         rw_dirs_pattern($1, var_lib_t, var_lib_t)
5556 ')
5557
5558 ########################################
5559 ## <summary>
5560 ##      Create objects in the /var/lib directory
5561 ## </summary>
5562 ## <param name="domain">
5563 ##      <summary>
5564 ##      Domain allowed access.
5565 ##      </summary>
5566 ## </param>
5567 ## <param name="file_type">
5568 ##      <summary>
5569 ##      The type of the object to be created
5570 ##      </summary>
5571 ## </param>
5572 ## <param name="object_class">
5573 ##      <summary>
5574 ##      The object class.
5575 ##      </summary>
5576 ## </param>
5577 #
5578 interface(`files_var_lib_filetrans',`
5579         gen_require(`
5580                 type var_t, var_lib_t;
5581         ')
5582
5583         allow $1 var_t:dir search_dir_perms;
5584         filetrans_pattern($1, var_lib_t, $2, $3, $4)
5585 ')
5586
5587 ########################################
5588 ## <summary>
5589 ##      Read generic files in /var/lib.
5590 ## </summary>
5591 ## <param name="domain">
5592 ##      <summary>
5593 ##      Domain allowed access.
5594 ##      </summary>
5595 ## </param>
5596 #
5597 interface(`files_read_var_lib_files',`
5598         gen_require(`
5599                 type var_t, var_lib_t;
5600         ')
5601
5602         allow $1 var_lib_t:dir list_dir_perms;
5603         read_files_pattern($1, { var_t var_lib_t }, var_lib_t)
5604 ')
5605
5606 ########################################
5607 ## <summary>
5608 ##      Read generic symbolic links in /var/lib
5609 ## </summary>
5610 ## <param name="domain">
5611 ##      <summary>
5612 ##      Domain allowed access.
5613 ##      </summary>
5614 ## </param>
5615 #
5616 interface(`files_read_var_lib_symlinks',`
5617         gen_require(`
5618                 type var_t, var_lib_t;
5619         ')
5620
5621         read_lnk_files_pattern($1, { var_t var_lib_t }, var_lib_t)
5622 ')
5623
5624 # cjp: the next two interfaces really need to be fixed
5625 # in some way.  They really neeed their own types.
5626
5627 ########################################
5628 ## <summary>
5629 ##      Create, read, write, and delete the
5630 ##      pseudorandom number generator seed.
5631 ## </summary>
5632 ## <param name="domain">
5633 ##      <summary>
5634 ##      Domain allowed access.
5635 ##      </summary>
5636 ## </param>
5637 #
5638 interface(`files_manage_urandom_seed',`
5639         gen_require(`
5640                 type var_t, var_lib_t;
5641         ')
5642
5643         allow $1 var_t:dir search_dir_perms;
5644         manage_files_pattern($1, var_lib_t, var_lib_t)
5645 ')
5646
5647 ########################################
5648 ## <summary>
5649 ##      Allow domain to manage mount tables
5650 ##      necessary for rpcd, nfsd, etc.
5651 ## </summary>
5652 ## <param name="domain">
5653 ##      <summary>
5654 ##      Domain allowed access.
5655 ##      </summary>
5656 ## </param>
5657 #
5658 interface(`files_manage_mounttab',`
5659         gen_require(`
5660                 type var_t, var_lib_t;
5661         ')
5662
5663         allow $1 var_t:dir search_dir_perms;
5664         manage_files_pattern($1, var_lib_t, var_lib_t)
5665 ')
5666
5667 ########################################
5668 ## <summary>
5669 ##      List generic lock directories.
5670 ## </summary>
5671 ## <param name="domain">
5672 ##      <summary>
5673 ##      Domain allowed access.
5674 ##      </summary>
5675 ## </param>
5676 #
5677 interface(`files_list_locks',`
5678         gen_require(`
5679                 type var_t, var_lock_t;
5680         ')
5681
5682         files_search_locks($1)
5683         list_dirs_pattern($1, var_t, var_lock_t)
5684 ')
5685
5686 ########################################
5687 ## <summary>
5688 ##      Search the locks directory (/var/lock).
5689 ## </summary>
5690 ## <param name="domain">
5691 ##      <summary>
5692 ##      Domain allowed access.
5693 ##      </summary>
5694 ## </param>
5695 #
5696 interface(`files_search_locks',`
5697         gen_require(`
5698                 type var_t, var_lock_t;
5699         ')
5700
5701         files_search_pids($1)
5702         allow $1 var_lock_t:lnk_file read_lnk_file_perms;
5703         search_dirs_pattern($1, var_t, var_lock_t)
5704 ')
5705
5706 ########################################
5707 ## <summary>
5708 ##      Do not audit attempts to search the
5709 ##      locks directory (/var/lock).
5710 ## </summary>
5711 ## <param name="domain">
5712 ##      <summary>
5713 ##      Domain to not audit.
5714 ##      </summary>
5715 ## </param>
5716 #
5717 interface(`files_dontaudit_search_locks',`
5718         gen_require(`
5719                 type var_lock_t;
5720         ')
5721
5722         dontaudit $1 var_lock_t:lnk_file read_lnk_file_perms;
5723         dontaudit $1 var_lock_t:dir search_dir_perms;
5724 ')
5725
5726 ########################################
5727 ## <summary>
5728 ##      create a directory in the /var/lock
5729 ##      directories.
5730 ## </summary>
5731 ## <param name="domain">
5732 ##      <summary>
5733 ##      Domain allowed access.
5734 ##      </summary>
5735 ## </param>
5736 #
5737 interface(`files_create_lock_dirs',`
5738         gen_require(`
5739                 type var_t, var_lock_t;
5740         ')
5741         files_search_locks($1)
5742         allow $1 var_lock_t:dir create_dir_perms;
5743 ')
5744
5745 ########################################
5746 ## <summary>
5747 ##      Set the attributes of the /var/lock directory.
5748 ## </summary>
5749 ## <param name="domain">
5750 ##      <summary>
5751 ##      Domain allowed access.
5752 ##      </summary>
5753 ## </param>
5754 #
5755 interface(`files_setattr_lock_dirs',`
5756         gen_require(`
5757                 type var_lock_t;
5758         ')
5759
5760         allow $1 var_lock_t:dir setattr;
5761 ')
5762
5763 ########################################
5764 ## <summary>
5765 ##      Add and remove entries in the /var/lock
5766 ##      directories.
5767 ## </summary>
5768 ## <param name="domain">
5769 ##      <summary>
5770 ##      Domain allowed access.
5771 ##      </summary>
5772 ## </param>
5773 #
5774 interface(`files_rw_lock_dirs',`
5775         gen_require(`
5776                 type var_t, var_lock_t;
5777         ')
5778
5779         files_search_locks($1)
5780         rw_dirs_pattern($1, var_t, var_lock_t)
5781 ')
5782
5783 ########################################
5784 ## <summary>
5785 ##      Relabel to and from all lock directory types.
5786 ## </summary>
5787 ## <param name="domain">
5788 ##      <summary>
5789 ##      Domain allowed access.
5790 ##      </summary>
5791 ## </param>
5792 #
5793 interface(`files_relabel_all_lock_dirs',`
5794         gen_require(`
5795                 attribute lockfile;
5796                 type var_t;
5797         ')
5798
5799         allow $1 var_t:dir search_dir_perms;
5800         relabel_dirs_pattern($1, lockfile, lockfile)
5801 ')
5802
5803 ########################################
5804 ## <summary>
5805 ##      Get the attributes of generic lock files.
5806 ## </summary>
5807 ## <param name="domain">
5808 ##      <summary>
5809 ##      Domain allowed access.
5810 ##      </summary>
5811 ## </param>
5812 #
5813 interface(`files_getattr_generic_locks',`
5814         gen_require(`
5815                 type var_t, var_lock_t;
5816         ')
5817
5818         files_search_locks($1)
5819         allow $1 var_lock_t:dir list_dir_perms;
5820         getattr_files_pattern($1, var_lock_t, var_lock_t)
5821 ')
5822
5823 ########################################
5824 ## <summary>
5825 ##      Delete generic lock files.
5826 ## </summary>
5827 ## <param name="domain">
5828 ##      <summary>
5829 ##      Domain allowed access.
5830 ##      </summary>
5831 ## </param>
5832 #
5833 interface(`files_delete_generic_locks',`
5834        gen_require(`
5835                 type var_t, var_lock_t;
5836        ')
5837
5838        files_search_locks($1)
5839        delete_files_pattern($1, var_lock_t, var_lock_t)
5840 ')
5841
5842 ########################################
5843 ## <summary>
5844 ##      Create, read, write, and delete generic
5845 ##      lock files.
5846 ## </summary>
5847 ## <param name="domain">
5848 ##      <summary>
5849 ##      Domain allowed access.
5850 ##      </summary>
5851 ## </param>
5852 #
5853 interface(`files_manage_generic_locks',`
5854         gen_require(`
5855                 type var_t, var_lock_t;
5856         ')
5857
5858         files_search_locks($1)
5859         manage_files_pattern($1, var_lock_t, var_lock_t)
5860 ')
5861
5862 ########################################
5863 ## <summary>
5864 ##      Delete all lock files.
5865 ## </summary>
5866 ## <param name="domain">
5867 ##      <summary>
5868 ##      Domain allowed access.
5869 ##      </summary>
5870 ## </param>
5871 ## <rolecap/>
5872 #
5873 interface(`files_delete_all_locks',`
5874         gen_require(`
5875                 attribute lockfile;
5876                 type var_t;
5877         ')
5878
5879         allow $1 var_t:dir search_dir_perms;
5880         delete_files_pattern($1, lockfile, lockfile)
5881 ')
5882
5883 ########################################
5884 ## <summary>
5885 ##      Read all lock files.
5886 ## </summary>
5887 ## <param name="domain">
5888 ##      <summary>
5889 ##      Domain allowed access.
5890 ##      </summary>
5891 ## </param>
5892 #
5893 interface(`files_read_all_locks',`
5894         gen_require(`
5895                 attribute lockfile;
5896                 type var_t, var_lock_t;
5897         ')
5898
5899         files_search_locks($1)
5900         allow $1 lockfile:dir list_dir_perms;
5901         read_files_pattern($1, lockfile, lockfile)
5902         read_lnk_files_pattern($1, lockfile, lockfile)
5903 ')
5904
5905 ########################################
5906 ## <summary>
5907 ##      manage all lock files.
5908 ## </summary>
5909 ## <param name="domain">
5910 ##      <summary>
5911 ##      Domain allowed access.
5912 ##      </summary>
5913 ## </param>
5914 #
5915 interface(`files_manage_all_locks',`
5916         gen_require(`
5917                 attribute lockfile;
5918                 type var_t, var_lock_t;
5919         ')
5920
5921         files_search_locks($1)
5922         manage_dirs_pattern($1, lockfile, lockfile)
5923         manage_files_pattern($1, lockfile, lockfile)
5924         manage_lnk_files_pattern($1, lockfile, lockfile)
5925 ')
5926
5927 ########################################
5928 ## <summary>
5929 ##      Create an object in the locks directory, with a private
5930 ##      type using a type transition.
5931 ## </summary>
5932 ## <param name="domain">
5933 ##      <summary>
5934 ##      Domain allowed access.
5935 ##      </summary>
5936 ## </param>
5937 ## <param name="private type">
5938 ##      <summary>
5939 ##      The type of the object to be created.
5940 ##      </summary>
5941 ## </param>
5942 ## <param name="object">
5943 ##      <summary>
5944 ##      The object class of the object being created.
5945 ##      </summary>
5946 ## </param>
5947 #
5948 interface(`files_lock_filetrans',`
5949         gen_require(`
5950                 type var_t, var_lock_t;
5951         ')
5952
5953         files_search_locks($1)
5954         filetrans_pattern($1, var_lock_t, $2, $3, $4)
5955 ')
5956
5957 ########################################
5958 ## <summary>
5959 ##      Do not audit attempts to get the attributes
5960 ##      of the /var/run directory.
5961 ## </summary>
5962 ## <param name="domain">
5963 ##      <summary>
5964 ##      Domain to not audit.
5965 ##      </summary>
5966 ## </param>
5967 #
5968 interface(`files_dontaudit_getattr_pid_dirs',`
5969         gen_require(`
5970                 type var_run_t;
5971         ')
5972
5973         dontaudit $1 var_run_t:dir getattr;
5974 ')
5975
5976 ########################################
5977 ## <summary>
5978 ##      Set the attributes of the /var/run directory.
5979 ## </summary>
5980 ## <param name="domain">
5981 ##      <summary>
5982 ##      Domain allowed access.
5983 ##      </summary>
5984 ## </param>
5985 #
5986 interface(`files_setattr_pid_dirs',`
5987         gen_require(`
5988                 type var_run_t;
5989         ')
5990
5991         allow $1 var_run_t:dir setattr;
5992 ')
5993
5994 ########################################
5995 ## <summary>
5996 ##      Search the contents of runtime process
5997 ##      ID directories (/var/run).
5998 ## </summary>
5999 ## <param name="domain">
6000 ##      <summary>
6001 ##      Domain allowed access.
6002 ##      </summary>
6003 ## </param>
6004 #
6005 interface(`files_search_pids',`
6006         gen_require(`
6007                 type var_t, var_run_t;
6008         ')
6009
6010         allow $1 var_run_t:lnk_file read_lnk_file_perms;
6011         search_dirs_pattern($1, var_t, var_run_t)
6012 ')
6013
6014 ######################################
6015 ## <summary>
6016 ## Add and remove entries from pid directories.
6017 ## </summary>
6018 ## <param name="domain">
6019 ## <summary>
6020 ## Domain allowed access.
6021 ## </summary>
6022 ## </param>
6023 #
6024 interface(`files_rw_pid_dirs',`
6025     gen_require(`
6026         type var_run_t;
6027     ')
6028
6029     allow $1 var_run_t:dir rw_dir_perms;
6030 ')
6031
6032 #######################################
6033 ## <summary>
6034 ##      Create generic pid directory.
6035 ## </summary>
6036 ## <param name="domain">
6037 ##      <summary>
6038 ##      Domain allowed access.
6039 ##      </summary>
6040 ## </param>
6041 #
6042 interface(`files_create_var_run_dirs',`
6043         gen_require(`
6044                 type var_t, var_run_t;
6045         ')
6046
6047         allow $1 var_t:dir search_dir_perms;
6048         allow $1 var_run_t:dir create_dir_perms;
6049 ')
6050
6051 ########################################
6052 ## <summary>
6053 ##      Do not audit attempts to search
6054 ##      the /var/run directory.
6055 ## </summary>
6056 ## <param name="domain">
6057 ##      <summary>
6058 ##      Domain to not audit.
6059 ##      </summary>
6060 ## </param>
6061 #
6062 interface(`files_dontaudit_search_pids',`
6063         gen_require(`
6064                 type var_run_t;
6065         ')
6066
6067         dontaudit $1 var_run_t:dir search_dir_perms;
6068 ')
6069
6070 ########################################
6071 ## <summary>
6072 ##      Do not audit attempts to search
6073 ##      the all /var/run directory.
6074 ## </summary>
6075 ## <param name="domain">
6076 ##      <summary>
6077 ##      Domain to not audit.
6078 ##      </summary>
6079 ## </param>
6080 #
6081 interface(`files_dontaudit_search_all_pids',`
6082         gen_require(`
6083                 attribute pidfile;
6084         ')
6085
6086         dontaudit $1 pidfile:dir search_dir_perms;
6087 ')
6088
6089 ########################################
6090 ## <summary>
6091 ##      List the contents of the runtime process
6092 ##      ID directories (/var/run).
6093 ## </summary>
6094 ## <param name="domain">
6095 ##      <summary>
6096 ##      Domain allowed access.
6097 ##      </summary>
6098 ## </param>
6099 #
6100 interface(`files_list_pids',`
6101         gen_require(`
6102                 type var_t, var_run_t;
6103         ')
6104
6105         list_dirs_pattern($1, var_t, var_run_t)
6106 ')
6107
6108 ########################################
6109 ## <summary>
6110 ##      Read generic process ID files.
6111 ## </summary>
6112 ## <param name="domain">
6113 ##      <summary>
6114 ##      Domain allowed access.
6115 ##      </summary>
6116 ## </param>
6117 #
6118 interface(`files_read_generic_pids',`
6119         gen_require(`
6120                 type var_t, var_run_t;
6121         ')
6122
6123         list_dirs_pattern($1, var_t, var_run_t)
6124         read_files_pattern($1, var_run_t, var_run_t)
6125 ')
6126
6127 ########################################
6128 ## <summary>
6129 ##      Write named generic process ID pipes
6130 ## </summary>
6131 ## <param name="domain">
6132 ##      <summary>
6133 ##      Domain allowed access.
6134 ##      </summary>
6135 ## </param>
6136 #
6137 interface(`files_write_generic_pid_pipes',`
6138         gen_require(`
6139                 type var_run_t;
6140         ')
6141
6142         allow $1 var_run_t:fifo_file write;
6143 ')
6144
6145 ########################################
6146 ## <summary>
6147 ##      Create an object in the process ID directory, with a private type.
6148 ## </summary>
6149 ## <desc>
6150 ##      <p>
6151 ##      Create an object in the process ID directory (e.g., /var/run)
6152 ##      with a private type.  Typically this is used for creating
6153 ##      private PID files in /var/run with the private type instead
6154 ##      of the general PID file type. To accomplish this goal,
6155 ##      either the program must be SELinux-aware, or use this interface.
6156 ##      </p>
6157 ##      <p>
6158 ##      Related interfaces:
6159 ##      </p>
6160 ##      <ul>
6161 ##              <li>files_pid_file()</li>
6162 ##      </ul>
6163 ##      <p>
6164 ##      Example usage with a domain that can create and
6165 ##      write its PID file with a private PID file type in the
6166 ##      /var/run directory:
6167 ##      </p>
6168 ##      <p>
6169 ##      type mypidfile_t;
6170 ##      files_pid_file(mypidfile_t)
6171 ##      allow mydomain_t mypidfile_t:file { create_file_perms write_file_perms };
6172 ##      files_pid_filetrans(mydomain_t, mypidfile_t, file)
6173 ##      </p>
6174 ## </desc>
6175 ## <param name="domain">
6176 ##      <summary>
6177 ##      Domain allowed access.
6178 ##      </summary>
6179 ## </param>
6180 ## <param name="private type">
6181 ##      <summary>
6182 ##      The type of the object to be created.
6183 ##      </summary>
6184 ## </param>
6185 ## <param name="object">
6186 ##      <summary>
6187 ##      The object class of the object being created.
6188 ##      </summary>
6189 ## </param>
6190 ## <infoflow type="write" weight="10"/>
6191 #
6192 interface(`files_pid_filetrans',`
6193         gen_require(`
6194                 type var_t, var_run_t;
6195         ')
6196
6197         allow $1 var_t:dir search_dir_perms;
6198         filetrans_pattern($1, var_run_t, $2, $3, $4)
6199 ')
6200
6201 ########################################
6202 ## <summary>
6203 ##      Read and write generic process ID files.
6204 ## </summary>
6205 ## <param name="domain">
6206 ##      <summary>
6207 ##      Domain allowed access.
6208 ##      </summary>
6209 ## </param>
6210 #
6211 interface(`files_rw_generic_pids',`
6212         gen_require(`
6213                 type var_t, var_run_t;
6214         ')
6215
6216         list_dirs_pattern($1, var_t, var_run_t)
6217         rw_files_pattern($1, var_run_t, var_run_t)
6218 ')
6219
6220 ########################################
6221 ## <summary>
6222 ##      Do not audit attempts to get the attributes of
6223 ##      daemon runtime data files.
6224 ## </summary>
6225 ## <param name="domain">
6226 ##      <summary>
6227 ##      Domain to not audit.
6228 ##      </summary>
6229 ## </param>
6230 #
6231 interface(`files_dontaudit_getattr_all_pids',`
6232         gen_require(`
6233                 attribute pidfile;
6234         ')
6235
6236         dontaudit $1 pidfile:file getattr;
6237 ')
6238
6239 ########################################
6240 ## <summary>
6241 ##      Do not audit attempts to write to daemon runtime data files.
6242 ## </summary>
6243 ## <param name="domain">
6244 ##      <summary>
6245 ##      Domain to not audit.
6246 ##      </summary>
6247 ## </param>
6248 #
6249 interface(`files_dontaudit_write_all_pids',`
6250         gen_require(`
6251                 attribute pidfile;
6252         ')
6253
6254         dontaudit $1 pidfile:file write;
6255 ')
6256
6257 ########################################
6258 ## <summary>
6259 ##      Do not audit attempts to ioctl daemon runtime data files.
6260 ## </summary>
6261 ## <param name="domain">
6262 ##      <summary>
6263 ##      Domain to not audit.
6264 ##      </summary>
6265 ## </param>
6266 #
6267 interface(`files_dontaudit_ioctl_all_pids',`
6268         gen_require(`
6269                 attribute pidfile;
6270         ')
6271
6272         dontaudit $1 pidfile:file ioctl;
6273 ')
6274
6275 ########################################
6276 ## <summary>
6277 ##      Relable all pid directories
6278 ## </summary>
6279 ## <param name="domain">
6280 ##      <summary>
6281 ##      Domain allowed access.
6282 ##      </summary>
6283 ## </param>
6284 #
6285 interface(`files_relabel_all_pid_dirs',`
6286         gen_require(`
6287                 attribute pidfile;
6288         ')
6289
6290         relabel_dirs_pattern($1, pidfile, pidfile)
6291 ')
6292
6293 ########################################
6294 ## <summary>
6295 ##      Delete all pid sockets
6296 ## </summary>
6297 ## <param name="domain">
6298 ##      <summary>
6299 ##      Domain allowed access.
6300 ##      </summary>
6301 ## </param>
6302 #
6303 interface(`files_delete_all_pid_sockets',`
6304         gen_require(`
6305                 attribute pidfile;
6306         ')
6307
6308         allow $1 pidfile:sock_file delete_sock_file_perms;
6309 ')
6310
6311 ########################################
6312 ## <summary>
6313 ##      Create all pid sockets
6314 ## </summary>
6315 ## <param name="domain">
6316 ##      <summary>
6317 ##      Domain allowed access.
6318 ##      </summary>
6319 ## </param>
6320 #
6321 interface(`files_create_all_pid_sockets',`
6322         gen_require(`
6323                 attribute pidfile;
6324         ')
6325
6326         allow $1 pidfile:sock_file create_sock_file_perms;
6327 ')
6328
6329 ########################################
6330 ## <summary>
6331 ##      Create all pid named pipes
6332 ## </summary>
6333 ## <param name="domain">
6334 ##      <summary>
6335 ##      Domain allowed access.
6336 ##      </summary>
6337 ## </param>
6338 #
6339 interface(`files_create_all_pid_pipes',`
6340         gen_require(`
6341                 attribute pidfile;
6342         ')
6343
6344         allow $1 pidfile:fifo_file create_fifo_file_perms;
6345 ')
6346
6347 ########################################
6348 ## <summary>
6349 ##      Delete all pid named pipes
6350 ## </summary>
6351 ## <param name="domain">
6352 ##      <summary>
6353 ##      Domain allowed access.
6354 ##      </summary>
6355 ## </param>
6356 #
6357 interface(`files_delete_all_pid_pipes',`
6358         gen_require(`
6359                 attribute pidfile;
6360         ')
6361
6362         allow $1 pidfile:fifo_file delete_fifo_file_perms;
6363 ')
6364
6365 ########################################
6366 ## <summary>
6367 ##      manage all pidfile directories
6368 ##      in the /var/run directory.
6369 ## </summary>
6370 ## <param name="domain">
6371 ##      <summary>
6372 ##      Domain allowed access.
6373 ##      </summary>
6374 ## </param>
6375 #
6376 interface(`files_manage_all_pid_dirs',`
6377         gen_require(`
6378                 attribute pidfile;
6379         ')
6380
6381         manage_dirs_pattern($1,pidfile,pidfile)
6382 ')
6383
6384
6385 ########################################
6386 ## <summary>
6387 ##      Read all process ID files.
6388 ## </summary>
6389 ## <param name="domain">
6390 ##      <summary>
6391 ##      Domain allowed access.
6392 ##      </summary>
6393 ## </param>
6394 ## <rolecap/>
6395 #
6396 interface(`files_read_all_pids',`
6397         gen_require(`
6398                 attribute pidfile;
6399                 type var_t;
6400         ')
6401
6402         list_dirs_pattern($1, var_t, pidfile)
6403         read_files_pattern($1, pidfile, pidfile)
6404         read_lnk_files_pattern($1, pidfile, pidfile)
6405 ')
6406
6407 ########################################
6408 ## <summary>
6409 ##      Relable all pid files
6410 ## </summary>
6411 ## <param name="domain">
6412 ##      <summary>
6413 ##      Domain allowed access.
6414 ##      </summary>
6415 ## </param>
6416 #
6417 interface(`files_relabel_all_pid_files',`
6418         gen_require(`
6419                 attribute pidfile;
6420         ')
6421
6422         relabel_files_pattern($1, pidfile, pidfile)
6423 ')
6424
6425 ########################################
6426 ## <summary>
6427 ##      Execute generic programs in /var/run in the caller domain.
6428 ## </summary>
6429 ## <param name="domain">
6430 ##      <summary>
6431 ##      Domain allowed access.
6432 ##      </summary>
6433 ## </param>
6434 #
6435 interface(`files_exec_generic_pid_files',`
6436         gen_require(`
6437                 type var_run_t;
6438         ')
6439
6440         exec_files_pattern($1, var_run_t, var_run_t)
6441 ')
6442
6443 ########################################
6444 ## <summary>
6445 ##      manage all pidfiles
6446 ##      in the /var/run directory.
6447 ## </summary>
6448 ## <param name="domain">
6449 ##      <summary>
6450 ##      Domain allowed access.
6451 ##      </summary>
6452 ## </param>
6453 #
6454 interface(`files_manage_all_pids',`
6455         gen_require(`
6456                 attribute pidfile;
6457         ')
6458
6459         manage_files_pattern($1,pidfile,pidfile)
6460 ')
6461
6462 ########################################
6463 ## <summary>
6464 ##      Mount filesystems on all polyinstantiation
6465 ##      member directories.
6466 ## </summary>
6467 ## <param name="domain">
6468 ##      <summary>
6469 ##      Domain allowed access.
6470 ##      </summary>
6471 ## </param>
6472 #
6473 interface(`files_mounton_all_poly_members',`
6474         gen_require(`
6475                 attribute polymember;
6476         ')
6477
6478         allow $1 polymember:dir mounton;
6479 ')
6480
6481 ########################################
6482 ## <summary>
6483 ##      Delete all process IDs.
6484 ## </summary>
6485 ## <param name="domain">
6486 ##      <summary>
6487 ##      Domain allowed access.
6488 ##      </summary>
6489 ## </param>
6490 ## <rolecap/>
6491 #
6492 interface(`files_delete_all_pids',`
6493         gen_require(`
6494                 attribute pidfile;
6495                 type var_t, var_run_t;
6496         ')
6497
6498         allow $1 var_t:dir search_dir_perms;
6499         allow $1 var_run_t:dir rmdir;
6500         allow $1 var_run_t:lnk_file delete_lnk_file_perms;
6501         delete_files_pattern($1, pidfile, pidfile)
6502         delete_fifo_files_pattern($1, pidfile, pidfile)
6503         delete_sock_files_pattern($1, pidfile, { pidfile var_run_t })
6504 ')
6505
6506 ########################################
6507 ## <summary>
6508 ##      Delete all process ID directories.
6509 ## </summary>
6510 ## <param name="domain">
6511 ##      <summary>
6512 ##      Domain allowed access.
6513 ##      </summary>
6514 ## </param>
6515 #
6516 interface(`files_delete_all_pid_dirs',`
6517         gen_require(`
6518                 attribute pidfile;
6519                 type var_t;
6520         ')
6521
6522         allow $1 var_t:dir search_dir_perms;
6523         delete_dirs_pattern($1, pidfile, pidfile)
6524 ')
6525
6526 ########################################
6527 ## <summary>
6528 ##      Make the specified type a file
6529 ##      used for spool files.
6530 ## </summary>
6531 ## <desc>
6532 ##      <p>
6533 ##      Make the specified type usable for spool files.
6534 ##      This will also make the type usable for files, making
6535 ##      calls to files_type() redundant.  Failure to use this interface
6536 ##      for a spool file may result in problems with
6537 ##      purging spool files.
6538 ##      </p>
6539 ##      <p>
6540 ##      Related interfaces:
6541 ##      </p>
6542 ##      <ul>
6543 ##              <li>files_spool_filetrans()</li>
6544 ##      </ul>
6545 ##      <p>
6546 ##      Example usage with a domain that can create and
6547 ##      write its spool file in the system spool file
6548 ##      directories (/var/spool):
6549 ##      </p>
6550 ##      <p>
6551 ##      type myspoolfile_t;
6552 ##      files_spool_file(myfile_spool_t)
6553 ##      allow mydomain_t myfile_spool_t:file { create_file_perms write_file_perms };
6554 ##      files_spool_filetrans(mydomain_t, myfile_spool_t, file)
6555 ##      </p>
6556 ## </desc>
6557 ## <param name="file_type">
6558 ##      <summary>
6559 ##      Type of the file to be used as a
6560 ##      spool file.
6561 ##      </summary>
6562 ## </param>
6563 ## <infoflow type="none"/>
6564 #
6565 interface(`files_spool_file',`
6566         gen_require(`
6567                 attribute spoolfile;
6568         ')
6569
6570         files_type($1)
6571         typeattribute $1 spoolfile;
6572 ')
6573
6574 ########################################
6575 ## <summary>
6576 ##      Create all spool sockets
6577 ## </summary>
6578 ## <param name="domain">
6579 ##      <summary>
6580 ##      Domain allowed access.
6581 ##      </summary>
6582 ## </param>
6583 #
6584 interface(`files_create_all_spool_sockets',`
6585         gen_require(`
6586                 attribute spoolfile;
6587         ')
6588
6589         allow $1 spoolfile:sock_file create_sock_file_perms;
6590 ')
6591
6592 ########################################
6593 ## <summary>
6594 ##      Delete all spool sockets
6595 ## </summary>
6596 ## <param name="domain">
6597 ##      <summary>
6598 ##      Domain allowed access.
6599 ##      </summary>
6600 ## </param>
6601 #
6602 interface(`files_delete_all_spool_sockets',`
6603         gen_require(`
6604                 attribute spoolfile;
6605         ')
6606
6607         allow $1 spoolfile:sock_file delete_sock_file_perms;
6608 ')
6609
6610 ########################################
6611 ## <summary>
6612 ##      Search the contents of generic spool
6613 ##      directories (/var/spool).
6614 ## </summary>
6615 ## <param name="domain">
6616 ##      <summary>
6617 ##      Domain allowed access.
6618 ##      </summary>
6619 ## </param>
6620 #
6621 interface(`files_search_spool',`
6622         gen_require(`
6623                 type var_t, var_spool_t;
6624         ')
6625
6626         search_dirs_pattern($1, var_t, var_spool_t)
6627 ')
6628
6629 ########################################
6630 ## <summary>
6631 ##      Do not audit attempts to search generic
6632 ##      spool directories.
6633 ## </summary>
6634 ## <param name="domain">
6635 ##      <summary>
6636 ##      Domain to not audit.
6637 ##      </summary>
6638 ## </param>
6639 #
6640 interface(`files_dontaudit_search_spool',`
6641         gen_require(`
6642                 type var_spool_t;
6643         ')
6644
6645         dontaudit $1 var_spool_t:dir search_dir_perms;
6646 ')
6647
6648 ########################################
6649 ## <summary>
6650 ##      List the contents of generic spool
6651 ##      (/var/spool) directories.
6652 ## </summary>
6653 ## <param name="domain">
6654 ##      <summary>
6655 ##      Domain allowed access.
6656 ##      </summary>
6657 ## </param>
6658 #
6659 interface(`files_list_spool',`
6660         gen_require(`
6661                 type var_t, var_spool_t;
6662         ')
6663
6664         list_dirs_pattern($1, var_t, var_spool_t)
6665 ')
6666
6667 ########################################
6668 ## <summary>
6669 ##      Create, read, write, and delete generic
6670 ##      spool directories (/var/spool).
6671 ## </summary>
6672 ## <param name="domain">
6673 ##      <summary>
6674 ##      Domain allowed access.
6675 ##      </summary>
6676 ## </param>
6677 #
6678 interface(`files_manage_generic_spool_dirs',`
6679         gen_require(`
6680                 type var_t, var_spool_t;
6681         ')
6682
6683         allow $1 var_t:dir search_dir_perms;
6684         manage_dirs_pattern($1, var_spool_t, var_spool_t)
6685 ')
6686
6687 ########################################
6688 ## <summary>
6689 ##      Read generic spool files.
6690 ## </summary>
6691 ## <param name="domain">
6692 ##      <summary>
6693 ##      Domain allowed access.
6694 ##      </summary>
6695 ## </param>
6696 #
6697 interface(`files_read_generic_spool',`
6698         gen_require(`
6699                 type var_t, var_spool_t;
6700         ')
6701
6702         list_dirs_pattern($1, var_t, var_spool_t)
6703         read_files_pattern($1, var_spool_t, var_spool_t)
6704 ')
6705
6706 ########################################
6707 ## <summary>
6708 ##      Create, read, write, and delete generic
6709 ##      spool files.
6710 ## </summary>
6711 ## <param name="domain">
6712 ##      <summary>
6713 ##      Domain allowed access.
6714 ##      </summary>
6715 ## </param>
6716 #
6717 interface(`files_manage_generic_spool',`
6718         gen_require(`
6719                 type var_t, var_spool_t;
6720         ')
6721
6722         allow $1 var_t:dir search_dir_perms;
6723         manage_files_pattern($1, var_spool_t, var_spool_t)
6724 ')
6725
6726 ########################################
6727 ## <summary>
6728 ##      Create objects in the spool directory
6729 ##      with a private type with a type transition.
6730 ## </summary>
6731 ## <param name="domain">
6732 ##      <summary>
6733 ##      Domain allowed access.
6734 ##      </summary>
6735 ## </param>
6736 ## <param name="file">
6737 ##      <summary>
6738 ##      Type to which the created node will be transitioned.
6739 ##      </summary>
6740 ## </param>
6741 ## <param name="class">
6742 ##      <summary>
6743 ##      Object class(es) (single or set including {}) for which this
6744 ##      the transition will occur.
6745 ##      </summary>
6746 ## </param>
6747 #
6748 interface(`files_spool_filetrans',`
6749         gen_require(`
6750                 type var_t, var_spool_t;
6751         ')
6752
6753         allow $1 var_t:dir search_dir_perms;
6754         filetrans_pattern($1, var_spool_t, $2, $3, $4)
6755 ')
6756
6757 ########################################
6758 ## <summary>
6759 ##      Allow access to manage all polyinstantiated
6760 ##      directories on the system.
6761 ## </summary>
6762 ## <param name="domain">
6763 ##      <summary>
6764 ##      Domain allowed access.
6765 ##      </summary>
6766 ## </param>
6767 #
6768 interface(`files_polyinstantiate_all',`
6769         gen_require(`
6770                 attribute polydir, polymember, polyparent;
6771                 type poly_t;
6772         ')
6773
6774         # Need to give access to /selinux/member
6775         selinux_compute_member($1)
6776
6777         # Need sys_admin capability for mounting
6778         allow $1 self:capability { chown fsetid sys_admin fowner };
6779
6780         # Need to give access to the directories to be polyinstantiated
6781         allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
6782
6783         # Need to give access to the polyinstantiated subdirectories
6784         allow $1 polymember:dir search_dir_perms;
6785
6786         # Need to give access to parent directories where original
6787         # is remounted for polyinstantiation aware programs (like gdm)
6788         allow $1 polyparent:dir { getattr mounton };
6789
6790         # Need to give permission to create directories where applicable
6791         allow $1 self:process setfscreate;
6792         allow $1 polymember: dir { create setattr relabelto };
6793         allow $1 polydir: dir { write add_name open };
6794         allow $1 polyparent:dir { open read write remove_name add_name relabelfrom relabelto };
6795
6796         # Default type for mountpoints
6797         allow $1 poly_t:dir { create mounton };
6798         fs_unmount_xattr_fs($1)
6799
6800         fs_mount_tmpfs($1)
6801         fs_unmount_tmpfs($1)
6802
6803         ifdef(`distro_redhat',`
6804                 # namespace.init
6805                 files_search_tmp($1)
6806                 files_search_home($1)
6807                 corecmd_exec_bin($1)
6808                 seutil_domtrans_setfiles($1)
6809         ')
6810 ')
6811
6812 ########################################
6813 ## <summary>
6814 ##      Unconfined access to files.
6815 ## </summary>
6816 ## <param name="domain">
6817 ##      <summary>
6818 ##      Domain allowed access.
6819 ##      </summary>
6820 ## </param>
6821 #
6822 interface(`files_unconfined',`
6823         gen_require(`
6824                 attribute files_unconfined_type;
6825         ')
6826
6827         typeattribute $1 files_unconfined_type;
6828 ')
6829
6830 ########################################
6831 ## <summary>
6832 ##      Create a core files in /
6833 ## </summary>
6834 ## <desc>
6835 ##      <p>
6836 ##      Create a core file in /,
6837 ##      </p>
6838 ## </desc>
6839 ## <param name="domain">
6840 ##      <summary>
6841 ##      Domain allowed access.
6842 ##      </summary>
6843 ## </param>
6844 ## <rolecap/>
6845 #
6846 interface(`files_manage_root_files',`
6847         gen_require(`
6848                 type root_t;
6849         ')
6850
6851         manage_files_pattern($1, root_t, root_t)
6852 ')
6853
6854 ########################################
6855 ## <summary>
6856 ##     Create a default directory
6857 ## </summary>
6858 ## <desc>
6859 ##     <p>
6860 ##     Create a default_t direcrory
6861 ##     </p>
6862 ## </desc>
6863 ## <param name="domain">
6864 ##     <summary>
6865 ##     Domain allowed access.
6866 ##     </summary>
6867 ## </param>
6868 ## <rolecap/>
6869 #
6870 interface(`files_create_default_dir',`
6871        gen_require(`
6872                type default_t;
6873        ')
6874
6875        allow $1 default_t:dir create;
6876 ')
6877
6878 ########################################
6879 ## <summary>
6880 ##      Create, default_t objects with an automatic
6881 ##      type transition.
6882 ## </summary>
6883 ## <param name="domain">
6884 ##      <summary>
6885 ##      Domain allowed access.
6886 ##      </summary>
6887 ## </param>
6888 ## <param name="object">
6889 ##      <summary>
6890 ##      The class of the object being created.
6891 ##      </summary>
6892 ## </param>
6893 #
6894 interface(`files_root_filetrans_default',`
6895        gen_require(`
6896                type root_t, default_t;
6897        ')
6898
6899        filetrans_pattern($1, root_t, default_t, $2)
6900 ')
6901
6902 ########################################
6903 ## <summary>
6904 ##      manage generic symbolic links
6905 ##      in the /var/run directory.
6906 ## </summary>
6907 ## <param name="domain">
6908 ##      <summary>
6909 ##      Domain allowed access.
6910 ##      </summary>
6911 ## </param>
6912 #
6913 interface(`files_manage_generic_pids_symlinks',`
6914         gen_require(`
6915                 type var_run_t;
6916         ')
6917
6918         manage_lnk_files_pattern($1,var_run_t,var_run_t)
6919 ')
6920
6921 ########################################
6922 ## <summary>
6923 ##      Do not audit attempts to getattr
6924 ##      all tmpfs files.
6925 ## </summary>
6926 ## <param name="domain">
6927 ##      <summary>
6928 ##      Domain to not audit.
6929 ##      </summary>
6930 ## </param>
6931 #
6932 interface(`files_dontaudit_getattr_tmpfs_files',`
6933         gen_require(`
6934                 attribute tmpfsfile;
6935         ')
6936
6937         allow $1 tmpfsfile:file getattr;
6938 ')
6939
6940 ########################################
6941 ## <summary>
6942 ##      Allow read write all tmpfs files
6943 ## </summary>
6944 ## <param name="domain">
6945 ##      <summary>
6946 ##      Domain to not audit.
6947 ##      </summary>
6948 ## </param>
6949 #
6950 interface(`files_rw_tmpfs_files',`
6951         gen_require(`
6952                 attribute tmpfsfile;
6953         ')
6954
6955         allow $1 tmpfsfile:file { read write };
6956 ')
6957
6958 ########################################
6959 ## <summary>
6960 ##      Do not audit attempts to read security files
6961 ## </summary>
6962 ## <param name="domain">
6963 ##      <summary>
6964 ##      Domain to not audit.
6965 ##      </summary>
6966 ## </param>
6967 #
6968 interface(`files_dontaudit_read_security_files',`
6969         gen_require(`
6970                 attribute security_file_type;
6971         ')
6972
6973         dontaudit $1 security_file_type:file read_file_perms;
6974 ')
6975
6976 ########################################
6977 ## <summary>
6978 ##      rw any files inherited from another process
6979 ## </summary>
6980 ## <param name="domain">
6981 ##      <summary>
6982 ##      Domain allowed access.
6983 ##      </summary>
6984 ## </param>
6985 ## <rolecap/>
6986 #
6987 interface(`files_rw_all_inherited_files',`
6988         gen_require(`
6989                 attribute file_type;
6990         ')
6991
6992         allow $1 { file_type $2 }:file rw_inherited_file_perms;
6993         allow $1 { file_type $2 }:fifo_file rw_inherited_fifo_file_perms;
6994         allow $1 { file_type $2 }:sock_file rw_inherited_sock_file_perms;
6995         allow $1 { file_type $2 }:chr_file rw_inherited_chr_file_perms;
6996 ')
6997
6998 ########################################
6999 ## <summary>
7000 ##      Allow any file point to be the entrypoint of this domain
7001 ## </summary>
7002 ## <param name="domain">
7003 ##      <summary>
7004 ##      Domain allowed access.
7005 ##      </summary>
7006 ## </param>
7007 ## <rolecap/>
7008 #
7009 interface(`files_entrypoint_all_files',`
7010         gen_require(`
7011                 attribute file_type;
7012         ')
7013         allow $1 file_type:file entrypoint;
7014 ')
7015
7016 ########################################
7017 ## <summary>
7018 ##      Do not audit attempts to rw inherited file perms
7019 ##      of non security files.
7020 ## </summary>
7021 ## <param name="domain">
7022 ##      <summary>
7023 ##      Domain to not audit.
7024 ##      </summary>
7025 ## </param>
7026 #
7027 interface(`files_dontaudit_all_non_security_leaks',`
7028         gen_require(`
7029                 attribute non_security_file_type;
7030         ')
7031
7032         dontaudit $1 non_security_file_type:file_class_set rw_inherited_file_perms;
7033 ')
7034
7035 ########################################
7036 ## <summary>
7037 ##      Do not audit attempts to read or write
7038 ##      all leaked files.
7039 ## </summary>
7040 ## <param name="domain">
7041 ##      <summary>
7042 ##      Domain to not audit.
7043 ##      </summary>
7044 ## </param>
7045 #
7046 interface(`files_dontaudit_leaks',`
7047         gen_require(`
7048                 attribute file_type;
7049         ')
7050
7051         dontaudit $1 file_type:file rw_inherited_file_perms;
7052         dontaudit $1 file_type:lnk_file { read };
7053 ')
7054
7055 ########################################
7056 ## <summary>
7057 ##      Allow domain to create_file_ass all types
7058 ## </summary>
7059 ## <param name="domain">
7060 ##      <summary>
7061 ##      Domain allowed access.
7062 ##      </summary>
7063 ## </param>
7064 #
7065 interface(`files_create_as_is_all_files',`
7066         gen_require(`
7067                 attribute file_type;
7068                 class kernel_service create_files_as;
7069         ')
7070
7071         allow $1 file_type:kernel_service create_files_as;
7072 ')
7073
7074 ########################################
7075 ## <summary>
7076 ##      Do not audit attempts to check the
7077 ##      write access on all files
7078 ## </summary>
7079 ## <param name="domain">
7080 ##      <summary>
7081 ##      Domain to not audit.
7082 ##      </summary>
7083 ## </param>
7084 #
7085 interface(`files_dontaudit_all_access_check',`
7086         gen_require(`
7087                 attribute file_type;
7088         ')
7089
7090         dontaudit $1 file_type:file_class_set audit_access;
7091 ')
7092
7093 ########################################
7094 ## <summary>
7095 ##      Do not audit attempts to write to all files
7096 ## </summary>
7097 ## <param name="domain">
7098 ##      <summary>
7099 ##      Domain to not audit.
7100 ##      </summary>
7101 ## </param>
7102 #
7103 interface(`files_dontaudit_write_all_files',`
7104         gen_require(`
7105                 attribute file_type;
7106         ')
7107
7108         dontaudit $1 file_type:dir_file_class_set write;
7109 ')