policy/modules/system/selinuxutil.if

   1 ## <summary>Policy for SELinux policy and userland applications.</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      Execute checkpolicy in the checkpolicy domain.
   6 ## </summary>
   7 ## <param name="domain">
   8 ##      <summary>
   9 ##      Domain allowed access.
  10 ##      </summary>
  11 ## </param>
  12 #
  13 interface(`seutil_domtrans_checkpolicy',`
  14         gen_require(`
  15                 type checkpolicy_t, checkpolicy_exec_t;
  16         ')
  17
  18         files_search_usr($1)
  19         corecmd_search_bin($1)
  20         domtrans_pattern($1,checkpolicy_exec_t,checkpolicy_t)
  21 ')
  22
  23 ########################################
  24 ## <summary>
  25 ##      Execute checkpolicy in the checkpolicy domain, and
  26 ##      allow the specified role the checkpolicy domain,
  27 ##      and use the caller's terminal.
  28 ## </summary>
  29 ## <param name="domain">
  30 ##      <summary>
  31 ##      Domain allowed access.
  32 ##      </summary>
  33 ## </param>
  34 ## <param name="role">
  35 ##      <summary>
  36 ##      The role to be allowed the checkpolicy domain.
  37 ##      </summary>
  38 ## </param>
  39 ## <rolecap/>
  40 #
  41 interface(`seutil_run_checkpolicy',`
  42         gen_require(`
  43                 type checkpolicy_t;
  44         ')
  45
  46         seutil_domtrans_checkpolicy($1)
  47         role $2 types checkpolicy_t;
  48 ')
  49
  50 ########################################
  51 ## <summary>
  52 ##      Execute checkpolicy in the caller domain.
  53 ## </summary>
  54 ## <param name="domain">
  55 ##      <summary>
  56 ##      Domain allowed access.
  57 ##      </summary>
  58 ## </param>
  59 ## <rolecap/>
  60 #
  61 interface(`seutil_exec_checkpolicy',`
  62         gen_require(`
  63                 type checkpolicy_exec_t;
  64         ')
  65
  66         files_search_usr($1)
  67         corecmd_search_bin($1)
  68         can_exec($1,checkpolicy_exec_t)
  69 ')
  70
  71 #######################################
  72 ## <summary>
  73 ##      Execute load_policy in the load_policy domain.
  74 ## </summary>
  75 ## <param name="domain">
  76 ##      <summary>
  77 ##      Domain allowed access.
  78 ##      </summary>
  79 ## </param>
  80 #
  81 interface(`seutil_domtrans_loadpolicy',`
  82         gen_require(`
  83                 type load_policy_t, load_policy_exec_t;
  84         ')
  85
  86         corecmd_search_bin($1)
  87         domtrans_pattern($1,load_policy_exec_t,load_policy_t)
  88 ')
  89
  90 ########################################
  91 ## <summary>
  92 ##      Execute load_policy in the load_policy domain, and
  93 ##      allow the specified role the load_policy domain,
  94 ##      and use the caller's terminal.
  95 ## </summary>
  96 ## <param name="domain">
  97 ##      <summary>
  98 ##      Domain allowed access.
  99 ##      </summary>
 100 ## </param>
 101 ## <param name="role">
 102 ##      <summary>
 103 ##      The role to be allowed the load_policy domain.
 104 ##      </summary>
 105 ## </param>
 106 ## <rolecap/>
 107 #
 108 interface(`seutil_run_loadpolicy',`
 109         gen_require(`
 110                 type load_policy_t;
 111         ')
 112
 113         seutil_domtrans_loadpolicy($1)
 114         role $2 types load_policy_t;
 115 ')
 116
 117 ########################################
 118 ## <summary>
 119 ##      Execute load_policy in the caller domain.
 120 ## </summary>
 121 ## <param name="domain">
 122 ##      <summary>
 123 ##      Domain allowed access.
 124 ##      </summary>
 125 ## </param>
 126 #
 127 interface(`seutil_exec_loadpolicy',`
 128         gen_require(`
 129                 type load_policy_exec_t;
 130         ')
 131
 132         corecmd_search_bin($1)
 133         can_exec($1,load_policy_exec_t)
 134 ')
 135
 136 ########################################
 137 ## <summary>
 138 ##      Read the load_policy program file.
 139 ## </summary>
 140 ## <param name="domain">
 141 ##      <summary>
 142 ##      Domain allowed access.
 143 ##      </summary>
 144 ## </param>
 145 #
 146 interface(`seutil_read_loadpolicy',`
 147         gen_require(`
 148                 type load_policy_exec_t;
 149         ')
 150
 151         corecmd_search_bin($1)
 152         allow $1 load_policy_exec_t:file read_file_perms;
 153 ')
 154
 155 #######################################
 156 ## <summary>
 157 ##      Execute newrole in the newole domain.
 158 ## </summary>
 159 ## <param name="domain">
 160 ##      <summary>
 161 ##      Domain allowed access.
 162 ##      </summary>
 163 ## </param>
 164 #
 165 interface(`seutil_domtrans_newrole',`
 166         gen_require(`
 167                 type newrole_t, newrole_exec_t;
 168         ')
 169
 170         files_search_usr($1)
 171         corecmd_search_bin($1)
 172         domtrans_pattern($1,newrole_exec_t,newrole_t)
 173 ')
 174
 175 ########################################
 176 ## <summary>
 177 ##      Execute newrole in the newrole domain, and
 178 ##      allow the specified role the newrole domain,
 179 ##      and use the caller's terminal.
 180 ## </summary>
 181 ## <param name="domain">
 182 ##      <summary>
 183 ##      Domain allowed access.
 184 ##      </summary>
 185 ## </param>
 186 ## <param name="role">
 187 ##      <summary>
 188 ##      The role to be allowed the newrole domain.
 189 ##      </summary>
 190 ## </param>
 191 ## <rolecap/>
 192 #
 193 interface(`seutil_run_newrole',`
 194         gen_require(`
 195                 type newrole_t;
 196         ')
 197
 198         seutil_domtrans_newrole($1)
 199         role $2 types newrole_t;
 200
 201         auth_run_upd_passwd(newrole_t, $2)
 202 ')
 203
 204 ########################################
 205 ## <summary>
 206 ##      Execute newrole in the caller domain.
 207 ## </summary>
 208 ## <param name="domain">
 209 ##      <summary>
 210 ##      Domain allowed access.
 211 ##      </summary>
 212 ## </param>
 213 #
 214 interface(`seutil_exec_newrole',`
 215         gen_require(`
 216                 type newrole_t, newrole_exec_t;
 217         ')
 218
 219         files_search_usr($1)
 220         corecmd_search_bin($1)
 221         can_exec($1,newrole_exec_t)
 222 ')
 223
 224 ########################################
 225 ## <summary>
 226 ##      Do not audit the caller attempts to send
 227 ##      a signal to newrole.
 228 ## </summary>
 229 ## <param name="domain">
 230 ##      <summary>
 231 ##      Domain allowed access.
 232 ##      </summary>
 233 ## </param>
 234 #
 235 interface(`seutil_dontaudit_signal_newrole',`
 236         gen_require(`
 237                 type newrole_t;
 238         ')
 239
 240         dontaudit $1 newrole_t:process signal;
 241 ')
 242
 243 ########################################
 244 ## <summary>
 245 ##      Send a SIGCHLD signal to newrole.
 246 ## </summary>
 247 ## <param name="domain">
 248 ##      <summary>
 249 ##      Domain allowed access.
 250 ##      </summary>
 251 ## </param>
 252 #
 253 interface(`seutil_sigchld_newrole',`
 254         gen_require(`
 255                 type newrole_t;
 256         ')
 257
 258         allow $1 newrole_t:process sigchld;
 259 ')
 260
 261 ########################################
 262 ## <summary>
 263 ##      Inherit and use newrole file descriptors.
 264 ## </summary>
 265 ## <param name="domain">
 266 ##      <summary>
 267 ##      Domain allowed access.
 268 ##      </summary>
 269 ## </param>
 270 #
 271 interface(`seutil_use_newrole_fds',`
 272         gen_require(`
 273                 type newrole_t;
 274         ')
 275
 276         allow $1 newrole_t:fd use;
 277 ')
 278
 279 ########################################
 280 ## <summary>
 281 ##      Do not audit attempts to inherit and use
 282 ##      newrole file descriptors.
 283 ## </summary>
 284 ## <param name="domain">
 285 ##      <summary>
 286 ##      Domain to not audit.
 287 ##      </summary>
 288 ## </param>
 289 #
 290 interface(`seutil_dontaudit_use_newrole_fds',`
 291         gen_require(`
 292                 type newrole_t;
 293         ')
 294
 295         dontaudit $1 newrole_t:fd use;
 296 ')
 297
 298 #######################################
 299 ## <summary>
 300 ##      Execute restorecon in the restorecon domain.  (Deprecated)
 301 ## </summary>
 302 ## <param name="domain">
 303 ##      <summary>
 304 ##      Domain allowed access.
 305 ##      </summary>
 306 ## </param>
 307 #
 308 interface(`seutil_domtrans_restorecon',`
 309         refpolicywarn(`$0($*) has been deprecated, please use seutil_domtrans_setfiles() instead.')
 310         seutil_domtrans_setfiles($1)
 311 ')
 312
 313 ########################################
 314 ## <summary>
 315 ##      Execute restorecon in the restorecon domain, and
 316 ##      allow the specified role the restorecon domain,
 317 ##      and use the caller's terminal.  (Deprecated)
 318 ## </summary>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="role">
 325 ##      <summary>
 326 ##      The role to be allowed the restorecon domain.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolecap/>
 330 #
 331 interface(`seutil_run_restorecon',`
 332         refpolicywarn(`$0($*) has been deprecated, please use seutil_run_setfiles() instead.')
 333         seutil_run_setfiles($1,$2)
 334 ')
 335
 336 ########################################
 337 ## <summary>
 338 ##      Execute restorecon in the caller domain.  (Deprecated)
 339 ## </summary>
 340 ## <param name="domain">
 341 ##      <summary>
 342 ##      Domain allowed access.
 343 ##      </summary>
 344 ## </param>
 345 ## <rolecap/>
 346 #
 347 interface(`seutil_exec_restorecon',`
 348         refpolicywarn(`$0($*) has been deprecated, please use seutil_exec_setfiles() instead.')
 349         seutil_exec_setfiles($1)
 350 ')
 351
 352 ########################################
 353 ## <summary>
 354 ##      Execute run_init in the run_init domain.
 355 ## </summary>
 356 ## <param name="domain">
 357 ##      <summary>
 358 ##      Domain allowed access.
 359 ##      </summary>
 360 ## </param>
 361 #
 362 interface(`seutil_domtrans_runinit',`
 363         gen_require(`
 364                 type run_init_t, run_init_exec_t;
 365         ')
 366
 367         files_search_usr($1)
 368         corecmd_search_bin($1)
 369         domtrans_pattern($1,run_init_exec_t,run_init_t)
 370 ')
 371
 372 ########################################
 373 ## <summary>
 374 ##      Execute init scripts in the run_init domain.
 375 ## </summary>
 376 ## <desc>
 377 ##      <p>
 378 ##      Execute init scripts in the run_init domain.
 379 ##      This is used for the Gentoo integrated run_init.
 380 ##      </p>
 381 ## </desc>
 382 ## <param name="domain">
 383 ##      <summary>
 384 ##      Domain allowed access.
 385 ##      </summary>
 386 ## </param>
 387 #
 388 interface(`seutil_init_script_domtrans_runinit',`
 389         gen_require(`
 390                 type run_init_t;
 391         ')
 392
 393         init_script_file_domtrans($1,run_init_t)
 394
 395         allow run_init_t $1:fd use;
 396         allow run_init_t $1:fifo_file rw_file_perms;
 397         allow run_init_t $1:process sigchld;
 398 ')
 399
 400 ########################################
 401 ## <summary>
 402 ##      Execute run_init in the run_init domain, and
 403 ##      allow the specified role the run_init domain,
 404 ##      and use the caller's terminal.
 405 ## </summary>
 406 ## <param name="domain">
 407 ##      <summary>
 408 ##      Domain allowed access.
 409 ##      </summary>
 410 ## </param>
 411 ## <param name="role">
 412 ##      <summary>
 413 ##      The role to be allowed the run_init domain.
 414 ##      </summary>
 415 ## </param>
 416 ## <rolecap/>
 417 #
 418 interface(`seutil_run_runinit',`
 419         gen_require(`
 420                 type run_init_t;
 421                 role system_r;
 422         ')
 423
 424         auth_run_chk_passwd(run_init_t, $2)
 425         seutil_domtrans_runinit($1)
 426         role $2 types run_init_t;
 427
 428         allow $2 system_r;
 429 ')
 430
 431 ########################################
 432 ## <summary>
 433 ##      Execute init scripts in the run_init domain, and
 434 ##      allow the specified role the run_init domain,
 435 ##      and use the caller's terminal.
 436 ## </summary>
 437 ## <desc>
 438 ##      <p>
 439 ##      Execute init scripts in the run_init domain, and
 440 ##      allow the specified role the run_init domain,
 441 ##      and use the caller's terminal.
 442 ##      </p>
 443 ##      <p>
 444 ##      This is used for the Gentoo integrated run_init.
 445 ##      </p>
 446 ## </desc>
 447 ## <param name="domain">
 448 ##      <summary>
 449 ##      Domain allowed access.
 450 ##      </summary>
 451 ## </param>
 452 ## <param name="role">
 453 ##      <summary>
 454 ##      The role to be allowed the run_init domain.
 455 ##      </summary>
 456 ## </param>
 457 #
 458 interface(`seutil_init_script_run_runinit',`
 459         gen_require(`
 460                 type run_init_t;
 461                 role system_r;
 462         ')
 463
 464         auth_run_chk_passwd(run_init_t, $2)
 465         seutil_init_script_domtrans_runinit($1)
 466         role $2 types run_init_t;
 467
 468         allow $2 system_r;
 469 ')
 470
 471 ########################################
 472 ## <summary>
 473 ##      Inherit and use run_init file descriptors.
 474 ## </summary>
 475 ## <param name="domain">
 476 ##      <summary>
 477 ##      Domain allowed access.
 478 ##      </summary>
 479 ## </param>
 480 #
 481 interface(`seutil_use_runinit_fds',`
 482         gen_require(`
 483                 type run_init_t;
 484         ')
 485
 486         allow $1 run_init_t:fd use;
 487 ')
 488
 489 ########################################
 490 ## <summary>
 491 ##      Execute setfiles in the setfiles domain.
 492 ## </summary>
 493 ## <param name="domain">
 494 ##      <summary>
 495 ##      Domain allowed access.
 496 ##      </summary>
 497 ## </param>
 498 #
 499 interface(`seutil_domtrans_setfiles',`
 500         gen_require(`
 501                 type setfiles_t, setfiles_exec_t;
 502         ')
 503
 504         files_search_usr($1)
 505         corecmd_search_bin($1)
 506         domtrans_pattern($1,setfiles_exec_t,setfiles_t)
 507 ')
 508
 509 ########################################
 510 ## <summary>
 511 ##      Execute setfiles in the setfiles domain, and
 512 ##      allow the specified role the setfiles domain,
 513 ##      and use the caller's terminal.
 514 ## </summary>
 515 ## <param name="domain">
 516 ##      <summary>
 517 ##      Domain allowed access.
 518 ##      </summary>
 519 ## </param>
 520 ## <param name="role">
 521 ##      <summary>
 522 ##      The role to be allowed the setfiles domain.
 523 ##      </summary>
 524 ## </param>
 525 ## <rolecap/>
 526 #
 527 interface(`seutil_run_setfiles',`
 528         gen_require(`
 529                 type setfiles_t;
 530         ')
 531
 532         seutil_domtrans_setfiles($1)
 533         role $2 types setfiles_t;
 534 ')
 535
 536 ########################################
 537 ## <summary>
 538 ##      Execute setfiles in the caller domain.
 539 ## </summary>
 540 ## <param name="domain">
 541 ##      <summary>
 542 ##      Domain allowed access.
 543 ##      </summary>
 544 ## </param>
 545 #
 546 interface(`seutil_exec_setfiles',`
 547         gen_require(`
 548                 type setfiles_exec_t;
 549         ')
 550
 551         files_search_usr($1)
 552         corecmd_search_bin($1)
 553         can_exec($1,setfiles_exec_t)
 554 ')
 555
 556 ########################################
 557 ## <summary>
 558 ##      Do not audit attempts to search the SELinux
 559 ##      configuration directory (/etc/selinux).
 560 ## </summary>
 561 ## <param name="domain">
 562 ##      <summary>
 563 ##      Domain to not audit.
 564 ##      </summary>
 565 ## </param>
 566 #
 567 interface(`seutil_dontaudit_search_config',`
 568         gen_require(`
 569                 type selinux_config_t;
 570         ')
 571
 572         dontaudit $1 selinux_config_t:dir search_dir_perms;
 573 ')
 574
 575 ########################################
 576 ## <summary>
 577 ##      Do not audit attempts to read the SELinux
 578 ##      userland configuration (/etc/selinux).
 579 ## </summary>
 580 ## <param name="domain">
 581 ##      <summary>
 582 ##      Domain to not audit.
 583 ##      </summary>
 584 ## </param>
 585 #
 586 interface(`seutil_dontaudit_read_config',`
 587         gen_require(`
 588                 type selinux_config_t;
 589         ')
 590
 591         dontaudit $1 selinux_config_t:dir search_dir_perms;
 592         dontaudit $1 selinux_config_t:file read_file_perms;
 593 ')
 594
 595 ########################################
 596 ## <summary>
 597 ##      Read the general SELinux configuration files.
 598 ## </summary>
 599 ## <param name="domain">
 600 ##      <summary>
 601 ##      Domain allowed access.
 602 ##      </summary>
 603 ## </param>
 604 ## <rolecap/>
 605 #
 606 interface(`seutil_read_config',`
 607         gen_require(`
 608                 type selinux_config_t;
 609         ')
 610
 611         files_search_etc($1)
 612         allow $1 selinux_config_t:dir list_dir_perms;
 613         read_files_pattern($1,selinux_config_t,selinux_config_t)
 614         read_lnk_files_pattern($1,selinux_config_t,selinux_config_t)
 615 ')
 616
 617 ########################################
 618 ## <summary>
 619 ##      Read and write the general SELinux configuration files.
 620 ## </summary>
 621 ## <param name="domain">
 622 ##      <summary>
 623 ##      Domain allowed access.
 624 ##      </summary>
 625 ## </param>
 626 ## <rolecap/>
 627 #
 628 interface(`seutil_rw_config',`
 629         gen_require(`
 630                 type selinux_config_t;
 631         ')
 632
 633         files_search_etc($1)
 634         allow $1 selinux_config_t:dir list_dir_perms;
 635         rw_files_pattern($1,selinux_config_t,selinux_config_t)
 636 ')
 637
 638 #######################################
 639 ## <summary>
 640 ##      Create, read, write, and delete
 641 ##      the general selinux configuration files.  (Deprecated)
 642 ## </summary>
 643 ## <desc>
 644 ##      <p>
 645 ##      Create, read, write, and delete
 646 ##      the general selinux configuration files.
 647 ##      </p>
 648 ##      <p>
 649 ##      This interface has been deprecated, please
 650 ##      use the seutil_manage_config() interface instead.
 651 ##      </p>
 652 ## </desc>
 653 ## <param name="domain">
 654 ##      <summary>
 655 ##      Domain allowed access.
 656 ##      </summary>
 657 ## </param>
 658 ## <rolecap/>
 659 #
 660 interface(`seutil_manage_selinux_config',`
 661         refpolicywarn(`$0($*) has been deprecated.  Please use seutil_manage_config() instead.')
 662         seutil_manage_config($1)
 663 ')
 664
 665 #######################################
 666 ## <summary>
 667 ##      Create, read, write, and delete
 668 ##      the general selinux configuration files.
 669 ## </summary>
 670 ## <param name="domain">
 671 ##      <summary>
 672 ##      Domain allowed access.
 673 ##      </summary>
 674 ## </param>
 675 ## <rolecap/>
 676 #
 677 interface(`seutil_manage_config',`
 678         gen_require(`
 679                 type selinux_config_t;
 680         ')
 681
 682         files_search_etc($1)
 683         manage_files_pattern($1,selinux_config_t,selinux_config_t)
 684         read_lnk_files_pattern($1,selinux_config_t,selinux_config_t)
 685 ')
 686
 687 #######################################
 688 ## <summary>
 689 ##      Create, read, write, and delete
 690 ##      the general selinux configuration files.
 691 ## </summary>
 692 ## <param name="domain">
 693 ##      <summary>
 694 ##      Domain allowed access.
 695 ##      </summary>
 696 ## </param>
 697 ## <rolecap/>
 698 #
 699 interface(`seutil_manage_config_dirs',`
 700         gen_require(`
 701                 type selinux_config_t;
 702         ')
 703
 704         files_search_etc($1)
 705         allow $1 selinux_config_t:dir manage_dir_perms;
 706 ')
 707
 708 ########################################
 709 ## <summary>
 710 ##      Search the policy directory with default_context files.
 711 ## </summary>
 712 ## <param name="domain">
 713 ##      <summary>
 714 ##      Domain allowed access.
 715 ##      </summary>
 716 ## </param>
 717 #
 718 interface(`seutil_search_default_contexts',`
 719         gen_require(`
 720                 type selinux_config_t, default_context_t;
 721         ')
 722
 723         files_search_etc($1)
 724         search_dirs_pattern($1,selinux_config_t,default_context_t)
 725 ')
 726
 727 ########################################
 728 ## <summary>
 729 ##      Read the default_contexts files.
 730 ## </summary>
 731 ## <param name="domain">
 732 ##      <summary>
 733 ##      Domain allowed access.
 734 ##      </summary>
 735 ## </param>
 736 ## <rolecap/>
 737 #
 738 interface(`seutil_read_default_contexts',`
 739         gen_require(`
 740                 type selinux_config_t, default_context_t;
 741         ')
 742
 743         files_search_etc($1)
 744         allow $1 selinux_config_t:dir search_dir_perms;
 745         allow $1 default_context_t:dir list_dir_perms;
 746         read_files_pattern($1,default_context_t,default_context_t)
 747 ')
 748
 749 ########################################
 750 ## <summary>
 751 ##      Create, read, write, and delete the default_contexts files.
 752 ## </summary>
 753 ## <param name="domain">
 754 ##      <summary>
 755 ##      Domain allowed access.
 756 ##      </summary>
 757 ## </param>
 758 #
 759 interface(`seutil_manage_default_contexts',`
 760         gen_require(`
 761                 type selinux_config_t, default_context_t;
 762         ')
 763
 764         files_search_etc($1)
 765         allow $1 selinux_config_t:dir search_dir_perms;
 766         manage_files_pattern($1,default_context_t,default_context_t)
 767 ')
 768
 769 ########################################
 770 ## <summary>
 771 ##      Read the file_contexts files.
 772 ## </summary>
 773 ## <param name="domain">
 774 ##      <summary>
 775 ##      Domain allowed access.
 776 ##      </summary>
 777 ## </param>
 778 ## <rolecap/>
 779 #
 780 interface(`seutil_read_file_contexts',`
 781         gen_require(`
 782                 type selinux_config_t, default_context_t, file_context_t;
 783         ')
 784
 785         files_search_etc($1)
 786         allow $1 { selinux_config_t default_context_t }:dir search_dir_perms;
 787         read_files_pattern($1,file_context_t,file_context_t)
 788 ')
 789
 790 ########################################
 791 ## <summary>
 792 ##      Do not audit attempts to read the file_contexts files.
 793 ## </summary>
 794 ## <param name="domain">
 795 ##      <summary>
 796 ##      Domain allowed access.
 797 ##      </summary>
 798 ## </param>
 799 ## <rolecap/>
 800 #
 801 interface(`seutil_dontaudit_read_file_contexts',`
 802         gen_require(`
 803                 type selinux_config_t, default_context_t, file_context_t;
 804         ')
 805
 806         dontaudit $1 { selinux_config_t default_context_t file_context_t }:dir search_dir_perms;
 807         dontaudit $1 file_context_t:file read_file_perms;
 808 ')
 809
 810 ########################################
 811 ## <summary>
 812 ##      Read and write the file_contexts files.
 813 ## </summary>
 814 ## <param name="domain">
 815 ##      <summary>
 816 ##      Domain allowed access.
 817 ##      </summary>
 818 ## </param>
 819 #
 820 interface(`seutil_rw_file_contexts',`
 821         gen_require(`
 822                 type selinux_config_t, file_context_t, default_context_t;
 823         ')
 824
 825         files_search_etc($1)
 826         allow $1 { selinux_config_t default_context_t }:dir search_dir_perms;
 827         rw_files_pattern($1,file_context_t,file_context_t)
 828 ')
 829
 830 ########################################
 831 ## <summary>
 832 ##      Create, read, write, and delete the file_contexts files.
 833 ## </summary>
 834 ## <param name="domain">
 835 ##      <summary>
 836 ##      Domain allowed access.
 837 ##      </summary>
 838 ## </param>
 839 ## <rolecap/>
 840 #
 841 interface(`seutil_manage_file_contexts',`
 842         gen_require(`
 843                 type selinux_config_t, file_context_t, default_context_t;
 844         ')
 845
 846         files_search_etc($1)
 847         allow $1 { selinux_config_t default_context_t }:dir search_dir_perms;
 848         manage_files_pattern($1,file_context_t,file_context_t)
 849 ')
 850
 851 ########################################
 852 ## <summary>
 853 ##      Read the SELinux binary policy.
 854 ## </summary>
 855 ## <param name="domain">
 856 ##      <summary>
 857 ##      Domain allowed access.
 858 ##      </summary>
 859 ## </param>
 860 #
 861 interface(`seutil_read_bin_policy',`
 862         gen_require(`
 863                 type selinux_config_t, policy_config_t;
 864         ')
 865
 866         files_search_etc($1)
 867         allow $1 selinux_config_t:dir search_dir_perms;
 868         read_files_pattern($1,policy_config_t,policy_config_t)
 869 ')
 870
 871 ########################################
 872 ## <summary>
 873 ##      Create the SELinux binary policy.
 874 ## </summary>
 875 ## <param name="domain">
 876 ##      <summary>
 877 ##      Domain allowed access.
 878 ##      </summary>
 879 ## </param>
 880 #
 881 interface(`seutil_create_bin_policy',`
 882         gen_require(`
 883 #               attribute can_write_binary_policy;
 884                 type selinux_config_t, policy_config_t;
 885         ')
 886
 887         files_search_etc($1)
 888         allow $1 selinux_config_t:dir search_dir_perms;
 889         create_files_pattern($1,policy_config_t,policy_config_t)
 890         write_files_pattern($1,policy_config_t,policy_config_t)
 891 #       typeattribute $1 can_write_binary_policy;
 892 ')
 893
 894 ########################################
 895 ## <summary>
 896 ##      Allow the caller to relabel a file to the binary policy type.
 897 ## </summary>
 898 ## <param name="domain">
 899 ##      <summary>
 900 ##      Domain allowed access.
 901 ##      </summary>
 902 ## </param>
 903 #
 904 interface(`seutil_relabelto_bin_policy',`
 905         gen_require(`
 906                 attribute can_relabelto_binary_policy;
 907                 type policy_config_t;
 908         ')
 909
 910         allow $1 policy_config_t:file relabelto;
 911         typeattribute $1 can_relabelto_binary_policy;
 912 ')
 913
 914 ########################################
 915 ## <summary>
 916 ##      Create, read, write, and delete the SELinux
 917 ##      binary policy.
 918 ## </summary>
 919 ## <param name="domain">
 920 ##      <summary>
 921 ##      Domain allowed access.
 922 ##      </summary>
 923 ## </param>
 924 #
 925 interface(`seutil_manage_bin_policy',`
 926         gen_require(`
 927                 attribute can_write_binary_policy;
 928                 type selinux_config_t, policy_config_t;
 929         ')
 930
 931         files_search_etc($1)
 932         allow $1 selinux_config_t:dir search_dir_perms;
 933         manage_files_pattern($1,policy_config_t,policy_config_t)
 934         typeattribute $1 can_write_binary_policy;
 935 ')
 936
 937 ########################################
 938 ## <summary>
 939 ##      Read SELinux policy source files.
 940 ## </summary>
 941 ## <param name="domain">
 942 ##      <summary>
 943 ##      Domain allowed access.
 944 ##      </summary>
 945 ## </param>
 946 #
 947 interface(`seutil_read_src_policy',`
 948         gen_require(`
 949                 type selinux_config_t, policy_src_t;
 950         ')
 951
 952         files_search_etc($1)
 953         list_dirs_pattern($1,selinux_config_t,policy_src_t)
 954         read_files_pattern($1,policy_src_t,policy_src_t)
 955 ')
 956
 957 ########################################
 958 ## <summary>
 959 ##      Create, read, write, and delete SELinux
 960 ##      policy source files.
 961 ## </summary>
 962 ## <param name="domain">
 963 ##      <summary>
 964 ##      Domain allowed access.
 965 ##      </summary>
 966 ## </param>
 967 ## <rolecap/>
 968 #
 969 interface(`seutil_manage_src_policy',`
 970         gen_require(`
 971                 type selinux_config_t, policy_src_t;
 972         ')
 973
 974         files_search_etc($1)
 975         allow $1 selinux_config_t:dir search_dir_perms;
 976         manage_dirs_pattern($1,policy_src_t,policy_src_t)
 977         manage_files_pattern($1,policy_src_t,policy_src_t)
 978 ')
 979
 980 ########################################
 981 ## <summary>
 982 ##      Execute a domain transition to run semanage.
 983 ## </summary>
 984 ## <param name="domain">
 985 ##      <summary>
 986 ##      Domain allowed to transition.
 987 ##      </summary>
 988 ## </param>
 989 #
 990 interface(`seutil_domtrans_semanage',`
 991         gen_require(`
 992                 type semanage_t, semanage_exec_t;
 993         ')
 994
 995         files_search_usr($1)
 996         corecmd_search_bin($1)
 997         domtrans_pattern($1,semanage_exec_t,semanage_t)
 998 ')
 999
1000 ########################################
1001 ## <summary>
1002 ##      Execute semanage in the semanage domain, and
1003 ##      allow the specified role the semanage domain,
1004 ##      and use the caller's terminal.
1005 ## </summary>
1006 ## <param name="domain">
1007 ##      <summary>
1008 ##      Domain allowed access.
1009 ##      </summary>
1010 ## </param>
1011 ## <param name="role">
1012 ##      <summary>
1013 ##      The role to be allowed the checkpolicy domain.
1014 ##      </summary>
1015 ## </param>
1016 ## <rolecap/>
1017 #
1018 interface(`seutil_run_semanage',`
1019         gen_require(`
1020                 type semanage_t;
1021         ')
1022
1023         seutil_domtrans_semanage($1)
1024         seutil_run_setfiles(semanage_t, $2)
1025         seutil_run_loadpolicy(semanage_t, $2)
1026         role $2 types semanage_t;
1027 ')
1028
1029 ########################################
1030 ## <summary>
1031 ##      Full management of the semanage
1032 ##      module store.
1033 ## </summary>
1034 ## <param name="domain">
1035 ##      <summary>
1036 ##      Domain allowed access.
1037 ##      </summary>
1038 ## </param>
1039 #
1040 interface(`seutil_manage_module_store',`
1041         gen_require(`
1042                 type selinux_config_t, semanage_store_t;
1043         ')
1044
1045         files_search_etc($1)
1046         manage_dirs_pattern($1,selinux_config_t,semanage_store_t)
1047         manage_files_pattern($1,semanage_store_t,semanage_store_t)
1048         filetrans_pattern($1,selinux_config_t,semanage_store_t,dir)
1049 ')
1050
1051 #######################################
1052 ## <summary>
1053 ##      Get read lock on module store
1054 ## </summary>
1055 ## <param name="domain">
1056 ##      <summary>
1057 ##      Domain allowed access.
1058 ##      </summary>
1059 ## </param>
1060 #
1061 interface(`seutil_get_semanage_read_lock',`
1062         gen_require(`
1063                 type selinux_config_t, semanage_read_lock_t;
1064         ')
1065
1066         files_search_etc($1)
1067         rw_files_pattern($1,selinux_config_t,semanage_read_lock_t)
1068 ')
1069
1070 #######################################
1071 ## <summary>
1072 ##      Get trans lock on module store
1073 ## </summary>
1074 ## <param name="domain">
1075 ##      <summary>
1076 ##      Domain allowed access.
1077 ##      </summary>
1078 ## </param>
1079 #
1080 interface(`seutil_get_semanage_trans_lock',`
1081         gen_require(`
1082                 type selinux_config_t, semanage_trans_lock_t;
1083         ')
1084
1085         files_search_etc($1)
1086         rw_files_pattern($1,selinux_config_t,semanage_trans_lock_t)
1087 ')
1088
1089 ########################################
1090 ## <summary>
1091 ##      SELinux-enabled program access for
1092 ##      libselinux-linked programs.
1093 ## </summary>
1094 ## <desc>
1095 ##      <p>
1096 ##      SELinux-enabled programs are typically
1097 ##      linked to the libselinux library.  This
1098 ##      interface will allow access required for
1099 ##      the libselinux constructor to function.
1100 ##      </p>
1101 ## </desc>
1102 ## <param name="domain">
1103 ##      <summary>
1104 ##      Domain allowed access.
1105 ##      </summary>
1106 ## </param>
1107 #
1108 interface(`seutil_libselinux_linked',`
1109         selinux_get_fs_mount($1)
1110         seutil_read_config($1)
1111 ')
1112
1113 ########################################
1114 ## <summary>
1115 ##      Do not audit SELinux-enabled program access for
1116 ##      libselinux-linked programs.
1117 ## </summary>
1118 ## <desc>
1119 ##      <p>
1120 ##      SELinux-enabled programs are typically
1121 ##      linked to the libselinux library.  This
1122 ##      interface will dontaudit access required for
1123 ##      the libselinux constructor to function.
1124 ##      </p>
1125 ##      <p>
1126 ##      Generally this should not be used on anything
1127 ##      but simple SELinux-enabled programs that do not
1128 ##      rely on data initialized by the libselinux
1129 ##      constructor.
1130 ##      </p>
1131 ## </desc>
1132 ## <param name="domain">
1133 ##      <summary>
1134 ##      Domain allowed access.
1135 ##      </summary>
1136 ## </param>
1137 #
1138 interface(`seutil_dontaudit_libselinux_linked',`
1139         selinux_dontaudit_get_fs_mount($1)
1140         seutil_dontaudit_read_config($1)
1141 ')