## <summary>

## Device nodes and interfaces for many basic system devices.

## </summary>

## <desc>

## 

## This module creates the device node concept and provides

## the policy for many of the device files. Notable exceptions are

## the mass storage and terminal devices that are covered by other

## modules.

## 

## 

## This module creates the concept of a device node. That is a

## char or block device file, usually in /dev. All types that

## are used to label device nodes should use the dev_node macro.

## 

## 

## Additionally, this module controls access to three things:

##	

##		
the device directories containing device nodes

##		
device nodes as a group

##		
individual access to specific device nodes covered by

##		this module.

##	

## 

## </desc>

## <required val="true">

##	Depended on by other required modules.

## </required>

########################################

## <summary>

##	Make the passed in type a type appropriate for

##	use on device nodes (usually files in /dev).

## </summary>

## <param name="object_type">

##	<summary>

##	The object type that will be used on device nodes.

##	</summary>

## </param>

#

interface(`dev_node',`

	gen_require(`

		attribute device_node;

	')

	typeattribute $1 device_node;

')

########################################

## <summary>

##	Allow full relabeling (to and from) of all device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to relabel.

##	</summary>

## </param>

## <rolecap/>

#

interface(`dev_relabel_all_dev_nodes',`

	gen_require(`

		attribute device_node;

		type device_t;

	')

	relabelfrom_dirs_pattern($1,device_t,device_node)

	relabelfrom_files_pattern($1,device_t,device_node)

	relabelfrom_lnk_files_pattern($1,device_t,device_node)

	relabelfrom_fifo_files_pattern($1,device_t,device_node)

	relabelfrom_sock_files_pattern($1,device_t,device_node)

	relabel_blk_files_pattern($1,device_t,{ device_t device_node })

	relabel_chr_files_pattern($1,device_t,{ device_t device_node })

')

########################################

## <summary>

##	List all of the device nodes in a device directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to list device nodes.

##	</summary>

## </param>

#

interface(`dev_list_all_dev_nodes',`

	gen_require(`

		type device_t;

	')

	list_dirs_pattern($1,device_t,device_t)

	read_lnk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Set the attributes of /dev directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_setattr_generic_dirs',`

	gen_require(`

		type device_t;

	')

	setattr_dirs_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Dontaudit attempts to list all device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit listing of device nodes.

##	</summary>

## </param>

#

interface(`dev_dontaudit_list_all_dev_nodes',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:dir list_dir_perms;

')

########################################

## <summary>

##	Add entries to directories in /dev.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to add entries.

##	</summary>

## </param>

#

interface(`dev_add_entry_generic_dirs',`

	gen_require(`

		type device_t;

	')

	allow $1 device_t:dir add_entry_dir_perms;

')

########################################

## <summary>

##	Create a directory in the device directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to create the directory.

##	</summary>

## </param>

#

interface(`dev_create_generic_dirs',`

	gen_require(`

		type device_t;

	')

	create_dirs_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Delete a directory in the device directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to create the directory.

##	</summary>

## </param>

#

interface(`dev_delete_generic_dirs',`

	gen_require(`

		type device_t;

	')

	delete_dirs_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Allow full relabeling (to and from) of directories in /dev.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to relabel.

##	</summary>

## </param>

#

interface(`dev_relabel_generic_dev_dirs',`

	gen_require(`

		type device_t;

	')

	relabel_dirs_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	dontaudit getattr generic files in /dev.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`dev_dontaudit_getattr_generic_files',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:file getattr;

')

########################################

## <summary>

##	Read and write generic files in /dev.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_rw_generic_files',`

	gen_require(`

		type device_t;

	')

	rw_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Delete generic files in /dev.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_delete_generic_files',`

	gen_require(`

		type device_t;

	')

	delete_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Create a file in the device directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed to create the files.

##	</summary>

## </param>

#

interface(`dev_manage_generic_files',`

	gen_require(`

		type device_t;

	')

	manage_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Dontaudit getattr on generic pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit.

##	</summary>

## </param>

#

interface(`dev_dontaudit_getattr_generic_pipes',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:fifo_file getattr;

')

########################################

## <summary>

##	Allow getattr on generic block devices.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_getattr_generic_blk_files',`

	gen_require(`

		type device_t;

	')

	getattr_blk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Dontaudit getattr on generic block devices.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_getattr_generic_blk_files',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:blk_file getattr;

')

########################################

## <summary>

##	Dontaudit setattr on generic block devices.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_setattr_generic_blk_files',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:blk_file setattr;

')

########################################

## <summary>

##	Allow read, write, and create for generic character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_create_generic_chr_files',`

	gen_require(`

		type device_t;

	')

	create_chr_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Allow getattr for generic character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_getattr_generic_chr_files',`

	gen_require(`

		type device_t;

	')

	getattr_chr_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Dontaudit getattr for generic character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_getattr_generic_chr_files',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:chr_file getattr;

')

########################################

## <summary>

##	Dontaudit setattr for generic character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_setattr_generic_chr_files',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:chr_file setattr;

')

########################################

## <summary>

##	Do not audit attempts to set the attributes

##	of symbolic links in device directories (/dev).

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`dev_dontaudit_setattr_generic_symlinks',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:lnk_file setattr;

')

########################################

## <summary>

##	Create symbolic links in device directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_create_generic_symlinks',`

	gen_require(`

		type device_t;

	')

	create_lnk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Delete symbolic links in device directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_delete_generic_symlinks',`

	gen_require(`

		type device_t;

	')

	delete_lnk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Create, delete, read, and write symbolic links in device directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_manage_generic_symlinks',`

	gen_require(`

		type device_t;

	')

	manage_lnk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Relabel symbolic links in device directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_relabel_generic_symlinks',`

	gen_require(`

		type device_t;

	')

	relabel_lnk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Create, delete, read, and write device nodes in device directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_manage_all_dev_nodes',`

	gen_require(`

		attribute device_node, memory_raw_read, memory_raw_write;

		type device_t;

	')

	manage_dirs_pattern($1,device_t,device_t)

	manage_sock_files_pattern($1,device_t,device_t)

	manage_lnk_files_pattern($1,device_t,device_t)

	manage_chr_files_pattern($1,device_t,{ device_t device_node })

	manage_blk_files_pattern($1,device_t,{ device_t device_node })

	relabel_dirs_pattern($1,device_t,device_t)

	relabel_chr_files_pattern($1,device_t,{ device_t device_node })

	relabel_blk_files_pattern($1,device_t,{ device_t device_node })

	# these next rules are to satisfy assertions broken by the above lines.

	# the permissions hopefully can be cut back a lot

	storage_raw_read_fixed_disk($1)

	storage_raw_write_fixed_disk($1)

	storage_read_scsi_generic($1)

	storage_write_scsi_generic($1)

	typeattribute $1 memory_raw_read;

	typeattribute $1 memory_raw_write;

')

########################################

## <summary>

##	Dontaudit getattr for generic device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_rw_generic_dev_nodes',`

	gen_require(`

		type device_t;

	')

	dontaudit $1 device_t:{ chr_file blk_file } { getattr read write ioctl };

')

########################################

## <summary>

##	Create, delete, read, and write block device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_manage_generic_blk_files',`

	gen_require(`

		type device_t;

	')

	manage_blk_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Create, delete, read, and write character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_manage_generic_chr_files',`

	gen_require(`

		type device_t;

	')

	manage_chr_files_pattern($1,device_t,device_t)

')

########################################

## <summary>

##	Create, read, and write device nodes. The node

##	will be transitioned to the type provided.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <param name="file">

##	<summary>

##	Type to which the created node will be transitioned.

##	</summary>

## </param>

## <param name="objectclass(es)">

##	<summary>

##	Object class(es) (single or set including {}) for which this

##	the transition will occur.

##	</summary>

## </param>

#

interface(`dev_filetrans',`

	gen_require(`

		type device_t;

	')

	filetrans_pattern($1,device_t,$2,$3)

	fs_associate_tmpfs($2)

	files_associate_tmp($2)

')

########################################

## <summary>

##	Getattr on all block file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`dev_getattr_all_blk_files',`

	gen_require(`

		attribute device_node;

		type device_t;

	')

	getattr_blk_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Dontaudit getattr on all block file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_getattr_all_blk_files',`

	gen_require(`

		attribute device_node;

	')

	dontaudit $1 device_node:blk_file getattr;

')

########################################

## <summary>

##	Getattr on all character file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`dev_getattr_all_chr_files',`

	gen_require(`

		attribute device_node;

	')

	getattr_chr_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Dontaudit getattr on all character file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to dontaudit access.

##	</summary>

## </param>

#

interface(`dev_dontaudit_getattr_all_chr_files',`

	gen_require(`

		attribute device_node;

	')

	dontaudit $1 device_node:chr_file getattr;

')

########################################

## <summary>

##	Setattr on all block file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`dev_setattr_all_blk_files',`

	gen_require(`

		attribute device_node;

	')

	setattr_blk_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Setattr on all character file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`dev_setattr_all_chr_files',`

	gen_require(`

		attribute device_node;

	')

	setattr_chr_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Dontaudit read on all block file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`dev_dontaudit_read_all_blk_files',`

	gen_require(`

		attribute device_node;

	')

	dontaudit $1 device_node:blk_file { getattr read };

')

########################################

## <summary>

##	Dontaudit read on all character file device nodes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`dev_dontaudit_read_all_chr_files',`

	gen_require(`

		attribute device_node;

	')

	dontaudit $1 device_node:chr_file { getattr read };

')

########################################

## <summary>

##	Create all block device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_create_all_blk_files',`

	gen_require(`

		attribute device_node;

	')

	create_blk_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Create all character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_create_all_chr_files',`

	gen_require(`

		attribute device_node;

	')

	create_chr_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Delete all block device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_delete_all_blk_files',`

	gen_require(`

		attribute device_node;

	')

	delete_blk_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Delete all character device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_delete_all_chr_files',`

	gen_require(`

		attribute device_node;

	')

	delete_chr_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Rename all block device files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`dev_rename_all_blk_files',`

	gen_require(`

		attribute device_node;

	')

	rename_blk_files_pattern($1,device_t,device_node)

')

########################################

## <summary>

##	Rename all character device files.

## </summary>

## <param name="domain">

##	<summary>