Chris PeBenito 17de1b
Chris PeBenito a52b4d
policy_module(files,1.3.0)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Declarations
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
attribute file_type;
Chris PeBenito 17de1b
attribute files_unconfined_type;
Chris PeBenito 17de1b
attribute lockfile;
Chris PeBenito 17de1b
attribute mountpoint;
Chris PeBenito 17de1b
attribute pidfile;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# For labeling types that are to be polyinstantiated
Chris PeBenito 17de1b
attribute polydir;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# And for labeling the parent directories of those polyinstantiated directories
Chris PeBenito 17de1b
# This is necessary for remounting the original in the parent to give
Chris PeBenito 17de1b
# security aware apps access
Chris PeBenito 17de1b
attribute polyparent;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# And labeling for the member directories
Chris PeBenito 17de1b
attribute polymember;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# sensitive security files whose accesses should
Chris PeBenito 17de1b
# not be dontaudited for uses
Chris PeBenito 17de1b
attribute security_file_type;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
attribute tmpfile;
Chris PeBenito 17de1b
attribute tmpfsfile;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# this is a hack and should be changed
Chris PeBenito 17de1b
attribute usercanread;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# boot_t is the type for files in /boot
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type boot_t;
Chris PeBenito 17de1b
files_mountpoint(boot_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# default_t is the default type for files that do not
Chris PeBenito 17de1b
# match any specification in the file_contexts configuration
Chris PeBenito 17de1b
# other than the generic /.* specification.
Chris PeBenito 17de1b
type default_t;
Chris PeBenito 17de1b
files_mountpoint(default_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# etc_t is the type of the system etc directories.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type etc_t;
Chris PeBenito 17de1b
files_type(etc_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# etc_runtime_t is the type of various
Chris PeBenito 17de1b
# files in /etc that are automatically
Chris PeBenito 17de1b
# generated during initialization.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type etc_runtime_t;
Chris PeBenito 17de1b
files_type(etc_runtime_t)
Chris PeBenito 693d4a
#Temporarily in policy until FC5 dissappears
Chris PeBenito 693d4a
typealias etc_runtime_t alias firstboot_rw_t;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# file_t is the default type of a file that has not yet been
Chris PeBenito 17de1b
# assigned an extended attribute (EA) value (when using a filesystem
Chris PeBenito 17de1b
# that supports EAs).
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type file_t;
Chris PeBenito 17de1b
files_mountpoint(file_t)
Chris PeBenito 17de1b
kernel_rootfs_mountpoint(file_t)
Chris PeBenito 17de1b
sid file gen_context(system_u:object_r:file_t,s0)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# home_root_t is the type for the directory where user home directories
Chris PeBenito 17de1b
# are created
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type home_root_t;
Chris PeBenito 17de1b
files_mountpoint(home_root_t)
Chris PeBenito 17de1b
files_poly_parent(home_root_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# lost_found_t is the type for the lost+found directories.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type lost_found_t;
Chris PeBenito 17de1b
files_type(lost_found_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# mnt_t is the type for mount points such as /mnt/cdrom
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type mnt_t;
Chris PeBenito 17de1b
files_mountpoint(mnt_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# modules_object_t is the type for kernel modules
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type modules_object_t;
Chris PeBenito 17de1b
files_type(modules_object_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type no_access_t;
Chris PeBenito 17de1b
files_type(no_access_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type poly_t;
Chris PeBenito 17de1b
files_type(poly_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
type readable_t;
Chris PeBenito 17de1b
files_type(readable_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# root_t is the type for rootfs and the root directory.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type root_t;
Chris PeBenito 17de1b
files_mountpoint(root_t)
Chris PeBenito 17de1b
files_poly_parent(root_t)
Chris PeBenito 17de1b
kernel_rootfs_mountpoint(root_t)
Chris PeBenito 17de1b
genfscon rootfs / gen_context(system_u:object_r:root_t,s0)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# src_t is the type of files in the system src directories.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type src_t;
Chris PeBenito 17de1b
files_mountpoint(src_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# system_map_t is for the system.map files in /boot
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type system_map_t;
Chris PeBenito 17de1b
files_type(system_map_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# tmp_t is the type of the temporary directories
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type tmp_t;
Chris PeBenito 17de1b
files_tmp_file(tmp_t)
Chris PeBenito 17de1b
files_mountpoint(tmp_t)
Chris PeBenito 17de1b
files_poly(tmp_t)
Chris PeBenito 17de1b
files_poly_parent(tmp_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# usr_t is the type for /usr.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type usr_t;
Chris PeBenito 17de1b
files_mountpoint(usr_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# var_t is the type of /var
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type var_t;
Chris PeBenito 17de1b
files_mountpoint(var_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# var_lib_t is the type of /var/lib
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type var_lib_t;
Chris PeBenito 17de1b
files_mountpoint(var_lib_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# var_lock_t is tye type of /var/lock
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type var_lock_t;
Chris PeBenito 17de1b
files_lock_file(var_lock_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# var_run_t is the type of /var/run, usually
Chris PeBenito 17de1b
# used for pid and other runtime files.
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type var_run_t;
Chris PeBenito 17de1b
files_pid_file(var_run_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# var_spool_t is the type of /var/spool
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
type var_spool_t;
Chris PeBenito 17de1b
files_tmp_file(var_spool_t)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Rules for all file types
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
allow file_type self:filesystem associate;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
fs_associate(file_type)
Chris PeBenito 17de1b
fs_associate_noxattr(file_type)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
ifdef(`targeted_policy', `
Chris PeBenito 17de1b
	fs_associate_tmpfs(file_type)
Chris PeBenito 17de1b
')
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Rules for all tmp file types
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
allow tmpfile tmp_t:filesystem associate;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
fs_associate_tmpfs(tmpfile)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Rules for all tmpfs file types
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
fs_associate_tmpfs(tmpfsfile)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Unconfined access to this module
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# Create/access any file in a labeled filesystem;
Chris PeBenito 17de1b
allow files_unconfined_type file_type:{ file chr_file } ~execmod;
Chris PeBenito 17de1b
allow files_unconfined_type file_type:{ dir lnk_file sock_file fifo_file blk_file } *;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# Mount/unmount any filesystem with the context= option. 
Chris PeBenito 17de1b
allow files_unconfined_type file_type:filesystem *;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
ifdef(`targeted_policy',`
Chris PeBenito 17de1b
	tunable_policy(`allow_execmod',`
Chris PeBenito 17de1b
		allow files_unconfined_type file_type:file execmod;
Chris PeBenito 17de1b
	')
Chris PeBenito 17de1b
')