## <summary>Policy for filesystems.</summary>

## <required val="true">

##	Contains the initial SID for the filesystems.

## </required>

########################################

## <summary>

##	Transform specified type into a filesystem type.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_type',`

	gen_require(`

		attribute filesystem_type;

	')

	typeattribute $1 filesystem_type;

')

########################################

## <summary>

##	Transform specified type into a filesystem

##	type which does not have extended attribute

##	support.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_noxattr_type',`

	gen_require(`

		attribute noxattrfs;

	')

	fs_type($1)

	typeattribute $1 noxattrfs;

')

########################################

## <summary>

##	Associate the specified file type to persistent

##	filesystems with extended attributes.  This

##	allows a file of this type to be created on

##	a filesystem such as ext3, JFS, and XFS.

## </summary>

## <param name="file_type">

##	<summary>

##	The type of the to be associated.

##	</summary>

## </param>

#

interface(`fs_associate',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem associate;

')

########################################

## <summary>

##	Associate the specified file type to

##	filesystems which lack extended attributes

##	support.  This allows a file of this type

##	to be created on a filesystem such as

##	FAT32, and NFS.

## </summary>

## <param name="file_type">

##	<summary>

##	The type of the to be associated.

##	</summary>

## </param>

#

interface(`fs_associate_noxattr',`

	gen_require(`

		attribute noxattrfs;

	')

	allow $1 noxattrfs:filesystem associate;

')

########################################

## <summary>

##	Execute files on a filesystem that does

##	not support extended attributes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_exec_noxattr',`

	gen_require(`

		attribute noxattrfs;

	')

	can_exec($1,noxattrfs)

')

########################################

## <summary>

##	Mount a persistent filesystem which

##	has extended attributes, such as

##	ext3, JFS, or XFS.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_mount_xattr_fs',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem mount;

')

########################################

## <summary>

##	Remount a persistent filesystem which

##	has extended attributes, such as

##	ext3, JFS, or XFS.  This allows

##	some mount options to be changed.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_remount_xattr_fs',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem remount;

')

########################################

## <summary>

##	Unmount a persistent filesystem which

##	has extended attributes, such as

##	ext3, JFS, or XFS.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_unmount_xattr_fs',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem unmount;

')

########################################

## <summary>

##	Get the attributes of a persistent

##	filesystem which has extended

##	attributes, such as ext3, JFS, or XFS.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_getattr_xattr_fs',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem getattr;

')

########################################

## <summary>

##	Do not audit attempts to

##	get the attributes of a persistent

##	filesystem which has extended

##	attributes, such as ext3, JFS, or XFS.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`fs_dontaudit_getattr_xattr_fs',`

	gen_require(`

		type fs_t;

	')

	dontaudit $1 fs_t:filesystem getattr;

')

########################################

## <summary>

##	Allow changing of the label of a

##	filesystem with extended attributes

##	using the context= mount option.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_relabelfrom_xattr_fs',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem relabelfrom;

')

########################################

## <summary>

##	Get the filesystem quotas of a filesystem

##	with extended attributes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_get_xattr_fs_quotas',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem quotaget;

')

########################################

## <summary>

##	Set the filesystem quotas of a filesystem

##	with extended attributes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_set_xattr_fs_quotas',`

	gen_require(`

		type fs_t;

	')

	allow $1 fs_t:filesystem quotamod;

')

########################################

## <summary>

##	Read files on anon_inodefs file systems.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_read_anon_inodefs_files',`

	gen_require(`

		type anon_inodefs_t;

	')

	read_files_pattern($1, anon_inodefs_t, anon_inodefs_t)

')

########################################

## <summary>

##	Read and write files on anon_inodefs

##	file systems.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_rw_anon_inodefs_files',`

	gen_require(`

		type anon_inodefs_t;

	')

	rw_files_pattern($1, anon_inodefs_t, anon_inodefs_t)

')

########################################

## <summary>

##	Mount an automount pseudo filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_mount_autofs',`

	gen_require(`

		type autofs_t;

	')

	allow $1 autofs_t:filesystem mount;

')

########################################

## <summary>

##	Remount an automount pseudo filesystem

##	This allows some mount options to be changed.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_remount_autofs',`

	gen_require(`

		type autofs_t;

	')

	allow $1 autofs_t:filesystem remount;

')

########################################

## <summary>

##	Unmount an automount pseudo filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_unmount_autofs',`

	gen_require(`

		type autofs_t;

	')

	allow $1 autofs_t:filesystem unmount;

')

########################################

## <summary>

##	Get the attributes of an automount

##	pseudo filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_getattr_autofs',`

	gen_require(`

		type autofs_t;

	')

	allow $1 autofs_t:filesystem getattr;

')

########################################

## <summary>

##	Search automount filesystem to use automatically

##	mounted filesystems.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_search_auto_mountpoints',`

	gen_require(`

		type autofs_t;

	')

	allow $1 autofs_t:dir search_dir_perms;

')

########################################

## <summary>

##	Read directories of automatically

##	mounted filesystems.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_list_auto_mountpoints',`

	gen_require(`

		type autofs_t;

	')

	allow $1 autofs_t:dir list_dir_perms;

')

########################################

## <summary>

##	Do not audit attempts to list directories of automatically

##	mounted filesystems.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`fs_dontaudit_list_auto_mountpoints',`

	gen_require(`

		type autofs_t;

	')

	dontaudit $1 autofs_t:dir list_dir_perms;

')

########################################

## <summary>

##	Create, read, write, and delete symbolic links

##	on an autofs filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_manage_autofs_symlinks',`

	gen_require(`

		type autofs_t;

	')

	manage_lnk_files_pattern($1, autofs_t, autofs_t)

')

########################################

## <summary>

##	Get the attributes of directories on

##	binfmt_misc filesystems. 

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_getattr_binfmt_misc_dirs',`

	gen_require(`

		type binfmt_misc_fs_t;

	')

	allow $1 binfmt_misc_fs_t:dir getattr;

')

########################################

## <summary>

##	Register an interpreter for new binary

##	file types, using the kernel binfmt_misc

##	support.

## </summary>

## <desc>

##	

##	Register an interpreter for new binary

##	file types, using the kernel binfmt_misc

##	support.

##	

##	

##	A common use for this is to

##	register a JVM as an interpreter for

##	Java byte code.  Registered binaries

##	can be directly executed on a command line

##	without specifying the interpreter.

##	

## </desc>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_register_binary_executable_type',`

	gen_require(`

		type binfmt_misc_fs_t;

	')

	rw_files_pattern($1, binfmt_misc_fs_t, binfmt_misc_fs_t)

')

########################################

## <summary>

##	Mount a CIFS or SMB network filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_mount_cifs',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:filesystem mount;

')

########################################

## <summary>

##	Remount a CIFS or SMB network filesystem.

##	This allows some mount options to be changed.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_remount_cifs',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:filesystem remount;

')

########################################

## <summary>

##	Unmount a CIFS or SMB network filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_unmount_cifs',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:filesystem unmount;

')

########################################

## <summary>

##	Get the attributes of a CIFS or

##	SMB network filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_getattr_cifs',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:filesystem getattr;

')

########################################

## <summary>

##	Search directories on a CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_search_cifs',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:dir search_dir_perms;

')

########################################

## <summary>

##	List the contents of directories on a

##	CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_list_cifs',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:dir list_dir_perms;

')

########################################

## <summary>

##	Do not audit attempts to list the contents

##	of directories on a CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`fs_dontaudit_list_cifs',`

	gen_require(`

		type cifs_t;

	')

	dontaudit $1 cifs_t:dir list_dir_perms;

')

########################################

## <summary>

##	Read files on a CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_read_cifs_files',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:dir list_dir_perms;

	read_files_pattern($1, cifs_t, cifs_t)

')

########################################

## <summary>

##	Get the attributes of filesystems that

##	do not have extended attribute support.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

## <rolecap/>

#

interface(`fs_getattr_noxattr_fs',`

	gen_require(`

		attribute noxattrfs;

	')

	allow $1 noxattrfs:filesystem getattr;

')

########################################

## <summary>

##	Read all noxattrfs directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_list_noxattr_fs',`

	gen_require(`

		attribute noxattrfs;

	')

	allow $1 noxattrfs:dir list_dir_perms;

')

########################################

## <summary>

##	Create, read, write, and delete all noxattrfs directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_manage_noxattr_fs_dirs',`

	gen_require(`

		attribute noxattrfs;

	')

	allow $1 noxattrfs:dir manage_dir_perms;

')

########################################

## <summary>

##	Read all noxattrfs files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_read_noxattr_fs_files',`

	gen_require(`

		attribute noxattrfs;

	')

	read_files_pattern($1, noxattrfs, noxattrfs)

')

########################################

## <summary>

##	Create, read, write, and delete all noxattrfs files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_manage_noxattr_fs_files',`

	gen_require(`

		attribute noxattrfs;

	')

	manage_files_pattern($1, noxattrfs, noxattrfs)

')

########################################

## <summary>

##	Read all noxattrfs symbolic links.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_read_noxattr_fs_symlinks',`

	gen_require(`

		attribute noxattrfs;

	')

	read_lnk_files_pattern($1, noxattrfs, noxattrfs)

')

########################################

## <summary>

##	Do not audit attempts to read

##	files on a CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`fs_dontaudit_read_cifs_files',`

	gen_require(`

		type cifs_t;

	')

	dontaudit $1 cifs_t:file read_file_perms;

')

########################################

## <summary>

##	Do not audit attempts to read or

##	write files on a CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`fs_dontaudit_rw_cifs_files',`

	gen_require(`

		type cifs_t;

	')

	dontaudit $1 cifs_t:file { read write };

')

########################################

## <summary>

##	Read symbolic links on a CIFS or SMB filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_read_cifs_symlinks',`

	gen_require(`

		type cifs_t;

	')

	allow $1 cifs_t:dir list_dir_perms;

	read_lnk_files_pattern($1, cifs_t, cifs_t)

')

########################################

## <summary>

##	Read named pipes

##	on a CIFS or SMB network filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_read_cifs_named_pipes',`

	gen_require(`

		type cifs_t;

	')

	read_fifo_files_pattern($1, cifs_t, cifs_t)

')

########################################

## <summary>

##	Read named pipes

##	on a CIFS or SMB network filesystem.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`fs_read_cifs_named_sockets',`

	gen_require(`

		type cifs_t;

	')

	read_sock_files_pattern($1, cifs_t, cifs_t)

')

########################################

## <summary>

##	Execute files on a CIFS or SMB

##	network filesystem, in the caller

##	domain.