Chris PeBenito e32d52
## <summary>
Chris PeBenito e276b8
##	Policy for kernel threads, proc filesystem,
Chris PeBenito 836929
##	and unlabeled processes and objects.
Chris PeBenito e32d52
## </summary>
Chris PeBenito 274547
## <required val="true">
Chris PeBenito 725926
##	This module has initial SIDs.
Chris PeBenito 274547
## </required>
Chris PeBenito e181fe
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 414e41
##	Allows to start userland processes
Chris PeBenito 414e41
##	by transitioning to the specified domain.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The process type entered by kernel.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="entrypoint">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The executable type for the entrypoint.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito ff3138
#
Chris PeBenito 270d42
interface(`kernel_domtrans_to',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type kernel_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito c0868a
	domtrans_pattern(kernel_t, $2, $1)
Chris PeBenito ff3138
')
Chris PeBenito ff3138
Chris PeBenito ff3138
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito e070dd
##	Allows to start userland processes
Chris PeBenito e070dd
##	by transitioning to the specified domain,
Chris PeBenito e070dd
##	with a range transition.
Chris PeBenito e070dd
## </summary>
Chris PeBenito e070dd
## <param name="domain">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	The process type entered by kernel.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="entrypoint">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	The executable type for the entrypoint.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
## <param name="range">
Chris PeBenito e070dd
##	<summary>
Chris PeBenito e070dd
##	Range for the domain.
Chris PeBenito e070dd
##	</summary>
Chris PeBenito e070dd
## </param>
Chris PeBenito e070dd
#
Chris PeBenito e070dd
interface(`kernel_ranged_domtrans_to',`
Chris PeBenito e070dd
	gen_require(`
Chris PeBenito e070dd
		type kernel_t;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e276b8
	kernel_domtrans_to($1, $2)
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mcs',`
Chris PeBenito e070dd
		range_transition kernel_t $2:process $3;
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
Chris PeBenito e070dd
	ifdef(`enable_mls',`
Chris PeBenito e070dd
		range_transition kernel_t $2:process $3;
Chris PeBenito 2d0c9c
		mls_rangetrans_target($1)
Chris PeBenito e070dd
	')
Chris PeBenito e070dd
')
Chris PeBenito e070dd
Chris PeBenito e070dd
########################################
Chris PeBenito e070dd
## <summary>
Chris PeBenito 414e41
##	Allows the kernel to mount filesystems on
Chris PeBenito 414e41
##	the specified directory type.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="directory_type">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the directory to use as a mountpoint.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 588ffa
#
Chris PeBenito 199895
interface(`kernel_rootfs_mountpoint',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 588ffa
Chris PeBenito 588ffa
	allow kernel_t $1:dir mounton;
Chris PeBenito 588ffa
')
Chris PeBenito 588ffa
Chris PeBenito 588ffa
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 98a8ea
##	Set the process group of kernel threads.
Chris PeBenito 98a8ea
## </summary>
Chris PeBenito 98a8ea
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 98a8ea
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 98a8ea
## </param>
Chris PeBenito 98a8ea
#
Chris PeBenito 98a8ea
interface(`kernel_setpgid',`
Chris PeBenito 98a8ea
	gen_require(`
Chris PeBenito 98a8ea
		type kernel_t;
Chris PeBenito 98a8ea
	')
Chris PeBenito 98a8ea
Chris PeBenito 98a8ea
	allow $1 kernel_t:process setpgid;
Chris PeBenito 98a8ea
')
Chris PeBenito 98a8ea
Chris PeBenito 98a8ea
########################################
Chris PeBenito 98a8ea
## <summary>
Chris PeBenito 939a42
##	Set the priority of kernel threads.
Chris PeBenito 939a42
## </summary>
Chris PeBenito 939a42
## <param name="domain">
Chris PeBenito 939a42
##	<summary>
Chris PeBenito 939a42
##	Domain allowed access.
Chris PeBenito 939a42
##	</summary>
Chris PeBenito 939a42
## </param>
Chris PeBenito 939a42
#
Chris PeBenito 939a42
interface(`kernel_setsched',`
Chris PeBenito 939a42
	gen_require(`
Chris PeBenito 939a42
		type kernel_t;
Chris PeBenito 939a42
	')
Chris PeBenito 939a42
Chris PeBenito 939a42
	allow $1 kernel_t:process setsched;
Chris PeBenito 939a42
')
Chris PeBenito 939a42
Chris PeBenito 939a42
########################################
Chris PeBenito 939a42
## <summary>
Chris PeBenito 414e41
##	Send a SIGCHLD signal to kernel threads.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito 7a2f20
#
Chris PeBenito 199895
interface(`kernel_sigchld',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type kernel_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 7a2f20
Chris PeBenito 98a8ea
	allow $1 kernel_t:process sigchld;
Chris PeBenito 7a2f20
')
Chris PeBenito 7a2f20
Chris PeBenito 7a2f20
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 041738
##	Send a kill signal to kernel threads.
Chris PeBenito 041738
## </summary>
Chris PeBenito 041738
## <param name="domain">
Chris PeBenito 041738
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 041738
##	</summary>
Chris PeBenito 041738
## </param>
Chris PeBenito 041738
#
Chris PeBenito 041738
interface(`kernel_kill',`
Chris PeBenito 041738
	gen_require(`
Chris PeBenito 041738
		type kernel_t;
Chris PeBenito 041738
	')
Chris PeBenito 041738
Chris PeBenito 041738
	allow $1 kernel_t:process sigkill;
Chris PeBenito 041738
')
Chris PeBenito 041738
Chris PeBenito 041738
########################################
Chris PeBenito 041738
## <summary>
Chris PeBenito 0907bd
##	Send a generic signal to kernel threads.
Chris PeBenito 0907bd
## </summary>
Chris PeBenito 0907bd
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 0907bd
## </param>
Chris PeBenito 0907bd
#
Chris PeBenito 0907bd
interface(`kernel_signal',`
Chris PeBenito 0907bd
	gen_require(`
Chris PeBenito 0907bd
		type kernel_t;
Chris PeBenito 0907bd
	')
Chris PeBenito 0907bd
Chris PeBenito a65fd9
	allow $1 kernel_t:process signal;
Chris PeBenito 0907bd
')
Chris PeBenito 0907bd
Chris PeBenito 0907bd
########################################
Chris PeBenito 0907bd
## <summary>
Chris PeBenito 414e41
##	Allows the kernel to share state information with
Chris PeBenito 414e41
##	the caller.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 414e41
##	The type of the process with which to share state information.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`kernel_share_state',`
Chris PeBenito 7a2f20
	gen_require(`
Chris PeBenito 7a2f20
		type kernel_t;
Chris PeBenito 7a2f20
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow kernel_t $1:process share;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 414e41
##	Permits caller to use kernel file descriptors.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 1c1ac6
interface(`kernel_use_fds',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 kernel_t:fd use;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito a2d824
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to use
Chris PeBenito 414e41
##	kernel file descriptors.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a7ee7f
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito a2d824
#
Chris PeBenito 1c1ac6
interface(`kernel_dontaudit_use_fds',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 kernel_t:fd use;
Chris PeBenito a2d824
')
Chris PeBenito a2d824
Chris PeBenito b4cd15
########################################
Chris PeBenito 4051d1
## <summary>
Chris PeBenito ae9e27
##	Read and write kernel unnamed pipes.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 445522
interface(`kernel_rw_pipes',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type kernel_t;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 kernel_t:fifo_file { read write };
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Read and write kernel unix datagram sockets.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 445522
interface(`kernel_rw_unix_dgram_sockets',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type kernel_t;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 kernel_t:unix_dgram_socket { read write ioctl };
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Send messages to kernel unix datagram sockets.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 37f15c
interface(`kernel_dgram_send',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type kernel_t;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	allow $1 kernel_t:unix_dgram_socket sendto;
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito 33c7e6
##	Receive messages from kernel TCP sockets.  (Deprecated)
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a5f339
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`kernel_tcp_recvfrom',`
Chris PeBenito 33c7e6
	refpolicywarn(`$0($*) has been deprecated.')
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito 33c7e6
##	Send UDP network traffic to the kernel.  (Deprecated)
Chris PeBenito 18cc01
## </summary>
Chris PeBenito 18cc01
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 18cc01
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 18cc01
## </param>
Chris PeBenito 18cc01
#
Chris PeBenito 1c1ac6
interface(`kernel_udp_send',`
Chris PeBenito 33c7e6
	refpolicywarn(`$0($*) has been deprecated.')
Chris PeBenito 18cc01
')
Chris PeBenito 18cc01
Chris PeBenito 18cc01
########################################
Chris PeBenito 18cc01
## <summary>
Chris PeBenito 33c7e6
##	Receive messages from kernel UDP sockets.  (Deprecated)
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a5f339
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`kernel_udp_recvfrom',`
Chris PeBenito 33c7e6
	refpolicywarn(`$0($*) has been deprecated.')
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 414e41
##	Allows caller to load kernel modules
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`kernel_load_module',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		attribute can_load_kernmodule;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 self:capability sys_module;
Chris PeBenito 0c73cd
	typeattribute $1 can_load_kernmodule;
Chris PeBenito 4416c4
Chris PeBenito 4416c4
	# load_module() calls stop_machine() which
Chris PeBenito 4416c4
	# calls sched_setscheduler()
Chris PeBenito 4416c4
	allow $1 self:capability sys_nice;
Chris PeBenito 4416c4
	kernel_setsched($1)
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito a5e213
##	Allow search the kernel key ring.
Chris PeBenito a5e213
## </summary>
Chris PeBenito a5e213
## <param name="domain">
Chris PeBenito a5e213
##	<summary>
Chris PeBenito a5e213
##	Domain allowed access.
Chris PeBenito a5e213
##	</summary>
Chris PeBenito a5e213
## </param>
Chris PeBenito a5e213
#
Chris PeBenito a5e213
interface(`kernel_search_key',`
Chris PeBenito a5e213
	gen_require(`
Chris PeBenito a5e213
		type kernel_t;
Chris PeBenito a5e213
	')
Chris PeBenito a5e213
Chris PeBenito a5e213
	allow $1 kernel_t:key search;
Chris PeBenito a5e213
')
Chris PeBenito a5e213
Chris PeBenito a5e213
########################################
Chris PeBenito a5e213
## <summary>
Chris PeBenito 495df4
##	dontaudit search the kernel key ring.
Chris PeBenito 495df4
## </summary>
Chris PeBenito 495df4
## <param name="domain">
Chris PeBenito 495df4
##	<summary>
Dominick Grift 705f70
##	Domain to not audit.
Chris PeBenito 495df4
##	</summary>
Chris PeBenito 495df4
## </param>
Chris PeBenito 495df4
#
Chris PeBenito 495df4
interface(`kernel_dontaudit_search_key',`
Chris PeBenito 495df4
	gen_require(`
Chris PeBenito 495df4
		type kernel_t;
Chris PeBenito 495df4
	')
Chris PeBenito 495df4
Chris PeBenito 495df4
	dontaudit $1 kernel_t:key search;
Chris PeBenito 495df4
')
Chris PeBenito 495df4
Chris PeBenito 495df4
########################################
Chris PeBenito 495df4
## <summary>
Chris PeBenito a5e213
##	Allow link to the kernel key ring.
Chris PeBenito a5e213
## </summary>
Chris PeBenito a5e213
## <param name="domain">
Chris PeBenito a5e213
##	<summary>
Chris PeBenito a5e213
##	Domain allowed access.
Chris PeBenito a5e213
##	</summary>
Chris PeBenito a5e213
## </param>
Chris PeBenito a5e213
#
Chris PeBenito a5e213
interface(`kernel_link_key',`
Chris PeBenito a5e213
	gen_require(`
Chris PeBenito a5e213
		type kernel_t;
Chris PeBenito a5e213
	')
Chris PeBenito a5e213
Chris PeBenito a5e213
	allow $1 kernel_t:key link;
Chris PeBenito a5e213
')
Chris PeBenito a5e213
Chris PeBenito a5e213
########################################
Chris PeBenito a5e213
## <summary>
Chris PeBenito 495df4
##	dontaudit link to the kernel key ring.
Chris PeBenito 495df4
## </summary>
Chris PeBenito 495df4
## <param name="domain">
Chris PeBenito 495df4
##	<summary>
Dominick Grift 705f70
##	Domain to not audit.
Chris PeBenito 495df4
##	</summary>
Chris PeBenito 495df4
## </param>
Chris PeBenito 495df4
#
Chris PeBenito 495df4
interface(`kernel_dontaudit_link_key',`
Chris PeBenito 495df4
	gen_require(`
Chris PeBenito 495df4
		type kernel_t;
Chris PeBenito 495df4
	')
Chris PeBenito 495df4
Chris PeBenito 495df4
	dontaudit $1 kernel_t:key link;
Chris PeBenito 495df4
')
Chris PeBenito 495df4
Chris PeBenito 495df4
########################################
Chris PeBenito 495df4
## <summary>
Chris PeBenito 414e41
##	Allows caller to read the ring buffer.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`kernel_read_ring_buffer',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 kernel_t:system syslog_read;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read the ring buffer.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`kernel_dontaudit_read_ring_buffer',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 kernel_t:system syslog_read;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
########################################
Chris PeBenito 58c3da
## <summary>
Chris PeBenito 58c3da
##	Change the level of kernel messages logged to the console.
Chris PeBenito 58c3da
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 230838
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`kernel_change_ring_buffer_level',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 kernel_t:system syslog_console;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 414e41
##	Allows the caller to clear the ring buffer.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito bbcd3c
## <rolecap/>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`kernel_clear_ring_buffer',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 kernel_t:system syslog_mod;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito e276b8
##	Allows caller to request the kernel to load a module
Chris PeBenito e276b8
## </summary>
Chris PeBenito e8871c
## <desc>
Chris PeBenito e8871c
##	

Chris PeBenito e8871c
##	Allow the specified domain to request that the kernel
Chris PeBenito e8871c
##	load a kernel module.  An example of this is the
Chris PeBenito e8871c
##	auto-loading of network drivers when doing an
Chris PeBenito e8871c
##	ioctl() on a network interface.
Chris PeBenito e8871c
##	

Chris PeBenito e8871c
##	

Chris PeBenito e8871c
##	In the specific case of a module loading request
Chris PeBenito e8871c
##	on a network interface, the domain will also
Chris PeBenito e8871c
##	need the net_admin capability.
Chris PeBenito e8871c
##	

Chris PeBenito e8871c
## </desc>
Chris PeBenito e276b8
## <param name="domain">
Chris PeBenito e276b8
##	<summary>
Chris PeBenito e276b8
##	Domain allowed access.
Chris PeBenito e276b8
##	</summary>
Chris PeBenito e276b8
## </param>
Chris PeBenito e276b8
#
Chris PeBenito e276b8
interface(`kernel_request_load_module',`
Chris PeBenito e276b8
	gen_require(`
Chris PeBenito e276b8
		type kernel_t;
Chris PeBenito e276b8
	')
Chris PeBenito e276b8
Chris PeBenito e276b8
	allow $1 kernel_t:system module_request;
Chris PeBenito e276b8
')
Chris PeBenito e276b8
Chris PeBenito e276b8
########################################
Chris PeBenito e276b8
## <summary>
Chris PeBenito 60f04f
##	Do not audit requests to the kernel to load a module.
Chris PeBenito 60f04f
## </summary>
Chris PeBenito 60f04f
## <param name="domain">
Chris PeBenito 60f04f
##	<summary>
Chris PeBenito 60f04f
##	Domain to not audit.
Chris PeBenito 60f04f
##	</summary>
Chris PeBenito 60f04f
## </param>
Chris PeBenito 60f04f
#
Chris PeBenito 60f04f
interface(`kernel_dontaudit_request_load_module',`
Chris PeBenito 60f04f
	gen_require(`
Chris PeBenito 60f04f
		type kernel_t;
Chris PeBenito 60f04f
	')
Chris PeBenito 60f04f
Chris PeBenito 60f04f
	dontaudit $1 kernel_t:system module_request;
Chris PeBenito 60f04f
')
Chris PeBenito 60f04f
Chris PeBenito 60f04f
########################################
Chris PeBenito 60f04f
## <summary>
Chris PeBenito 414e41
##	Get information on all System V IPC objects.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito e276b8
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`kernel_get_sysvipc_info',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type kernel_t;
Chris PeBenito cbc9d6
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 kernel_t:system ipc_info;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito a1fcff
##	Get the attributes of a kernel debugging filesystem.
Chris PeBenito a1fcff
## </summary>
Chris PeBenito a1fcff
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a1fcff
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a1fcff
## </param>
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
interface(`kernel_getattr_debugfs',`
Chris PeBenito a1fcff
	gen_require(`
Chris PeBenito a1fcff
		type debugfs_t;
Chris PeBenito a1fcff
	')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
	allow $1 debugfs_t:filesystem getattr;
Chris PeBenito a1fcff
')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
########################################
Chris PeBenito a1fcff
## <summary>
Chris PeBenito a1fcff
##	Mount a kernel debugging filesystem.
Chris PeBenito a1fcff
## </summary>
Chris PeBenito a1fcff
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a1fcff
## </param>
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
interface(`kernel_mount_debugfs',`
Chris PeBenito a1fcff
	gen_require(`
Chris PeBenito a1fcff
		type debugfs_t;
Chris PeBenito a1fcff
	')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
	allow $1 debugfs_t:filesystem mount;
Chris PeBenito a1fcff
')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
########################################
Chris PeBenito a1fcff
## <summary>
Chris PeBenito a1fcff
##	Unmount a kernel debugging filesystem.
Chris PeBenito a1fcff
## </summary>
Chris PeBenito a1fcff
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a1fcff
## </param>
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
interface(`kernel_unmount_debugfs',`
Chris PeBenito a1fcff
	gen_require(`
Chris PeBenito a1fcff
		type debugfs_t;
Chris PeBenito a1fcff
	')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
	allow $1 debugfs_t:filesystem unmount;
Chris PeBenito a1fcff
')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
########################################
Chris PeBenito a1fcff
## <summary>
Chris PeBenito a1fcff
##	Remount a kernel debugging filesystem.
Chris PeBenito a1fcff
## </summary>
Chris PeBenito a1fcff
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a1fcff
## </param>
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
interface(`kernel_remount_debugfs',`
Chris PeBenito a1fcff
	gen_require(`
Chris PeBenito a1fcff
		type debugfs_t;
Chris PeBenito a1fcff
	')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
	allow $1 debugfs_t:filesystem remount;
Chris PeBenito a1fcff
')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
########################################
Chris PeBenito a1fcff
## <summary>
Chris PeBenito a1fcff
##	Search the contents of a kernel debugging filesystem.
Chris PeBenito a1fcff
## </summary>
Chris PeBenito a1fcff
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a1fcff
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a1fcff
## </param>
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
interface(`kernel_search_debugfs',`
Chris PeBenito a1fcff
	gen_require(`
Chris PeBenito a1fcff
		type debugfs_t;
Chris PeBenito a1fcff
	')
Chris PeBenito a1fcff
Chris PeBenito 0bfccd
	search_dirs_pattern($1, debugfs_t, debugfs_t)
Chris PeBenito a1fcff
')
Chris PeBenito a1fcff
Chris PeBenito a1fcff
########################################
Chris PeBenito a1fcff
## <summary>
Chris PeBenito 041738
##	Do not audit attempts to search the kernel debugging filesystem.
Chris PeBenito 041738
## </summary>
Chris PeBenito 041738
## <param name="domain">
Chris PeBenito 041738
##	<summary>
Dominick Grift 705f70
##	Domain to not audit.
Chris PeBenito 041738
##	</summary>
Chris PeBenito 041738
## </param>
Chris PeBenito 041738
#
Chris PeBenito 041738
interface(`kernel_dontaudit_search_debugfs',`
Chris PeBenito 041738
	gen_require(`
Chris PeBenito 041738
		type debugfs_t;
Chris PeBenito 041738
	')
Chris PeBenito 041738
Chris PeBenito 041738
	dontaudit $1 debugfs_t:dir search_dir_perms;
Chris PeBenito 041738
')
Chris PeBenito 041738
Chris PeBenito 041738
########################################
Chris PeBenito 041738
## <summary>
Chris PeBenito d8636f
##	Read information from the debugging filesystem.
Chris PeBenito d8636f
## </summary>
Chris PeBenito d8636f
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito d8636f
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito d8636f
## </param>
Chris PeBenito d8636f
#
Chris PeBenito d8636f
interface(`kernel_read_debugfs',`
Chris PeBenito d8636f
	gen_require(`
Chris PeBenito d8636f
		type debugfs_t;
Chris PeBenito d8636f
	')
Chris PeBenito d8636f
Chris PeBenito 0bfccd
	read_files_pattern($1, debugfs_t, debugfs_t)
Chris PeBenito 0bfccd
	read_lnk_files_pattern($1, debugfs_t, debugfs_t)
Chris PeBenito 0bfccd
	list_dirs_pattern($1, debugfs_t, debugfs_t)
Chris PeBenito d8636f
')
Chris PeBenito d8636f
Chris PeBenito d8636f
########################################
Chris PeBenito d8636f
## <summary>
Dan Walsh 3eaa99
##	Read/Write information from the debugging filesystem.
Dan Walsh 3eaa99
## </summary>
Dan Walsh 3eaa99
## <param name="domain">
Dan Walsh 3eaa99
##	<summary>
Dan Walsh 3eaa99
##	Domain allowed access.
Dan Walsh 3eaa99
##	</summary>
Dan Walsh 3eaa99
## </param>
Dan Walsh 3eaa99
#
Dan Walsh 3eaa99
interface(`kernel_rw_debugfs',`
Dan Walsh 3eaa99
	gen_require(`
Dan Walsh 3eaa99
		type debugfs_t;
Dan Walsh 3eaa99
	')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
	rw_files_pattern($1, debugfs_t, debugfs_t)
Dan Walsh 3eaa99
	read_lnk_files_pattern($1, debugfs_t, debugfs_t)
Dan Walsh 3eaa99
	list_dirs_pattern($1, debugfs_t, debugfs_t)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Dan Walsh 3eaa99
########################################
Dan Walsh 3eaa99
## <summary>
Dan Walsh cbadf7
##	Manage information from the debugging filesystem.
Dan Walsh cbadf7
## </summary>
Dan Walsh cbadf7
## <param name="domain">
Dan Walsh cbadf7
##	<summary>
Dan Walsh cbadf7
##	Domain allowed access.
Dan Walsh cbadf7
##	</summary>
Dan Walsh cbadf7
## </param>
Dan Walsh cbadf7
#
Dan Walsh cbadf7
interface(`kernel_manage_debugfs',`
Dan Walsh cbadf7
	gen_require(`
Dan Walsh cbadf7
		type debugfs_t;
Dan Walsh cbadf7
	')
Dan Walsh cbadf7
Dan Walsh cbadf7
	manage_files_pattern($1, debugfs_t, debugfs_t)
Dan Walsh cbadf7
	read_lnk_files_pattern($1, debugfs_t, debugfs_t)
Dan Walsh cbadf7
	list_dirs_pattern($1, debugfs_t, debugfs_t)
Dan Walsh cbadf7
')
Dan Walsh cbadf7
Dan Walsh cbadf7
########################################
Dan Walsh cbadf7
## <summary>
Chris PeBenito 882186
##	Mount a kernel VM filesystem.
Chris PeBenito 882186
## </summary>
Chris PeBenito 882186
## <param name="domain">
Chris PeBenito 882186
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito 882186
##	</summary>
Chris PeBenito 882186
## </param>
Chris PeBenito 882186
#
Chris PeBenito 882186
interface(`kernel_mount_kvmfs',`
Chris PeBenito 882186
	gen_require(`
Chris PeBenito 882186
		type kvmfs_t;
Chris PeBenito 882186
	')
Chris PeBenito 882186
Chris PeBenito 882186
	allow $1 kvmfs_t:filesystem mount;
Chris PeBenito 882186
')
Chris PeBenito 882186
Chris PeBenito 882186
########################################
Chris PeBenito 882186
## <summary>
Chris PeBenito d592b6
##	Unmount the proc filesystem.
Chris PeBenito d592b6
## </summary>
Chris PeBenito d592b6
## <param name="domain">
Chris PeBenito d592b6
##	<summary>
Dominick Grift 705f70
##	Domain allowed access.
Chris PeBenito d592b6
##	</summary>
Chris PeBenito d592b6
## </param>
Chris PeBenito d592b6
#
Chris PeBenito d592b6
interface(`kernel_unmount_proc',`
Chris PeBenito d592b6
	gen_require(`
Chris PeBenito d592b6
		type proc_t;
Chris PeBenito d592b6
	')
Chris PeBenito d592b6
Chris PeBenito d592b6
	allow $1 proc_t:filesystem unmount;
Chris PeBenito d592b6
')
Chris PeBenito d592b6
Chris PeBenito d592b6
########################################
Chris PeBenito d592b6
## <summary>
Chris PeBenito a42ca7
##	Get the attributes of the proc filesystem.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito a42ca7
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a42ca7
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a42ca7
## </param>
Chris PeBenito a42ca7
#
Chris PeBenito a42ca7
interface(`kernel_getattr_proc',`
Chris PeBenito a42ca7
	gen_require(`
Chris PeBenito a42ca7
		type proc_t;
Chris PeBenito a42ca7
	')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
	allow $1 proc_t:filesystem getattr;
Chris PeBenito a42ca7
')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito a42ca7
##	Search directories in /proc.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito a42ca7
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a42ca7
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a42ca7
## </param>
Chris PeBenito a42ca7
#
Chris PeBenito a42ca7
interface(`kernel_search_proc',`
Chris PeBenito a42ca7
	gen_require(`
Chris PeBenito a42ca7
		type proc_t;
Chris PeBenito a42ca7
	')
Chris PeBenito a42ca7
Chris PeBenito 0bfccd
	search_dirs_pattern($1, proc_t, proc_t)
Chris PeBenito a42ca7
')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito a42ca7
##	List the contents of directories in /proc.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito a42ca7
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a42ca7
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a42ca7
## </param>
Chris PeBenito a42ca7
#
Chris PeBenito a42ca7
interface(`kernel_list_proc',`
Chris PeBenito a42ca7
	gen_require(`
Chris PeBenito a42ca7
		type proc_t;
Chris PeBenito a42ca7
	')
Chris PeBenito a42ca7
Chris PeBenito 0bfccd
	list_dirs_pattern($1, proc_t, proc_t)
Chris PeBenito a42ca7
')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 725926
##	Do not audit attempts to list the
Chris PeBenito 725926
##	contents of directories in /proc.
Chris PeBenito 725926
## </summary>
Chris PeBenito 725926
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 725926
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 725926
## </param>
Chris PeBenito 725926
#
Chris PeBenito 725926
interface(`kernel_dontaudit_list_proc',`
Chris PeBenito 725926
	gen_require(`
Chris PeBenito 725926
		type proc_t;
Chris PeBenito 725926
	')
Chris PeBenito 725926
Chris PeBenito 725926
	dontaudit $1 proc_t:dir list_dir_perms;
Chris PeBenito 725926
')
Chris PeBenito 725926
Chris PeBenito 725926
########################################
Chris PeBenito 725926
## <summary>
Chris PeBenito 131e57
##	Get the attributes of files in /proc.
Chris PeBenito 131e57
## </summary>
Chris PeBenito 131e57
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 131e57
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 131e57
## </param>
Chris PeBenito 131e57
#
Chris PeBenito 131e57
interface(`kernel_getattr_proc_files',`
Chris PeBenito 131e57
	gen_require(`
Chris PeBenito 131e57
		type proc_t;
Chris PeBenito 131e57
	')
Chris PeBenito 131e57
Chris PeBenito 0bfccd
	getattr_files_pattern($1, proc_t, proc_t)
Chris PeBenito 131e57
')
Chris PeBenito 131e57
Chris PeBenito 131e57
########################################
Chris PeBenito 131e57
## <summary>
Chris PeBenito 7a0c0b
##	Read generic symbolic links in /proc.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 7a0c0b
## <desc>
Chris PeBenito 7a0c0b
##	

Chris PeBenito 7a0c0b
##	Allow the specified domain to read (follow) generic
Chris PeBenito 7a0c0b
##	symbolic links (symlinks) in the proc filesystem (/proc).
Chris PeBenito 7a0c0b
##	This interface does not include access to the targets of
Chris PeBenito 7a0c0b
##	these links.  An example symlink is /proc/self.
Chris PeBenito 7a0c0b
##	

Chris PeBenito 7a0c0b
## </desc>
Chris PeBenito a42ca7
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito a42ca7
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito a42ca7
## </param>
Chris PeBenito 7a0c0b
## <infoflow type="read" weight="10"/>
Chris PeBenito a42ca7
#
Chris PeBenito a42ca7
interface(`kernel_read_proc_symlinks',`
Chris PeBenito a42ca7
	gen_require(`
Chris PeBenito a42ca7
		type proc_t;
Chris PeBenito a42ca7
	')
Chris PeBenito a42ca7
Chris PeBenito 0bfccd
	read_lnk_files_pattern($1, proc_t, proc_t)
Chris PeBenito a42ca7
')
Chris PeBenito a42ca7
Chris PeBenito a42ca7
########################################
Chris PeBenito a42ca7
## <summary>
Chris PeBenito 7a0c0b
##	Allows caller to read system state information in /proc.
Chris PeBenito a42ca7
## </summary>
Chris PeBenito 7a0c0b
## <desc>
Chris PeBenito 7a0c0b
##	

Chris PeBenito 7a0c0b
##	Allow the specified domain to read general system
Chris PeBenito 7a0c0b
##	state information from the proc filesystem (/proc).
Chris PeBenito 7a0c0b
##	

Chris PeBenito 7a0c0b
##	

Chris PeBenito 7a0c0b
##	Generally it should be safe to allow this access.  Some
Chris PeBenito 7a0c0b
##	example files that can be read based on this interface:
Chris PeBenito 7a0c0b
##	

Chris PeBenito 7a0c0b
##	
    Chris PeBenito 7a0c0b
    ##		
  • /proc/cpuinfo
  • Chris PeBenito 7a0c0b
    ##		
  • /proc/meminfo
  • Chris PeBenito 7a0c0b
    ##		
  • /proc/uptime
  • Chris PeBenito 7a0c0b
    ##	
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	This does not allow access to sysctl entries (/proc/sys/*)
    Chris PeBenito 7a0c0b
    ##	nor process state information (/proc/pid).
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ## </desc>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 7a0c0b
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 7a0c0b
    ## <infoflow type="read" weight="10"/>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 199895
    interface(`kernel_read_system_state',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, proc_t, proc_t)
    Chris PeBenito 0bfccd
    	read_lnk_files_pattern($1, proc_t, proc_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_t)
    Chris PeBenito d8636f
    ')
    Chris PeBenito d8636f
    Chris PeBenito d8636f
    ########################################
    Chris PeBenito d8636f
    ## <summary>
    Chris PeBenito d8636f
    ##	Write to generic proc entries.
    Chris PeBenito d8636f
    ## </summary>
    Chris PeBenito d8636f
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito d8636f
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito d8636f
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito d8636f
    #
    Chris PeBenito d8636f
    # cjp: this should probably go away.  any
    Chris PeBenito d8636f
    # file thats writable in proc should really
    Chris PeBenito d8636f
    # have its own label.
    Chris PeBenito d8636f
    #
    Chris PeBenito 445522
    interface(`kernel_write_proc_files',`
    Chris PeBenito d8636f
    	gen_require(`
    Chris PeBenito d8636f
    		type proc_t;
    Chris PeBenito d8636f
    	')
    Chris PeBenito d8636f
    Chris PeBenito 0bfccd
    	write_files_pattern($1, proc_t, proc_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito 67484f
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Do not audit attempts by caller to
    Chris PeBenito a42ca7
    ##	read system state information in proc.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 67484f
    #
    Chris PeBenito 199895
    interface(`kernel_dontaudit_read_system_state',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito a65fd9
    	dontaudit $1 proc_t:file read_file_perms;
    Chris PeBenito 67484f
    ')
    Chris PeBenito 67484f
    Don Miner c11417
    ########################################
    Don Miner c11417
    ## <summary>
    Don Miner c11417
    ##	Do not audit attempts by caller to
    Don Miner c11417
    ##	read system state information in proc.
    Don Miner c11417
    ## </summary>
    Don Miner c11417
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Don Miner c11417
    ## </param>
    Don Miner c11417
    #
    Chris PeBenito 445522
    interface(`kernel_dontaudit_read_proc_symlinks',`
    Don Miner c11417
    	gen_require(`
    Don Miner c11417
    		type proc_t;
    Don Miner c11417
    	')
    Don Miner c11417
    Don Miner c11417
    	dontaudit $1 proc_t:lnk_file read;
    Don Miner c11417
    ')
    Don Miner c11417
    Chris PeBenito b4cd15
    #######################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 7d4161
    ##	Allow caller to read and write state information for AFS.
    Chris PeBenito 7d4161
    ## </summary>
    Chris PeBenito 7d4161
    ## <param name="domain">
    Chris PeBenito 7d4161
    ##	<summary>
    Chris PeBenito 7d4161
    ##	Domain allowed access.
    Chris PeBenito 7d4161
    ##	</summary>
    Chris PeBenito 7d4161
    ## </param>
    Chris PeBenito 7d4161
    ## <rolecap/>
    Chris PeBenito 7d4161
    #
    Chris PeBenito 7d4161
    interface(`kernel_rw_afs_state',`
    Chris PeBenito 7d4161
    	gen_require(`
    Chris PeBenito 7d4161
    		type proc_t, proc_afs_t;
    Chris PeBenito 7d4161
    	')
    Chris PeBenito 7d4161
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_t)
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, proc_afs_t, proc_afs_t)
    Chris PeBenito 7d4161
    ')
    Chris PeBenito 7d4161
    Chris PeBenito 7d4161
    #######################################
    Chris PeBenito 7d4161
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to read the state information for software raid.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 199895
    interface(`kernel_read_software_raid_state',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, proc_mdstat_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, proc_t, proc_mdstat_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_t)
    Chris PeBenito 50aca6
    ')
    Chris PeBenito 50aca6
    Chris PeBenito 50aca6
    #######################################
    Chris PeBenito 50aca6
    ## <summary>
    Chris PeBenito 50aca6
    ##	Allow caller to read and set the state information for software raid.
    Chris PeBenito 50aca6
    ## </summary>
    Chris PeBenito 50aca6
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 50aca6
    ## </param>
    Chris PeBenito 50aca6
    #
    Chris PeBenito 50aca6
    interface(`kernel_rw_software_raid_state',`
    Chris PeBenito 50aca6
    	gen_require(`
    Chris PeBenito 50aca6
    		type proc_t, proc_mdstat_t;
    Chris PeBenito 50aca6
    	')
    Chris PeBenito 50aca6
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, proc_t, proc_mdstat_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Allows caller to get attribues of core kernel interface.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_getattr_core_if',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, proc_kcore_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	getattr_files_pattern($1, proc_t, proc_kcore_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Do not audit attempts to get the attributes of
    Chris PeBenito 414e41
    ##	core kernel interfaces.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 7bba9d
    #
    Chris PeBenito 445522
    interface(`kernel_dontaudit_getattr_core_if',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_kcore_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0c73cd
    	dontaudit $1 proc_kcore_t:file getattr;
    Chris PeBenito 7bba9d
    ')
    Chris PeBenito 7bba9d
    Chris PeBenito 7bba9d
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito e276b8
    ##	Allows caller to read the core kernel interface.
    Chris PeBenito e276b8
    ## </summary>
    Chris PeBenito e276b8
    ## <param name="domain">
    Chris PeBenito e276b8
    ##	<summary>
    Chris PeBenito e276b8
    ##	Domain allowed access.
    Chris PeBenito e276b8
    ##	</summary>
    Chris PeBenito e276b8
    ## </param>
    Chris PeBenito e276b8
    #
    Chris PeBenito e276b8
    interface(`kernel_read_core_if',`
    Chris PeBenito e276b8
    	gen_require(`
    Chris PeBenito e276b8
    		type proc_t, proc_kcore_t;
    Chris PeBenito e276b8
    		attribute can_dump_kernel;
    Chris PeBenito e276b8
    	')
    Chris PeBenito e276b8
    Chris PeBenito e21162
    	allow $1 self:capability sys_rawio;
    Chris PeBenito e276b8
    	read_files_pattern($1, proc_t, proc_kcore_t)
    Chris PeBenito e276b8
    	list_dirs_pattern($1, proc_t, proc_t)
    Chris PeBenito e276b8
    Chris PeBenito e276b8
    	typeattribute $1 can_dump_kernel;
    Chris PeBenito e276b8
    ')
    Chris PeBenito e276b8
    Chris PeBenito e276b8
    ########################################
    Chris PeBenito e276b8
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to read kernel messages
    Chris PeBenito 414e41
    ##	using the /proc/kmsg interface.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito a266e3
    #
    Chris PeBenito 199895
    interface(`kernel_read_messages',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		attribute can_receive_kernel_messages;
    Chris PeBenito cbc9d6
    		type proc_kmsg_t, proc_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, proc_t, proc_kmsg_t)
    Chris PeBenito c0868a
    Chris PeBenito 0c73cd
    	typeattribute $1 can_receive_kernel_messages;
    Chris PeBenito a266e3
    ')
    Chris PeBenito a266e3
    Chris PeBenito a266e3
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to get the attributes of kernel message
    Chris PeBenito 414e41
    ##	interface (/proc/kmsg).
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito a266e3
    #
    Chris PeBenito 199895
    interface(`kernel_getattr_message_if',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_kmsg_t, proc_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	getattr_files_pattern($1, proc_t, proc_kmsg_t)
    Chris PeBenito a266e3
    ')
    Chris PeBenito a266e3
    Chris PeBenito a266e3
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Do not audit attempts by caller to get the attributes of kernel
    Chris PeBenito 414e41
    ##	message interfaces.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 07d6e3
    #
    Chris PeBenito 199895
    interface(`kernel_dontaudit_getattr_message_if',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_kmsg_t, proc_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0c73cd
    	dontaudit $1 proc_kmsg_t:file getattr;
    Chris PeBenito 07d6e3
    ')
    Chris PeBenito 07d6e3
    Chris PeBenito 07d6e3
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 246839
    ##	Do not audit attempts to search the network
    Chris PeBenito 246839
    ##	state directory.
    Chris PeBenito 246839
    ## </summary>
    Chris PeBenito 246839
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 246839
    ## </param>
    Chris PeBenito 246839
    ##
    Chris PeBenito 246839
    #
    Chris PeBenito 246839
    interface(`kernel_dontaudit_search_network_state',`
    Chris PeBenito 246839
    	gen_require(`
    Chris PeBenito 246839
    		type proc_net_t;
    Chris PeBenito 246839
    	')
    Chris PeBenito 246839
    Chris PeBenito 712566
    	dontaudit $1 proc_net_t:dir search;
    Chris PeBenito 246839
    ')
    Chris PeBenito 246839
    Chris PeBenito 246839
    ########################################
    Chris PeBenito 246839
    ## <summary>
    Chris PeBenito 43989f
    ##	Allow searching of network state directory.
    Chris PeBenito 43989f
    ## </summary>
    Chris PeBenito 43989f
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 43989f
    ## </param>
    Chris PeBenito 43989f
    ##
    Chris PeBenito 43989f
    #
    Chris PeBenito 43989f
    interface(`kernel_search_network_state',`
    Chris PeBenito 43989f
    	gen_require(`
    Chris PeBenito 43989f
    		type proc_net_t;
    Chris PeBenito 43989f
    	')
    Chris PeBenito 43989f
    Chris PeBenito 0bfccd
    	search_dirs_pattern($1, proc_t, proc_net_t)
    Chris PeBenito 43989f
    ')
    Chris PeBenito 43989f
    Chris PeBenito 43989f
    ########################################
    Chris PeBenito 43989f
    ## <summary>
    Chris PeBenito 7a0c0b
    ##	Read the network state information.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 7a0c0b
    ## <desc>
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	Allow the specified domain to read the networking
    Chris PeBenito 7a0c0b
    ##	state information. This includes several pieces
    Chris PeBenito 7a0c0b
    ##	of networking information, such as network interface
    Chris PeBenito 7a0c0b
    ##	names, netfilter (iptables) statistics, protocol
    Chris PeBenito 7a0c0b
    ##	information, routes, and remote procedure call (RPC)
    Chris PeBenito 7a0c0b
    ##	information.
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ## </desc>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 7a0c0b
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 7a0c0b
    ## <infoflow type="read" weight="10"/>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 199895
    interface(`kernel_read_network_state',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, proc_net_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t proc_net_t }, proc_net_t)
    Chris PeBenito 0bfccd
    	read_lnk_files_pattern($1, { proc_t proc_net_t }, proc_net_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_net_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 43989f
    ##	Allow caller to read the network state symbolic links.
    Chris PeBenito 43989f
    ## </summary>
    Chris PeBenito 43989f
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 43989f
    ## </param>
    Chris PeBenito 43989f
    #
    Chris PeBenito 43989f
    interface(`kernel_read_network_state_symlinks',`
    Chris PeBenito 43989f
    	gen_require(`
    Chris PeBenito 43989f
    		type proc_t, proc_net_t;
    Chris PeBenito 43989f
    	')
    Chris PeBenito 43989f
    Chris PeBenito 0bfccd
    	read_lnk_files_pattern($1, { proc_t proc_net_t }, proc_net_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_net_t)
    Chris PeBenito 43989f
    ')
    Chris PeBenito 43989f
    Chris PeBenito 43989f
    ########################################
    Chris PeBenito 43989f
    ## <summary>
    Chris PeBenito a3cf80
    ##	Allow searching of xen state directory.
    Chris PeBenito a3cf80
    ## </summary>
    Chris PeBenito a3cf80
    ## <param name="domain">
    Chris PeBenito a3cf80
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito a3cf80
    ##	</summary>
    Chris PeBenito a3cf80
    ## </param>
    Chris PeBenito a3cf80
    ##
    Chris PeBenito a3cf80
    #
    Chris PeBenito a3cf80
    interface(`kernel_search_xen_state',`
    Chris PeBenito a3cf80
    	gen_require(`
    Chris PeBenito a3cf80
    		type proc_t, proc_xen_t;
    Chris PeBenito a3cf80
    	')
    Chris PeBenito a3cf80
    Chris PeBenito 0bfccd
    	search_dirs_pattern($1, proc_t, proc_xen_t)
    Chris PeBenito a3cf80
    ')
    Chris PeBenito a3cf80
    Chris PeBenito a3cf80
    ########################################
    Chris PeBenito a3cf80
    ## <summary>
    Chris PeBenito a3cf80
    ##	Do not audit attempts to search the xen
    Chris PeBenito a3cf80
    ##	state directory.
    Chris PeBenito a3cf80
    ## </summary>
    Chris PeBenito a3cf80
    ## <param name="domain">
    Chris PeBenito a3cf80
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito a3cf80
    ##	</summary>
    Chris PeBenito a3cf80
    ## </param>
    Chris PeBenito a3cf80
    ##
    Chris PeBenito a3cf80
    #
    Chris PeBenito a3cf80
    interface(`kernel_dontaudit_search_xen_state',`
    Chris PeBenito a3cf80
    	gen_require(`
    Chris PeBenito a3cf80
    		type proc_xen_t;
    Chris PeBenito a3cf80
    	')
    Chris PeBenito a3cf80
    Chris PeBenito a3cf80
    	dontaudit $1 proc_xen_t:dir search;
    Chris PeBenito a3cf80
    ')
    Chris PeBenito a3cf80
    Chris PeBenito a3cf80
    ########################################
    Chris PeBenito a3cf80
    ## <summary>
    Chris PeBenito a3cf80
    ##	Allow caller to read the xen state information.
    Chris PeBenito a3cf80
    ## </summary>
    Chris PeBenito a3cf80
    ## <param name="domain">
    Chris PeBenito a3cf80
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito a3cf80
    ##	</summary>
    Chris PeBenito a3cf80
    ## </param>
    Chris PeBenito a3cf80
    ##
    Chris PeBenito a3cf80
    #
    Chris PeBenito a3cf80
    interface(`kernel_read_xen_state',`
    Chris PeBenito a3cf80
    	gen_require(`
    Chris PeBenito a3cf80
    		type proc_t, proc_xen_t;
    Chris PeBenito a3cf80
    	')
    Chris PeBenito a3cf80
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
    Chris PeBenito 0bfccd
    	read_lnk_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_xen_t)
    Chris PeBenito a3cf80
    ')
    Chris PeBenito a3cf80
    Chris PeBenito a3cf80
    ########################################
    Chris PeBenito a3cf80
    ## <summary>
    Chris PeBenito a3cf80
    ##	Allow caller to read the xen state symbolic links.
    Chris PeBenito a3cf80
    ## </summary>
    Chris PeBenito a3cf80
    ## <param name="domain">
    Chris PeBenito a3cf80
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito a3cf80
    ##	</summary>
    Chris PeBenito a3cf80
    ## </param>
    Chris PeBenito a3cf80
    ##
    Chris PeBenito a3cf80
    #
    Chris PeBenito a3cf80
    interface(`kernel_read_xen_state_symlinks',`
    Chris PeBenito a3cf80
    	gen_require(`
    Chris PeBenito a3cf80
    		type proc_t, proc_xen_t;
    Chris PeBenito a3cf80
    	')
    Chris PeBenito a3cf80
    Chris PeBenito 0bfccd
    	read_lnk_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, proc_xen_t)
    Chris PeBenito a3cf80
    ')
    Chris PeBenito a3cf80
    Chris PeBenito a3cf80
    ########################################
    Chris PeBenito a3cf80
    ## <summary>
    Chris PeBenito a3cf80
    ##	Allow caller to write xen state information.
    Chris PeBenito a3cf80
    ## </summary>
    Chris PeBenito a3cf80
    ## <param name="domain">
    Chris PeBenito a3cf80
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito a3cf80
    ##	</summary>
    Chris PeBenito a3cf80
    ## </param>
    Chris PeBenito a3cf80
    ##
    Chris PeBenito a3cf80
    #
    Chris PeBenito a3cf80
    interface(`kernel_write_xen_state',`
    Chris PeBenito a3cf80
    	gen_require(`
    Chris PeBenito a3cf80
    		type proc_t, proc_xen_t;
    Chris PeBenito a3cf80
    	')
    Chris PeBenito a3cf80
    Chris PeBenito 0bfccd
    	write_files_pattern($1, { proc_t proc_xen_t }, proc_xen_t)
    Chris PeBenito a3cf80
    ')
    Chris PeBenito a3cf80
    Chris PeBenito a3cf80
    ########################################
    Chris PeBenito a3cf80
    ## <summary>
    Chris PeBenito a65fd9
    ##	Allow attempts to list all proc directories.
    Chris PeBenito a65fd9
    ## </summary>
    Chris PeBenito a65fd9
    ## <param name="domain">
    Chris PeBenito a65fd9
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito a65fd9
    ##	</summary>
    Chris PeBenito a65fd9
    ## </param>
    Chris PeBenito a65fd9
    #
    Chris PeBenito a65fd9
    interface(`kernel_list_all_proc',`
    Chris PeBenito a65fd9
    	gen_require(`
    Chris PeBenito a65fd9
    		attribute proc_type;
    Chris PeBenito a65fd9
    	')
    Chris PeBenito a65fd9
    Chris PeBenito a65fd9
    	allow $1 proc_type:dir list_dir_perms;
    Chris PeBenito a65fd9
    	allow $1 proc_type:file getattr;
    Chris PeBenito a65fd9
    ')
    Chris PeBenito a65fd9
    Chris PeBenito a65fd9
    ########################################
    Chris PeBenito a65fd9
    ## <summary>
    Chris PeBenito eac818
    ##	Do not audit attempts to list all proc directories.
    Chris PeBenito eac818
    ## </summary>
    Chris PeBenito eac818
    ## <param name="domain">
    Chris PeBenito eac818
    ##	<summary>
    Chris PeBenito eac818
    ##	Domain to not audit.
    Chris PeBenito eac818
    ##	</summary>
    Chris PeBenito eac818
    ## </param>
    Chris PeBenito eac818
    #
    Chris PeBenito eac818
    interface(`kernel_dontaudit_list_all_proc',`
    Chris PeBenito eac818
    	gen_require(`
    Chris PeBenito eac818
    		attribute proc_type;
    Chris PeBenito eac818
    	')
    Chris PeBenito eac818
    Chris PeBenito eac818
    	dontaudit $1 proc_type:dir list_dir_perms;
    Chris PeBenito a65fd9
    	dontaudit $1 proc_type:file getattr;
    Chris PeBenito eac818
    ')
    Chris PeBenito eac818
    Chris PeBenito eac818
    ########################################
    Chris PeBenito eac818
    ## <summary>
    Chris PeBenito 77f6e2
    ##	Do not audit attempts by caller to search
    Chris PeBenito 77f6e2
    ##	the base directory of sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 3865d6
    ##
    Chris PeBenito 3b857e
    #
    Chris PeBenito 77f6e2
    interface(`kernel_dontaudit_search_sysctl',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type sysctl_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0c73cd
    	dontaudit $1 sysctl_t:dir search;
    Chris PeBenito 3b857e
    ')
    Chris PeBenito 3b857e
    Chris PeBenito 3b857e
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 43989f
    ##	Allow access to read sysctl directories.
    Chris PeBenito 43989f
    ## </summary>
    Chris PeBenito 43989f
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 43989f
    ## </param>
    Chris PeBenito 43989f
    ##
    Chris PeBenito 43989f
    #
    Chris PeBenito 43989f
    interface(`kernel_read_sysctl',`
    Chris PeBenito 43989f
    	gen_require(`
    Chris PeBenito a65fd9
    		type sysctl_t, proc_t;
    Chris PeBenito 43989f
    	')
    Chris PeBenito 43989f
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, proc_t, sysctl_t)
    Chris PeBenito a65fd9
    	read_files_pattern($1, sysctl_t, sysctl_t)
    Chris PeBenito 43989f
    ')
    Chris PeBenito 43989f
    Chris PeBenito 43989f
    ########################################
    Chris PeBenito 43989f
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to read the device sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_read_device_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_dev_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t sysctl_t sysctl_dev_t }, sysctl_dev_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_dev_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read and write device sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_rw_device_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_dev_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, { proc_t sysctl_t sysctl_dev_t }, sysctl_dev_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_dev_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 230838
    ##	Allow caller to search virtual memory sysctls.
    Chris PeBenito 230838
    ## </summary>
    Chris PeBenito 230838
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 230838
    ## </param>
    Chris PeBenito 230838
    #
    Chris PeBenito 230838
    interface(`kernel_search_vm_sysctl',`
    Chris PeBenito 230838
    	gen_require(`
    Chris PeBenito 230838
    		type proc_t, sysctl_t, sysctl_vm_t;
    Chris PeBenito 230838
    	')
    Chris PeBenito 230838
    Chris PeBenito 0bfccd
    	search_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_t)
    Chris PeBenito 230838
    ')
    Chris PeBenito 230838
    Chris PeBenito 230838
    ########################################
    Chris PeBenito 230838
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to read virtual memory sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_read_vm_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_vm_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t sysctl_t sysctl_vm_t }, sysctl_vm_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read and write virtual memory sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_rw_vm_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_vm_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	rw_files_pattern($1 ,{ proc_t sysctl_t sysctl_vm_t }, sysctl_vm_t)
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_vm_t)
    Chris PeBenito cdc86e
    Chris PeBenito cdc86e
    	# hal needs this
    Chris PeBenito cdc86e
    	allow $1 sysctl_vm_t:dir write;
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 77f6e2
    ##	Search network sysctl directories.
    Chris PeBenito 77f6e2
    ## </summary>
    Chris PeBenito 77f6e2
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 77f6e2
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 77f6e2
    ## </param>
    Chris PeBenito 77f6e2
    #
    Chris PeBenito 77f6e2
    interface(`kernel_search_network_sysctl',`
    Chris PeBenito 77f6e2
    	gen_require(`
    Chris PeBenito 77f6e2
    		type proc_t, sysctl_t, sysctl_net_t;
    Chris PeBenito 77f6e2
    	')
    Chris PeBenito 77f6e2
    Chris PeBenito 0bfccd
    	search_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
    Chris PeBenito 77f6e2
    ')
    Chris PeBenito 77f6e2
    Chris PeBenito 77f6e2
    ########################################
    Chris PeBenito 77f6e2
    ## <summary>
    Chris PeBenito 77f6e2
    ##	Do not audit attempts by caller to search network sysctl directories.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Dominick Grift 705f70
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito 3b857e
    #
    Chris PeBenito 77f6e2
    interface(`kernel_dontaudit_search_network_sysctl',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type sysctl_net_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0c73cd
    	dontaudit $1 sysctl_net_t:dir search;
    Chris PeBenito 3b857e
    ')
    Chris PeBenito 3b857e
    Chris PeBenito 3b857e
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to read network sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_read_net_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_net_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to modiry contents of sysctl network files.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_rw_net_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_net_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Allow caller to read unix domain
    Chris PeBenito 414e41
    ##	socket sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_read_unix_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read and write unix domain
    Chris PeBenito 414e41
    ##	socket sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_rw_unix_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_net_t, sysctl_net_unix_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t }, sysctl_net_unix_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read the hotplug sysctl.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_read_hotplug_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read and write the hotplug sysctl.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_rw_hotplug_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_kernel_t, sysctl_hotplug_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_hotplug_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read the modprobe sysctl.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_read_modprobe_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito 414e41
    ##	Read and write the modprobe sysctl.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 414e41
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito 230838
    ##	Domain allowed access.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito 414e41
    ## </param>
    Chris PeBenito bbcd3c
    ## <rolecap/>
    Chris PeBenito b4cd15
    #
    Chris PeBenito 445522
    interface(`kernel_rw_modprobe_sysctls',`
    Chris PeBenito cbc9d6
    	gen_require(`
    Chris PeBenito cbc9d6
    		type proc_t, sysctl_t, sysctl_kernel_t, sysctl_modprobe_t;
    Chris PeBenito cbc9d6
    	')
    Chris PeBenito 0c73cd
    Chris PeBenito 0bfccd
    	rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_modprobe_t)
    Chris PeBenito c0868a
    Chris PeBenito 0bfccd
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
    Chris PeBenito b4cd15
    ')
    Chris PeBenito b4cd15
    Chris PeBenito b4cd15
    ########################################
    Chris PeBenito a42ca7
    ## <summary>
    Chris PeBenito e749cd
    ##	Do not audit attempts to search generic kernel sysctls.
    Chris PeBenito e749cd
    ## </summary>
    Chris PeBenito e749cd
    ## <param name="domain">
    Chris PeBenito 885b83
    ##	<summary>
    Chris PeBenito e749cd
    ##	Domain to not audit.
    Chris PeBenito 885b83
    ##	</summary>
    Chris PeBenito e749cd
    ## </param>
    Chris PeBenito e749cd
    #
    Chris PeBenito e749cd
    interface(`kernel_dontaudit_search_kernel_sysctl',`
    Chris PeBenito e749cd
    	gen_require(`
    Chris PeBenito e749cd
    		type sysctl_kernel_t;
    Chris PeBenito e749cd
    	')
    Chris PeBenito e749cd
    Chris PeBenito e749cd
    	dontaudit $1 sysctl_kernel_t:dir search;
    Chris PeBenito e749cd
    ')
    Chris PeBenito e749cd
    Chris PeBenito e749cd
    ########################################
    Chris PeBenito e749cd
    ## <summary>
    Chris PeBenito a65fd9
    ##	Read generic crypto sysctls.
    Chris PeBenito a65fd9
    ## </summary>
    Chris PeBenito a65fd9
    ## <param name="domain">
    Chris PeBenito a65fd9
    ##	<summary>
    Chris PeBenito a65fd9
    ##	Domain allowed access.
    Chris PeBenito a65fd9
    ##	</summary>
    Chris PeBenito a65fd9
    ## </param>
    Chris PeBenito a65fd9
    #
    Chris PeBenito a65fd9
    interface(`kernel_read_crypto_sysctls',`
    Chris PeBenito a65fd9
    	gen_require(`
    Chris PeBenito a65fd9
    		type proc_t, sysctl_t, sysctl_crypto_t;
    Chris PeBenito a65fd9
    	')
    Chris PeBenito a65fd9
    Chris PeBenito a65fd9
    	read_files_pattern($1, { proc_t sysctl_t sysctl_crypto_t }, sysctl_crypto_t)
    Chris PeBenito a65fd9
    	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_crypto_t)
    Chris PeBenito a65fd9
    ')
    Chris PeBenito a65fd9
    Chris PeBenito a65fd9
    ########################################
    Chris PeBenito a65fd9
    ## <summary>
    Chris PeBenito 7a0c0b
    ##	Read general kernel sysctls.
    Chris PeBenito a42ca7
    ## </summary>
    Chris PeBenito 7a0c0b
    ## <desc>
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	Allow the specified domain to read general
    Chris PeBenito 7a0c0b
    ##	kernel sysctl settings. These settings are typically
    Chris PeBenito 7a0c0b
    ##	read using the sysctl program.  The settings
    Chris PeBenito 7a0c0b
    ##	that are included by this interface are prefixed
    Chris PeBenito 7a0c0b
    ##	with "kernel.", for example, kernel.sysrq.
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	This does not include access to the hotplug
    Chris PeBenito 7a0c0b
    ##	handler setting (kernel.hotplug)
    Chris PeBenito 7a0c0b
    ##	nor the module installer handler setting
    Chris PeBenito 7a0c0b
    ##	(kernel.modprobe).
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	Related interfaces:
    Chris PeBenito 7a0c0b
    ##	

    Chris PeBenito 7a0c0b
    ##	
      Chris PeBenito 7a0c0b
      ##		
    • kernel_rw_kernel_sysctl()
    • Chris PeBenito 7a0c0b
      ##	
      Chris PeBenito 7a0c0b
      ## </desc>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito 7a0c0b
      ## <infoflow type="read" weight="10"/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_read_kernel_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, sysctl_t, sysctl_kernel_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	read_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_kernel_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito dce68d
      ##	Do not audit attempts to write generic kernel sysctls.
      Chris PeBenito dce68d
      ## </summary>
      Chris PeBenito dce68d
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito dce68d
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito dce68d
      ## </param>
      Chris PeBenito dce68d
      #
      Chris PeBenito dce68d
      interface(`kernel_dontaudit_write_kernel_sysctl',`
      Chris PeBenito dce68d
      	gen_require(`
      Chris PeBenito dce68d
      		type sysctl_kernel_t;
      Chris PeBenito dce68d
      	')
      Chris PeBenito dce68d
      Chris PeBenito dce68d
      	dontaudit $1 sysctl_kernel_t:file write;
      Chris PeBenito dce68d
      ')
      Chris PeBenito dce68d
      Chris PeBenito dce68d
      ########################################
      Chris PeBenito dce68d
      ## <summary>
      Chris PeBenito 414e41
      ##	Read and write generic kernel sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 199895
      interface(`kernel_rw_kernel_sysctl',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, sysctl_t, sysctl_kernel_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	rw_files_pattern($1, { proc_t sysctl_t sysctl_kernel_t }, sysctl_kernel_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_kernel_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Read filesystem sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_read_fs_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, sysctl_t, sysctl_fs_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	read_files_pattern($1, { proc_t sysctl_t sysctl_fs_t }, sysctl_fs_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_fs_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Read and write fileystem sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_rw_fs_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, sysctl_t, sysctl_fs_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	rw_files_pattern($1, { proc_t sysctl_t sysctl_fs_t }, sysctl_fs_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_fs_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Read IRQ sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_read_irq_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, sysctl_irq_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	read_files_pattern($1, { proc_t sysctl_irq_t }, sysctl_irq_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, proc_t, sysctl_irq_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Read and write IRQ sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_rw_irq_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, sysctl_irq_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	rw_files_pattern($1, { proc_t sysctl_irq_t }, sysctl_irq_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, proc_t, sysctl_irq_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito ac9db9
      ## <summary>
      Chris PeBenito ac9db9
      ##	Read RPC sysctls.
      Chris PeBenito ac9db9
      ## </summary>
      Chris PeBenito ac9db9
      ## <param name="domain">
      Chris PeBenito ac9db9
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito ac9db9
      ##	</summary>
      Chris PeBenito ac9db9
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_read_rpc_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, proc_net_t, sysctl_rpc_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	read_files_pattern($1, { proc_t proc_net_t sysctl_rpc_t }, sysctl_rpc_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_rpc_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito ac9db9
      ## <summary>
      Chris PeBenito ac9db9
      ##	Read and write RPC sysctls.
      Chris PeBenito ac9db9
      ## </summary>
      Chris PeBenito ac9db9
      ## <param name="domain">
      Chris PeBenito ac9db9
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito ac9db9
      ##	</summary>
      Chris PeBenito ac9db9
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_rw_rpc_sysctls',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type proc_t, proc_net_t, sysctl_rpc_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0bfccd
      	rw_files_pattern($1, { proc_t proc_net_t sysctl_rpc_t }, sysctl_rpc_t)
      Chris PeBenito c0868a
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_rpc_t)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito eac818
      ##	Do not audit attempts to list all sysctl directories.
      Chris PeBenito eac818
      ## </summary>
      Chris PeBenito eac818
      ## <param name="domain">
      Chris PeBenito eac818
      ##	<summary>
      Chris PeBenito eac818
      ##	Domain to not audit.
      Chris PeBenito eac818
      ##	</summary>
      Chris PeBenito eac818
      ## </param>
      Chris PeBenito eac818
      #
      Chris PeBenito eac818
      interface(`kernel_dontaudit_list_all_sysctls',`
      Chris PeBenito eac818
      	gen_require(`
      Chris PeBenito eac818
      		attribute sysctl_type;
      Chris PeBenito eac818
      	')
      Chris PeBenito eac818
      Chris PeBenito eac818
      	dontaudit $1 sysctl_type:dir list_dir_perms;
      Dan Walsh 3eaa99
      	dontaudit $1 sysctl_type:file read_file_perms;
      Chris PeBenito eac818
      ')
      Chris PeBenito eac818
      Chris PeBenito eac818
      ########################################
      Chris PeBenito eac818
      ## <summary>
      Chris PeBenito 414e41
      ##	Allow caller to read all sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_read_all_sysctls',`
      Chris PeBenito d25063
      	gen_require(`
      Chris PeBenito d25063
      		attribute sysctl_type;
      Chris PeBenito d25063
      		type proc_t, proc_net_t;
      Chris PeBenito d25063
      	')
      Chris PeBenito d25063
      Chris PeBenito d25063
      	# proc_net_t for /proc/net/rpc sysctls
      Chris PeBenito 0bfccd
      	read_files_pattern($1, { proc_t proc_net_t sysctl_type }, sysctl_type)
      Chris PeBenito d25063
      Chris PeBenito 0bfccd
      	list_dirs_pattern($1, { proc_t proc_net_t }, sysctl_type)
      Chris PeBenito b4cd15
      ')
      Chris PeBenito b4cd15
      Chris PeBenito b4cd15
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Read and write all sysctls.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito bbcd3c
      ## <rolecap/>
      Chris PeBenito b4cd15
      #
      Chris PeBenito 445522
      interface(`kernel_rw_all_sysctls',`
      Chris PeBenito d25063
      	gen_require(`
      Chris PeBenito d25063
      		attribute sysctl_type;
      Chris PeBenito d25063
      		type proc_t, proc_net_t;
      Chris PeBenito d25063
      	')
      Chris PeBenito d25063
      Chris PeBenito d25063
      	# proc_net_t for /proc/net/rpc sysctls
      Chris PeBenito 0bfccd
      	rw_files_pattern($1, { proc_t proc_net_t sysctl_type }, sysctl_type)
      Chris PeBenito d25063
      Chris PeBenito c0868a
      	allow $1 sysctl_type:dir list_dir_perms;
      Chris PeBenito c0868a
      	# why is setattr needed?
      Chris PeBenito c0868a
      	allow $1 sysctl_type:file setattr;
      Chris PeBenito f5c42b
      ')
      Chris PeBenito f5c42b
      Chris PeBenito f5c42b
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Send a kill signal to unlabeled processes.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito 199895
      interface(`kernel_kill_unlabeled',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0c73cd
      	allow $1 unlabeled_t:process sigkill;
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito c6fd1f
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 041738
      ##	Mount a kernel unlabeled filesystem.
      Chris PeBenito 041738
      ## </summary>
      Chris PeBenito 041738
      ## <param name="domain">
      Chris PeBenito 041738
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain allowed access.
      Chris PeBenito 041738
      ##	</summary>
      Chris PeBenito 041738
      ## </param>
      Chris PeBenito 041738
      #
      Chris PeBenito 041738
      interface(`kernel_mount_unlabeled',`
      Chris PeBenito 041738
      	gen_require(`
      Chris PeBenito 041738
      		type unlabeled_t;
      Chris PeBenito 041738
      	')
      Chris PeBenito 041738
      Chris PeBenito 041738
      	allow $1 unlabeled_t:filesystem mount;
      Chris PeBenito 041738
      ')
      Chris PeBenito 041738
      Chris PeBenito 60f04f
      ########################################
      Chris PeBenito 60f04f
      ## <summary>
      Chris PeBenito 60f04f
      ##	Unmount a kernel unlabeled filesystem.
      Chris PeBenito 60f04f
      ## </summary>
      Chris PeBenito 60f04f
      ## <param name="domain">
      Chris PeBenito 60f04f
      ##	<summary>
      Chris PeBenito 60f04f
      ##	Domain allowed access.
      Chris PeBenito 60f04f
      ##	</summary>
      Chris PeBenito 60f04f
      ## </param>
      Chris PeBenito 60f04f
      #
      Chris PeBenito 60f04f
      interface(`kernel_unmount_unlabeled',`
      Chris PeBenito 60f04f
      	gen_require(`
      Chris PeBenito 60f04f
      		type unlabeled_t;
      Chris PeBenito 60f04f
      	')
      Chris PeBenito 60f04f
      Chris PeBenito 60f04f
      	allow $1 unlabeled_t:filesystem unmount;
      Chris PeBenito 60f04f
      ')
      Chris PeBenito 041738
      Chris PeBenito 041738
      ########################################
      Chris PeBenito 041738
      ## <summary>
      Chris PeBenito 414e41
      ##	Send general signals to unlabeled processes.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito 199895
      interface(`kernel_signal_unlabeled',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0c73cd
      	allow $1 unlabeled_t:process signal;
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito c6fd1f
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Send a null signal to unlabeled processes.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito 199895
      interface(`kernel_signull_unlabeled',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0c73cd
      	allow $1 unlabeled_t:process signull;
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito c6fd1f
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Send a stop signal to unlabeled processes.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito 199895
      interface(`kernel_sigstop_unlabeled',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0c73cd
      	allow $1 unlabeled_t:process sigstop;
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito c6fd1f
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 414e41
      ##	Send a child terminated signal to unlabeled processes.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 230838
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito 199895
      interface(`kernel_sigchld_unlabeled',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0c73cd
      	allow $1 unlabeled_t:process sigchld;
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito c6fd1f
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito ae9e27
      ##	List unlabeled directories.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ae9e27
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito ae9e27
      interface(`kernel_list_unlabeled',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito a42ca7
      	')
      Chris PeBenito a42ca7
      Chris PeBenito c0868a
      	allow $1 unlabeled_t:dir list_dir_perms;
      Chris PeBenito a42ca7
      ')
      Chris PeBenito a42ca7
      Chris PeBenito a42ca7
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 495df4
      ##	Read the process state (/proc/pid) of all unlabeled_t.
      Chris PeBenito 495df4
      ## </summary>
      Chris PeBenito 495df4
      ## <param name="domain">
      Chris PeBenito 495df4
      ##	<summary>
      Chris PeBenito 495df4
      ##	Domain allowed access.
      Chris PeBenito 495df4
      ##	</summary>
      Chris PeBenito 495df4
      ## </param>
      Chris PeBenito 495df4
      #
      Chris PeBenito 495df4
      interface(`kernel_read_unlabeled_state',`
      Chris PeBenito 495df4
      	gen_require(`
      Chris PeBenito 495df4
      		type unlabeled_t;
      Chris PeBenito 495df4
      	')
      Chris PeBenito 495df4
      Chris PeBenito 495df4
      	allow $1 unlabeled_t:dir list_dir_perms;
      Chris PeBenito 0bfccd
      	read_files_pattern($1, unlabeled_t, unlabeled_t)
      Chris PeBenito 0bfccd
      	read_lnk_files_pattern($1, unlabeled_t, unlabeled_t)
      Chris PeBenito 495df4
      ')
      Chris PeBenito 495df4
      Chris PeBenito 495df4
      ########################################
      Chris PeBenito 495df4
      ## <summary>
      Chris PeBenito ac9aa2
      ##	Do not audit attempts to list unlabeled directories.
      Chris PeBenito ac9aa2
      ## </summary>
      Chris PeBenito ac9aa2
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ac9aa2
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito ac9aa2
      ## </param>
      Chris PeBenito ac9aa2
      #
      Chris PeBenito ac9aa2
      interface(`kernel_dontaudit_list_unlabeled',`
      Chris PeBenito ac9aa2
      	gen_require(`
      Chris PeBenito ac9aa2
      		type unlabeled_t;
      Chris PeBenito ac9aa2
      	')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      	dontaudit $1 unlabeled_t:dir list_dir_perms;
      Chris PeBenito ac9aa2
      ')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      ########################################
      Chris PeBenito ac9aa2
      ## <summary>
      Chris PeBenito a42ca7
      ##	Read and write unlabeled directories.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito a42ca7
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito a42ca7
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito a42ca7
      ## </param>
      Chris PeBenito a42ca7
      #
      Chris PeBenito 445522
      interface(`kernel_rw_unlabeled_dirs',`
      Chris PeBenito a42ca7
      	gen_require(`
      Chris PeBenito a42ca7
      		type unlabeled_t;
      Chris PeBenito a42ca7
      	')
      Chris PeBenito a42ca7
      Chris PeBenito a42ca7
      	allow $1 unlabeled_t:dir rw_dir_perms;
      Chris PeBenito a42ca7
      ')
      Chris PeBenito a42ca7
      Chris PeBenito a42ca7
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito 60f04f
      ##	Read and write unlabeled files.
      Chris PeBenito 60f04f
      ## </summary>
      Chris PeBenito 60f04f
      ## <param name="domain">
      Chris PeBenito 60f04f
      ##	<summary>
      Chris PeBenito 60f04f
      ##	Domain allowed access.
      Chris PeBenito 60f04f
      ##	</summary>
      Chris PeBenito 60f04f
      ## </param>
      Chris PeBenito 60f04f
      #
      Chris PeBenito 60f04f
      interface(`kernel_rw_unlabeled_files',`
      Chris PeBenito 60f04f
      	gen_require(`
      Chris PeBenito 60f04f
      		type unlabeled_t;
      Chris PeBenito 60f04f
      	')
      Chris PeBenito 60f04f
      Chris PeBenito 60f04f
      	allow $1 unlabeled_t:file rw_file_perms;
      Chris PeBenito 60f04f
      ')
      Chris PeBenito 60f04f
      Chris PeBenito 60f04f
      ########################################
      Chris PeBenito 60f04f
      ## <summary>
      Chris PeBenito 10b1f3
      ##	Do not audit attempts by caller to get the
      Chris PeBenito 10b1f3
      ##	attributes of an unlabeled file.
      Chris PeBenito 10b1f3
      ## </summary>
      Chris PeBenito 10b1f3
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 10b1f3
      ## </param>
      Chris PeBenito 10b1f3
      #
      Chris PeBenito 445522
      interface(`kernel_dontaudit_getattr_unlabeled_files',`
      Chris PeBenito 10b1f3
      	gen_require(`
      Chris PeBenito 10b1f3
      		type unlabeled_t;
      Chris PeBenito 10b1f3
      	')
      Chris PeBenito 10b1f3
      Chris PeBenito 10b1f3
      	dontaudit $1 unlabeled_t:file getattr;
      Chris PeBenito 10b1f3
      ')
      Chris PeBenito 10b1f3
      Chris PeBenito 10b1f3
      ########################################
      Chris PeBenito 10b1f3
      ## <summary>
      Chris PeBenito 725926
      ##	Do not audit attempts by caller to
      Chris PeBenito 725926
      ##	read an unlabeled file.
      Chris PeBenito 725926
      ## </summary>
      Chris PeBenito 725926
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 725926
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 725926
      ## </param>
      Chris PeBenito 725926
      #
      Chris PeBenito 445522
      interface(`kernel_dontaudit_read_unlabeled_files',`
      Chris PeBenito 725926
      	gen_require(`
      Chris PeBenito 725926
      		type unlabeled_t;
      Chris PeBenito 725926
      	')
      Chris PeBenito 725926
      Chris PeBenito 725926
      	dontaudit $1 unlabeled_t:file { getattr read };
      Chris PeBenito 725926
      ')
      Chris PeBenito 725926
      Chris PeBenito 725926
      ########################################
      Chris PeBenito 725926
      ## <summary>
      Chris PeBenito ac9aa2
      ##	Do not audit attempts by caller to get the
      Chris PeBenito ac9aa2
      ##	attributes of unlabeled symbolic links.
      Chris PeBenito ac9aa2
      ## </summary>
      Chris PeBenito ac9aa2
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito ac9aa2
      ## </param>
      Chris PeBenito ac9aa2
      #
      Chris PeBenito ac9aa2
      interface(`kernel_dontaudit_getattr_unlabeled_symlinks',`
      Chris PeBenito ac9aa2
      	gen_require(`
      Chris PeBenito ac9aa2
      		type unlabeled_t;
      Chris PeBenito ac9aa2
      	')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      	dontaudit $1 unlabeled_t:lnk_file getattr;
      Chris PeBenito ac9aa2
      ')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      ########################################
      Chris PeBenito ac9aa2
      ## <summary>
      Chris PeBenito ac9aa2
      ##	Do not audit attempts by caller to get the
      Chris PeBenito ac9aa2
      ##	attributes of unlabeled named pipes.
      Chris PeBenito ac9aa2
      ## </summary>
      Chris PeBenito ac9aa2
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito ac9aa2
      ## </param>
      Chris PeBenito ac9aa2
      #
      Chris PeBenito ac9aa2
      interface(`kernel_dontaudit_getattr_unlabeled_pipes',`
      Chris PeBenito ac9aa2
      	gen_require(`
      Chris PeBenito ac9aa2
      		type unlabeled_t;
      Chris PeBenito ac9aa2
      	')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      	dontaudit $1 unlabeled_t:fifo_file getattr;
      Chris PeBenito ac9aa2
      ')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      ########################################
      Chris PeBenito ac9aa2
      ## <summary>
      Chris PeBenito ac9aa2
      ##	Do not audit attempts by caller to get the
      Chris PeBenito ac9aa2
      ##	attributes of unlabeled named sockets.
      Chris PeBenito ac9aa2
      ## </summary>
      Chris PeBenito ac9aa2
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito ac9aa2
      ## </param>
      Chris PeBenito ac9aa2
      #
      Chris PeBenito ac9aa2
      interface(`kernel_dontaudit_getattr_unlabeled_sockets',`
      Chris PeBenito ac9aa2
      	gen_require(`
      Chris PeBenito ac9aa2
      		type unlabeled_t;
      Chris PeBenito ac9aa2
      	')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      	dontaudit $1 unlabeled_t:sock_file getattr;
      Chris PeBenito ac9aa2
      ')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      ########################################
      Chris PeBenito ac9aa2
      ## <summary>
      Chris PeBenito ae9e27
      ##	Do not audit attempts by caller to get attributes for
      Chris PeBenito ae9e27
      ##	unlabeled block devices.
      Chris PeBenito ae9e27
      ## </summary>
      Chris PeBenito ae9e27
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito ae9e27
      ## </param>
      Chris PeBenito ae9e27
      #
      Chris PeBenito 445522
      interface(`kernel_dontaudit_getattr_unlabeled_blk_files',`
      Chris PeBenito ae9e27
      	gen_require(`
      Chris PeBenito ae9e27
      		type unlabeled_t;
      Chris PeBenito ae9e27
      	')
      Chris PeBenito ae9e27
      Chris PeBenito 10b1f3
      	dontaudit $1 unlabeled_t:blk_file getattr;
      Chris PeBenito ae9e27
      ')
      Chris PeBenito ae9e27
      Chris PeBenito ae9e27
      ########################################
      Chris PeBenito ae9e27
      ## <summary>
      Chris PeBenito a42ca7
      ##	Read and write unlabeled block device nodes.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito a42ca7
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito a42ca7
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito a42ca7
      ## </param>
      Chris PeBenito a42ca7
      #
      Chris PeBenito 445522
      interface(`kernel_rw_unlabeled_blk_files',`
      Chris PeBenito a42ca7
      	gen_require(`
      Chris PeBenito a42ca7
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito 0c73cd
      	allow $1 unlabeled_t:blk_file getattr;
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito c6fd1f
      ########################################
      Chris PeBenito a42ca7
      ## <summary>
      Chris PeBenito ac9aa2
      ##	Do not audit attempts by caller to get attributes for
      Chris PeBenito ac9aa2
      ##	unlabeled character devices.
      Chris PeBenito ac9aa2
      ## </summary>
      Chris PeBenito ac9aa2
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Dominick Grift 705f70
      ##	Domain to not audit.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito ac9aa2
      ## </param>
      Chris PeBenito ac9aa2
      #
      Chris PeBenito 445522
      interface(`kernel_dontaudit_getattr_unlabeled_chr_files',`
      Chris PeBenito ac9aa2
      	gen_require(`
      Chris PeBenito ac9aa2
      		type unlabeled_t;
      Chris PeBenito ac9aa2
      	')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      	dontaudit $1 unlabeled_t:chr_file getattr;
      Chris PeBenito ac9aa2
      ')
      Chris PeBenito ac9aa2
      Chris PeBenito ac9aa2
      ########################################
      Chris PeBenito ac9aa2
      ## <summary>
      Chris PeBenito c66a3a
      ##	Allow caller to relabel unlabeled directories.
      Chris PeBenito a42ca7
      ## </summary>
      Chris PeBenito 414e41
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 414e41
      ## </param>
      Chris PeBenito c6fd1f
      #
      Chris PeBenito c66a3a
      interface(`kernel_relabelfrom_unlabeled_dirs',`
      Chris PeBenito c66a3a
      	gen_require(`
      Chris PeBenito c66a3a
      		type unlabeled_t;
      Chris PeBenito c66a3a
      	')
      Chris PeBenito c66a3a
      Chris PeBenito 82d277
      	allow $1 unlabeled_t:dir { list_dir_perms relabelfrom };
      Chris PeBenito c66a3a
      ')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      ########################################
      Chris PeBenito c66a3a
      ## <summary>
      Chris PeBenito c66a3a
      ##	Allow caller to relabel unlabeled files.
      Chris PeBenito c66a3a
      ## </summary>
      Chris PeBenito c66a3a
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito c66a3a
      ## </param>
      Chris PeBenito c66a3a
      #
      Chris PeBenito c66a3a
      interface(`kernel_relabelfrom_unlabeled_files',`
      Chris PeBenito c66a3a
      	gen_require(`
      Chris PeBenito c66a3a
      		type unlabeled_t;
      Chris PeBenito c66a3a
      	')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      	kernel_list_unlabeled($1)
      Chris PeBenito c66a3a
      	allow $1 unlabeled_t:file { getattr relabelfrom };
      Chris PeBenito c66a3a
      ')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      ########################################
      Chris PeBenito c66a3a
      ## <summary>
      Chris PeBenito c66a3a
      ##	Allow caller to relabel unlabeled symbolic links.
      Chris PeBenito c66a3a
      ## </summary>
      Chris PeBenito c66a3a
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito c66a3a
      ## </param>
      Chris PeBenito c66a3a
      #
      Chris PeBenito c66a3a
      interface(`kernel_relabelfrom_unlabeled_symlinks',`
      Chris PeBenito c66a3a
      	gen_require(`
      Chris PeBenito c66a3a
      		type unlabeled_t;
      Chris PeBenito c66a3a
      	')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      	kernel_list_unlabeled($1)
      Chris PeBenito c66a3a
      	allow $1 unlabeled_t:lnk_file { getattr relabelfrom };
      Chris PeBenito c66a3a
      ')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      ########################################
      Chris PeBenito c66a3a
      ## <summary>
      Chris PeBenito c66a3a
      ##	Allow caller to relabel unlabeled named pipes.
      Chris PeBenito c66a3a
      ## </summary>
      Chris PeBenito c66a3a
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito c66a3a
      ## </param>
      Chris PeBenito c66a3a
      #
      Chris PeBenito c66a3a
      interface(`kernel_relabelfrom_unlabeled_pipes',`
      Chris PeBenito c66a3a
      	gen_require(`
      Chris PeBenito c66a3a
      		type unlabeled_t;
      Chris PeBenito c66a3a
      	')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      	kernel_list_unlabeled($1)
      Chris PeBenito c66a3a
      	allow $1 unlabeled_t:fifo_file { getattr relabelfrom };
      Chris PeBenito c66a3a
      ')
      Chris PeBenito c66a3a
      Chris PeBenito c66a3a
      ########################################
      Chris PeBenito c66a3a
      ## <summary>
      Chris PeBenito c66a3a
      ##	Allow caller to relabel unlabeled named sockets.
      Chris PeBenito c66a3a
      ## </summary>
      Chris PeBenito c66a3a
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito ac9db9
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito c66a3a
      ## </param>
      Chris PeBenito c66a3a
      #
      Chris PeBenito c66a3a
      interface(`kernel_relabelfrom_unlabeled_sockets',`
      Chris PeBenito cbc9d6
      	gen_require(`
      Chris PeBenito cbc9d6
      		type unlabeled_t;
      Chris PeBenito cbc9d6
      	')
      Chris PeBenito 0c73cd
      Chris PeBenito bf080a
      	kernel_list_unlabeled($1)
      Chris PeBenito c66a3a
      	allow $1 unlabeled_t:sock_file { getattr relabelfrom };
      Chris PeBenito c6fd1f
      ')
      Chris PeBenito c6fd1f
      Chris PeBenito 9726b3
      ########################################
      Chris PeBenito 9726b3
      ## <summary>
      Chris PeBenito bd7037
      ##	Send and receive messages from an
      Chris PeBenito bd7037
      ##	unlabeled IPSEC association.
      Chris PeBenito bd7037
      ## </summary>
      Chris PeBenito bd7037
      ## <desc>
      Chris PeBenito bd7037
      ##	

      Chris PeBenito bd7037
      ##	Send and receive messages from an
      Chris PeBenito bd7037
      ##	unlabeled IPSEC association.  Network
      Chris PeBenito bd7037
      ##	connections that are not protected
      Chris PeBenito bd7037
      ##	by IPSEC have use an unlabeled
      Chris PeBenito bd7037
      ##	assocation.
      Chris PeBenito bd7037
      ##	

      Chris PeBenito bd7037
      ##	

      Chris PeBenito bd7037
      ##	The corenetwork interface
      Chris PeBenito 460e05
      ##	corenet_non_ipsec_sendrecv() should
      Chris PeBenito bd7037
      ##	be used instead of this one.
      Chris PeBenito bd7037
      ##	

      Chris PeBenito bd7037
      ## </desc>
      Chris PeBenito bd7037
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito bd7037
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito bd7037
      ## </param>
      Chris PeBenito bd7037
      #
      Chris PeBenito bd7037
      interface(`kernel_sendrecv_unlabeled_association',`
      Chris PeBenito bd7037
      	gen_require(`
      Chris PeBenito bd7037
      		type unlabeled_t;
      Chris PeBenito bd7037
      	')
      Chris PeBenito bd7037
      Chris PeBenito bd7037
      	allow $1 unlabeled_t:association { sendto recvfrom };
      Chris PeBenito c467d9
      Chris PeBenito c467d9
      	# temporary hack until labeling on packets is supported
      Chris PeBenito c467d9
      	allow $1 unlabeled_t:packet { send recv };
      Chris PeBenito bd7037
      ')
      Chris PeBenito bd7037
      Chris PeBenito bd7037
      ########################################
      Chris PeBenito bd7037
      ## <summary>
      Chris PeBenito bf469d
      ##	Do not audit attempts to send and receive messages
      Chris PeBenito bf469d
      ##	from an	unlabeled IPSEC association.
      Chris PeBenito bf469d
      ## </summary>
      Chris PeBenito bf469d
      ## <desc>
      Chris PeBenito bf469d
      ##	

      Chris PeBenito bf469d
      ##	Do not audit attempts to send and receive messages
      Chris PeBenito bf469d
      ##	from an	unlabeled IPSEC association.  Network
      Chris PeBenito bf469d
      ##	connections that are not protected
      Chris PeBenito bf469d
      ##	by IPSEC have use an unlabeled
      Chris PeBenito bf469d
      ##	assocation.
      Chris PeBenito bf469d
      ##	

      Chris PeBenito bf469d
      ##	

      Chris PeBenito bf469d
      ##	The corenetwork interface
      Chris PeBenito bf469d
      ##	corenet_dontaudit_non_ipsec_sendrecv() should
      Chris PeBenito bf469d
      ##	be used instead of this one.
      Chris PeBenito bf469d
      ##	

      Chris PeBenito bf469d
      ## </desc>
      Chris PeBenito bf469d
      ## <param name="domain">
      Chris PeBenito bf469d
      ##	<summary>
      Chris PeBenito bf469d
      ##	Domain to not audit.
      Chris PeBenito bf469d
      ##	</summary>
      Chris PeBenito bf469d
      ## </param>
      Chris PeBenito bf469d
      #
      Chris PeBenito bf469d
      interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
      Chris PeBenito bf469d
      	gen_require(`
      Chris PeBenito bf469d
      		type unlabeled_t;
      Chris PeBenito bf469d
      	')
      Chris PeBenito bf469d
      Chris PeBenito bf469d
      	dontaudit $1 unlabeled_t:association { sendto recvfrom };
      Chris PeBenito bf469d
      ')
      Chris PeBenito bf469d
      Chris PeBenito bf469d
      ########################################
      Chris PeBenito bf469d
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Receive TCP packets from an unlabeled connection.
      Chris PeBenito 130f8a
      ## </summary>
      Chris PeBenito 130f8a
      ## <desc>
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito ff8f0a
      ##	Receive TCP packets from an unlabeled connection.
      Chris PeBenito ff8f0a
      ##	

      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 190066
      ##	The corenetwork interface corenet_tcp_recv_unlabeled() should
      Chris PeBenito 130f8a
      ##	be used instead of this one.
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 130f8a
      ## </desc>
      Chris PeBenito 130f8a
      ## <param name="domain">
      Chris PeBenito 130f8a
      ##	<summary>
      Chris PeBenito 130f8a
      ##	Domain allowed access.
      Chris PeBenito 130f8a
      ##	</summary>
      Chris PeBenito 130f8a
      ## </param>
      Chris PeBenito 130f8a
      #
      Chris PeBenito 130f8a
      interface(`kernel_tcp_recvfrom_unlabeled',`
      Chris PeBenito 130f8a
      	gen_require(`
      Chris PeBenito 130f8a
      		type unlabeled_t;
      Chris PeBenito 130f8a
      	')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      	allow $1 unlabeled_t:tcp_socket recvfrom;
      Chris PeBenito 130f8a
      ')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      ########################################
      Chris PeBenito 130f8a
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Do not audit attempts to receive TCP packets from an unlabeled
      Chris PeBenito 190066
      ##	connection.
      Chris PeBenito 130f8a
      ## </summary>
      Chris PeBenito 130f8a
      ## <desc>
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito ff8f0a
      ##	Do not audit attempts to receive TCP packets from an unlabeled
      Chris PeBenito 190066
      ##	connection.
      Chris PeBenito ff8f0a
      ##	

      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 190066
      ##	The corenetwork interface corenet_dontaudit_tcp_recv_unlabeled()
      Chris PeBenito 190066
      ##	should be used instead of this one.
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 130f8a
      ## </desc>
      Chris PeBenito 130f8a
      ## <param name="domain">
      Chris PeBenito 130f8a
      ##	<summary>
      Chris PeBenito 130f8a
      ##	Domain to not audit.
      Chris PeBenito 130f8a
      ##	</summary>
      Chris PeBenito 130f8a
      ## </param>
      Chris PeBenito 130f8a
      #
      Chris PeBenito 130f8a
      interface(`kernel_dontaudit_tcp_recvfrom_unlabeled',`
      Chris PeBenito 130f8a
      	gen_require(`
      Chris PeBenito 130f8a
      		type unlabeled_t;
      Chris PeBenito 130f8a
      	')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      	dontaudit $1 unlabeled_t:tcp_socket recvfrom;
      Chris PeBenito 130f8a
      ')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      ########################################
      Chris PeBenito 130f8a
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Receive UDP packets from an unlabeled connection.
      Chris PeBenito 130f8a
      ## </summary>
      Chris PeBenito 130f8a
      ## <desc>
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito ff8f0a
      ##	Receive UDP packets from an unlabeled connection.
      Chris PeBenito ff8f0a
      ##	

      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 190066
      ##	The corenetwork interface corenet_udp_recv_unlabeled() should
      Chris PeBenito 130f8a
      ##	be used instead of this one.
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 130f8a
      ## </desc>
      Chris PeBenito 130f8a
      ## <param name="domain">
      Chris PeBenito 130f8a
      ##	<summary>
      Chris PeBenito 130f8a
      ##	Domain allowed access.
      Chris PeBenito 130f8a
      ##	</summary>
      Chris PeBenito 130f8a
      ## </param>
      Chris PeBenito 130f8a
      #
      Chris PeBenito 130f8a
      interface(`kernel_udp_recvfrom_unlabeled',`
      Chris PeBenito 130f8a
      	gen_require(`
      Chris PeBenito 130f8a
      		type unlabeled_t;
      Chris PeBenito 130f8a
      	')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      	allow $1 unlabeled_t:udp_socket recvfrom;
      Chris PeBenito 130f8a
      ')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      ########################################
      Chris PeBenito 130f8a
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Do not audit attempts to receive UDP packets from an unlabeled
      Chris PeBenito 190066
      ##	connection.
      Chris PeBenito 130f8a
      ## </summary>
      Chris PeBenito 130f8a
      ## <desc>
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito ff8f0a
      ##	Do not audit attempts to receive UDP packets from an unlabeled
      Chris PeBenito 190066
      ##	connection.
      Chris PeBenito ff8f0a
      ##	

      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 190066
      ##	The corenetwork interface corenet_dontaudit_udp_recv_unlabeled()
      Chris PeBenito 190066
      ##	should be used instead of this one.
      Chris PeBenito 130f8a
      ##	

      Chris PeBenito 130f8a
      ## </desc>
      Chris PeBenito 130f8a
      ## <param name="domain">
      Chris PeBenito 130f8a
      ##	<summary>
      Chris PeBenito 130f8a
      ##	Domain to not audit.
      Chris PeBenito 130f8a
      ##	</summary>
      Chris PeBenito 130f8a
      ## </param>
      Chris PeBenito 130f8a
      #
      Chris PeBenito 130f8a
      interface(`kernel_dontaudit_udp_recvfrom_unlabeled',`
      Chris PeBenito 130f8a
      	gen_require(`
      Chris PeBenito 130f8a
      		type unlabeled_t;
      Chris PeBenito 130f8a
      	')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      	dontaudit $1 unlabeled_t:udp_socket recvfrom;
      Chris PeBenito 130f8a
      ')
      Chris PeBenito 130f8a
      Chris PeBenito 130f8a
      ########################################
      Chris PeBenito 130f8a
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Receive Raw IP packets from an unlabeled connection.
      Chris PeBenito 6b19be
      ## </summary>
      Chris PeBenito 6b19be
      ## <desc>
      Chris PeBenito 6b19be
      ##	

      Chris PeBenito ff8f0a
      ##	Receive Raw IP packets from an unlabeled connection.
      Chris PeBenito ff8f0a
      ##	

      Chris PeBenito 6b19be
      ##	

      Chris PeBenito 190066
      ##	The corenetwork interface corenet_raw_recv_unlabeled() should
      Chris PeBenito 6b19be
      ##	be used instead of this one.
      Chris PeBenito 6b19be
      ##	

      Chris PeBenito 6b19be
      ## </desc>
      Chris PeBenito 6b19be
      ## <param name="domain">
      Chris PeBenito 6b19be
      ##	<summary>
      Chris PeBenito 6b19be
      ##	Domain allowed access.
      Chris PeBenito 6b19be
      ##	</summary>
      Chris PeBenito 6b19be
      ## </param>
      Chris PeBenito 6b19be
      #
      Chris PeBenito 6b19be
      interface(`kernel_raw_recvfrom_unlabeled',`
      Chris PeBenito 6b19be
      	gen_require(`
      Chris PeBenito 6b19be
      		type unlabeled_t;
      Chris PeBenito 6b19be
      	')
      Chris PeBenito 6b19be
      Chris PeBenito 6b19be
      	allow $1 unlabeled_t:rawip_socket recvfrom;
      Chris PeBenito 6b19be
      ')
      Chris PeBenito 6b19be
      Chris PeBenito 6b19be
      ########################################
      Chris PeBenito 6b19be
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Do not audit attempts to receive Raw IP packets from an unlabeled
      Chris PeBenito 190066
      ##	connection.
      Chris PeBenito 6b19be
      ## </summary>
      Chris PeBenito 6b19be
      ## <desc>
      Chris PeBenito 6b19be
      ##	

      Chris PeBenito ff8f0a
      ##	Do not audit attempts to receive Raw IP packets from an unlabeled
      Chris PeBenito 190066
      ##	connection.
      Chris PeBenito ff8f0a
      ##	

      Chris PeBenito 6b19be
      ##	

      Chris PeBenito 190066
      ##	The corenetwork interface corenet_dontaudit_raw_recv_unlabeled()
      Chris PeBenito 190066
      ##	should be used instead of this one.
      Chris PeBenito 6b19be
      ##	

      Chris PeBenito 6b19be
      ## </desc>
      Chris PeBenito 6b19be
      ## <param name="domain">
      Chris PeBenito 6b19be
      ##	<summary>
      Chris PeBenito 6b19be
      ##	Domain to not audit.
      Chris PeBenito 6b19be
      ##	</summary>
      Chris PeBenito 6b19be
      ## </param>
      Chris PeBenito 6b19be
      #
      Chris PeBenito 6b19be
      interface(`kernel_dontaudit_raw_recvfrom_unlabeled',`
      Chris PeBenito 6b19be
      	gen_require(`
      Chris PeBenito 6b19be
      		type unlabeled_t;
      Chris PeBenito 6b19be
      	')
      Chris PeBenito 6b19be
      Chris PeBenito 6b19be
      	dontaudit $1 unlabeled_t:rawip_socket recvfrom;
      Chris PeBenito 6b19be
      ')
      Chris PeBenito 6b19be
      Chris PeBenito 6b19be
      ########################################
      Chris PeBenito 6b19be
      ## <summary>
      Chris PeBenito a013b5
      ##	Send and receive unlabeled packets.
      Chris PeBenito a013b5
      ## </summary>
      Chris PeBenito a013b5
      ## <desc>
      Chris PeBenito a013b5
      ##	

      Chris PeBenito a013b5
      ##	Send and receive unlabeled packets.
      Chris PeBenito a013b5
      ##	These packets do not match any netfilter
      Chris PeBenito a013b5
      ##	SECMARK rules.
      Chris PeBenito a013b5
      ##	

      Chris PeBenito a013b5
      ##	

      Chris PeBenito a013b5
      ##	The corenetwork interface
      Chris PeBenito a013b5
      ##	corenet_sendrecv_unlabeled_packets() should
      Chris PeBenito a013b5
      ##	be used instead of this one.
      Chris PeBenito a013b5
      ##	

      Chris PeBenito a013b5
      ## </desc>
      Chris PeBenito a013b5
      ## <param name="domain">
      Chris PeBenito a013b5
      ##	<summary>
      Chris PeBenito a013b5
      ##	Domain allowed access.
      Chris PeBenito a013b5
      ##	</summary>
      Chris PeBenito a013b5
      ## </param>
      Chris PeBenito a013b5
      #
      Chris PeBenito a013b5
      interface(`kernel_sendrecv_unlabeled_packets',`
      Chris PeBenito a013b5
      	gen_require(`
      Chris PeBenito a013b5
      		type unlabeled_t;
      Chris PeBenito a013b5
      	')
      Chris PeBenito a013b5
      Chris PeBenito a013b5
      	allow $1 unlabeled_t:packet { send recv };
      Chris PeBenito a013b5
      ')
      Chris PeBenito a013b5
      Chris PeBenito a013b5
      ########################################
      Chris PeBenito a013b5
      ## <summary>
      Chris PeBenito 308baa
      ##	Receive packets from an unlabeled peer.
      Chris PeBenito 308baa
      ## </summary>
      Chris PeBenito 308baa
      ## <desc>
      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ##	Receive packets from an unlabeled peer, these packets do not have any
      Chris PeBenito ff8f0a
      ##	peer labeling information present.
      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ##	The corenetwork interface corenet_recvfrom_unlabeled_peer() should
      Chris PeBenito 308baa
      ##	be used instead of this one.
      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ## </desc>
      Chris PeBenito 308baa
      ## <param name="domain">
      Chris PeBenito 308baa
      ##	<summary>
      Chris PeBenito 308baa
      ##	Domain allowed access.
      Chris PeBenito 308baa
      ##	</summary>
      Chris PeBenito 308baa
      ## </param>
      Chris PeBenito 308baa
      #
      Chris PeBenito 308baa
      interface(`kernel_recvfrom_unlabeled_peer',`
      Chris PeBenito 308baa
      	gen_require(`
      Chris PeBenito 308baa
      		type unlabeled_t;
      Chris PeBenito 308baa
      	')
      Chris PeBenito 308baa
      Chris PeBenito 308baa
      	allow $1 unlabeled_t:peer recv;
      Chris PeBenito 308baa
      ')
      Chris PeBenito 308baa
      Chris PeBenito 308baa
      ########################################
      Chris PeBenito 308baa
      ## <summary>
      Chris PeBenito 308baa
      ##	Do not audit attempts to receive packets from an unlabeled peer.
      Chris PeBenito 308baa
      ## </summary>
      Chris PeBenito 308baa
      ## <desc>
      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ##	Do not audit attempts to receive packets from an unlabeled peer,
      Chris PeBenito ff8f0a
      ##	these packets do not have any peer labeling information present.
      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ##	The corenetwork interface corenet_dontaudit_*_recvfrom_unlabeled()
      Chris PeBenito 308baa
      ##	should be used instead of this one.
      Chris PeBenito 308baa
      ##	

      Chris PeBenito 308baa
      ## </desc>
      Chris PeBenito 308baa
      ## <param name="domain">
      Chris PeBenito 308baa
      ##	<summary>
      Chris PeBenito 308baa
      ##	Domain to not audit.
      Chris PeBenito 308baa
      ##	</summary>
      Chris PeBenito 308baa
      ## </param>
      Chris PeBenito 308baa
      #
      Chris PeBenito 308baa
      interface(`kernel_dontaudit_recvfrom_unlabeled_peer',`
      Chris PeBenito 308baa
      	gen_require(`
      Chris PeBenito 308baa
      		type unlabeled_t;
      Chris PeBenito 308baa
      	')
      Chris PeBenito 308baa
      Chris PeBenito 308baa
      	dontaudit $1 unlabeled_t:peer recv;
      Chris PeBenito 308baa
      ')
      Chris PeBenito 308baa
      Chris PeBenito 308baa
      ########################################
      Chris PeBenito 308baa
      ## <summary>
      Chris PeBenito ff8f0a
      ##	Relabel from unlabeled database objects.
      Chris PeBenito e8cb08
      ## </summary>
      Chris PeBenito e8cb08
      ## <param name="domain">
      Chris PeBenito ff8f0a
      ##	<summary>
      Chris PeBenito ff8f0a
      ##	Domain allowed access.
      Chris PeBenito ff8f0a
      ##	</summary>
      Chris PeBenito e8cb08
      ## </param>
      Chris PeBenito e8cb08
      #
      Chris PeBenito e8cb08
      interface(`kernel_relabelfrom_unlabeled_database',`
      Chris PeBenito e8cb08
      	gen_require(`
      Chris PeBenito e8cb08
      		type unlabeled_t;
      Chris PeBenito e8cb08
      		class db_database { setattr relabelfrom };
      Chris PeBenito e8cb08
      		class db_table { setattr relabelfrom };
      Chris PeBenito e8cb08
      		class db_procedure { setattr relabelfrom };
      Chris PeBenito e8cb08
      		class db_column { setattr relabelfrom };
      Chris PeBenito e8cb08
      		class db_tuple { update relabelfrom };
      Chris PeBenito e8cb08
      		class db_blob { setattr relabelfrom };
      Chris PeBenito e8cb08
      	')
      Chris PeBenito e8cb08
      Chris PeBenito e8cb08
      	allow $1 unlabeled_t:db_database { setattr relabelfrom };
      Chris PeBenito e8cb08
      	allow $1 unlabeled_t:db_table { setattr relabelfrom };
      Chris PeBenito e8cb08
      	allow $1 unlabeled_t:db_procedure { setattr relabelfrom };
      Chris PeBenito e8cb08
      	allow $1 unlabeled_t:db_column { setattr relabelfrom };
      Chris PeBenito e8cb08
      	allow $1 unlabeled_t:db_tuple { update relabelfrom };
      Chris PeBenito e8cb08
      	allow $1 unlabeled_t:db_blob { setattr relabelfrom };
      Chris PeBenito e8cb08
      ')
      Chris PeBenito e8cb08
      Chris PeBenito e8cb08
      ########################################
      Chris PeBenito e8cb08
      ## <summary>
      Dan Walsh 3eaa99
      ##      Relabel to unlabeled context .
      Dan Walsh 3eaa99
      ## </summary>
      Dan Walsh 3eaa99
      ## <param name="domain">
      Dan Walsh 3eaa99
      ##      <summary>
      Dan Walsh 3eaa99
      ##      Domain allowed access.
      Dan Walsh 3eaa99
      ##      </summary>
      Dan Walsh 3eaa99
      ## </param>
      Dan Walsh 3eaa99
      #
      Dan Walsh 3eaa99
      interface(`kernel_relabelto_unlabeled',`
      Dan Walsh 3eaa99
      	gen_require(`
      Dan Walsh 3eaa99
      		type unlabeled_t;
      Dan Walsh 3eaa99
      	')
      Dan Walsh 3eaa99
      Dan Walsh 3eaa99
      	allow $1 unlabeled_t:dir_file_class_set relabelto;
      Dan Walsh 3eaa99
      ')
      Dan Walsh 3eaa99
      Dan Walsh 3eaa99
      ########################################
      Dan Walsh 3eaa99
      ## <summary>
      Chris PeBenito 460e05
      ##	Unconfined access to kernel module resources.
      Chris PeBenito 9726b3
      ## </summary>
      Chris PeBenito 9726b3
      ## <param name="domain">
      Chris PeBenito 885b83
      ##	<summary>
      Chris PeBenito 9726b3
      ##	Domain allowed access.
      Chris PeBenito 885b83
      ##	</summary>
      Chris PeBenito 9726b3
      ## </param>
      Chris PeBenito 9726b3
      #
      Chris PeBenito 9726b3
      interface(`kernel_unconfined',`
      Chris PeBenito 9726b3
      	gen_require(`
      Chris PeBenito d25063
      		attribute kern_unconfined;
      Chris PeBenito 9726b3
      	')
      Chris PeBenito 9726b3
      Chris PeBenito d25063
      	typeattribute $1 kern_unconfined;
      Chris PeBenito 9726b3
      ')
      Dan Walsh 3eaa99
      Dan Walsh 3eaa99
      ########################################
      Dan Walsh 3eaa99
      ## <summary>
      Dan Walsh 3eaa99
      ##	Allow the specified domain to connect to
      Dan Walsh 3eaa99
      ##	the kernel with a unix socket.
      Dan Walsh 3eaa99
      ## </summary>
      Dan Walsh 3eaa99
      ## <param name="domain">
      Dan Walsh 3eaa99
      ##	<summary>
      Dan Walsh 3eaa99
      ##	Domain allowed access.
      Dan Walsh 3eaa99
      ##	</summary>
      Dan Walsh 3eaa99
      ## </param>
      Dan Walsh 3eaa99
      #
      Dan Walsh 3eaa99
      interface(`kernel_stream_connect',`
      Dan Walsh 3eaa99
      	gen_require(`
      Dan Walsh 3eaa99
      		type kernel_t;
      Dan Walsh 3eaa99
      	')
      Dan Walsh 3eaa99
      Dan Walsh 3eaa99
      	allow $1 kernel_t:unix_stream_socket connectto;
      Dan Walsh 3eaa99
      ')
      Dan Walsh 3eaa99