Chris PeBenito 76a9fe
policy_module(kernel, 1.12.2)
Chris PeBenito 960373
Chris PeBenito ff7bc1
########################################
Chris PeBenito ff7bc1
#
Chris PeBenito ff7bc1
# Declarations
Chris PeBenito ff7bc1
#
Chris PeBenito ff7bc1
Chris PeBenito 18f25a
# assertion related attributes
Chris PeBenito a266e3
attribute can_load_kernmodule;
Chris PeBenito a266e3
attribute can_receive_kernel_messages;
Chris PeBenito e276b8
attribute can_dump_kernel;
Chris PeBenito a266e3
Chris PeBenito b518fc
neverallow ~{ can_load_kernmodule kern_unconfined } self:capability sys_module;
Chris PeBenito 712566
Chris PeBenito d25063
# domains with unconfined access to kernel resources
Chris PeBenito d25063
attribute kern_unconfined;
Chris PeBenito d25063
Chris PeBenito d25063
# regular entries in proc
Chris PeBenito d25063
attribute proc_type;
Chris PeBenito d25063
Chris PeBenito d25063
# sysctls
Chris PeBenito d25063
attribute sysctl_type;
Chris PeBenito d25063
Chris PeBenito 9fd4b8
role system_r;
Chris PeBenito 9fd4b8
role sysadm_r;
Chris PeBenito 9fd4b8
role staff_r;
Chris PeBenito 9fd4b8
role user_r;
Chris PeBenito 18d59e
Chris PeBenito 350b6a
# here until order dependence is fixed:
Chris PeBenito 350b6a
role unconfined_r;
Chris PeBenito 350b6a
Chris PeBenito 18d59e
ifdef(`enable_mls',`
Chris PeBenito 18d59e
	role secadm_r;
Chris PeBenito 2dbd38
	role auditadm_r;
Chris PeBenito 18d59e
')
Chris PeBenito 9fd4b8
Chris PeBenito a266e3
#
Chris PeBenito b4cd15
# kernel_t is the domain of kernel threads.
Chris PeBenito b4cd15
# It is also the target type when checking permissions in the system class.
Chris PeBenito e276b8
#
Chris PeBenito f0574f
type kernel_t, can_load_kernmodule;
Chris PeBenito fb0a3a
domain_base_type(kernel_t)
Chris PeBenito f0574f
mls_rangetrans_source(kernel_t)
Chris PeBenito f0574f
role system_r types kernel_t;
Chris PeBenito e070dd
sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito a1fcff
# DebugFS
Chris PeBenito a1fcff
#
Chris PeBenito a1fcff
Chris PeBenito a1fcff
type debugfs_t;
Chris PeBenito a1fcff
fs_type(debugfs_t)
Chris PeBenito a1fcff
allow debugfs_t self:filesystem associate;
Chris PeBenito e02c61
genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
Chris PeBenito a1fcff
Chris PeBenito a1fcff
#
Chris PeBenito 937849
# kvmFS
Chris PeBenito 937849
#
Chris PeBenito 937849
Chris PeBenito 937849
type kvmfs_t;
Chris PeBenito 937849
fs_type(kvmfs_t)
Chris PeBenito 937849
genfscon kvmfs / gen_context(system_u:object_r:kvmfs_t,s0)
Chris PeBenito 937849
Chris PeBenito 937849
#
Chris PeBenito b4cd15
# Procfs types
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
Chris PeBenito d25063
type proc_t, proc_type;
Chris PeBenito c9428d
files_mountpoint(proc_t)
Chris PeBenito cbca03
fs_type(proc_t)
Chris PeBenito e02c61
genfscon proc / gen_context(system_u:object_r:proc_t,s0)
Chris PeBenito e02c61
genfscon proc /sysvipc gen_context(system_u:object_r:proc_t,s0)
Chris PeBenito b4cd15
Chris PeBenito 7d4161
type proc_afs_t, proc_type;
Chris PeBenito 7d4161
genfscon proc /fs/openafs gen_context(system_u:object_r:proc_afs_t,s0)
Chris PeBenito 7d4161
Chris PeBenito b4cd15
# kernel message interface
Chris PeBenito d25063
type proc_kmsg_t, proc_type;
Chris PeBenito e070dd
genfscon proc /kmsg gen_context(system_u:object_r:proc_kmsg_t,mls_systemhigh)
Chris PeBenito b518fc
neverallow ~{ can_receive_kernel_messages kern_unconfined } proc_kmsg_t:file ~getattr;
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc kcore: inaccessible
Chris PeBenito d25063
type proc_kcore_t, proc_type;
Chris PeBenito e276b8
neverallow ~{ can_dump_kernel kern_unconfined } proc_kcore_t:file ~getattr;
Chris PeBenito e070dd
genfscon proc /kcore gen_context(system_u:object_r:proc_kcore_t,mls_systemhigh)
Chris PeBenito b4cd15
Chris PeBenito d25063
type proc_mdstat_t, proc_type;
Chris PeBenito e02c61
genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
Chris PeBenito b4cd15
Chris PeBenito d25063
type proc_net_t, proc_type;
Chris PeBenito e02c61
genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
Chris PeBenito b4cd15
Chris PeBenito a3cf80
type proc_xen_t, proc_type;
Chris PeBenito a65fd9
files_mountpoint(proc_xen_t)
Chris PeBenito a3cf80
genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
Chris PeBenito a3cf80
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Sysctl types
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
Chris PeBenito d25063
# /proc/sys directory, base directory of sysctls
Chris PeBenito d25063
type sysctl_t, sysctl_type;
Chris PeBenito d25063
files_mountpoint(sysctl_t)
Chris PeBenito e02c61
sid sysctl gen_context(system_u:object_r:sysctl_t,s0)
Chris PeBenito e02c61
genfscon proc /sys gen_context(system_u:object_r:sysctl_t,s0)
Chris PeBenito d25063
Chris PeBenito b4cd15
# /proc/irq directory and files
Chris PeBenito d25063
type sysctl_irq_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /irq gen_context(system_u:object_r:sysctl_irq_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/net/rpc directory and files
Chris PeBenito d25063
type sysctl_rpc_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /net/rpc gen_context(system_u:object_r:sysctl_rpc_t,s0)
Chris PeBenito b4cd15
Chris PeBenito a65fd9
# /proc/sys/crypto directory and files
Chris PeBenito a65fd9
type sysctl_crypto_t, sysctl_type;
Chris PeBenito a65fd9
genfscon proc /sys/crypto gen_context(system_u:object_r:sysctl_crypto_t,s0)
Chris PeBenito a65fd9
Chris PeBenito b4cd15
# /proc/sys/fs directory and files
Chris PeBenito d25063
type sysctl_fs_t, sysctl_type;
Chris PeBenito c9428d
files_mountpoint(sysctl_fs_t)
Chris PeBenito e02c61
genfscon proc /sys/fs gen_context(system_u:object_r:sysctl_fs_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/kernel directory and files
Chris PeBenito d25063
type sysctl_kernel_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/kernel gen_context(system_u:object_r:sysctl_kernel_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/kernel/modprobe file
Chris PeBenito d25063
type sysctl_modprobe_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/kernel/modprobe gen_context(system_u:object_r:sysctl_modprobe_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/kernel/hotplug file
Chris PeBenito d25063
type sysctl_hotplug_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/kernel/hotplug gen_context(system_u:object_r:sysctl_hotplug_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/net directory and files
Chris PeBenito d25063
type sysctl_net_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/net gen_context(system_u:object_r:sysctl_net_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/net/unix directory and files
Chris PeBenito d25063
type sysctl_net_unix_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/net/unix gen_context(system_u:object_r:sysctl_net_unix_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/vm directory and files
Chris PeBenito d25063
type sysctl_vm_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/vm gen_context(system_u:object_r:sysctl_vm_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# /proc/sys/dev directory and files
Chris PeBenito d25063
type sysctl_dev_t, sysctl_type;
Chris PeBenito e02c61
genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
Chris PeBenito a266e3
Chris PeBenito d25063
#
Chris PeBenito d25063
# unlabeled_t is the type of unlabeled objects.
Chris PeBenito d25063
# Objects that have no known labeling information or that
Chris PeBenito d25063
# have labels that are no longer valid are treated as having this type.
Chris PeBenito d25063
#
Chris PeBenito d25063
type unlabeled_t;
Chris PeBenito e070dd
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Dan Walsh 3eaa99
fs_associate(unlabeled_t)
Chris PeBenito d25063
Chris PeBenito d25063
# These initial sids are no longer used, and can be removed:
Chris PeBenito e070dd
sid any_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito e02c61
sid file_labels		gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e070dd
sid icmp_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito e070dd
sid igmp_packet		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito b518fc
sid init		gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e070dd
sid kmod		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito e070dd
sid policy		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito e070dd
sid scmp_packet		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito e02c61
sid sysctl_modprobe 	gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e02c61
sid sysctl_fs		gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e02c61
sid sysctl_kernel	gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e02c61
sid sysctl_net		gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e02c61
sid sysctl_net_unix	gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e02c61
sid sysctl_vm		gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e02c61
sid sysctl_dev		gen_context(system_u:object_r:unlabeled_t,s0)
Chris PeBenito e070dd
sid tcp_socket		gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
Chris PeBenito d25063
Chris PeBenito a266e3
########################################
Chris PeBenito a266e3
#
Chris PeBenito a266e3
# kernel local policy
Chris PeBenito a266e3
#
Chris PeBenito a266e3
Chris PeBenito a266e3
allow kernel_t self:capability *;
Chris PeBenito c38127
allow kernel_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
Chris PeBenito c2c00b
allow kernel_t self:shm create_shm_perms;
Chris PeBenito c2c00b
allow kernel_t self:sem create_sem_perms;
Chris PeBenito a266e3
allow kernel_t self:msg { send receive };
Chris PeBenito c2c00b
allow kernel_t self:msgq create_msgq_perms;
Chris PeBenito c2c00b
allow kernel_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito c2c00b
allow kernel_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito a266e3
allow kernel_t self:unix_dgram_socket sendto;
Chris PeBenito a266e3
allow kernel_t self:unix_stream_socket connectto;
Chris PeBenito ef659a
allow kernel_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito ef659a
allow kernel_t self:sock_file read_sock_file_perms;
Chris PeBenito a266e3
allow kernel_t self:fd use;
Chris PeBenito a266e3
Chris PeBenito a65fd9
allow kernel_t debugfs_t:dir search_dir_perms;
Chris PeBenito a65fd9
Chris PeBenito ef659a
allow kernel_t proc_t:dir list_dir_perms;
Chris PeBenito ef659a
allow kernel_t proc_t:file read_file_perms;
Chris PeBenito ef659a
allow kernel_t proc_t:lnk_file read_lnk_file_perms;
Chris PeBenito 72fcec
Chris PeBenito ef659a
allow kernel_t proc_net_t:dir list_dir_perms;
Chris PeBenito ef659a
allow kernel_t proc_net_t:file read_file_perms;
Chris PeBenito 72fcec
Chris PeBenito ef659a
allow kernel_t proc_mdstat_t:file read_file_perms;
Chris PeBenito 72fcec
Chris PeBenito a266e3
allow kernel_t proc_kcore_t:file getattr;
Chris PeBenito 72fcec
Chris PeBenito a266e3
allow kernel_t proc_kmsg_t:file getattr;
Chris PeBenito 72fcec
Chris PeBenito ef659a
allow kernel_t sysctl_kernel_t:dir list_dir_perms;
Chris PeBenito ef659a
allow kernel_t sysctl_kernel_t:file read_file_perms;
Chris PeBenito ef659a
allow kernel_t sysctl_t:dir list_dir_perms;
Chris PeBenito a266e3
Chris PeBenito 72fcec
# Other possible mount points for the root fs are in files
Chris PeBenito 72fcec
allow kernel_t unlabeled_t:dir mounton;
Chris PeBenito 72fcec
# Kernel-generated traffic e.g., TCP resets on
Chris PeBenito 72fcec
# connections with invalidated labels:
Chris PeBenito 72fcec
allow kernel_t unlabeled_t:packet send;
Chris PeBenito 605ba2
Chris PeBenito 7722c2
# Allow unlabeled network traffic
Chris PeBenito 308baa
allow unlabeled_t unlabeled_t:packet { forward_in forward_out };
Chris PeBenito 7722c2
corenet_in_generic_if(unlabeled_t)
Chris PeBenito 7722c2
corenet_in_generic_node(unlabeled_t)
Chris PeBenito 308baa
Chris PeBenito 190066
corenet_all_recvfrom_unlabeled(kernel_t)
Chris PeBenito 190066
corenet_all_recvfrom_netlabel(kernel_t)
Chris PeBenito a154cd
# Kernel-generated traffic e.g., ICMP replies:
Chris PeBenito a154cd
corenet_raw_sendrecv_all_if(kernel_t)
Chris PeBenito a154cd
corenet_raw_sendrecv_all_nodes(kernel_t)
Chris PeBenito bf080a
corenet_raw_send_generic_if(kernel_t)
Chris PeBenito a154cd
# Kernel-generated traffic e.g., TCP resets:
Chris PeBenito 0fd9dc
corenet_tcp_sendrecv_all_if(kernel_t)
Chris PeBenito 0fd9dc
corenet_tcp_sendrecv_all_nodes(kernel_t)
Chris PeBenito bf080a
corenet_raw_send_generic_node(kernel_t)
Chris PeBenito 006e99
corenet_send_all_packets(kernel_t)
Chris PeBenito a154cd
Chris PeBenito 605ba2
dev_read_sysfs(kernel_t)
Chris PeBenito 605ba2
dev_search_usbfs(kernel_t)
Chris PeBenito 03a6e0
# devtmpfs handling:
Chris PeBenito 03a6e0
dev_create_generic_dirs(kernel_t)
Chris PeBenito 03a6e0
dev_delete_generic_dirs(kernel_t)
Chris PeBenito 03a6e0
dev_create_generic_blk_files(kernel_t)
Chris PeBenito 03a6e0
dev_delete_generic_blk_files(kernel_t)
Chris PeBenito 03a6e0
dev_create_generic_chr_files(kernel_t)
Chris PeBenito 03a6e0
dev_delete_generic_chr_files(kernel_t)
Jeremy Solt d6e1ef
dev_mounton(kernel_t)
Chris PeBenito a154cd
Chris PeBenito e276b8
# Mount root file system. Used when loading a policy
Chris PeBenito a154cd
# from initrd, then mounting the root filesystem
Chris PeBenito a154cd
fs_mount_all_fs(kernel_t)
Chris PeBenito 67b620
fs_unmount_all_fs(kernel_t)
Chris PeBenito a154cd
Chris PeBenito 605ba2
selinux_load_policy(kernel_t)
Chris PeBenito 605ba2
Dan Walsh 3eaa99
term_use_all_terms(kernel_t)
Dan Walsh 3eaa99
term_use_ptmx(kernel_t)
Chris PeBenito 605ba2
Chris PeBenito c9428d
corecmd_exec_shell(kernel_t)
Chris PeBenito 8021cb
corecmd_list_bin(kernel_t)
Chris PeBenito a154cd
# /proc/sys/kernel/modprobe is set to /bin/true if not using modules.
Chris PeBenito c9428d
corecmd_exec_bin(kernel_t)
Chris PeBenito a154cd
Chris PeBenito a154cd
domain_signal_all_domains(kernel_t)
Chris PeBenito 605ba2
domain_search_all_domains_state(kernel_t)
Chris PeBenito 588ffa
Chris PeBenito c9428d
files_list_root(kernel_t)
Chris PeBenito 712566
files_list_etc(kernel_t)
Chris PeBenito c9428d
files_list_home(kernel_t)
Chris PeBenito c9428d
files_read_usr_files(kernel_t)
Dan Walsh 3eaa99
files_manage_mounttab(kernel_t)
Dan Walsh 3eaa99
files_manage_generic_spool_dirs(kernel_t)
Chris PeBenito 588ffa
Chris PeBenito 9779f0
mcs_process_set_categories(kernel_t)
Dan Walsh 3eaa99
mcs_file_read_all(kernel_t)
Dan Walsh 3eaa99
mcs_file_write_all(kernel_t)
Chris PeBenito 9779f0
Chris PeBenito f0574f
mls_process_read_up(kernel_t)
Chris PeBenito f0574f
mls_process_write_down(kernel_t)
Chris PeBenito 67b620
mls_file_write_all_levels(kernel_t)
Chris PeBenito e276b8
mls_file_read_all_levels(kernel_t)
Dan Walsh 3eaa99
mls_socket_write_all_levels(kernel_t) 
Dan Walsh 3eaa99
mls_fd_share_all_levels(kernel_t) 
Dan Walsh 3eaa99
Dan Walsh 3eaa99
logging_manage_generic_logs(kernel_t)
Chris PeBenito f0574f
Chris PeBenito 6b19be
ifdef(`distro_redhat',`
Chris PeBenito 6b19be
	# Bugzilla 222337
Chris PeBenito 6b19be
	fs_rw_tmpfs_chr_files(kernel_t)
Chris PeBenito 6b19be
')
Chris PeBenito 6b19be
Dan Walsh 3eaa99
userdom_user_home_dir_filetrans_user_home_content(kernel_t, { file dir })
Dan Walsh 3eaa99
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 18cc01
	hotplug_search_config(kernel_t)
Chris PeBenito 18cc01
')
Chris PeBenito 18cc01
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 18cc01
	init_sigchld(kernel_t)
Chris PeBenito 18cc01
')
Chris PeBenito 18cc01
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 18cc01
	libs_use_ld_so(kernel_t)
Chris PeBenito 18cc01
	libs_use_shared_libs(kernel_t)
Chris PeBenito 18cc01
')
Chris PeBenito 18cc01
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 18cc01
	logging_send_syslog_msg(kernel_t)
Chris PeBenito 18cc01
')
Chris PeBenito 18cc01
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 34e722
	nis_use_ypbind(kernel_t)
Chris PeBenito 34e722
')
Chris PeBenito 34e722
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito ff8f0a
	# nfs kernel server needs kernel UDP access. It is less risky and painful
Chris PeBenito 43989f
	# to just give it everything.
Chris PeBenito 43989f
	allow kernel_t self:tcp_socket create_stream_socket_perms;
Chris PeBenito 037762
	allow kernel_t self:udp_socket create_socket_perms;
Chris PeBenito 43989f
Chris PeBenito e276b8
	# nfs kernel server needs kernel UDP access. It is less risky and painful
Chris PeBenito 43989f
	# to just give it everything.
Chris PeBenito 668b30
	corenet_udp_sendrecv_generic_if(kernel_t)
Chris PeBenito c12621
	corenet_udp_sendrecv_generic_node(kernel_t)
Chris PeBenito 43989f
	corenet_udp_sendrecv_all_ports(kernel_t)
Chris PeBenito c12621
	corenet_udp_bind_generic_node(kernel_t)
Chris PeBenito b8373e
	corenet_sendrecv_portmap_client_packets(kernel_t)
Chris PeBenito 35a4b3
	corenet_sendrecv_generic_server_packets(kernel_t)
Chris PeBenito 43989f
Chris PeBenito ed38ca
	fs_getattr_xattr_fs(kernel_t)
Chris PeBenito ed38ca
Chris PeBenito 43989f
	auth_dontaudit_getattr_shadow(kernel_t)
Chris PeBenito 43989f
Chris PeBenito 43989f
	sysnet_read_config(kernel_t)
Chris PeBenito 43989f
Chris PeBenito 43989f
	rpc_manage_nfs_ro_content(kernel_t)
Chris PeBenito 43989f
	rpc_manage_nfs_rw_content(kernel_t)
Chris PeBenito e276b8
	rpc_udp_rw_nfs_sockets(kernel_t)
Chris PeBenito 43989f
Chris PeBenito 43989f
	tunable_policy(`nfs_export_all_ro',`
Chris PeBenito ed38ca
		fs_getattr_noxattr_fs(kernel_t)
Chris PeBenito ed38ca
		fs_list_noxattr_fs(kernel_t)
Chris PeBenito ed38ca
		fs_read_noxattr_fs_files(kernel_t)
Chris PeBenito ed38ca
		fs_read_noxattr_fs_symlinks(kernel_t)
Chris PeBenito ed38ca
Chris PeBenito ed38ca
		auth_read_all_dirs_except_shadow(kernel_t)
Chris PeBenito ed38ca
		auth_read_all_files_except_shadow(kernel_t)
Chris PeBenito ed38ca
		auth_read_all_symlinks_except_shadow(kernel_t)
Chris PeBenito 43989f
	')
Chris PeBenito 43989f
Chris PeBenito 43989f
	tunable_policy(`nfs_export_all_rw',`
Chris PeBenito ed38ca
		fs_getattr_noxattr_fs(kernel_t)
Chris PeBenito ed38ca
		fs_list_noxattr_fs(kernel_t)
Chris PeBenito ed38ca
		fs_read_noxattr_fs_files(kernel_t)
Chris PeBenito ed38ca
		fs_read_noxattr_fs_symlinks(kernel_t)
Chris PeBenito 43989f
Chris PeBenito 15fefa
		auth_manage_all_files_except_shadow(kernel_t)
Chris PeBenito 43989f
	')
Chris PeBenito 43989f
')
Chris PeBenito 43989f
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 18cc01
	seutil_read_config(kernel_t)
Chris PeBenito 1815ba
	seutil_read_bin_policy(kernel_t)
Chris PeBenito 18cc01
')
Chris PeBenito 18cc01
Chris PeBenito 350b6a
optional_policy(`
Chris PeBenito e276b8
	unconfined_domain_noaudit(kernel_t)
Chris PeBenito 350b6a
')
Chris PeBenito 350b6a
Dan Walsh 3eaa99
optional_policy(`
Dan Walsh 3eaa99
	xserver_xdm_manage_spool(kernel_t)
Dan Walsh 3eaa99
')
Dan Walsh 3eaa99
Chris PeBenito 588ffa
########################################
Chris PeBenito 588ffa
#
Chris PeBenito 588ffa
# Unlabeled process local policy
Chris PeBenito 588ffa
#
Chris PeBenito 588ffa
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 18cc01
	# If you load a new policy that removes active domains, processes can
Chris PeBenito 18cc01
	# get stuck if you do not allow unlabeled processes to signal init.
Chris PeBenito 18cc01
	# If you load an incompatible policy, you should probably reboot,
Chris PeBenito 18cc01
	# since you may have compromised system security.
Chris PeBenito 18cc01
	init_sigchld(unlabeled_t)
Chris PeBenito 18cc01
')
Chris PeBenito b518fc
Chris PeBenito b518fc
########################################
Chris PeBenito b518fc
#
Chris PeBenito b518fc
# Rules for unconfined acccess to this module
Chris PeBenito b518fc
#
Chris PeBenito b518fc
Chris PeBenito 6b19be
allow kern_unconfined proc_type:{ dir file lnk_file } *;
Chris PeBenito b518fc
Chris PeBenito 8152a7
allow kern_unconfined sysctl_type:{ dir file } *;
Chris PeBenito b518fc
Chris PeBenito b518fc
allow kern_unconfined kernel_t:system *;
Chris PeBenito b518fc
Chris PeBenito b518fc
allow kern_unconfined unlabeled_t:dir_file_class_set *;
Chris PeBenito b518fc
allow kern_unconfined unlabeled_t:filesystem *;
Chris PeBenito b518fc
allow kern_unconfined unlabeled_t:association *;
Chris PeBenito c5657a
allow kern_unconfined unlabeled_t:packet *;
Chris PeBenito 3c3c04
allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };