Chris PeBenito 9570b2
policy_module(selinux, 1.8.0)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Declarations
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito f0435b
attribute boolean_type;
Chris PeBenito 17de1b
attribute can_load_policy;
Chris PeBenito 17de1b
attribute can_setenforce;
Chris PeBenito 17de1b
attribute can_setsecparam;
Chris PeBenito 17de1b
attribute selinux_unconfined_type;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# 
Chris PeBenito 17de1b
# security_t is the target type when checking
Chris PeBenito 17de1b
# the permissions in the security class.  It is also
Chris PeBenito 17de1b
# applied to selinuxfs inodes.
Chris PeBenito 17de1b
#
Chris PeBenito f0435b
type security_t, boolean_type;
Chris PeBenito 17de1b
fs_type(security_t)
Chris PeBenito 17de1b
mls_trusted_object(security_t)
Chris PeBenito e070dd
sid security gen_context(system_u:object_r:security_t,mls_systemhigh)
Chris PeBenito 17de1b
genfscon selinuxfs / gen_context(system_u:object_r:security_t,s0)
Chris PeBenito 91d6c9
genfscon securityfs / gen_context(system_u:object_r:security_t,s0)
Chris PeBenito 17de1b
Chris PeBenito 17de1b
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
Chris PeBenito 17de1b
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
Chris PeBenito 17de1b
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
########################################
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
# Unconfined access to this module
Chris PeBenito 17de1b
#
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# use SELinuxfs
Chris PeBenito 0b36a2
allow selinux_unconfined_type security_t:dir list_dir_perms;
Chris PeBenito 0b36a2
allow selinux_unconfined_type security_t:file rw_file_perms;
Chris PeBenito f0435b
allow selinux_unconfined_type boolean_type:file read_file_perms;
Chris PeBenito 17de1b
Chris PeBenito 17de1b
# Access the security API.
Chris PeBenito 17de1b
allow selinux_unconfined_type security_t:security ~{ load_policy setenforce setbool };
Chris PeBenito 17de1b
Chris PeBenito 17de1b
if(!secure_mode_policyload) {
Chris PeBenito f0435b
	allow selinux_unconfined_type boolean_type:file rw_file_perms;
Chris PeBenito 17de1b
	allow selinux_unconfined_type security_t:security { load_policy setenforce setbool };
Chris PeBenito 133000
Chris PeBenito 133000
	ifdef(`distro_rhel4',`
Chris PeBenito 133000
		# needed for systems without audit support
Chris PeBenito 465510
		auditallow selinux_unconfined_type security_t:security { load_policy setenforce setbool };
Chris PeBenito 133000
	')
Chris PeBenito 17de1b
}