policy_module(selinux, 1.8.0)

########################################

#

# Declarations

#

attribute boolean_type;

attribute can_load_policy;

attribute can_setenforce;

attribute can_setsecparam;

attribute selinux_unconfined_type;

# 

# security_t is the target type when checking

# the permissions in the security class.  It is also

# applied to selinuxfs inodes.

#

type security_t, boolean_type;

fs_type(security_t)

mls_trusted_object(security_t)

sid security gen_context(system_u:object_r:security_t,mls_systemhigh)

genfscon selinuxfs / gen_context(system_u:object_r:security_t,s0)

genfscon securityfs / gen_context(system_u:object_r:security_t,s0)

neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;

neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;

neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;

########################################

#

# Unconfined access to this module

#

# use SELinuxfs

allow selinux_unconfined_type security_t:dir list_dir_perms;

allow selinux_unconfined_type security_t:file rw_file_perms;

allow selinux_unconfined_type boolean_type:file read_file_perms;

# Access the security API.

allow selinux_unconfined_type security_t:security ~{ load_policy setenforce setbool };

if(!secure_mode_policyload) {

	allow selinux_unconfined_type boolean_type:file rw_file_perms;

	allow selinux_unconfined_type security_t:security { load_policy setenforce setbool };

	ifdef(`distro_rhel4',`

		# needed for systems without audit support

		auditallow selinux_unconfined_type security_t:security { load_policy setenforce setbool };

	')

}