policy_module(storage,1.2.0)

########################################

#

# Declarations

#

attribute fixed_disk_raw_read;

attribute fixed_disk_raw_write;

attribute scsi_generic_read;

attribute scsi_generic_write;

attribute storage_unconfined_type;

#

# fixed_disk_device_t is the type of 

# /dev/hd* and /dev/sd*.

#

type fixed_disk_device_t;

dev_node(fixed_disk_device_t)

neverallow ~{ fixed_disk_raw_read storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } read;

neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write };

#

# scsi_generic_device_t is the type of /dev/sg*

# it gives access to ALL SCSI devices (both fixed and removable)

#

type scsi_generic_device_t;

dev_node(scsi_generic_device_t)

neverallow ~{ scsi_generic_read storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } read;

neverallow ~{ scsi_generic_write storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } { append write };

#

# removable_device_t is the type of

# /dev/scd* and /dev/fd*.

#

type removable_device_t;

dev_node(removable_device_t)

#

# tape_device_t is the type of

#

type tape_device_t;

dev_node(tape_device_t)

########################################

#

# Unconfined access to this module

#

allow storage_unconfined_type { fixed_disk_device_t removable_device_t }:blk_file *;

allow storage_unconfined_type { scsi_generic_device_t tape_device_t }:chr_file *;