Chris PeBenito c43097
## <summary>Policy for the kernel modules, kernel image, and bootloader.</summary>
Chris PeBenito c43097
Chris PeBenito c43097
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Execute bootloader in the bootloader domain.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito c43097
#
Chris PeBenito 199895
interface(`bootloader_domtrans',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type bootloader_t;
Chris PeBenito cbc9d6
		class process sigchld;
Chris PeBenito cbc9d6
		class fd use;
Chris PeBenito cbc9d6
		class fifo_file rw_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	domain_auto_trans($1, bootloader_exec_t, bootloader_t)
Chris PeBenito d11566
Chris PeBenito d11566
	allow $1 bootloader_t:fd use;
Chris PeBenito d11566
	allow bootloader_t $1:fd use;
Chris PeBenito d11566
	allow bootloader_t $1:fifo_file rw_file_perms;
Chris PeBenito d11566
	allow bootloader_t $1:process sigchld;
Chris PeBenito c43097
')
Chris PeBenito c43097
Chris PeBenito c43097
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Execute bootloader interactively and do
Chris PeBenito 414e41
##	a domain transition to the bootloader domain.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the bootloader domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the bootloader domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito c43097
#
Chris PeBenito 199895
interface(`bootloader_run',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type bootloader_t;
Chris PeBenito cbc9d6
		class chr_file rw_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito 0fd9dc
	bootloader_domtrans($1)
Chris PeBenito d11566
Chris PeBenito d11566
	role $2 types bootloader_t;
Chris PeBenito c2c00b
	allow bootloader_t $3:chr_file rw_file_perms;
Chris PeBenito c43097
')
Chris PeBenito c43097
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Search the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 8fd367
interface(`bootloader_search_boot',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t;
Chris PeBenito cbc9d6
		class dir search;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito d11566
	allow $1 boot_t:dir search;
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 075c4f
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to search the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`bootloader_dontaudit_search_boot',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t;
Chris PeBenito cbc9d6
		class dir search;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito d11566
	dontaudit $1 boot_t:dir search;
Chris PeBenito 075c4f
')
Chris PeBenito 075c4f
Chris PeBenito 075c4f
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read and write symbolic links
Chris PeBenito 414e41
##	in the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 075c4f
#
Chris PeBenito 199895
interface(`bootloader_rw_boot_symlinks',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t;
Chris PeBenito cbc9d6
		class dir r_dir_perms;
Chris PeBenito cbc9d6
		class lnk_file rw_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir r_dir_perms;
Chris PeBenito c2c00b
	allow $1 boot_t:lnk_file rw_file_perms;
Chris PeBenito dc771f
')
Chris PeBenito dc771f
Chris PeBenito dc771f
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Install a kernel into the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito dc771f
#
Chris PeBenito 199895
interface(`bootloader_create_kernel',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t;
Chris PeBenito cbc9d6
		class dir ra_dir_perms;
Chris PeBenito cbc9d6
		class file { getattr read write create };
Chris PeBenito cbc9d6
		class lnk_file { getattr read create unlink };
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir ra_dir_perms;
Chris PeBenito d11566
	allow $1 boot_t:file { getattr read write create };
Chris PeBenito d11566
	allow $1 boot_t:lnk_file { getattr read create unlink };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Install a system.map into the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_create_kernel_symbol_table',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t, system_map_t;
Chris PeBenito cbc9d6
		class dir ra_dir_perms;
Chris PeBenito cbc9d6
		class file { rw_file_perms create };
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir ra_dir_perms;
Chris PeBenito c2c00b
	allow $1 system_map_t:file { rw_file_perms create };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read system.map in the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_read_kernel_symbol_table',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t, system_map_t;
Chris PeBenito cbc9d6
		class dir r_dir_perms;
Chris PeBenito cbc9d6
		class file r_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir r_dir_perms;
Chris PeBenito 0fd9dc
	allow $1 system_map_t:file r_file_perms;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Delete a kernel from /boot.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_delete_kernel',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t;
Chris PeBenito cbc9d6
		class dir { r_dir_perms write remove_name };
Chris PeBenito cbc9d6
		class file { getattr unlink };
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir { r_dir_perms write remove_name };
Chris PeBenito d11566
	allow $1 boot_t:file { getattr unlink };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Delete a system.map in the /boot directory.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_delete_kernel_symbol_table',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t, system_map_t;
Chris PeBenito cbc9d6
		class dir { r_dir_perms write remove_name };
Chris PeBenito cbc9d6
		class file { getattr unlink };
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir { r_dir_perms write remove_name };
Chris PeBenito d11566
	allow $1 system_map_t:file { getattr unlink };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read the bootloader configuration file.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_read_config',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type bootloader_etc_t;
Chris PeBenito cbc9d6
		class file r_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 bootloader_etc_t:file r_file_perms;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read and write the bootloader
Chris PeBenito 414e41
##	configuration file.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_rw_config',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type bootloader_etc_t;
Chris PeBenito cbc9d6
		class file rw_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 bootloader_etc_t:file rw_file_perms;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read and write the bootloader
Chris PeBenito 414e41
##	temporary data in /tmp.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`bootloader_rw_tmp_file',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type bootloader_tmp_t;
Chris PeBenito cbc9d6
		class file rw_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito cbc9d6
	# FIXME: read tmp_t dir
Chris PeBenito c2c00b
	allow $1 bootloader_tmp_t:file rw_file_perms;
Chris PeBenito 7bba9d
')
Chris PeBenito 7bba9d
Chris PeBenito 7bba9d
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read and write the bootloader
Chris PeBenito 414e41
##	temporary data in /tmp.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 7bba9d
#
Chris PeBenito 199895
interface(`bootloader_create_runtime_file',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type boot_t, boot_runtime_t;
Chris PeBenito cbc9d6
		class dir rw_dir_perms;
Chris PeBenito cbc9d6
		class file { rw_file_perms create unlink };
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 boot_t:dir rw_dir_perms;
Chris PeBenito c2c00b
	allow $1 boot_runtime_t:file { rw_file_perms create unlink };
Chris PeBenito d11566
	type_transition $1 boot_t:file boot_runtime_t;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito 5f75f5
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	List the contents of the kernel module directories.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 5f75f5
#
Chris PeBenito 199895
interface(`bootloader_list_kernel_modules',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type modules_object_t;
Chris PeBenito cbc9d6
		class dir r_dir_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 modules_object_t:dir r_dir_perms;
Chris PeBenito 5f75f5
')
Chris PeBenito 5f75f5
Chris PeBenito 5f75f5
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 11633b
##	Get the attributes of kernel module files.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 11633b
## <param name="domain">
Chris PeBenito 11633b
##	The type of the process performing this action.
Chris PeBenito 11633b
## </param>
Chris PeBenito 11633b
#
Chris PeBenito 11633b
interface(`bootloader_getattr_kernel_modules',`
Chris PeBenito 11633b
	gen_require(`
Chris PeBenito 11633b
		type modules_object_t;
Chris PeBenito 11633b
		class dir search;
Chris PeBenito 11633b
		class file getattr;
Chris PeBenito 11633b
	')
Chris PeBenito 11633b
Chris PeBenito 11633b
	allow $1 modules_object_t:dir search;
Chris PeBenito 11633b
	allow $1 modules_object_t:dir getattr;
Chris PeBenito 11633b
')
Chris PeBenito 11633b
Chris PeBenito 11633b
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Read kernel module files.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 5f75f5
#
Chris PeBenito 199895
interface(`bootloader_read_kernel_modules',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type modules_object_t;
Chris PeBenito cbc9d6
		class dir r_dir_perms;
Chris PeBenito cbc9d6
		class lnk_file r_file_perms;
Chris PeBenito cbc9d6
		class file r_file_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 modules_object_t:dir r_dir_perms;
Chris PeBenito c2c00b
	allow $1 modules_object_t:lnk_file r_file_perms;
Chris PeBenito c2c00b
	allow $1 modules_object_t:file r_file_perms;
Chris PeBenito 5f75f5
')
Chris PeBenito 5f75f5
Chris PeBenito d490eb
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Write kernel module files.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito d490eb
#
Chris PeBenito 199895
interface(`bootloader_write_kernel_modules',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		attribute rw_kern_modules;
Chris PeBenito cbc9d6
		type modules_object_t;
Chris PeBenito cbc9d6
		class dir r_dir_perms;
Chris PeBenito cbc9d6
		class file { write append };
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 modules_object_t:dir r_dir_perms;
Chris PeBenito eca5b2
	allow $1 modules_object_t:file { write append };
Chris PeBenito d11566
Chris PeBenito c9428d
	typeattribute $1 rw_kern_modules;
Chris PeBenito d490eb
')
Chris PeBenito d490eb
Chris PeBenito 5f75f5
########################################
Chris PeBenito 11633b
## <summary>
Chris PeBenito 414e41
##	Create, read, write, and delete
Chris PeBenito 414e41
##	kernel module files.
Chris PeBenito 11633b
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 5f75f5
#
Chris PeBenito 199895
interface(`bootloader_manage_kernel_modules',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		attribute rw_kern_modules;
Chris PeBenito cbc9d6
		type modules_object_t;
Chris PeBenito cbc9d6
		class file { getattr create read write setattr unlink };
Chris PeBenito cbc9d6
		class dir rw_dir_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito c2c00b
	allow $1 modules_object_t:file { rw_file_perms create setattr unlink };
Chris PeBenito c2c00b
	allow $1 modules_object_t:dir rw_dir_perms;
Chris PeBenito d11566
Chris PeBenito c9428d
	typeattribute $1 rw_kern_modules;
Chris PeBenito 5f75f5
')
Chris PeBenito 5f75f5
Chris PeBenito 5f75f5
########################################
Chris PeBenito 5f75f5
#
Chris PeBenito 8fd367
# bootloader_create_modules(domain,privatetype,[class(es)])
Chris PeBenito 5f75f5
#
Chris PeBenito 8fd367
interface(`bootloader_create_modules',`
Chris PeBenito cbc9d6
	gen_require(`
Chris PeBenito cbc9d6
		type modules_object_t;
Chris PeBenito cbc9d6
		class dir rw_dir_perms;
Chris PeBenito cbc9d6
	')
Chris PeBenito d11566
Chris PeBenito cbc9d6
	allow $1 modules_object_t:dir rw_dir_perms;
Chris PeBenito d11566
Chris PeBenito d11566
	# if a class is specified use it, else use file as default
Chris PeBenito d11566
	ifelse(`$3',`',`
Chris PeBenito d11566
		type_transition $1 modules_object_t:file $2;
Chris PeBenito d11566
	',`
Chris PeBenito d11566
		type_transition $1 modules_object_t:$3 $2;
Chris PeBenito d11566
	')
Chris PeBenito 5f75f5
')