## <module name="devices" layer="kernel">

## <summary>

##	Policy for all devices except mass storage and terminal devices.

## </summary>

########################################

#

# devices_make_device_node(type)

#

define(`devices_make_device_node',`

	requires_block_template(`$0'_depend)

	typeattribute $1 device_node;

	filesystem_associate($1)

	optional_policy(`distro_redhat',`

		filesystem_tmpfs_associate($1)

	')

')

define(`devices_make_device_node_depend',`

	attribute device_node;

')

########################################

#

# devices_manage_all_devices_labels(domain)

#

define(`devices_manage_all_devices_labels',`

	requires_block_template(`$0'_depend)

	allow $1 device_node:dir { getattr relabelfrom };

	allow $1 device_node:file { getattr relabelfrom };

	allow $1 device_node:lnk_file { getattr relabelfrom };

	allow $1 device_node:fifo_file { getattr relabelfrom };

	allow $1 device_node:sock_file { getattr relabelfrom };

	allow $1 { device_t device_node }:blk_file { getattr relabelfrom relabelto };

	allow $1 { device_t device_node }:chr_file { getattr relabelfrom relabelto };

')

define(`devices_manage_all_devices_labels_depend',`

	attribute device_node;

	type device_t;

	class dir { getattr relabelfrom };

	class file { getattr relabelfrom };

	class lnk_file { getattr relabelfrom };

	class fifo_file { getattr relabelfrom };

	class sock_file { getattr relabelfrom };

	class blk_file { getattr relabelfrom relabelto };

	class chr_file { getattr relabelfrom relabelto };

')

########################################

#

# devices_list_device_nodes(domain)

#

define(`devices_list_device_nodes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_t:lnk_file { getattr read };

')

define(`devices_list_device_nodes_depend',`

	type device_t;

	class dir r_dir_perms;

	class lnk_file { getattr read };

')

########################################

#

# devices_ignore_list_device_nodes(domain)

#

define(`devices_ignore_list_device_nodes',`

	requires_block_template(`$0'_depend)

	dontaudit $1 device_t:dir r_dir_perms;

')

define(`devices_ignore_list_device_nodes_depend',`

	type device_t;

	class dir r_dir_perms;

')

########################################

#

# devices_add_dev_dir(domain)

#

define(`devices_add_dev_dir',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir { ra_dir_perms create };

')

define(`devices_add_dev_dir_depend',`

	type device_t;

	class dir { ra_dir_perms create };

')

########################################

#

# devices_ignore_get_generic_pipe_attributes(domain)

#

define(`devices_ignore_get_generic_pipe_attributes',`

	requires_block_template(`$0'_depend)

	dontaudit $1 device_t:fifo_file getattr;

')

define(`devices_ignore_get_generic_pipe_attributes_depend',`

	type device_t;

	class fifo_file getattr;

')

########################################

#

# devices_get_generic_block_device_attributes(domain)

#

define(`devices_get_generic_block_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_t:blk_file getattr;

')

define(`devices_get_generic_block_device_attributes_depend',`

	type device_t;

	class dir r_dir_perms;

	class blk_file getattr;

')

########################################

#

# devices_ignore_get_generic_block_device_attributes(domain)

#

define(`devices_ignore_get_generic_block_device_attributes',`

	requires_block_template(`$0'_depend)

	dontaudit $1 device_t:blk_file getattr;

')

define(`devices_ignore_get_generic_block_device_attributes_depend',`

	type device_t;

	class blk_file getattr;

')

########################################

#

# devices_manage_generic_block_device(domain)

#

define(`devices_manage_generic_block_device',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_t:blk_file create_file_perms;

')

define(`devices_manage_generic_block_device_depend',`

	type device_t;

	class blk_file create_file_perms;

')

########################################

#

# devices_add_generic_character_device(domain)

#

define(`devices_add_generic_character_device',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir { getattr search read write add_name };

	allow $1 device_t:chr_file create;

	allow $1 self:capability mknod;

')

define(`devices_add_generic_character_device_depend',`

	type device_t;

	class dir { getattr search read write add_name };

	class chr_file create;

	class capability mknod;

')

########################################

#

# devices_get_generic_character_device_attributes(domain)

#

define(`devices_get_generic_character_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_t:chr_file getattr;

')

define(`devices_get_generic_character_device_attributes_depend',`

	type device_t;

	class dir r_dir_perms;

	class chr_file getattr;

')

########################################

#

# devices_ignore_get_generic_character_device_attributes(domain)

#

define(`devices_ignore_get_generic_character_device_attributes',`

	requires_block_template(`$0'_depend)

	dontaudit $1 device_t:chr_file getattr;

')

define(`devices_ignore_get_generic_character_device_attributes_depend',`

	type device_t;

	class chr_file getattr;

')

########################################

## <interface name="devices_remove_dev_symbolic_links">

##	<description>

##		Delete symbolic links in /dev.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<infoflow type="write" weight="1"/>

## </interface>

#

define(`devices_remove_dev_symbolic_links',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir { getattr read write remove_name };

	allow $1 device_t:lnk_file unlink;

')

define(`devices_remove_dev_symbolic_links_depend',`

	attribute device_node, memory_raw_read, memory_raw_write;

	type device_t;

	class dir { getattr read write remove_name };

	class lnk_file unlink;

')

########################################

#

# devices_manage_dev_symbolic_links(domain)

#

define(`devices_manage_dev_symbolic_links',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };

')

define(`devices_manage_dev_symbolic_links_depend',`

	type device_t;

	class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	class lnk_file { create read getattr setattr link unlink rename };

')

########################################

#

# devices_manage_device_nodes(domain)

#

define(`devices_manage_device_nodes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	allow $1 device_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };

	allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };

	allow $1 device_t:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	allow $1 device_node:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	# these next rules are to satisfy assertions broken by the above lines.

	# the permissions hopefully can be cut back a lot

	storage_raw_read_fixed_disk($1)

	storage_raw_write_fixed_disk($1)

	storage_read_scsi_generic($1)

	storage_write_scsi_generic($1)

	typeattribute $1 memory_raw_read;

	typeattribute $1 memory_raw_write;

')

define(`devices_manage_device_nodes_depend',`

	attribute device_node, memory_raw_read, memory_raw_write;

	type device_t;

	class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	class sock_file { create ioctl read getattr lock write setattr append link unlink rename };

	class lnk_file { create read getattr setattr link unlink rename };

	class chr_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	class blk_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

')

########################################

#

# devices_ignore_modify_generic_devices(domain)

#

define(`devices_ignore_modify_generic_devices',`

	requires_block_template(`$0'_depend)

	dontaudit $1 device_t:{ chr_file blk_file } { getattr read write ioctl };

')

define(`devices_ignore_modify_generic_devices_depend',`

	type device_t;

	class chr_file { getattr read write ioctl };

	class blk_file { getattr read write ioctl };

')

########################################

#

# devices_manage_generic_block_devices(domain)

#

define(`devices_manage_generic_block_devices',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_t:blk_file create_file_perms;

')

define(`devices_manage_generic_block_devices_depend',`

	type device_t;

	class dir rw_dir_perms;

	class blk_file create_file_perms;

')

########################################

#

# devices_manage_generic_character_devices(domain)

#

define(`devices_manage_generic_character_devices',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_t:chr_file create_file_perms;

')

define(`devices_manage_generic_character_devices_depend',`

	type device_t;

	class dir rw_dir_perms;

	class chr_file create_file_perms;

')

########################################

#

# devices_create_dev_entry(domain,file,objectclass(es))

#

define(`devices_create_dev_entry',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	type_transition $1 device_t:$3 $2;

	optional_policy(`distro_redhat',`

		filesystem_tmpfs_associate($2)

	')

')

define(`devices_set_dev_entry_depend',`

	type device_t;

	class dir rw_dir_perms;

')

########################################

#

# devices_get_all_block_device_attributes(domain)

#

define(`devices_get_all_block_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:blk_file getattr;

')

define(`devices_get_all_block_device_attributes_depend',`

	attribute device_node;

	class blk_file getattr;

	class dir r_dir_perms;

')

########################################

#

# devices_ignore_get_all_block_device_attributes(domain)

#

define(`devices_ignore_get_all_block_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_node:blk_file getattr;

')

define(`devices_ignore_get_all_block_device_attributes_depend',`

	attribute device_node;

	class blk_file getattr;

')

########################################

#

# devices_get_all_character_device_attributes(domain)

#

define(`devices_get_all_character_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:chr_file getattr;

')

define(`devices_get_all_character_device_attributes_depend',`

	attribute device_node;

	class chr_file getattr;

	class dir r_dir_perms;

')

########################################

#

# devices_ignore_get_all_character_device_attributes(domain)

#

define(`devices_ignore_get_all_character_device_attributes',`

	requires_block_template(`$0'_depend)

	dontaudit $1 device_node:chr_file getattr;

')

define(`devices_ignore_get_all_character_device_attributes_depend',`

	attribute device_node;

	class chr_file getattr;

')

########################################

#

# devices_set_all_block_device_attributes(domain)

#

define(`devices_set_all_block_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:blk_file setattr;

')

define(`devices_set_all_block_device_attributes_depend',`

	attribute device_node;

	class dir r_dir_perms;

	class blk_file setattr;

')

########################################

#

# devices_set_all_character_device_attributes(domain)

#

define(`devices_set_all_character_device_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:chr_file setattr;

')

define(`devices_set_all_character_device_attributes_depend',`

	attribute device_node;

	class dir r_dir_perms;

	class chr_file setattr;

')

########################################

#

# devices_manage_all_block_devices(domain)

#

define(`devices_manage_all_block_devices',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_node:blk_file create_file_perms;

	# these next rules are to satisfy assertions broken by the above lines.

	storage_raw_read_fixed_disk($1)

	storage_raw_write_fixed_disk($1)

	storage_read_scsi_generic($1)

	storage_write_scsi_generic($1)

')

define(`devices_manage_generic_block_devices_depend',`

	attribute device_node;

	class dir rw_dir_perms;

	class blk_file create_file_perms;

')

########################################

#

# devices_manage_all_character_devices(domain)

#

define(`devices_manage_all_character_devices',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_node:chr_file create_file_perms;

	typeattribute $1 memory_raw_read, memory_raw_write;

')

define(`devices_manage_all_character_devices_depend',`

	attribute device_node, memory_raw_read, memory_raw_write;

	class dir rw_dir_perms;

	class chr_file create_file_perms;

')

########################################

#

# devices_raw_read_memory(domain)

#

define(`devices_raw_read_memory',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 memory_device_t:chr_file r_file_perms;

	allow $1 self:capability sys_rawio;

	typeattribute $1 memory_raw_read;

')

define(`devices_raw_read_memory_depend',`

type device_t, memory_device_t;

attribute memory_raw_read;

class dir r_dir_perms;

class chr_file r_file_perms;

class capability sys_rawio;

')

########################################

#

# devices_raw_write_memory(domain)

#

define(`devices_raw_write_memory',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 memory_device_t:chr_file write;

	allow $1 self:capability sys_rawio;

	typeattribute $1 memory_raw_write;

')

define(`devices_raw_write_memory_depend',`

type device_t, memory_device_t;

attribute memory_raw_write;

class dir r_dir_perms;

class chr_file write;

class capability sys_rawio;

')

########################################

#

# devices_legacy_raw_read_memory(domain)

#

define(`devices_legacy_raw_read_memory',`

	requires_block_template(`$0'_depend)

	devices_raw_read_memory($1)

	allow $1 memory_device_t:chr_file execute;

')

define(`devices_legacy_raw_read_memory_depend',`

	type device_t, memory_device_t;

	class chr_file execute;

')

########################################

#

# devices_legacy_raw_write_memory(domain)

#

define(`devices_legacy_raw_write_memory',`

	requires_block_template(`$0'_depend)

	devices_raw_write_memory($1)

	allow $1 memory_device_t:chr_file execute;

')

define(`devices_legacy_raw_write_memory_depend',`

	type device_t, memory_device_t;

	class chr_file execute;

')

########################################

#

# devices_get_random_data(domain)

#

define(`devices_get_random_data',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 random_device_t:chr_file r_file_perms;

')

define(`devices_get_random_data_depend',`

	type device_t, random_device_t;

	class dir r_dir_perms;

	class chr_file r_file_perms;

')

########################################

#

# devices_get_pseudorandom_data(domain)

#

define(`devices_get_pseudorandom_data',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 urandom_device_t:chr_file r_file_perms;

')

define(`devices_get_pseudorandom_data_depend',`

	type device_t, urandom_device_t;

	class dir r_dir_perms;

	class chr_file r_file_perms;

')

########################################

#

# devices_add_entropy(domain)

#

define(`devices_add_entropy',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 random_device_t:chr_file { getattr write ioctl };

')

define(`devices_add_entropy_depend',`

	type device_t, random_device_t;

	class dir r_dir_perms;

	class chr_file { getattr write ioctl };

')

########################################

#

# devices_set_pseudorandom_seed(domain)

#

define(`devices_set_pseudorandom_seed',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 urandom_device_t:chr_file { getattr write ioctl };

')

define(`devices_set_pseudorandom_seed_depend',`

	type device_t, urandom_device_t;

	class dir r_dir_perms;

	class chr_file { getattr write ioctl };

')

########################################

#

# devices_use_dev_null(domain)

#

define(`devices_use_dev_null',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 null_device_t:chr_file rw_file_perms;

')

define(`devices_use_dev_null_depend',`

	type device_t, null_device_t;

	class device_t:dir r_dir_perms;

	class chr_file rw_file_perms;

')

########################################

#

# devices_use_dev_zero(domain)

#

define(`devices_use_dev_zero',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 zero_device_t:chr_file rw_file_perms;

')

define(`devices_use_dev_zero_depend',`

	type device_t, zero_device_t;

	class device_t:dir r_dir_perms;

	class chr_file r_file_perms;

')

########################################

#

# devices_legacy_use_dev_zero(domain)

#

define(`devices_legacy_use_dev_zero',`

	requires_block_template(`$0'_depend)

	devices_use_dev_zero($1)

	allow $1 zero_device_t:chr_file execute;

')

define(`devices_legacy_use_dev_zero_depend',`

	type zero_device_t;

	class chr_file execute;

')

########################################

#

# devices_read_realtime_clock(domain)

#

define(`devices_read_realtime_clock',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 clock_device_t:chr_file r_file_perms;

')

define(`devices_read_realtime_clock_depend',`

type device_t, clock_device_t;

class dir r_dir_perms;

class chr_file r_file_perms;

')

########################################

#

# devices_write_realtime_clock(domain)

#

define(`devices_write_realtime_clock',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 clock_device_t:chr_file { setattr lock write append ioctl };

')

define(`devices_write_realtime_clock_depend',`

	type device_t, clock_device_t;

	class dir r_dir_perms;

	class chr_file { setattr lock write append ioctl };

')

########################################

#

# devices_modify_realtime_clock(domain)

#

define(`devices_modify_realtime_clock',`

	devices_read_realtime_clock($1)

	devices_write_realtime_clock($1)

')

########################################

#

# devices_record_sound_input(domain)

#

define(`devices_record_sound_input',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 sound_device_t:chr_file r_file_perms;

')

define(`devices_record_sound_input_depend',`

type device_t, sound_device_t;

class dir r_dir_perms;

class chr_file r_file_perms;

')

########################################

#

# devices_play_sound(domain)

#

define(`devices_play_sound',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 sound_device_t:chr_file { getattr write ioctl };

')

define(`devices_play_sound_depend',`

	type device_t, sound_device_t;

	class dir r_dir_perms;

	class chr_file { getattr write ioctl };

')

########################################

#

# devices_read_sound_mixer_levels(domain)

#

define(`devices_read_sound_mixer_levels',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 sound_device_t:chr_file { getattr read ioctl };

')

define(`devices_read_sound_mixer_levels_depend',`

	type device_t, sound_device_t;

	class dir r_dir_perms;

	class chr_file { getattr read ioctl };

')

########################################

#

# devices_write_sound_mixer_levels(domain)

#

define(`devices_write_sound_mixer_levels',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 sound_device_t:chr_file { getattr write ioctl };

')

define(`devices_write_sound_mixer_levels_depend',`

	type device_t, sound_device_t;

	class dir r_dir_perms;

	class chr_file { getattr write ioctl };

')

########################################

#

# devices_direct_agp_access(domain)

#

define(`devices_direct_agp_access',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 agp_device_t:chr_file rw_file_perms;

')

define(`devices_direct_agp_access_depend',`

	type device_t, agp_device_t;

	class dir r_dir_perms;

	class chr_file rw_file_perms;

')

########################################

#

# devices_get_direct_rendering_interface_attributes(domain)

#

define(`devices_get_direct_rendering_interface_attributes',`

	requires_block_template(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 dri_device_t:chr_file getattr;

')