## <module name="devices" layer="kernel">

## <summary>

##	Device nodes and interfaces for many basic system devices.

## </summary>

## <description>

##	

##	This module creates the device node concept and provides

##	the policy for many of the device files. Notable exceptions are

##	the mass storage and terminal devices that are covered by other

##	modules.

##	

##	

##	This module creates the concept of a device node. That is a

##	char or block device file, usually in /dev. All types that

##	are used to label device nodes should use the dev_node macro.

##	

##	

##	Additionally, this module controls access to three things:

##		

##			
the device directories containing device nodes

##			
device nodes as a group

##			
individual access to specific device nodes covered by

##		  	this module.

##		

##	

## </description>

########################################

## <interface name="dev_node">

##	<summary>

##		Make the passed in type a type appropriate for

##		use on device nodes (usually files in /dev).

##	</summary>

##	<parameter name="object_type">

##		The object type that will be used on device nodes.

##	</parameter>

## </interface>

#

define(`dev_node',`

	gen_require(`$0'_depend)

	typeattribute $1 device_node;

	fs_associate($1)

	optional_policy(`distro_redhat',`

		fs_associate_tmpfs($1)

	')

')

define(`dev_node_depend',`

	attribute device_node;

')

########################################

## <interface name="dev_relabel_all_dev_nodes">

##	<summary>

##		Allow full relabeling (to and from) of all device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain allowed to relabel.

##	</parameter>

## </interface>

#

define(`dev_relabel_all_dev_nodes',`

	gen_require(`$0'_depend)

	allow $1 device_node:dir { getattr relabelfrom };

	allow $1 device_node:file { getattr relabelfrom };

	allow $1 device_node:lnk_file { getattr relabelfrom };

	allow $1 device_node:fifo_file { getattr relabelfrom };

	allow $1 device_node:sock_file { getattr relabelfrom };

	allow $1 { device_t device_node }:blk_file { getattr relabelfrom relabelto };

	allow $1 { device_t device_node }:chr_file { getattr relabelfrom relabelto };

')

define(`dev_relabel_all_dev_nodes_depend',`

	attribute device_node;

	type device_t;

	class dir { getattr relabelfrom };

	class file { getattr relabelfrom };

	class lnk_file { getattr relabelfrom };

	class fifo_file { getattr relabelfrom };

	class sock_file { getattr relabelfrom };

	class blk_file { getattr relabelfrom relabelto };

	class chr_file { getattr relabelfrom relabelto };

')

########################################

## <interface name="dev_list_all_dev_nodes">

##	<summary>

##		List all of the device nodes in a device directory.

##	</summary>

##	<parameter name="domain">

##		Domain allowed to list device nodes.

##	</parameter>

## </interface>

#

define(`dev_list_all_dev_nodes',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_t:lnk_file { getattr read };

')

define(`dev_list_all_dev_nodes_depend',`

	type device_t;

	class dir r_dir_perms;

	class lnk_file { getattr read };

')

########################################

## <interface name="dev_dontaudit_list_all_dev_nodes">

##	<summary>

##		Dontaudit attempts to list all device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit listing of device nodes.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_list_all_dev_nodes',`

	gen_require(`$0'_depend)

	dontaudit $1 device_t:dir r_dir_perms;

')

define(`dev_dontaudit_list_all_dev_nodes_depend',`

	type device_t;

	class dir r_dir_perms;

')

########################################

## <interface name="dev_create_dir">

##	<summary>

##		Create a directory in the device directory.

##	</summary>

##	<parameter name="domain">

##		Domain allowed to create the directory.

##	</parameter>

## </interface>

#

define(`dev_create_dir',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir { ra_dir_perms create };

')

define(`dev_create_dir_depend',`

	type device_t;

	class dir { ra_dir_perms create };

')

########################################

## <interface name="dev_relabel_dev_dirs">

##	<summary>

##		Allow full relabeling (to and from) of directories in /dev.

##	</summary>

##	<parameter name="domain">

##		Domain allowed to relabel.

##	</parameter>

## </interface>

#

define(`dev_relabel_dev_dirs',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir { r_dir_perms relabelfrom relabelto };

')

define(`dev_relabel_dev_dirs_depend',`

	type device_t;

	class dir { r_dir_perms relabelfrom relabelto };

')

########################################

## <interface name="dev_dontaudit_getattr_generic_pipe">

##	<summary>

##		Dontaudit getattr on generic pipes.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_getattr_generic_pipe',`

	gen_require(`$0'_depend)

	dontaudit $1 device_t:fifo_file getattr;

')

define(`dev_dontaudit_getattr_generic_pipe_depend',`

	type device_t;

	class fifo_file getattr;

')

########################################

## <interface name="dev_getattr_generic_blk_file">

##	<summary>

##		Allow getattr on generic block devices.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_getattr_generic_blk_file',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_t:blk_file getattr;

')

define(`ddev_getattr_generic_blk_file_depend',`

	type device_t;

	class dir r_dir_perms;

	class blk_file getattr;

')

########################################

## <interface name="dev_dontaudit_getattr_generic_blk_file">

##	<summary>

##		Dontaudit getattr on generic block devices.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit access.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_getattr_generic_blk_file',`

	gen_require(`$0'_depend)

	dontaudit $1 device_t:blk_file getattr;

')

define(`dev_dontaudit_getattr_generic_blk_file_depend',`

	type device_t;

	class blk_file getattr;

')

########################################

## <interface name="dev_manage_generic_blk_file">

##	<summary>

##		Allow read, write, create, and delete for generic

##		block files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_generic_blk_file',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_t:blk_file create_file_perms;

')

define(`dev_manage_generic_blk_file_depend',`

	type device_t;

	class blk_file create_file_perms;

')

########################################

## <interface name="dev_create_generic_chr_file">

##	<summary>

##		Allow read, write, and create for generic character device files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_create_generic_chr_file',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir ra_dir_perms;

	allow $1 device_t:chr_file create;

	allow $1 self:capability mknod;

')

define(`dev_create_generic_chr_file_depend',`

	type device_t;

	class dir ra_dir_perms;

	class chr_file create;

	class capability mknod;

')

########################################

## <interface name="dev_getattr_generic_chr_file">

##	<summary>

##		Allow getattr for generic character device files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_getattr_generic_chr_file',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_t:chr_file getattr;

')

define(`dev_getattr_generic_chr_file_depend',`

	type device_t;

	class dir r_dir_perms;

	class chr_file getattr;

')

########################################

## <interface name="dev_dontaudit_getattr_generic_chr_file">

##	<summary>

##		Dontaudit getattr for generic character device files.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit access.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_getattr_generic_chr_file',`

	gen_require(`$0'_depend)

	dontaudit $1 device_t:chr_file getattr;

')

define(`dev_dontaudit_getattr_generic_chr_file_depend',`

	type device_t;

	class chr_file getattr;

')

########################################

## <interface name="dev_del_generic_symlinks">

##	<summary>

##		Delete symbolic links in device directories.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_del_generic_symlinks',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir { getattr read write remove_name };

	allow $1 device_t:lnk_file unlink;

')

define(`dev_del_generic_symlinks_depend',`

	attribute device_node, memory_raw_read, memory_raw_write;

	type device_t;

	class dir { getattr read write remove_name };

	class lnk_file unlink;

')

########################################

## <interface name="dev_manage_generic_symlinks">

##	<summary>

##		Create, delete, read, and write symbolic links in device directories.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_generic_symlinks',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };

')

define(`dev_manage_generic_symlinks_depend',`

	type device_t;

	class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	class lnk_file { create read getattr setattr link unlink rename };

')

########################################

## <interface name="dev_manage_dev_nodes">

##	<summary>

##		Create, delete, read, and write device nodes in device directories.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_dev_nodes',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	allow $1 device_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };

	allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };

	allow $1 device_t:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	allow $1 device_node:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	# these next rules are to satisfy assertions broken by the above lines.

	# the permissions hopefully can be cut back a lot

	storage_raw_read_fixed_disk($1)

	storage_raw_write_fixed_disk($1)

	storage_read_scsi_generic($1)

	storage_write_scsi_generic($1)

	typeattribute $1 memory_raw_read;

	typeattribute $1 memory_raw_write;

')

define(`dev_manage_dev_nodes_depend',`

	attribute device_node, memory_raw_read, memory_raw_write;

	type device_t;

	class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };

	class sock_file { create ioctl read getattr lock write setattr append link unlink rename };

	class lnk_file { create read getattr setattr link unlink rename };

	class chr_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	class blk_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

')

########################################

## <interface name="dev_dontaudit_rw_generic_dev_nodes">

##	<summary>

##		Dontaudit getattr for generic device files.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit access.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_rw_generic_dev_nodes',`

	gen_require(`$0'_depend)

	dontaudit $1 device_t:{ chr_file blk_file } { getattr read write ioctl };

')

define(`dev_dontaudit_rw_generic_dev_nodes_depend',`

	type device_t;

	class chr_file { getattr read write ioctl };

	class blk_file { getattr read write ioctl };

')

########################################

## <interface name="dev_manage_generic_blk_file">

##	<summary>

##		Create, delete, read, and write block device files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_generic_blk_file',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_t:blk_file create_file_perms;

')

define(`dev_manage_generic_blk_file_depend',`

	type device_t;

	class dir rw_dir_perms;

	class blk_file create_file_perms;

')

########################################

## <interface name="dev_manage_generic_chr_file">

##	<summary>

##		Create, delete, read, and write character device files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_generic_chr_file',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_t:chr_file create_file_perms;

')

define(`dev_manage_generic_chr_file_depend',`

	type device_t;

	class dir rw_dir_perms;

	class chr_file create_file_perms;

')

########################################

## <interface name="dev_create_dev_node">

##	<summary>

##		Create, read, and write device nodes. The node

##		will be transitioned to the type provided.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

##	<parameter name="file">

##		Type to which the created node will be transitioned.

##	</parameter>

##	<parameter name="objectclass(es)">

##		Object class(es) (single or set including {}) for which this

##		the transition will occur.

##	</parameter>

## </interface>

#

define(`dev_create_dev_node',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	type_transition $1 device_t:$3 $2;

	optional_policy(`distro_redhat',`

		fs_associate_tmpfs($2)

	')

')

define(`dev_create_dev_node_depend',`

	type device_t;

	class dir rw_dir_perms;

')

########################################

## <interface name="dev_getattr_all_blk_files">

##	<summary>

##		Getattr on all block file device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_getattr_all_blk_files',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:blk_file getattr;

')

define(`dev_getattr_all_blk_files_depend',`

	attribute device_node;

	class blk_file getattr;

	class dir r_dir_perms;

')

########################################

## <interface name="dev_dontaudit_getattr_all_blk_files">

##	<summary>

##		Dontaudit getattr on all block file device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit access.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_getattr_all_blk_files',`

	gen_require(`$0'_depend)

	allow $1 device_node:blk_file getattr;

')

define(`dev_dontaudit_getattr_all_blk_files_depend',`

	attribute device_node;

	class blk_file getattr;

')

########################################

## <interface name="dev_getattr_all_chr_files">

##	<summary>

##		Getattr on all character file device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_getattr_all_chr_files',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:chr_file getattr;

')

define(`dev_getattr_all_chr_files_depend',`

	attribute device_node;

	class chr_file getattr;

	class dir r_dir_perms;

')

########################################

## <interface name="dev_dontaudit_getattr_all_chr_files">

##	<summary>

##		Dontaudit getattr on all character file device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain to dontaudit access.

##	</parameter>

## </interface>

#

define(`dev_dontaudit_getattr_all_chr_files',`

	gen_require(`$0'_depend)

	dontaudit $1 device_node:chr_file getattr;

')

define(`dev_dontaudit_getattr_all_chr_files_depend',`

	attribute device_node;

	class chr_file getattr;

')

########################################

## <interface name="dev_setattr_all_blk_files">

##	<summary>

##		Setattr on all block file device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_setattr_all_blk_files',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:blk_file setattr;

')

define(`dev_setattr_all_blk_files_depend',`

	attribute device_node;

	class dir r_dir_perms;

	class blk_file setattr;

')

########################################

## <interface name="dev_setattr_all_chr_files">

##	<summary>

##		Setattr on all character file device nodes.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_setattr_all_chr_files',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 device_node:chr_file setattr;

')

define(`dev_setattr_all_chr_files_depend',`

	attribute device_node;

	class dir r_dir_perms;

	class chr_file setattr;

')

########################################

## <interface name="dev_manage_all_blk_files">

##	<summary>

##		Read, write, create, and delete all block device files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_all_blk_files',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_node:blk_file create_file_perms;

	# these next rules are to satisfy assertions broken by the above lines.

	storage_raw_read_fixed_disk($1)

	storage_raw_write_fixed_disk($1)

	storage_read_scsi_generic($1)

	storage_write_scsi_generic($1)

')

define(`dev_manage_all_blk_files_depend',`

	attribute device_node;

	class dir rw_dir_perms;

	class blk_file create_file_perms;

')

########################################

## <interface name="dev_manage_all_chr_files">

##	<summary>

##		Read, write, create, and delete all character device files.

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_manage_all_chr_files',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir rw_dir_perms;

	allow $1 device_node:chr_file create_file_perms;

	typeattribute $1 memory_raw_read, memory_raw_write;

')

define(`dev_manage_all_chr_files_depend',`

	attribute device_node, memory_raw_read, memory_raw_write;

	class dir rw_dir_perms;

	class chr_file create_file_perms;

')

########################################

## <interface name="dev_read_raw_memory">

##	<summary>

##		Read raw memory devices (e.g. /dev/mem).

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_read_raw_memory',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 memory_device_t:chr_file r_file_perms;

	allow $1 self:capability sys_rawio;

	typeattribute $1 memory_raw_read;

')

define(`dev_read_raw_memory_depend',`

	type device_t, memory_device_t;

	attribute memory_raw_read;

	class dir r_dir_perms;

	class chr_file r_file_perms;

	class capability sys_rawio;

')

########################################

## <interface name="dev_write_raw_memory">

##	<summary>

##		Write raw memory devices (e.g. /dev/mem).

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_write_raw_memory',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 memory_device_t:chr_file write;

	allow $1 self:capability sys_rawio;

	typeattribute $1 memory_raw_write;

')

define(`dev_write_raw_memory_depend',`

	type device_t, memory_device_t;

	attribute memory_raw_write;

	class dir r_dir_perms;

	class chr_file write;

	class capability sys_rawio;

')

########################################

## <interface name="dev_rx_raw_memory">

##	<summary>

##		Read and execute raw memory devices (e.g. /dev/mem).

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_rx_raw_memory',`

	gen_require(`$0'_depend)

	dev_read_raw_memory($1)

	allow $1 memory_device_t:chr_file execute;

')

define(`dev_rx_raw_memory_depend',`

	type device_t, memory_device_t;

	class chr_file execute;

')

########################################

## <interface name="dev_wx_raw_memory">

##	<summary>

##		Write and execute raw memory devices (e.g. /dev/mem).

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_wx_raw_memory',`

	gen_require(`$0'_depend)

	dev_write_raw_memory($1)

	allow $1 memory_device_t:chr_file execute;

')

define(`dev_wx_raw_memory_depend',`

	type device_t, memory_device_t;

	class chr_file execute;

')

########################################

## <interface name="dev_read_rand">

##	<summary>

##		Read from random devices (e.g., /dev/random)

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_read_rand',`

	gen_require(`$0'_depend)

	allow $1 device_t:dir r_dir_perms;

	allow $1 random_device_t:chr_file r_file_perms;

')

define(`dev_read_rand_depend',`

	type device_t, random_device_t;

	class dir r_dir_perms;

	class chr_file r_file_perms;

')

########################################

## <interface name="dev_read_urand">

##	<summary>

##		Read from pseudo random devices (e.g., /dev/urandom)

##	</summary>

##	<parameter name="domain">

##		Domain allowed access.

##	</parameter>

## </interface>

#

define(`dev_read_urand',`