Chris PeBenito e181fe
Chris PeBenito 413982
policy_module(devices,1.1.6)
Chris PeBenito 960373
Chris PeBenito fd89e1
########################################
Chris PeBenito fd89e1
#
Chris PeBenito fd89e1
# Declarations
Chris PeBenito fd89e1
#
Chris PeBenito fd89e1
Chris PeBenito b4cd15
attribute device_node;
Chris PeBenito 6b6740
attribute memory_raw_read;
Chris PeBenito 6b6740
attribute memory_raw_write;
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# device_t is the type of /dev.
Chris PeBenito b4cd15
#
Chris PeBenito ee5772
type device_t;
Chris PeBenito 2aec14
fs_associate_tmpfs(device_t)
Chris PeBenito 8fd367
files_type(device_t)
Chris PeBenito c9428d
files_mountpoint(device_t)
Chris PeBenito 2aec14
files_associate_tmp(device_t)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
# Only directories and symlinks should be labeled device_t.
Chris PeBenito b4cd15
# If there are other files with this type, it is wrong.
Chris PeBenito b4cd15
# Relabelto is allowed for setfiles to function, in case
Chris PeBenito b4cd15
# a device node has no specific type yet, but is for some
Chris PeBenito b4cd15
# reason labeled with a specific type
Chris PeBenito 07d6e3
#cjp: want this, but udev policy breaks this
Chris PeBenito fd89e1
#neverallow domain device_t:{ file fifo_file sock_file chr_file blk_file } ~{ getattr setattr relabelfrom relabelto };
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Type for /dev/agpgart
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type agp_device_t;
Chris PeBenito 2aec14
dev_node(agp_device_t)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Type for /dev/apm_bios
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type apm_bios_t;
Chris PeBenito 2aec14
dev_node(apm_bios_t)
Chris PeBenito b4cd15
Chris PeBenito 2aec14
type cardmgr_dev_t;
Chris PeBenito 2aec14
dev_node(cardmgr_dev_t)
Chris PeBenito 34e722
files_tmp_file(cardmgr_dev_t)
Chris PeBenito dec168
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# clock_device_t is the type of
Chris PeBenito b4cd15
# /dev/rtc.
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type clock_device_t;
Chris PeBenito 2aec14
dev_node(clock_device_t)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# cpu control devices /dev/cpu/0/*
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type cpu_device_t;
Chris PeBenito 2aec14
dev_node(cpu_device_t)
Chris PeBenito b4cd15
Chris PeBenito 0907bd
# for the IBM zSeries z90crypt hardware ssl accelorator
Chris PeBenito 2aec14
type crypt_device_t;
Chris PeBenito 2aec14
dev_node(crypt_device_t)
Chris PeBenito 0907bd
Chris PeBenito 2aec14
type dri_device_t;
Chris PeBenito 2aec14
dev_node(dri_device_t)
Chris PeBenito 6b6740
Chris PeBenito 2aec14
type event_device_t;
Chris PeBenito 2aec14
dev_node(event_device_t)
Chris PeBenito 6b6740
Chris PeBenito b4cd15
#
Chris PeBenito b4cd15
# Type for framebuffer /dev/fb/*
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type framebuf_device_t;
Chris PeBenito 2aec14
dev_node(framebuf_device_t)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito 700988
# Type for /dev/mapper/control
Chris PeBenito 700988
#
Chris PeBenito 2aec14
type lvm_control_t;
Chris PeBenito 2aec14
dev_node(lvm_control_t)
Chris PeBenito 700988
Chris PeBenito 700988
#
Chris PeBenito 6b6740
# memory_device_t is the type of /dev/kmem,
Chris PeBenito 6b6740
# /dev/mem and /dev/port.
Chris PeBenito 6b6740
#
Chris PeBenito 2aec14
type memory_device_t;
Chris PeBenito 2aec14
dev_node(memory_device_t)
Chris PeBenito 6b6740
Chris PeBenito 6b6740
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
Chris PeBenito 6b6740
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
Chris PeBenito 6b6740
Chris PeBenito 2aec14
type misc_device_t;
Chris PeBenito 2aec14
dev_node(misc_device_t)
Chris PeBenito b16c6b
Chris PeBenito 6b6740
#
Chris PeBenito 6b6740
# A more general type for mouse devices.
Chris PeBenito 6b6740
#
Chris PeBenito 2aec14
type mouse_device_t;
Chris PeBenito 2aec14
dev_node(mouse_device_t)
Chris PeBenito 6b6740
Chris PeBenito 6b6740
#
Chris PeBenito b4cd15
# Type for /dev/cpu/mtrr and /proc/mtrr
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type mtrr_device_t;
Chris PeBenito 2aec14
dev_node(mtrr_device_t)
Chris PeBenito e02c61
genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#
Chris PeBenito 6b6740
# null_device_t is the type of /dev/null.
Chris PeBenito 6b6740
#
Chris PeBenito 2aec14
type null_device_t;
Chris PeBenito 2aec14
dev_node(null_device_t)
Chris PeBenito f0574f
mls_trusted_object(null_device_t)
Chris PeBenito e02c61
sid devnull gen_context(system_u:object_r:null_device_t,s0)
Chris PeBenito 6b6740
Chris PeBenito 6b6740
#
Chris PeBenito b4cd15
# Type for /dev/pmu 
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type power_device_t;
Chris PeBenito 2aec14
dev_node(power_device_t)
Chris PeBenito b4cd15
Chris PeBenito 2aec14
type printer_device_t;
Chris PeBenito 2aec14
dev_node(printer_device_t)
Chris PeBenito 46be1f
Chris PeBenito b4cd15
#
Chris PeBenito 6b6740
# random_device_t is the type of /dev/random
Chris PeBenito 6b6740
#
Chris PeBenito 2aec14
type random_device_t;
Chris PeBenito 2aec14
dev_node(random_device_t)
Chris PeBenito 6b6740
Chris PeBenito 2aec14
type scanner_device_t;
Chris PeBenito 2aec14
dev_node(scanner_device_t)
Chris PeBenito 6b6740
Chris PeBenito 6b6740
#
Chris PeBenito b4cd15
# Type for sound devices and mixers
Chris PeBenito b4cd15
#
Chris PeBenito 2aec14
type sound_device_t;
Chris PeBenito 2aec14
dev_node(sound_device_t)
Chris PeBenito 700988
Chris PeBenito 6b6740
#
Chris PeBenito 8bd678
# sysfs_t is the type for the /sys pseudofs
Chris PeBenito 8bd678
#
Chris PeBenito 8bd678
type sysfs_t;
Chris PeBenito 8bd678
files_mountpoint(sysfs_t)
Chris PeBenito cbca03
fs_type(sysfs_t)
Chris PeBenito e02c61
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
Chris PeBenito 8bd678
Chris PeBenito 8bd678
#
Chris PeBenito 6b6740
# urandom_device_t is the type of /dev/urandom
Chris PeBenito 6b6740
#
Chris PeBenito 2aec14
type urandom_device_t;
Chris PeBenito 2aec14
dev_node(urandom_device_t)
Chris PeBenito 6b6740
Chris PeBenito 8bd678
#
Chris PeBenito 8bd678
# usbfs_t is the type for the /proc/bus/usb pseudofs
Chris PeBenito 8bd678
#
Chris PeBenito 8bd678
type usbfs_t alias usbdevfs_t;
Chris PeBenito 8bd678
files_mountpoint(usbfs_t)
Chris PeBenito 4d851f
fs_noxattr_type(usbfs_t)
Chris PeBenito e02c61
genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0)
Chris PeBenito e02c61
genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
Chris PeBenito 8bd678
Chris PeBenito b0d224
#
Chris PeBenito b0d224
# usb_device_t is the type for /dev/bus/usb/[0-9]+/[0-9]+
Chris PeBenito b0d224
#
Chris PeBenito b0d224
type usb_device_t;
Chris PeBenito b0d224
dev_node(usb_device_t)
Chris PeBenito b0d224
Chris PeBenito 2aec14
type v4l_device_t;
Chris PeBenito 2aec14
dev_node(v4l_device_t)
Chris PeBenito 35b2fb
Chris PeBenito a3cf80
type xen_device_t;
Chris PeBenito a3cf80
dev_node(xen_device_t)
Chris PeBenito a3cf80
Chris PeBenito 2aec14
type xserver_misc_device_t;
Chris PeBenito 2aec14
dev_node(xserver_misc_device_t)
Chris PeBenito 6b6740
Chris PeBenito 6b6740
#
Chris PeBenito 6b6740
# zero_device_t is the type of /dev/zero.
Chris PeBenito 6b6740
#
Chris PeBenito 2aec14
type zero_device_t;
Chris PeBenito 2aec14
dev_node(zero_device_t)
Chris PeBenito f0574f
mls_trusted_object(zero_device_t)
Chris PeBenito 710791
Chris PeBenito 28567a
########################################
Chris PeBenito 28567a
#
Chris PeBenito 28567a
# Rules for all device nodes
Chris PeBenito 28567a
#
Chris PeBenito 28567a
Chris PeBenito 28567a
fs_associate(device_node)
Chris PeBenito 28567a
fs_associate_tmpfs(device_node)
Chris PeBenito 28567a
Chris PeBenito 28567a
files_associate_tmp(device_node)