## <summary>

## Basic filesystem types and interfaces.

## </summary>

## <desc>

## 

## This module contains basic filesystem types and interfaces. This

## includes:

## 

##	
The concept of different file types including basic

##	files, mount points, tmp files, etc.

##	
Access to groups of files and all files.

##	
Types and interfaces for the basic filesystem layout

##	(/, /etc, /tmp, /usr, etc.).

## 

## 

## </desc>

## <required val="true">

##	Contains the concept of a file.

##	Comains the file initial SID.

## </required>

########################################

## <summary>

##	Make the specified type usable for files

##	in a filesystem.

## </summary>

## <param name="type">

##	<summary>

##	Type to be used for files.

##	</summary>

## </param>

#

interface(`files_type',`

	gen_require(`

		attribute file_type;

	')

	typeattribute $1 file_type;

')

########################################

#

# files_lock_file(type)

#

interface(`files_lock_file',`

	gen_require(`

		attribute lockfile;

	')

	files_type($1)

	typeattribute $1 lockfile;

')

########################################

#

# files_mountpoint(type)

#

interface(`files_mountpoint',`

	gen_require(`

		attribute mountpoint;

	')

	files_type($1)

	typeattribute $1 mountpoint;

')

########################################

#

# files_pid_file(type)

#

interface(`files_pid_file',`

	gen_require(`

		attribute pidfile;

	')

	files_type($1)

	typeattribute $1 pidfile;

')

########################################

## <summary>

##	Make the specified type a 

##	configuration file.

## </summary>

## <param name="file_type">

##	<summary>

##	Type to be used as a configuration file.

##	</summary>

## </param>

#

interface(`files_config_file',`

	gen_require(`

		attribute usercanread;

	')

	files_type($1)

	# this is a hack and should be removed.

	typeattribute $1 usercanread;

')

########################################

## <summary>

##	Make the specified type a 

##	polyinstantiated directory.

## </summary>

## <param name="file_type">

##	<summary>

##	Type of the file to be used as a

##	polyinstantiated directory.

##	</summary>

## </param>

#

interface(`files_poly',`

	gen_require(`

		attribute polydir;

	')

	files_type($1)

	typeattribute $1 polydir;

')

########################################

## <summary>

##	Make the specified type a parent

##	of a polyinstantiated directory.

## </summary>

## <param name="file_type">

##	<summary>

##	Type of the file to be used as a

##	parent directory.

##	</summary>

## </param>

#

interface(`files_poly_parent',`

	gen_require(`

		attribute polyparent;

	')

	files_type($1)

	typeattribute $1 polyparent;

')

########################################

## <summary>

##	Make the specified type a

##	polyinstantiation member directory.

## </summary>

## <param name="file_type">

##	<summary>

##	Type of the file to be used as a

##	member directory.

##	</summary>

## </param>

#

interface(`files_poly_member',`

	gen_require(`

		attribute polymember;

	')

	files_type($1)

	typeattribute $1 polymember;

')

########################################

## <summary>

##	Make the domain use the specified

##	type of polyinstantiated directory.

## </summary>

## <param name="domain">

##	<summary>

##	Domain using the polyinstantiated

##	directory.

##	</summary>

## </param>

## <param name="file_type">

##	<summary>

##	Type of the file to be used as a

##	member directory.

##	</summary>

## </param>

#

interface(`files_poly_member_tmp',`

	gen_require(`

		type tmp_t;

	')

	type_member $1 tmp_t:dir $2;

')

########################################

## <summary>

##	Make the specified type a file that

##	should not be dontaudited from

##	browsing from user domains.

## </summary>

## <param name="file_type">

##	<summary>

##	Type of the file to be used as a

##	member directory.

##	</summary>

## </param>

#

interface(`files_security_file',`

	gen_require(`

		attribute security_file_type;

	')

	files_type($1)

	typeattribute $1 security_file_type;

')

########################################

## <summary>

##	Make the specified type a file

##	used for temporary files.

## </summary>

## <param name="file_type">

##	<summary>

##	Type of the file to be used as a

##	temporary file.

##	</summary>

## </param>

#

interface(`files_tmp_file',`

	gen_require(`

		attribute tmpfile;

		type tmp_t;

	')

	files_type($1)

	files_poly_member($1)

	typeattribute $1 tmpfile;

')

########################################

## <summary>

##	Transform the type into a file, for use on a

##	virtual memory filesystem (tmpfs).

## </summary>

## <param name="type">

##	<summary>

##	The type to be transformed.

##	</summary>

## </param>

#

interface(`files_tmpfs_file',`

	gen_require(`

		attribute tmpfsfile;

	')

	files_type($1)

	typeattribute $1 tmpfsfile;

')

########################################

## <summary>

##	Get the attributes of all directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

# cjp: this is an odd interface, because to getattr

# all dirs, you need to search all the parent directories

#

interface(`files_getattr_all_dirs',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir { getattr search };

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_all_dirs',`

	gen_require(`

		attribute file_type;

	')

	dontaudit $1 file_type:dir getattr;

')

########################################

## <summary>

##	List all non-security directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_list_non_security',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	allow $1 { file_type -security_file_type }:dir r_dir_perms;

')

########################################

## <summary>

##	Do not audit attempts to list all

##	non-security directories.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_list_non_security',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:dir r_dir_perms;

')

########################################

## <summary>

##	Get the attributes of all files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_getattr_all_files',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:file getattr;

	allow $1 file_type:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_all_files',`

	gen_require(`

		attribute file_type;

	')

	dontaudit $1 file_type:file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_non_security_files',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:file getattr;

')

########################################

## <summary>

##	Read all files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_read_all_files',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:file r_file_perms;

	optional_policy(`

		auth_read_shadow($1)

	')

')

########################################

## <summary>

##	Read all non-security files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_read_non_security_files',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	allow $1 { file_type -security_file_type }:dir search_dir_perms;

	allow $1 { file_type -security_file_type }:file r_file_perms;

	allow $1 { file_type -security_file_type }:lnk_file { getattr read };

')

########################################

## <summary>

##	Read all directories on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the domain perfoming this action.

##	</summary>

## </param>

## <param name="exception_types" optional="true">

##	<summary>

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

##	</summary>

## </param>

#

interface(`files_read_all_dirs_except',`

	gen_require(`

		attribute file_type;

	')

	allow $1 { file_type $2 }:dir r_dir_perms;

')

########################################

## <summary>

##	Read all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the domain perfoming this action.

##	</summary>

## </param>

## <param name="exception_types" optional="true">

##	<summary>

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

##	</summary>

## </param>

#

interface(`files_read_all_files_except',`

	gen_require(`

		attribute file_type;

	')

	allow $1 { file_type $2 }:dir search;

	allow $1 { file_type $2 }:file r_file_perms;

')

########################################

## <summary>

##	Read all symbolic links on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the domain perfoming this action.

##	</summary>

## </param>

## <param name="exception_types" optional="true">

##	<summary>

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

##	</summary>

## </param>

#

interface(`files_read_all_symlinks_except',`

	gen_require(`

		attribute file_type;

	')

	allow $1 { file_type $2 }:dir search;

	allow $1 { file_type $2 }:lnk_file r_file_perms;

')

########################################

## <summary>

##	Get the attributes of all symbolic links.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_getattr_all_symlinks',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all symbolic links.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_all_symlinks',`

	gen_require(`

		attribute file_type;

	')

	dontaudit $1 file_type:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security symbolic links.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_non_security_symlinks',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security block devices.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_non_security_blk_files',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:blk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security character devices.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_non_security_chr_files',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:chr_file getattr;

')

########################################

## <summary>

##	Read all symbolic links.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_read_all_symlinks',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:lnk_file { getattr read };

')

########################################

## <summary>

##	Get the attributes of all named pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_getattr_all_pipes',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:fifo_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all named pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_all_pipes',`

	gen_require(`

		attribute file_type;

	')

	dontaudit $1 file_type:fifo_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security named pipes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_non_security_pipes',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:fifo_file getattr;

')

########################################

## <summary>

##	Get the attributes of all named sockets.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_getattr_all_sockets',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:sock_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all named sockets.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_all_sockets',`

	gen_require(`

		attribute file_type;

	')

	dontaudit $1 file_type:sock_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security named sockets.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to not audit.

##	</summary>

## </param>

#

interface(`files_dontaudit_getattr_non_security_sockets',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:sock_file getattr;

')

########################################

## <summary>

##	Read all block nodes with file types.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_read_all_blk_files',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:blk_file { getattr read };

')

########################################

## <summary>

##	Read all character nodes with file types.

## </summary>

## <param name="domain">

##	<summary>

##	Domain allowed access.

##	</summary>

## </param>

#

interface(`files_read_all_chr_files',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:chr_file { getattr read };

')

########################################

## <summary>

##	Relabel all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the domain perfoming this action.

##	</summary>

## </param>

## <param name="exception_types" optional="true">

##	<summary>

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

##	</summary>

## </param>

#

interface(`files_relabel_all_files',`

	gen_require(`

		attribute file_type;

	')

	allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };

	allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:blk_file { getattr relabelfrom };

	allow $1 { file_type $2 }:chr_file { getattr relabelfrom };

	# satisfy the assertions:

	seutil_relabelto_bin_policy($1)

')

########################################

## <summary>

##	Manage all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	<summary>

##	The type of the domain perfoming this action.

##	</summary>

## </param>

## <param name="exception_types" optional="true">

##	<summary>

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

##	</summary>

## </param>

#

interface(`files_manage_all_files',`

	gen_require(`

		attribute file_type;

	')

	allow $1 { file_type $2 }:dir create_dir_perms;

	allow $1 { file_type $2 }:file create_file_perms;

	allow $1 { file_type $2 }:lnk_file create_lnk_perms;

	allow $1 { file_type $2 }:fifo_file create_file_perms;

	allow $1 { file_type $2 }:sock_file create_file_perms;

	# satisfy the assertions:

	seutil_create_bin_policy($1)

	files_manage_kernel_modules($1)

')

########################################

#

# files_search_all(domain)

#

interface(`files_search_all',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir search;

')

########################################

#

# files_list_all(domain)

#

interface(`files_list_all',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir r_dir_perms;

')

########################################

#

# files_dontaudit_search_all_dirs(domain)

#

interface(`files_dontaudit_search_all_dirs',`

	gen_require(`

		attribute file_type;

	')