## <module name="filesystem" layer="kernel">

## <summary>Policy for filesystems.</summary>

########################################

## <interface name="fs_make_fs">

##	<description>

##		Transform specified type into a filesystem type.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

## </interface>

#

define(`fs_make_fs',`

	gen_require(`$0'_depend)

	typeattribute $1 fs_type;

')

define(`fs_make_fs_depend',`

	attribute fs_type;

')

########################################

## <interface name="fs_make_noxattr_fs">

##	<description>

##		Transform specified type into a filesystem

##		type which does not have extended attribute

##		support.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

## </interface>

#

define(`fs_make_noxattr_fs',`

	gen_require(`$0'_depend)

	fs_make_fs($1)

	typeattribute $1 noxattrfs;

')

define(`fs_make_noxattr_fs_depend',`

	attribute noxattrfs;

')

########################################

## <interface name="fs_associate">

##	<description>

##		Associate the specified file type to persistent

##		filesystems with extended attributes.  This

##		allows a file of this type to be created on

##		a filesystem such as ext3, JFS, and XFS.

##	</description>

##	<parameter name="file_type">

##		The type of the to be associated.

##	</parameter>

## </interface>

#

define(`fs_associate',`

	gen_require(`$0'_depend)

	allow $1 fs_t:filesystem associate;

')

define(`fs_associate_depend',`

	type fs_t;

	class filesystem associate;

')

########################################

## <interface name="fs_associate_noxattr">

##	<description>

##		Associate the specified file type to

##		filesystems which lack extended attributes

##		support.  This allows a file of this type

##		to be created on a filesystem such as

##		FAT32, and NFS.

##	</description>

##	<parameter name="file_type">

##		The type of the to be associated.

##	</parameter>

## </interface>

#

define(`fs_associate_noxattr',`

	gen_require(`$0'_depend)

	allow $1 noxattrfs:filesystem associate;

')

define(`fs_associate_noxattr_depend',`

	attribute noxattrfs;

	class filesystem associate;

')

########################################

## <interface name="fs_mount_xattr_fs">

##	<description>

##		Mount a persistent filesystem which

##		has extended attributes, such as

##		ext3, JFS, or XFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_mount_xattr_fs',`

	gen_require(`$0'_depend)

	allow $1 fs_t:filesystem mount;

')

define(`fs_mount_xattr_fs_depend',`

	type fs_t;

	class filesystem mount;

')

########################################

## <interface name="fs_remount_xattr_fs">

##	<description>

##		Remount a persistent filesystem which

##		has extended attributes, such as

##		ext3, JFS, or XFS.  This allows

##		some mount options to be changed.

##	</description>

##	<parameter name="domain">

##		The type of the domain remounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_remount_xattr_fs',`

	gen_require(`$0'_depend)

	allow $1 fs_t:filesystem remount;

')

define(`fs_remount_xattr_fs_depend',`

	type fs_t;

	class filesystem remount;

')

########################################

## <interface name="fs_unmount_xattr_fs">

##	<description>

##		Unmount a persistent filesystem which

##		has extended attributes, such as

##		ext3, JFS, or XFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain unmounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_unmount_xattr_fs',`

	gen_require(`$0'_depend)

	allow $1 fs_t:filesystem mount;

')

define(`fs_unmount_xattr_fs_depend',`

	type fs_t;

	class filesystem unmount;

')

########################################

## <interface name="fs_getattr_xattr_fs">

##	<description>

##		Get the attributes of a persistent

##		filesystem which has extended

##		attributes, such as ext3, JFS, or XFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain doing the

##		getattr on the filesystem.

##	</parameter>

## </interface>

#

define(`fs_getattr_xattr_fs',`

	gen_require(`$0'_depend)

	allow $1 fs_t:filesystem getattr;

')

define(`fs_getattr_xattr_fs_depend',`

	type fs_t;

	class filesystem getattr;

')

########################################

## <interface name="fs_dontaudit_getattr_xattr_fs">

##	<description>

##		Do not audit attempts to

##		get the attributes of a persistent

##		filesystem which has extended

##		attributes, such as ext3, JFS, or XFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain to not audit.

##	</parameter>

## </interface>

#

define(`fs_dontaudit_getattr_xattr_fs',`

	gen_require(`$0'_depend)

	dontaudit $1 fs_t:filesystem getattr;

')

define(`fs_dontaudit_getattr_xattr_fs_depend',`

	type fs_t;

	class filesystem getattr;

')

########################################

## <interface name="fs_relabelfrom_xattr_fs">

##	<description>

##		Allow changing of the label of a

##		filesystem with extended attributes

##		using the context= mount option.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_relabelfrom_xattr_fs',`

	gen_require(`$0'_depend)

	allow $1 fs_t:filesystem relabelfrom;

')

define(`fs_relabelfrom_xattr_fs_depend',`

	type fs_t;

	class filesystem relabelfrom;

')

########################################

## <interface name="fs_mount_autofs">

##	<description>

##		Mount an automount pseudo filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_mount_autofs',`

	gen_require(`$0'_depend)

	allow $1 autofs_t:filesystem mount;

')

define(`fs_mount_autofs_depend',`

	type autofs_t;

	class filesystem mount;

')

########################################

## <interface name="fs_remount_autofs">

##	<description>

##		Remount an automount pseudo filesystem

##		This allows some mount options to be changed.

##	</description>

##	<parameter name="domain">

##		The type of the domain remounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_remount_autofs',`

	gen_require(`$0'_depend)

	allow $1 autofs_t:filesystem remount;

')

define(`fs_remount_autofs_depend',`

	type autofs_t;

	class filesystem remount;

')

########################################

## <interface name="fs_unmount_autofs">

##	<description>

##		Unmount an automount pseudo filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain unmounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_unmount_autofs',`

	gen_require(`$0'_depend)

	allow $1 autofs_t:filesystem mount;

')

define(`fs_unmount_autofs_depend',`

	type autofs_t;

	class filesystem unmount;

')

########################################

## <interface name="fs_getattr_autofs">

##	<description>

##		Get the attributes of an automount

##		pseudo filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain doing the

##		getattr on the filesystem.

##	</parameter>

## </interface>

#

define(`fs_getattr_autofs',`

	gen_require(`$0'_depend)

	allow $1 autofs_t:filesystem getattr;

')

define(`fs_getattr_autofs_depend',`

	type autofs_t;

	class filesystem getattr;

')

########################################

## <interface name="fs_register_binary_executable_type">

##	<description>

##		Register an interpreter for new binary

##		file types, using the kernel binfmt_misc

##		support.  A common use for this is to

##		register a JVM as an interpreter for

##		Java byte code.  Registered binaries

##		can be directly executed on a command line

##		without specifying the interpreter.

##	</description>

##	<parameter name="domain">

##		The type of the domain registering

##		the interpreter.

##	</parameter>

## </interface>

#

define(`fs_register_binary_executable_type',`

	gen_require(`$0'_depend)

	allow $1 binfmt_misc_fs_t:dir { getattr search };

	allow $1 binfmt_misc_fs_t:file { getattr ioctl write };

')

define(`fs_register_binary_executable_type_depend',`

	type binfmt_misc_fs_t;

	class dir { getattr search };

	class file { getattr ioctl write };

')

########################################

## <interface name="fs_mount_cifs">

##	<description>

##		Mount a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_mount_cifs',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:filesystem mount;

')

define(`fs_mount_cifs_depend',`

	type cifs_t;

	class filesystem mount;

')

########################################

## <interface name="fs_remount_cifs">

##	<description>

##		Remount a CIFS or SMB network filesystem.

##		This allows some mount options to be changed.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_remount_cifs',`

	gen_require(`

		type cifs_t;

		class filesystem remount;

	')

	allow $1 cifs_t:filesystem remount;

')

########################################

## <interface name="fs_unmount_cifs">

##	<description>

##		Unmount a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_unmount_cifs',`

	gen_require(`

		type cifs_t;

		class filesystem unmount;

	')

	allow $1 cifs_t:filesystem mount;

')

########################################

## <interface name="fs_getattr_cifs">

##	<description>

##		Get the attributes of a CIFS or

##		SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain doing the

##		getattr on the filesystem.

##	</parameter>

## </interface>

#

define(`fs_getattr_cifs',`

	gen_require(`

		type cifs_t;

		class filesystem getattr;

	')

	allow $1 cifs_t:filesystem getattr;

')

########################################

## <interface name="fs_read_cifs_files">

##	<description>

##		Read files on a CIFS or SMB filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain reading the files.

##	</parameter>

## </interface>

#

define(`fs_read_cifs_files',`

	gen_require(`

		type cifs_t;

		class dir r_dir_perms;

		class file r_file_perms;

	')

	allow $1 cifs_t:dir r_dir_perms;

	allow $1 cifs_t:file r_file_perms;

')

########################################

## <interface name="fs_dontaudit_rw_cifs_files">

##	<description>

##		Do not audit attempts to read or

##		write files on a CIFS or SMB filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain to not audit.

##	</parameter>

## </interface>

#

define(`fs_dontaudit_rw_cifs_files',`

	gen_require(`

		type cifs_t;

		class file { read write };

	')

	dontaudit $1 cifs_t:file { read write };

')

########################################

## <interface name="fs_read_cifs_symlinks">

##	<description>

##		Read symbolic links on a CIFS or SMB filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain reading the symbolic links.

##	</parameter>

## </interface>

#

define(`fs_read_cifs_symlinks',`

	gen_require(`

		type cifs_t;

		class dir r_dir_perms;

		class lnk_file r_file_perms;

	')

	allow $1 cifs_t:dir r_dir_perms;

	allow $1 cifs_t:lnk_file r_file_perms;

')

########################################

## <interface name="fs_execute_cifs_files">

##	<description>

##		Execute files on a CIFS or SMB

##		network filesystem, in the caller

##		domain.

##	</description>

##	<parameter name="domain">

##		The type of the domain executing the files.

##	</parameter>

## </interface>

#

define(`fs_execute_cifs_files',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:dir r_dir_perms;

	can_exec($1, cifs_t)

')

define(`fs_execute_cifs_files_depend',`

	type cifs_t;

	class dir r_dir_perms;

	class file { getattr read execute execute_no_trans };

')

########################################

## <interface name="fs_dontaudit_rw_cifs_files">

##	<description>

##		Do not audit attempts to read or

##		write files on a CIFS or SMB filesystems.

##	</description>

##	<parameter name="domain">

##		The type of the domain to not audit.

##	</parameter>

## </interface>

#

define(`fs_read_cifs_files',`

	gen_require(`

		type cifs_t;

		class file { read write };

	')

	dontaudit $1 cifs_t:file { read write };

')

########################################

## <interface name="fs_manage_cifs_dirs">

##	<description>

##		Create, read, write, and delete directories

##		on a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain managing the directories.

##	</parameter>

## </interface>

#

define(`fs_manage_cifs_dirs',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:dir create_file_perms;

')

define(`fs_manage_cifs_dirs_depend',`

	type cifs_t;

	class dir create_file_perms;

')

########################################

## <interface name="fs_manage_cifs_files">

##	<description>

##		Create, read, write, and delete files

##		on a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain managing the files.

##	</parameter>

## </interface>

#

define(`fs_manage_cifs_files',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:dir rw_dir_perms;

	allow $1 cifs_t:file create_file_perms;

')

define(`fs_manage_cifs_files_depend',`

	type cifs_t;

	class dir rw_dir_perms;

	class file create_file_perms;

')

########################################

## <interface name="fs_manage_cifs_symlinks">

##	<description>

##		Create, read, write, and delete symbolic links

##		on a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain managing the symbolic links.

##	</parameter>

## </interface>

#

define(`fs_manage_cifs_symlinks',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:dir rw_dir_perms;

	allow $1 cifs_t:lnk_file create_lnk_perms;

')

define(`fs_manage_cifs_symlinks_depend',`

	type cifs_t;

	class dir rw_dir_perms;

	class lnk_file create_lnk_perms;

')

########################################

## <interface name="fs_manage_cifs_named_pipes">

##	<description>

##		Create, read, write, and delete named pipes

##		on a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain managing the pipes.

##	</parameter>

## </interface>

#

define(`fs_manage_cifs_named_pipes',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:dir rw_dir_perms;

	allow $1 cifs_t:fifo_file create_file_perms;

')

define(`fs_manage_cifs_named_pipes_depend',`

	type cifs_t;

	class dir rw_dir_perms;

	class fifo_file create_file_perms;

')

########################################

## <interface name="fs_manage_cifs_named_sockets">

##	<description>

##		Create, read, write, and delete named sockets

##		on a CIFS or SMB network filesystem.

##	</description>

##	<parameter name="domain">

##		The type of the domain managing the sockets.

##	</parameter>

## </interface>

#

define(`fs_manage_cifs_named_sockets',`

	gen_require(`$0'_depend)

	allow $1 cifs_t:dir rw_file_perms;

	allow $1 cifs_t:sock_file create_file_perms;

')

define(`fs_manage_cifs_named_sockets_depend',`

	type cifs_t;

	class dir rw_dir_perms;

	class sock_file create_file_perms;

')

########################################

## <interface name="fs_mount_dos_fs">

##	<description>

##		Mount a DOS filesystem, such as

##		FAT32 or NTFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_mount_dos_fs',`

	gen_require(`$0'_depend)

	allow $1 dosfs_t:filesystem mount;

')

define(`fs_mount_dos_fs_depend',`

	type dosfs_t;

	class filesystem mount;

')

########################################

## <interface name="fs_remount_dos_fs">

##	<description>

##		Remount a DOS filesystem, such as

##		FAT32 or NTFS.  This allows

##		some mount options to be changed.

##	</description>

##	<parameter name="domain">

##		The type of the domain remounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_remount_dos_fs',`

	gen_require(`$0'_depend)

	allow $1 dosfs_t:filesystem remount;

')

define(`fs_remount_dos_fs_depend',`

	type dosfs_t;

	class filesystem remount;

')

########################################

## <interface name="fs_unmount_dos_fs">

##	<description>

##		Unmount a DOS filesystem, such as

##		FAT32 or NTFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain unmounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_unmount_dos_fs',`

	gen_require(`$0'_depend)

	allow $1 dosfs_t:filesystem mount;

')

define(`fs_unmount_dos_fs_depend',`

	type dosfs_t;

	class filesystem unmount;

')

########################################

## <interface name="fs_getattr_dos_fs">

##	<description>

##		Get the attributes of a DOS

##		filesystem, such as FAT32 or NTFS.

##	</description>

##	<parameter name="domain">

##		The type of the domain doing the

##		getattr on the filesystem.

##	</parameter>

## </interface>

#

define(`fs_getattr_dos_fs',`

	gen_require(`$0'_depend)

	allow $1 dosfs_t:filesystem getattr;

')

define(`fs_getattr_dos_fs_depend',`

	type dosfs_t;

	class filesystem getattr;

')

########################################

## <interface name="fs_relabelfrom_dos_fs">

##	<description>

##		Allow changing of the label of a

##		DOS filesystem using the context= mount option.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_relabelfrom_dos_fs',`

	gen_require(`$0'_depend)

	allow $1 dosfs_t:filesystem relabelfrom;

')

define(`fs_relabelfrom_dos_fs_depend',`

	type dosfs_t;

	class filesystem relabelfrom;

')

########################################

## <interface name="fs_mount_iso9660_fs">

##	<description>

##		Mount an iso9660 filesystem, which

##		is usually used on CDs.

##	</description>

##	<parameter name="domain">

##		The type of the domain mounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_mount_iso9660_fs',`

	gen_require(`$0'_depend)

	allow $1 iso9660_t:filesystem mount;

')

define(`fs_mount_iso9660_fs_depend',`

	type iso9660_t;

	class filesystem mount;

')

########################################

## <interface name="fs_remount_iso9660_fs">

##	<description>

##		Remount an iso9660 filesystem, which

##		is usually used on CDs.  This allows

##		some mount options to be changed.

##	</description>

##	<parameter name="domain">

##		The type of the domain remounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_remount_iso9660_fs',`

	gen_require(`$0'_depend)

	allow $1 iso9660_t:filesystem remount;

')

define(`fs_remount_iso9660_fs_depend',`

	type iso9660_t;

	class filesystem remount;

')

########################################

## <interface name="fs_unmount_iso9660_fs">

##	<description>

##		Unmount an iso9660 filesystem, which

##		is usually used on CDs.

##	</description>

##	<parameter name="domain">

##		The type of the domain unmounting the filesystem.

##	</parameter>

## </interface>

#

define(`fs_unmount_iso9660_fs',`

	gen_require(`$0'_depend)

	allow $1 iso9660_t:filesystem mount;

')

define(`fs_unmount_iso9660_fs_depend',`

	type iso9660_t;

	class filesystem unmount;

')

########################################

## <interface name="fs_mount_iso9660_fs">

##	<description>

##		Get the attributes of an iso9660

##		filesystem, which is usually used on CDs.

##	</description>

##	<parameter name="domain">

##		The type of the domain doing the

##		getattr on the filesystem.

##	</parameter>