## <summary>

##	Policy for kernel security interface, in particular, selinuxfs.

## </summary>

## <required val="true">

##	Contains the policy for the kernel SELinux security interface.

## </required>

########################################

## <summary>

##	Gets the caller the mountpoint of the selinuxfs filesystem.

## </summary>

## <param name="domain">

##	The process type requesting the selinuxfs mountpoint.

## </param>

#

interface(`selinux_get_fs_mount',`

	# read /proc/filesystems to see if selinuxfs is supported

	# then read /proc/self/mount to see where selinuxfs is mounted

	kernel_read_system_state($1)

')

########################################

## <summary>

##	Do not audit attempts to search selinuxfs.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`selinux_dontaudit_search_fs',`

	gen_require(`

		type security_t;

		class dir search;

	')

	dontaudit $1 security_t:dir search;

')

########################################

## <summary>

##	Allows the caller to get the mode of policy enforcement

##	(enforcing or permissive mode).

## </summary>

## <param name="domain">

##	The process type to allow to get the enforcing mode.

## </param>

#

interface(`selinux_get_enforce_mode',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read };

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read };

')

########################################

## <summary>

##	Allow caller to set the mode of policy enforcement

##	(enforcing or permissive mode).

## </summary>

## <desc>

##	

##	Allow caller to set the mode of policy enforcement

##	(enforcing or permissive mode).

##	

##	

##	Since this is a security event, this action is

##	always audited.

##	

## </desc>

## <param name="domain">

##	The process type to allow to set the enforcement mode.

## </param>

#

interface(`selinux_set_enforce_mode',`

	gen_require(`

		type security_t;

		attribute can_setenforce;

		class dir { read search getattr };

		class file { getattr read write };

		class security setenforce;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security setenforce;

	auditallow $1 security_t:security setenforce;

	typeattribute $1 can_setenforce;

')

########################################

## <summary>

##	Allow caller to load the policy into the kernel.

## </summary>

## <param name="domain">

##	The process type that will load the policy.

## </param>

#

interface(`selinux_load_policy',`

	gen_require(`

		type security_t;

		attribute can_load_policy;

		class dir { read search getattr };

		class file { getattr read write };

		class security load_policy;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security load_policy;

	auditallow $1 security_t:security load_policy;

	typeattribute $1 can_load_policy;

')

########################################

## <summary>

##	Allow caller to set the state of Booleans to

##	enable or disable conditional portions of the policy.

## </summary>

## <desc>

##	

##	Allow caller to set the state of Booleans to

##	enable or disable conditional portions of the policy.

##	

##	

##	Since this is a security event, this action is

##	always audited.

##	

## </desc>

## <param name="domain">

##	The process type allowed to set the Boolean.

## </param>

## <param name="booltype" optional="true">

##	The type of Booleans the caller is allowed to set.

## </param>

#

interface(`selinux_set_boolean',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read write };

		class security setbool;

	')

	ifelse(`$2',`',`

		allow $1 security_t:dir { getattr search read };

		allow $1 security_t:file { getattr read write };

	',`

		allow $1 $2:dir { getattr search read };

		allow $1 $2:file { getattr read write };

	')

	allow $1 security_t:dir search;

	allow $1 security_t:security setbool;

	auditallow $1 security_t:security setbool;

')

########################################

## <summary>

##	Allow caller to set SELinux access vector cache parameters.

## </summary>

## <desc>

##	

##	Allow caller to set SELinux access vector cache parameters.

##	The allows the domain to set performance related parameters

##	of the AVC, such as cache threshold.

##	

##	

##	Since this is a security event, this action is

##	always audited.

##	

## </desc>

## <param name="domain">

##	The process type to allow to set security parameters.

## </param>

#

interface(`selinux_set_parameters',`

	gen_require(`

		type security_t;

		attribute can_setsecparam;

		class dir { read search getattr };

		class file { getattr read write };

		class security setsecparam;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security setsecparam;

	auditallow $1 security_t:security setsecparam;

	typeattribute $1 can_setsecparam;

')

########################################

## <summary>

##	Allows caller to validate security contexts.

## </summary>

## <param name="domain">

##	The process type permitted to validate contexts.

## </param>

#

interface(`selinux_validate_context',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read write };

		class security check_context;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security check_context;

')

########################################

## <summary>

##	Allows caller to compute an access vector.

## </summary>

## <param name="domain">

##	The process type allowed to compute an access vector.

## </param>

#

interface(`selinux_compute_access_vector',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read write };

		class security compute_av;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security compute_av;

')

########################################

## <summary>

##	Calculate the default type for object creation.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`selinux_compute_create_context',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read write };

		class security compute_create;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security compute_create;

')

########################################

## <summary>

##	Calculate the context for relabeling objects.

## </summary>

## <desc>

##	

##	Calculate the context for relabeling objects.

##	This is determined by using the type_change

##	rules in the policy, and is generally used

##	for determining the context for relabeling

##	a terminal when a user logs in.

##	

## </desc>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`selinux_compute_relabel_context',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read write };

		class security compute_relabel;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security compute_relabel;

')

########################################

## <summary>

##	Allows caller to compute possible contexts for a user.

## </summary>

## <param name="domain">

##	The process type allowed to compute user contexts.

## </param>

#

interface(`selinux_compute_user_contexts',`

	gen_require(`

		type security_t;

		class dir { read search getattr };

		class file { getattr read write };

		class security compute_user;

	')

	allow $1 security_t:dir { read search getattr };

	allow $1 security_t:file { getattr read write };

	allow $1 security_t:security compute_user;

')

########################################

## <summary>

##	Unconfined access to the SELinux kernel security server.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`selinux_unconfined',`

	gen_require(`

		attribute can_load_policy, can_setenforce, can_setsecparam;

		type security_t;

		class dir { getattr search read };

		class file { getattr read write };

		class security { load_policy setenforce setbool };

	')

	# Access the security API.

	allow $1 security_t:security *;

	auditallow $1 security_t:security { load_policy setenforce setbool };

	# use SELinuxfs

	allow $1 security_t:dir { getattr search read };

	allow $1 security_t:file { getattr read write };

	typeattribute $1 can_load_policy, can_setenforce, can_setsecparam;

')