Chris PeBenito 4bf4ed
## <summary>Policy for terminals.</summary>
Chris PeBenito fb0a3a
## <required val="true">
Chris PeBenito fb0a3a
##	Depended on by other required modules.
Chris PeBenito fb0a3a
## </required>
Chris PeBenito e181fe
Chris PeBenito b4cd15
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Transform specified type into a pty type.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="pty_type">
Chris PeBenito 414e41
##	An object type that will applied to a pty.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`term_pty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ptynode;
Chris PeBenito a7c3a1
		type devpts_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 1f8a8b
	files_type($1)
Chris PeBenito 0c73cd
	allow $1 devpts_t:filesystem associate;
Chris PeBenito 0c73cd
	typeattribute $1 ptynode;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Transform specified type into an user
Chris PeBenito 414e41
##	pty type. This allows it to be relabeled via
Chris PeBenito 414e41
##	type change by login programs such as ssh.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="userdomain">
Chris PeBenito 414e41
##	The type of the user domain associated with
Chris PeBenito 414e41
##	this pty.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="object_type">
Chris PeBenito 414e41
##	An object type that will applied to a pty.
Chris PeBenito 414e41
## </param>
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`term_user_pty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute server_ptynode;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 2a3478
	term_pty($2)
Chris PeBenito 2a3478
	type_change $2 server_ptynode:chr_file $1;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Transform specified type into a pty type
Chris PeBenito 414e41
##	used by login programs, such as sshd.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="pty_type">
Chris PeBenito 414e41
##	An object type that will applied to a pty.
Chris PeBenito 414e41
## </param>
Chris PeBenito 0404a3
#
Chris PeBenito 199895
interface(`term_login_pty',`
Chris PeBenito 0404a3
	gen_require(`
Chris PeBenito 0404a3
		attribute server_ptynode;
Chris PeBenito 0404a3
	')
Chris PeBenito 0404a3
Chris PeBenito 0404a3
	term_pty($1)
Chris PeBenito 0404a3
	typeattribute $1 server_ptynode;
Chris PeBenito 0404a3
')
Chris PeBenito 0404a3
Chris PeBenito 0404a3
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Transform specified type into a tty type.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="tty_type">
Chris PeBenito 414e41
##	An object type that will applied to a tty.
Chris PeBenito 414e41
## </param>
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`term_tty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito ef5ca0
		attribute ttynode, serial_device;
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito ef5ca0
	typeattribute $2 ttynode, serial_device;
Chris PeBenito 0c73cd
	type_change $1 tty_device_t:chr_file $2;
Chris PeBenito 0c73cd
Chris PeBenito 30705b
	files_associate_tmp($1)
Chris PeBenito 30705b
Chris PeBenito 0c73cd
	# Debian login is from shadow utils and does not allow resetting the perms.
Chris PeBenito 0c73cd
	# have to fix this!
Chris PeBenito 254bbc
	ifdef(`distro_debian',`
Chris PeBenito a7c3a1
		type_change $1 ttynode:chr_file $2;
Chris PeBenito 0c73cd
	')
Chris PeBenito 0c73cd
Chris PeBenito 254bbc
	ifdef(`distro_redhat',`
Chris PeBenito eda201
		fs_associate_tmpfs($2)
Chris PeBenito 0c73cd
	')
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Create a pty in the /dev/pts directory.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process creating the pty.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="pty_type">
Chris PeBenito 414e41
##	The type of the pty.
Chris PeBenito 414e41
## </param>
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`term_create_pty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type bsdpty_device_t, devpts_t, ptmx_t;
Chris PeBenito a7c3a1
	')
Karl MacMillan f0c985
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito c2c00b
	allow $1 ptmx_t:chr_file rw_file_perms;
Karl MacMillan f0c985
Chris PeBenito 0c73cd
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 devpts_t:filesystem getattr;
Chris PeBenito 0c73cd
	dontaudit $1 bsdpty_device_t:chr_file { getattr read write };
Chris PeBenito 0c73cd
	type_transition $1 devpts_t:chr_file $2;
Chris PeBenito 8a0da1
')
Chris PeBenito 8a0da1
Chris PeBenito 8a0da1
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read and write the console, all
Chris PeBenito 414e41
##	ttys and all ptys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito de2cee
#
Chris PeBenito 199895
interface(`term_use_all_terms',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode, ptynode;
Chris PeBenito a7c3a1
		type console_device_t, devpts_t, tty_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 { console_device_t tty_device_t ttynode ptynode }:chr_file rw_file_perms;
Chris PeBenito de2cee
')
Chris PeBenito de2cee
Chris PeBenito 3b857e
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Write to the console.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3b857e
#
Chris PeBenito 199895
interface(`term_write_console',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type console_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 3b857e
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 3b857e
	allow $1 console_device_t:chr_file write;
Chris PeBenito 3b857e
')
Chris PeBenito 3b857e
Chris PeBenito 3ce6cb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read from and write to the console.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`term_use_console',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type console_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 console_device_t:chr_file rw_file_perms;
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attemtps to read from
Chris PeBenito 414e41
##	or write to the console.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`term_dontaudit_use_console',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type console_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito da4fc9
	dontaudit $1 console_device_t:chr_file rw_file_perms;
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Set the attributes of the console
Chris PeBenito 414e41
##	device node.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`term_setattr_console',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type console_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 console_device_t:chr_file setattr;
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 0f707d
##	Do not audit attempts to get the
Chris PeBenito 0f707d
##	attributes of the /dev/pts directory.
Chris PeBenito 0f707d
## </summary>
Chris PeBenito 0f707d
## <param name="domain">
Chris PeBenito 0f707d
##	The type of the process to not audit.
Chris PeBenito 0f707d
## </param>
Chris PeBenito 0f707d
#
Chris PeBenito 0f707d
interface(`term_dontaudit_getattr_pty_dir',`
Chris PeBenito 0f707d
	gen_require(`
Chris PeBenito 0f707d
		type devpts_t;
Chris PeBenito 0f707d
		class dir getattr;
Chris PeBenito 0f707d
	')
Chris PeBenito 0f707d
Chris PeBenito 0f707d
	dontaudit $1 devpts_t:dir getattr;
Chris PeBenito 0f707d
')
Chris PeBenito 0f707d
Chris PeBenito 0f707d
########################################
Chris PeBenito 0f707d
## <summary>
Chris PeBenito 842859
##	Search the contents of the /dev/pts directory.
Chris PeBenito 842859
## </summary>
Chris PeBenito 842859
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 842859
## </param>
Chris PeBenito 842859
#
Chris PeBenito 842859
interface(`term_search_ptys',`
Chris PeBenito 842859
	gen_require(`
Chris PeBenito 842859
		type devpts_t;
Chris PeBenito 842859
	')
Chris PeBenito 842859
Chris PeBenito 842859
	dev_list_all_dev_nodes($1)
Chris PeBenito 842859
	allow $1 devpts_t:dir search;
Chris PeBenito 842859
')
Chris PeBenito 842859
Chris PeBenito 842859
########################################
Chris PeBenito 842859
## <summary>
Chris PeBenito 414e41
##	Read the /dev/pts directory to
Chris PeBenito 414e41
##	list all ptys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`term_list_ptys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type devpts_t;
Chris PeBenito a7c3a1
		class dir r_dir_perms;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read the
Chris PeBenito 5f38a6
##	/dev/pts directory.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process to not audit.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`term_dontaudit_list_ptys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type devpts_t;
Chris PeBenito a7c3a1
		class dir { getattr search read };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 devpts_t:dir { getattr search read };
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 5f38a6
##	Do not audit attempts to create, read,
Chris PeBenito 5f38a6
##	write, or delete the /dev/pts directory.
Chris PeBenito 5f38a6
## </summary>
Chris PeBenito 5f38a6
## <param name="domain">
Chris PeBenito 5f38a6
##	The type of the process to not audit.
Chris PeBenito 5f38a6
## </param>
Chris PeBenito 5f38a6
#
Chris PeBenito 5f38a6
interface(`term_dontaudit_manage_pty_dir',`
Chris PeBenito 5f38a6
	gen_require(`
Chris PeBenito 5f38a6
		type devpts_t;
Chris PeBenito 5f38a6
		class dir create_dir_perms;
Chris PeBenito 5f38a6
	')
Chris PeBenito 5f38a6
Chris PeBenito 5f38a6
	dontaudit $1 devpts_t:dir create_dir_perms;
Chris PeBenito 5f38a6
')
Chris PeBenito 5f38a6
Chris PeBenito 5f38a6
########################################
Chris PeBenito 5f38a6
## <summary>
Chris PeBenito e08118
##	ioctl of generic pty types.
Chris PeBenito e08118
## </summary>
Chris PeBenito e08118
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito e08118
## </param>
Chris PeBenito e08118
#
Chris PeBenito e08118
# cjp: added for ppp
Chris PeBenito e08118
interface(`term_ioctl_generic_pty',`
Chris PeBenito e08118
	gen_require(`
Chris PeBenito e08118
		type devpts_t;
Chris PeBenito e08118
	')
Chris PeBenito e08118
Chris PeBenito e08118
	dev_list_all_dev_nodes($1)
Chris PeBenito e08118
	allow $1 devpts_t:dir search;
Chris PeBenito e08118
	allow $1 devpts_t:chr_file ioctl;
Chris PeBenito e08118
')
Chris PeBenito e08118
Chris PeBenito e08118
########################################
Chris PeBenito e08118
## <summary>
Chris PeBenito 414e41
##	Read and write the generic pty
Chris PeBenito 414e41
##	type.  This is generally only used in
Chris PeBenito 414e41
##	the targeted policy.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`term_use_generic_pty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type devpts_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 671673
	allow $1 devpts_t:dir list_dir_perms;
Chris PeBenito e6a2ea
	allow $1 devpts_t:chr_file { rw_term_perms lock append };
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito de2cee
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Dot not audit attempts to read and
Chris PeBenito 414e41
##	write the generic pty type.  This is
Chris PeBenito 414e41
##	generally only used in the targeted policy.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process to not audit.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`term_dontaudit_use_generic_pty',`
Chris PeBenito 0e7216
	gen_require(`
Chris PeBenito 0e7216
		type devpts_t;
Chris PeBenito 0e7216
		class chr_file { read write };
Chris PeBenito 0e7216
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 devpts_t:chr_file { read write };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read and write the controlling
Chris PeBenito 414e41
##	terminal (/dev/tty).
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`term_use_controlling_term',`
Chris PeBenito 0e7216
	gen_require(`
Chris PeBenito 0e7216
		type devtty_t;
Chris PeBenito 0e7216
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito da4fc9
	allow $1 devtty_t:chr_file { rw_term_perms lock append };
Chris PeBenito 811985
')
Chris PeBenito 811985
Chris PeBenito 811985
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito e08118
##	Read and write the pty multiplexor (/dev/ptmx).
Chris PeBenito e08118
## </summary>
Chris PeBenito e08118
## <param name="domain">
Chris PeBenito e08118
##	The type of the process to allow access.
Chris PeBenito e08118
## </param>
Chris PeBenito e08118
#
Chris PeBenito e08118
interface(`term_use_ptmx',`
Chris PeBenito e08118
	gen_require(`
Chris PeBenito e08118
		type ptmx_t;
Chris PeBenito e08118
	')
Chris PeBenito e08118
Chris PeBenito e08118
	allow $1 ptmx_t:chr_file rw_file_perms;
Chris PeBenito e08118
')
Chris PeBenito e08118
Chris PeBenito e08118
########################################
Chris PeBenito e08118
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read and
Chris PeBenito 414e41
##	write the pty multiplexor (/dev/ptmx).
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process to not audit.
Chris PeBenito 414e41
## </param>
Chris PeBenito 811985
#
Chris PeBenito 199895
interface(`term_dontaudit_use_ptmx',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type ptmx_t;
Chris PeBenito a7c3a1
		class chr_file { getattr read write };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 ptmx_t:chr_file { getattr read write };
Chris PeBenito 55a46d
')
Chris PeBenito 55a46d
Chris PeBenito 55a46d
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Get the attributes of all user
Chris PeBenito 414e41
##	pty device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`term_getattr_all_user_ptys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ptynode;
Chris PeBenito a7c3a1
		class dir r_dir_perms;
Chris PeBenito a7c3a1
		class chr_file getattr;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 ptynode:chr_file getattr;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito 7bba9d
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito d9fd8e
##	Do not audit attempts to get the
Chris PeBenito d9fd8e
##	attributes of any user pty
Chris PeBenito d9fd8e
##	device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito d9fd8e
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito d9fd8e
## </param>
Chris PeBenito d9fd8e
#
Chris PeBenito d9fd8e
interface(`term_dontaudit_getattr_all_user_ptys',`
Chris PeBenito d9fd8e
	gen_require(`
Chris PeBenito d9fd8e
		attribute ptynode;
Chris PeBenito d9fd8e
		class chr_file getattr;
Chris PeBenito d9fd8e
	')
Chris PeBenito d9fd8e
Chris PeBenito d9fd8e
	dev_list_all_dev_nodes($1)
Chris PeBenito d9fd8e
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito d9fd8e
	dontaudit $1 ptynode:chr_file getattr;
Chris PeBenito d9fd8e
')
Chris PeBenito d9fd8e
Chris PeBenito d9fd8e
########################################
Chris PeBenito e5590e
## <summary>
Chris PeBenito e5590e
##	Set the attributes of all user
Chris PeBenito e5590e
##	pty device nodes.
Chris PeBenito e5590e
## </summary>
Chris PeBenito e5590e
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito e5590e
## </param>
Chris PeBenito e5590e
#
Chris PeBenito e5590e
interface(`term_setattr_all_user_ptys',`
Chris PeBenito e5590e
	gen_require(`
Chris PeBenito e5590e
		attribute ptynode;
Chris PeBenito e5590e
		class dir r_dir_perms;
Chris PeBenito e5590e
		class chr_file setattr;
Chris PeBenito e5590e
	')
Chris PeBenito e5590e
Chris PeBenito e5590e
	dev_list_all_dev_nodes($1)
Chris PeBenito e5590e
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito e5590e
	allow $1 ptynode:chr_file setattr;
Chris PeBenito e5590e
')
Chris PeBenito e5590e
Chris PeBenito e5590e
########################################
Chris PeBenito e5590e
## <summary>
Chris PeBenito e5590e
##	Relabel to all user ptys.
Chris PeBenito e5590e
## </summary>
Chris PeBenito e5590e
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito e5590e
## </param>
Chris PeBenito e5590e
#
Chris PeBenito e5590e
interface(`term_relabelto_all_user_ptys',`
Chris PeBenito e5590e
	gen_require(`
Chris PeBenito e5590e
		attribute ptynode;
Chris PeBenito e5590e
		class chr_file relabelto;
Chris PeBenito e5590e
	')
Chris PeBenito e5590e
Chris PeBenito e5590e
	allow $1 ptynode:chr_file relabelto;
Chris PeBenito e5590e
')
Chris PeBenito e5590e
Chris PeBenito e5590e
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read and write all user ptys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 7bba9d
#
Chris PeBenito 199895
interface(`term_use_all_user_ptys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ptynode;
Chris PeBenito 41c480
		type devpts_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 devpts_t:dir r_dir_perms;
Chris PeBenito e6a2ea
	allow $1 ptynode:chr_file { rw_term_perms lock append };
Chris PeBenito 7bba9d
')
Chris PeBenito 7bba9d
Chris PeBenito d0eddb
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read any
Chris PeBenito 414e41
##	user ptys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process to not audit.
Chris PeBenito 414e41
## </param>
Chris PeBenito d0eddb
#
Chris PeBenito 199895
interface(`term_dontaudit_use_all_user_ptys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ptynode;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 1f8a8b
	dontaudit $1 ptynode:chr_file { rw_term_perms lock append };
Chris PeBenito d0eddb
')
Chris PeBenito d0eddb
Chris PeBenito b4cd15
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Relabel from and to all user
Chris PeBenito 414e41
##	user pty device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 21871a
#
Chris PeBenito 199895
interface(`term_relabel_all_user_ptys',`
Chris PeBenito 21871a
	gen_require(`
Chris PeBenito 21871a
		attribute ptynode;
Chris PeBenito df00b2
		type devpts_t;
Chris PeBenito 21871a
		class chr_file { relabelfrom relabelto };
Chris PeBenito 21871a
	')
Chris PeBenito 21871a
Chris PeBenito 21871a
	dev_list_all_dev_nodes($1)
Chris PeBenito df00b2
	allow $1 devpts_t:dir search;
Chris PeBenito 21871a
	allow $1 ptynode:chr_file { relabelfrom relabelto };
Chris PeBenito 21871a
')
Chris PeBenito 21871a
Chris PeBenito 21871a
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Get the attributes of all unallocated
Chris PeBenito 414e41
##	tty device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 7bba9d
#
Chris PeBenito 199895
interface(`term_getattr_unallocated_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
		class chr_file getattr;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 tty_device_t:chr_file getattr;
Chris PeBenito 7bba9d
')
Chris PeBenito 7bba9d
Chris PeBenito 7bba9d
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito a5f339
##	Do not audit attempts to get the attributes
Chris PeBenito a5f339
##	of all unallocated tty device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`term_dontaudit_getattr_unallocated_ttys',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		type tty_device_t;
Chris PeBenito a5f339
		class chr_file getattr;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	dontaudit $1 tty_device_t:chr_file getattr;
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Set the attributes of all unallocated
Chris PeBenito 414e41
##	tty device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 7bba9d
#
Chris PeBenito 199895
interface(`term_setattr_unallocated_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
		class chr_file setattr;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 tty_device_t:chr_file setattr;
Chris PeBenito 7bba9d
')
Chris PeBenito 7bba9d
Chris PeBenito 7bba9d
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Relabel from and to the unallocated
Chris PeBenito 414e41
##	tty type.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 4bf4ed
#
Chris PeBenito 199895
interface(`term_relabel_unallocated_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
		class chr_file { relabelfrom relabelto };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 tty_device_t:chr_file { relabelfrom relabelto };
Chris PeBenito 4bf4ed
')
Chris PeBenito 4bf4ed
Chris PeBenito 4bf4ed
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Relabel from all user tty types to
Chris PeBenito 414e41
##	the unallocated tty type.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`term_reset_tty_labels',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
		class chr_file { relabelfrom relabelto };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 ttynode:chr_file relabelfrom;
Chris PeBenito 0c73cd
	allow $1 tty_device_t:chr_file relabelto;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Write to unallocated ttys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`term_write_unallocated_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
		class chr_file { getattr write };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 tty_device_t:chr_file { getattr write };
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read and write unallocated ttys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito de2cee
#
Chris PeBenito 199895
interface(`term_use_unallocated_tty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito da4fc9
	allow $1 tty_device_t:chr_file { rw_term_perms lock append };
Chris PeBenito de2cee
')
Chris PeBenito de2cee
Chris PeBenito de2cee
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read or
Chris PeBenito 414e41
##	write unallocated ttys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process to not audit.
Chris PeBenito 414e41
## </param>
Chris PeBenito de2cee
#
Chris PeBenito 199895
interface(`term_dontaudit_use_unallocated_tty',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		type tty_device_t;
Chris PeBenito a7c3a1
		class chr_file { read write };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 tty_device_t:chr_file { read write };
Chris PeBenito de2cee
')
Chris PeBenito de2cee
Chris PeBenito de2cee
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Get the attributes of all user tty
Chris PeBenito 414e41
##	device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito de2cee
#
Chris PeBenito 199895
interface(`term_getattr_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		class chr_file getattr;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 ttynode:chr_file getattr;
Chris PeBenito ee5772
')
Chris PeBenito ee5772
Chris PeBenito ee5772
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to get the
Chris PeBenito 414e41
##	attributes of any user tty
Chris PeBenito 414e41
##	device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito ee5772
#
Chris PeBenito 199895
interface(`term_dontaudit_getattr_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		class chr_file getattr;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito eda201
	dontaudit $1 ttynode:chr_file getattr;
Chris PeBenito 4bf4ed
')
Chris PeBenito 4bf4ed
Chris PeBenito 4bf4ed
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Set the attributes of all user tty
Chris PeBenito 414e41
##	device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 4bf4ed
#
Chris PeBenito 199895
interface(`term_setattr_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		class chr_file setattr;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	dev_list_all_dev_nodes($1)
Chris PeBenito eda201
	allow $1 ttynode:chr_file setattr;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito a2d824
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Relabel from and to all user
Chris PeBenito 414e41
##	user tty device nodes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito 4bf4ed
#
Chris PeBenito 199895
interface(`term_relabel_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		class chr_file { relabelfrom relabelto };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 ttynode:chr_file { relabelfrom relabelto };
Chris PeBenito 4bf4ed
')
Chris PeBenito 4bf4ed
Chris PeBenito 4bf4ed
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Write to all user ttys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`term_write_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		class chr_file { getattr write };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito 0c73cd
	allow $1 ttynode:chr_file { getattr write };
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Read and write all user to all user ttys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito a2d824
#
Chris PeBenito 199895
interface(`term_use_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Karl MacMillan f0c985
	dev_list_all_dev_nodes($1)
Chris PeBenito e6a2ea
	allow $1 ttynode:chr_file { rw_term_perms lock append };
Chris PeBenito a2d824
')
Chris PeBenito a2d824
Chris PeBenito de2cee
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read or write
Chris PeBenito 414e41
##	any user ttys.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 725926
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito de2cee
#
Chris PeBenito 199895
interface(`term_dontaudit_use_all_user_ttys',`
Chris PeBenito a7c3a1
	gen_require(`
Chris PeBenito a7c3a1
		attribute ttynode;
Chris PeBenito a7c3a1
		class chr_file { read write };
Chris PeBenito a7c3a1
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 ttynode:chr_file { read write };
Chris PeBenito de2cee
')
Chris PeBenito de2cee