Chris PeBenito 1c9f9a
## <summary>Core policy for domains.</summary>
Chris PeBenito 274547
## <required val="true">
Chris PeBenito 274547
##	Contains the concept of a domain.
Chris PeBenito 274547
## </required>
Chris PeBenito e181fe
Chris PeBenito b4cd15
########################################
Chris PeBenito 2e863f
## <summary>
Chris PeBenito 2e863f
##	Make the specified type usable as a basic domain.
Chris PeBenito 2e863f
## </summary>
Chris PeBenito 2e863f
## <desc>
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	Make the specified type usable as a basic domain.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	This is primarily used for kernel threads;
Chris PeBenito 2e863f
##	generally the domain_type() interface is
Chris PeBenito 2e863f
##	more appropriate for userland processes.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
## </desc>
Chris PeBenito 2e863f
## <param name="type">
Chris PeBenito 2e863f
##	Type to be used as a basic domain type.
Chris PeBenito 2e863f
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito fb0a3a
interface(`domain_base_type',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class dir r_dir_perms;
Chris PeBenito 77c124
		class lnk_file r_file_perms;
Chris PeBenito 77c124
		class file rw_file_perms;
Chris PeBenito 77c124
		class process { fork sigchld };
Chris PeBenito 77c124
	')
Chris PeBenito b4cd15
Chris PeBenito 0c73cd
	# mark as a domain
Chris PeBenito 0c73cd
	typeattribute $1 domain;
Chris PeBenito b4cd15
Chris PeBenito 0c73cd
	# allow the domain to read its /proc/pid entries
Chris PeBenito dd8229
	allow $1 self:dir r_dir_perms;
Chris PeBenito 77c124
	allow $1 self:lnk_file r_file_perms;
Chris PeBenito 77c124
	allow $1 self:file rw_file_perms;
Chris PeBenito b4cd15
Chris PeBenito 0c73cd
	# allow $1 to create child processes in this domain
Chris PeBenito 0c73cd
	allow $1 self:process { fork sigchld };
Chris PeBenito 710791
Chris PeBenito 710791
	ifdef(`targeted_policy',`
Chris PeBenito 710791
		tunable_policy(`allow_execmem',`
Chris PeBenito 710791
			allow $1 self:process execmem;
Chris PeBenito 710791
		')
Chris PeBenito 710791
	')
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 2e863f
## <summary>
Chris PeBenito 2e863f
##	Make the specified type usable as a domain.
Chris PeBenito 2e863f
## </summary>
Chris PeBenito 2e863f
## <param name="type">
Chris PeBenito 2e863f
##	Type to be used as a domain type.
Chris PeBenito 2e863f
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`domain_type',`
Chris PeBenito 0c73cd
	# start with basic domain
Chris PeBenito fb0a3a
	domain_base_type($1)
Chris PeBenito a9a20d
Chris PeBenito 0c73cd
	# Use trusted objects in /dev
Karl MacMillan f0c985
	dev_rw_null_dev($1)
Karl MacMillan f0c985
	dev_rw_zero_dev($1)
Chris PeBenito 0fd9dc
	term_use_controlling_term($1)
Chris PeBenito a9a20d
Chris PeBenito 0c73cd
	# read the root directory
Chris PeBenito c9428d
	files_list_root($1)
Chris PeBenito a9a20d
Chris PeBenito 6e6156
	# send init a sigchld and signull
Chris PeBenito 0c73cd
	init_sigchld($1)
Chris PeBenito 6e6156
	init_signull($1)
Chris PeBenito 6b48fd
Chris PeBenito c98340
	ifdef(`targeted_policy',`
Chris PeBenito c98340
		unconfined_use_fd($1)
Chris PeBenito c98340
		unconfined_sigchld($1)
Chris PeBenito c98340
	')
Chris PeBenito c98340
Chris PeBenito 1f91e1
	tunable_policy(`allow_ptrace',`
Chris PeBenito 1f91e1
		userdom_sigchld_sysadm($1)
Chris PeBenito 1f91e1
	')
Chris PeBenito 1f91e1
Chris PeBenito 3774e4
	# allow any domain to connect to the LDAP server
Chris PeBenito 3774e4
	optional_policy(`ldap.te',`
Chris PeBenito 3774e4
		ldap_use($1)
Chris PeBenito 3774e4
	')
Chris PeBenito 3774e4
Chris PeBenito 2db2c7
	# these 3 seem highly questionable:
Chris PeBenito 0c73cd
	optional_policy(`rpm.te',`
Chris PeBenito c9428d
		rpm_use_fd($1)
Chris PeBenito 0c73cd
		rpm_read_pipe($1)
Chris PeBenito 0c73cd
	')
Chris PeBenito 2db2c7
Chris PeBenito 2db2c7
	optional_policy(`selinux.te',`
Chris PeBenito 30705b
		selinux_dontaudit_read_fs($1)
Chris PeBenito 2db2c7
	')
Chris PeBenito 2db2c7
Chris PeBenito 2db2c7
	optional_policy(`selinuxutil.te',`
Chris PeBenito 2db2c7
		seutil_dontaudit_read_config($1)
Chris PeBenito 2db2c7
	')
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 2e863f
## <summary>
Chris PeBenito 2e863f
##	Make the specified type usable as
Chris PeBenito 2e863f
##	an entry point for the domain.
Chris PeBenito 2e863f
## </summary>
Chris PeBenito 2e863f
## <param name="domain">
Chris PeBenito 2e863f
##	Domain to be entered.
Chris PeBenito 2e863f
## </param>
Chris PeBenito 2e863f
## <param name="type">
Chris PeBenito 2e863f
##	Type of program used for entering
Chris PeBenito 2e863f
##	the domain.
Chris PeBenito 2e863f
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`domain_entry_file',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute entry_type;
Chris PeBenito 77c124
		class file entrypoint;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 8fd367
	files_type($2)
Chris PeBenito 2e863f
Chris PeBenito 0c73cd
	allow $1 $2:file entrypoint;
Chris PeBenito 2e863f
	allow $1 $2:file rx_file_perms;
Chris PeBenito 2e863f
Chris PeBenito 0c73cd
	typeattribute $2 entry_type;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito b4cd15
#
Chris PeBenito c9428d
# domain_wide_inherit_fd(domain)
Chris PeBenito 8a0da1
#
Chris PeBenito 199895
interface(`domain_wide_inherit_fd',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute privfd;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	typeattribute $1 privfd;
Chris PeBenito 8a0da1
')
Chris PeBenito 8a0da1
Chris PeBenito 8a0da1
########################################
Chris PeBenito 007ca5
#
Chris PeBenito 007ca5
# domain_dyntrans_type(domain)
Chris PeBenito 007ca5
#
Chris PeBenito 007ca5
interface(`domain_dyntrans_type',`
Chris PeBenito 007ca5
	gen_require(`
Chris PeBenito 007ca5
		attribute set_curr_context;
Chris PeBenito 007ca5
	')
Chris PeBenito 007ca5
Chris PeBenito 007ca5
	typeattribute $1 set_curr_context;
Chris PeBenito 007ca5
')
Chris PeBenito 007ca5
Chris PeBenito 007ca5
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 3774e4
##	Makes caller and execption to the constraint
Chris PeBenito 3774e4
##	preventing changing to the system user
Chris PeBenito 3774e4
##	identity and system role.
Chris PeBenito 3774e4
## </summary>
Chris PeBenito 3774e4
## <param name="domain">
Chris PeBenito 3774e4
##	Domain allowed access.
Chris PeBenito 3774e4
## </param>
Chris PeBenito 3774e4
#
Chris PeBenito 3774e4
interface(`domain_system_change_exempt',`
Chris PeBenito 3774e4
	gen_require(`
Chris PeBenito 3774e4
		attribute can_system_change;
Chris PeBenito 3774e4
	')
Chris PeBenito 3774e4
Chris PeBenito 3774e4
	typeattribute $1 can_system_change;
Chris PeBenito 3774e4
')
Chris PeBenito 3774e4
Chris PeBenito 3774e4
########################################
Chris PeBenito 3774e4
## <summary>
Chris PeBenito 414e41
##	Makes caller an exception to the constraint preventing
Chris PeBenito 414e41
##	changing of user identity.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The process type to make an exception to the constraint.
Chris PeBenito 414e41
## </param>
Chris PeBenito 8bd678
#
Chris PeBenito 199895
interface(`domain_subj_id_change_exempt',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute can_change_process_identity;
Chris PeBenito 77c124
	')
Chris PeBenito 8bd678
Chris PeBenito 8bd678
	typeattribute $1 can_change_process_identity;
Chris PeBenito 8bd678
')
Chris PeBenito 8bd678
Chris PeBenito 8bd678
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Makes caller an exception to the constraint preventing
Chris PeBenito 414e41
##	changing of role.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The process type to make an exception to the constraint.
Chris PeBenito 414e41
## </param>
Chris PeBenito 8bd678
#
Chris PeBenito 199895
interface(`domain_role_change_exempt',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute can_change_process_role;
Chris PeBenito 77c124
	')
Chris PeBenito 8bd678
Chris PeBenito 8bd678
	typeattribute $1 can_change_process_role;
Chris PeBenito 8bd678
')
Chris PeBenito 8bd678
Chris PeBenito 8bd678
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Makes caller an exception to the constraint preventing
Chris PeBenito 414e41
##	changing the user identity in object contexts.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The process type to make an exception to the constraint.
Chris PeBenito 414e41
## </param>
Chris PeBenito 8bd678
#
Chris PeBenito 199895
interface(`domain_obj_id_change_exempt',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute can_change_object_identity;
Chris PeBenito 77c124
	')
Chris PeBenito 8bd678
Chris PeBenito 8bd678
	typeattribute $1 can_change_object_identity;
Chris PeBenito 8bd678
')
Chris PeBenito 8bd678
Chris PeBenito 8bd678
########################################
Chris PeBenito 2e863f
## <summary>
Chris PeBenito 2e863f
##	Make the specified domain the target of
Chris PeBenito 2e863f
##	the user domain exception of the
Chris PeBenito 2e863f
##	SELinux role and identity change
Chris PeBenito 2e863f
##	constraints.
Chris PeBenito 2e863f
## </summary>
Chris PeBenito 2e863f
## <desc>
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	Make the specified domain the target of
Chris PeBenito 2e863f
##	the user domain exception of the
Chris PeBenito 2e863f
##	SELinux role and identity change
Chris PeBenito 2e863f
##	constraints.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	This interface is needed to decouple
Chris PeBenito 2e863f
##	the user domains from the base module.
Chris PeBenito 2e863f
##	It should not be used other than on
Chris PeBenito 2e863f
##	user domains.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
## </desc>
Chris PeBenito 2e863f
## <param name="domain">
Chris PeBenito 2e863f
##	Domain target for user exemption.
Chris PeBenito 2e863f
## </param>
Chris PeBenito 2e863f
#
Chris PeBenito 2e863f
interface(`domain_user_exemption_target',`
Chris PeBenito 2e863f
	gen_require(`
Chris PeBenito 2e863f
		attribute process_user_target;
Chris PeBenito 2e863f
	')
Chris PeBenito 2e863f
Chris PeBenito 2e863f
	typeattribute $1 process_user_target;
Chris PeBenito 2e863f
')
Chris PeBenito 2e863f
Chris PeBenito 2e863f
########################################
Chris PeBenito 2e863f
## <summary>
Chris PeBenito 2e863f
##	Make the specified domain the source of
Chris PeBenito 2e863f
##	the cron domain exception of the
Chris PeBenito 2e863f
##	SELinux role and identity change
Chris PeBenito 2e863f
##	constraints.
Chris PeBenito 2e863f
## </summary>
Chris PeBenito 2e863f
## <desc>
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	Make the specified domain the source of
Chris PeBenito 2e863f
##	the cron domain exception of the
Chris PeBenito 2e863f
##	SELinux role and identity change
Chris PeBenito 2e863f
##	constraints.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	This interface is needed to decouple
Chris PeBenito 2e863f
##	the cron domains from the base module.
Chris PeBenito 2e863f
##	It should not be used other than on
Chris PeBenito 2e863f
##	cron domains.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
## </desc>
Chris PeBenito 2e863f
## <param name="domain">
Chris PeBenito 2e863f
##	Domain target for user exemption.
Chris PeBenito 2e863f
## </param>
Chris PeBenito 2e863f
#
Chris PeBenito 2e863f
interface(`domain_cron_exemption_source',`
Chris PeBenito 2e863f
	gen_require(`
Chris PeBenito 2e863f
		attribute cron_source_domain;
Chris PeBenito 2e863f
	')
Chris PeBenito 2e863f
Chris PeBenito 2e863f
	typeattribute $1 cron_source_domain;
Chris PeBenito 2e863f
')
Chris PeBenito 2e863f
Chris PeBenito 2e863f
########################################
Chris PeBenito 2e863f
## <summary>
Chris PeBenito 2e863f
##	Make the specified domain the target of
Chris PeBenito 2e863f
##	the cron domain exception of the
Chris PeBenito 2e863f
##	SELinux role and identity change
Chris PeBenito 2e863f
##	constraints.
Chris PeBenito 2e863f
## </summary>
Chris PeBenito 2e863f
## <desc>
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	Make the specified domain the target of
Chris PeBenito 2e863f
##	the cron domain exception of the
Chris PeBenito 2e863f
##	SELinux role and identity change
Chris PeBenito 2e863f
##	constraints.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
##	This interface is needed to decouple
Chris PeBenito 2e863f
##	the cron domains from the base module.
Chris PeBenito 2e863f
##	It should not be used other than on
Chris PeBenito 2e863f
##	user cron jobs.
Chris PeBenito 2e863f
##	

Chris PeBenito 2e863f
## </desc>
Chris PeBenito 2e863f
## <param name="domain">
Chris PeBenito 2e863f
##	Domain target for user exemption.
Chris PeBenito 2e863f
## </param>
Chris PeBenito 2e863f
#
Chris PeBenito 2e863f
interface(`domain_cron_exemption_target',`
Chris PeBenito 2e863f
	gen_require(`
Chris PeBenito 2e863f
		attribute cron_job_domain;
Chris PeBenito 2e863f
	')
Chris PeBenito 2e863f
Chris PeBenito 2e863f
	typeattribute $1 cron_job_domain;
Chris PeBenito 2e863f
')
Chris PeBenito 2e863f
Chris PeBenito 2e863f
########################################
Chris PeBenito 8a0da1
#
Chris PeBenito c9428d
# domain_use_wide_inherit_fd(domain)
Chris PeBenito a2d824
#
Chris PeBenito 199895
interface(`domain_use_wide_inherit_fd',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute privfd;
Chris PeBenito 77c124
		class fd use;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 privfd:fd use;
Chris PeBenito a2d824
')
Chris PeBenito a2d824
Chris PeBenito a2d824
########################################
Chris PeBenito a2d824
#
Chris PeBenito c9428d
# domain_dontaudit_use_wide_inherit_fd(domain)
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`domain_dontaudit_use_wide_inherit_fd',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute privfd;
Chris PeBenito 77c124
		class fd use;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 privfd:fd use;
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
########################################
Chris PeBenito ebdc3b
## <summary>
Chris PeBenito ebdc3b
##	Send a SIGCHLD signal to domains whose file
Chris PeBenito ebdc3b
##	discriptors are widely inheritable.
Chris PeBenito ebdc3b
## </summary>
Chris PeBenito ebdc3b
## <param name="domain">
Chris PeBenito ebdc3b
##	Domain allowed access.
Chris PeBenito ebdc3b
## </param>
Chris PeBenito ebdc3b
#
Chris PeBenito ebdc3b
# cjp: this was added because of newrole
Chris PeBenito ebdc3b
interface(`domain_sigchld_wide_inherit_fd',`
Chris PeBenito ebdc3b
	gen_require(`
Chris PeBenito ebdc3b
		attribute privfd;
Chris PeBenito ebdc3b
	')
Chris PeBenito ebdc3b
Chris PeBenito d1b9d9
	allow $1 privfd:process sigchld;
Chris PeBenito ebdc3b
')
Chris PeBenito ebdc3b
Chris PeBenito ebdc3b
########################################
Chris PeBenito 3ce6cb
#
Chris PeBenito c9428d
# domain_setpriority_all_domains(domain)
Chris PeBenito 5817e3
#
Chris PeBenito 199895
interface(`domain_setpriority_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process setsched;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process setsched;
Chris PeBenito 5817e3
')
Chris PeBenito 5817e3
Chris PeBenito 5817e3
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Send general signals to all domains.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`domain_signal_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process signal;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process signal;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Send a null signal to all domains.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 1c9f9a
#
Chris PeBenito 199895
interface(`domain_signull_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process signull;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process signull;
Chris PeBenito 1c9f9a
')
Chris PeBenito 1c9f9a
Chris PeBenito 1c9f9a
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Send a stop signal to all domains.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito c6fd1f
#
Chris PeBenito 199895
interface(`domain_sigstop_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process sigstop;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process sigstop;
Chris PeBenito c6fd1f
')
Chris PeBenito c6fd1f
Chris PeBenito c6fd1f
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Send a child terminated signal to all domains.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`domain_sigchld_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process sigchld;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process sigchld;
Chris PeBenito c6fd1f
')
Chris PeBenito c6fd1f
Chris PeBenito c6fd1f
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Send a kill signal to all domains.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`domain_kill_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process sigkill;
Chris PeBenito 77c124
		class capability kill;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process sigkill;
Chris PeBenito 0c73cd
	allow $1 self:capability kill;
Chris PeBenito b4cd15
')
Chris PeBenito 605ba2
########################################
Chris PeBenito 605ba2
## <summary>
Chris PeBenito 605ba2
##	Search the process state directory (/proc/pid) of all domains.
Chris PeBenito 605ba2
## </summary>
Chris PeBenito 605ba2
## <param name="domain">
Chris PeBenito 605ba2
##	Domain allowed access.
Chris PeBenito 605ba2
## </param>
Chris PeBenito 605ba2
#
Chris PeBenito 605ba2
interface(`domain_search_all_domains_state',`
Chris PeBenito 605ba2
	gen_require(`
Chris PeBenito 605ba2
		attribute domain;
Chris PeBenito 605ba2
		class dir search;
Chris PeBenito 605ba2
	')
Chris PeBenito 605ba2
Chris PeBenito 605ba2
	kernel_search_proc($1)
Chris PeBenito 605ba2
	allow $1 domain:dir search;
Chris PeBenito 605ba2
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
########################################
Chris PeBenito 2ec4c9
## <summary>
Chris PeBenito 414e41
##	Read the process state (/proc/pid) of all domains.
Chris PeBenito 2ec4c9
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 605ba2
##	Domain allowed access.
Chris PeBenito 414e41
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`domain_read_all_domains_state',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class dir r_dir_perms;
Chris PeBenito 77c124
		class lnk_file r_file_perms;
Chris PeBenito 77c124
		class file r_file_perms;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 605ba2
	kernel_search_proc($1)
Chris PeBenito dd8229
	allow $1 domain:dir r_dir_perms;
Chris PeBenito dd8229
	allow $1 domain:lnk_file r_file_perms;
Chris PeBenito dd8229
	allow $1 domain:file r_file_perms;
Chris PeBenito ccc597
')
Chris PeBenito 0c73cd
Chris PeBenito ccc597
########################################
Chris PeBenito ccc597
## <summary>
Chris PeBenito ccc597
##	Get the attributes of all domains of all domains.
Chris PeBenito ccc597
## </summary>
Chris PeBenito ccc597
## <param name="domain">
Chris PeBenito ccc597
##	Domain allowed access.
Chris PeBenito ccc597
## </param>
Chris PeBenito ccc597
#
Chris PeBenito ccc597
interface(`domain_getattr_all_domains',`
Chris PeBenito ccc597
	gen_require(`
Chris PeBenito ccc597
		attribute domain;
Chris PeBenito ccc597
		class process getattr;
Chris PeBenito ccc597
	')
Chris PeBenito ccc597
Chris PeBenito ccc597
	allow $1 domain:process getattr;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito d490eb
########################################
Chris PeBenito 2ec4c9
## <summary>
Chris PeBenito ccc597
##	Read the process state (/proc/pid) of all confined domains.
Chris PeBenito 605ba2
## </summary>
Chris PeBenito 605ba2
## <param name="domain">
Chris PeBenito 605ba2
##	Domain allowed access.
Chris PeBenito 605ba2
## </param>
Chris PeBenito 605ba2
#
Chris PeBenito 605ba2
interface(`domain_read_confined_domains_state',`
Chris PeBenito 605ba2
	gen_require(`
Chris PeBenito 605ba2
		attribute domain, unconfined_domain;
Chris PeBenito 605ba2
	')
Chris PeBenito 605ba2
Chris PeBenito 605ba2
	kernel_search_proc($1)
Chris PeBenito 605ba2
	allow $1 { domain -unconfined_domain }:dir r_dir_perms;
Chris PeBenito 605ba2
	allow $1 { domain -unconfined_domain }:lnk_file r_file_perms;
Chris PeBenito 605ba2
	allow $1 { domain -unconfined_domain }:file r_file_perms;
Chris PeBenito 605ba2
	allow $1 { domain -unconfined_domain }:process getattr;
Chris PeBenito 605ba2
Chris PeBenito 605ba2
	dontaudit $1 unconfined_domain:dir search;
Chris PeBenito 239db5
	dontaudit $1 unconfined_domain:file { getattr read };
Chris PeBenito ccc597
')
Chris PeBenito ccc597
Chris PeBenito ccc597
########################################
Chris PeBenito ccc597
## <summary>
Chris PeBenito ccc597
##	Get the attributes of all confined domains.
Chris PeBenito ccc597
## </summary>
Chris PeBenito ccc597
## <param name="domain">
Chris PeBenito ccc597
##	Domain allowed access.
Chris PeBenito ccc597
## </param>
Chris PeBenito ccc597
#
Chris PeBenito ccc597
interface(`domain_getattr_confined_domains',`
Chris PeBenito ccc597
	gen_require(`
Chris PeBenito ccc597
		attribute domain, unconfined_domain;
Chris PeBenito ccc597
		class process getattr;
Chris PeBenito ccc597
	')
Chris PeBenito ccc597
Chris PeBenito ccc597
	allow $1 { domain -unconfined_domain }:process getattr;
Chris PeBenito ccc597
')
Chris PeBenito ccc597
Chris PeBenito ccc597
########################################
Chris PeBenito ccc597
## <summary>
Chris PeBenito 1f91e1
##	Ptrace all domains.
Chris PeBenito 1f91e1
## </summary>
Chris PeBenito 1f91e1
## <param name="domain">
Chris PeBenito 1f91e1
##	Domain allowed access.
Chris PeBenito 1f91e1
## </param>
Chris PeBenito 1f91e1
#
Chris PeBenito 1f91e1
interface(`domain_ptrace_all_domains',`
Chris PeBenito 1f91e1
	gen_require(`
Chris PeBenito 1f91e1
		attribute domain;
Chris PeBenito 1f91e1
	')
Chris PeBenito 1f91e1
Chris PeBenito 1f91e1
	allow $1 domain:process ptrace;
Chris PeBenito 1f91e1
')
Chris PeBenito 1f91e1
Chris PeBenito 1f91e1
########################################
Chris PeBenito 1f91e1
## <summary>
Chris PeBenito ccc597
##	Do not audit attempts to ptrace all domains.
Chris PeBenito ccc597
## </summary>
Chris PeBenito ccc597
## <desc>
Chris PeBenito ccc597
##	

Chris PeBenito ccc597
##	Do not audit attempts to ptrace all domains.
Chris PeBenito ccc597
##	

Chris PeBenito ccc597
##	

Chris PeBenito ccc597
##	Generally this needs to be suppressed because procps tries to access
Chris PeBenito ccc597
##	/proc/pid/environ and this now triggers a ptrace check in recent kernels
Chris PeBenito ccc597
##	(2.4 and 2.6).
Chris PeBenito ccc597
##	

Chris PeBenito ccc597
## </desc>
Chris PeBenito ccc597
## <param name="domain">
Chris PeBenito ccc597
##	Domain allowed access.
Chris PeBenito ccc597
## </param>
Chris PeBenito ccc597
#
Chris PeBenito ccc597
interface(`domain_dontaudit_ptrace_all_domains',`
Chris PeBenito ccc597
	gen_require(`
Chris PeBenito ccc597
		attribute domain;
Chris PeBenito ccc597
	')
Chris PeBenito ccc597
Chris PeBenito ccc597
	dontaudit $1 domain:process ptrace;
Chris PeBenito ccc597
')
Chris PeBenito ccc597
Chris PeBenito ccc597
########################################
Chris PeBenito ccc597
## <summary>
Chris PeBenito ccc597
##	Do not audit attempts to ptrace confined domains.
Chris PeBenito ccc597
## </summary>
Chris PeBenito ccc597
## <desc>
Chris PeBenito ccc597
##	

Chris PeBenito ccc597
##	Do not audit attempts to ptrace confined domains.
Chris PeBenito ccc597
##	

Chris PeBenito ccc597
##	

Chris PeBenito ccc597
##	Generally this needs to be suppressed because procps tries to access
Chris PeBenito ccc597
##	/proc/pid/environ and this now triggers a ptrace check in recent kernels
Chris PeBenito ccc597
##	(2.4 and 2.6).
Chris PeBenito ccc597
##	

Chris PeBenito ccc597
## </desc>
Chris PeBenito ccc597
## <param name="domain">
Chris PeBenito ccc597
##	Domain allowed access.
Chris PeBenito ccc597
## </param>
Chris PeBenito ccc597
#
Chris PeBenito ccc597
interface(`domain_dontaudit_ptrace_confined_domains',`
Chris PeBenito ccc597
	gen_require(`
Chris PeBenito ccc597
		attribute domain, unconfined_domain;
Chris PeBenito ccc597
		class process ptrace;
Chris PeBenito ccc597
	')
Chris PeBenito 605ba2
Chris PeBenito 605ba2
	dontaudit $1 { domain -unconfined_domain }:process ptrace;
Chris PeBenito 605ba2
')
Chris PeBenito 605ba2
Chris PeBenito 605ba2
########################################
Chris PeBenito 605ba2
## <summary>
Chris PeBenito 2ec4c9
##	Do not audit attempts to read the process
Chris PeBenito 2ec4c9
##	state (/proc/pid) of all domains.
Chris PeBenito 2ec4c9
## </summary>
Chris PeBenito 2ec4c9
## <param name="domain">
Chris PeBenito 2ec4c9
##	The type of the process performing this action.
Chris PeBenito 2ec4c9
## </param>
Chris PeBenito 2ec4c9
#
Chris PeBenito 2ec4c9
interface(`domain_dontaudit_read_all_domains_state',`
Chris PeBenito 2ec4c9
	gen_require(`
Chris PeBenito 2ec4c9
		attribute domain;
Chris PeBenito 2ec4c9
		class dir r_dir_perms;
Chris PeBenito 2ec4c9
		class lnk_file r_file_perms;
Chris PeBenito 2ec4c9
		class file r_file_perms;
Chris PeBenito 2ec4c9
	')
Chris PeBenito 2ec4c9
Chris PeBenito 2ec4c9
	dontaudit $1 domain:dir r_dir_perms;
Chris PeBenito 2ec4c9
	dontaudit $1 domain:lnk_file r_file_perms;
Chris PeBenito 2ec4c9
	dontaudit $1 domain:file r_file_perms;
Chris PeBenito 2ec4c9
	dontaudit $1 domain:process getattr;
Chris PeBenito 2ec4c9
')
Chris PeBenito 2ec4c9
Chris PeBenito 2ec4c9
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to read the process state
Chris PeBenito 414e41
##	directories of all domains.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito d490eb
#
Chris PeBenito 199895
interface(`domain_dontaudit_list_all_domains_proc',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class dir r_dir_perms;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 domain:dir r_dir_perms;
Chris PeBenito d490eb
')
Chris PeBenito d490eb
Chris PeBenito d490eb
########################################
Chris PeBenito 2ec4c9
## <summary>
Chris PeBenito 414e41
##	Get the session ID of all domains.
Chris PeBenito 2ec4c9
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito d490eb
#
Chris PeBenito 199895
interface(`domain_getsession_all_domains',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class process getsession;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 domain:process getsession;
Chris PeBenito d490eb
')
Chris PeBenito d490eb
Chris PeBenito 960373
########################################
Chris PeBenito 157c69
## <summary>
Chris PeBenito 2ec4c9
##	Do not audit attempts to get the
Chris PeBenito 2ec4c9
##	session ID of all domains.
Chris PeBenito 2ec4c9
## </summary>
Chris PeBenito 2ec4c9
## <param name="domain">
Chris PeBenito 2ec4c9
##	The type of the process performing this action.
Chris PeBenito 2ec4c9
## </param>
Chris PeBenito 2ec4c9
#
Chris PeBenito 2ec4c9
interface(`domain_dontaudit_getsession_all_domains',`
Chris PeBenito 2ec4c9
	gen_require(`
Chris PeBenito 2ec4c9
		attribute domain;
Chris PeBenito 2ec4c9
		class process getsession;
Chris PeBenito 2ec4c9
	')
Chris PeBenito 2ec4c9
Chris PeBenito 9d3bdc
	dontaudit $1 domain:process getsession;
Chris PeBenito 2ec4c9
')
Chris PeBenito 2ec4c9
Chris PeBenito 2ec4c9
########################################
Chris PeBenito 2ec4c9
## <summary>
Chris PeBenito 2ec4c9
##	Get the attributes of all domains
Chris PeBenito 2ec4c9
##	sockets, for all socket types.
Chris PeBenito 2ec4c9
## </summary>
Chris PeBenito 2ec4c9
## <desc>
Chris PeBenito 2ec4c9
##	

Chris PeBenito 2ec4c9
##	Get the attributes of all domains
Chris PeBenito 2ec4c9
##	sockets, for all socket types.
Chris PeBenito 2ec4c9
##	

Chris PeBenito 2ec4c9
##	

Chris PeBenito 2ec4c9
##	This is commonly used for domains
Chris PeBenito 2ec4c9
##	that can use lsof on all domains.
Chris PeBenito 2ec4c9
##	

Chris PeBenito 2ec4c9
## </desc>
Chris PeBenito 2ec4c9
## <param name="domain">
Chris PeBenito 2ec4c9
##	Domain allowed access.
Chris PeBenito 2ec4c9
## </param>
Chris PeBenito 2ec4c9
#
Chris PeBenito 2ec4c9
interface(`domain_getattr_all_sockets',`
Chris PeBenito 2ec4c9
	gen_require(`
Chris PeBenito 2ec4c9
		gen_require_set(getattr,socket_class_set)
Chris PeBenito 2ec4c9
	')
Chris PeBenito 2ec4c9
Chris PeBenito 2ec4c9
	allow $1 domain:socket_class_set getattr;
Chris PeBenito 2ec4c9
')
Chris PeBenito 2ec4c9
Chris PeBenito 2ec4c9
########################################
Chris PeBenito 2ec4c9
## <summary>
Chris PeBenito 157c69
##	Do not audit attempts to get the attributes
Chris PeBenito 157c69
##	of all domains sockets, for all socket types.
Chris PeBenito 157c69
## </summary>
Chris PeBenito 157c69
## <desc>
Chris PeBenito 157c69
##	

Chris PeBenito 157c69
##	Do not audit attempts to get the attributes
Chris PeBenito 157c69
##	of all domains sockets, for all socket types.
Chris PeBenito 157c69
##	

Chris PeBenito 157c69
##	

Chris PeBenito 157c69
##	This interface was added for PCMCIA cardmgr
Chris PeBenito 157c69
##	and is probably excessive.
Chris PeBenito 157c69
##	

Chris PeBenito 157c69
## </desc>
Chris PeBenito 157c69
## <param name="domain">
Chris PeBenito 157c69
##	Domain to not audit.
Chris PeBenito 157c69
## </param>
Chris PeBenito 157c69
#
Chris PeBenito 157c69
interface(`domain_dontaudit_getattr_all_sockets',`
Chris PeBenito 157c69
	gen_require(`
Chris PeBenito 157c69
		gen_require_set(getattr,socket_class_set)
Chris PeBenito 157c69
	')
Chris PeBenito 157c69
Chris PeBenito 157c69
	dontaudit $1 domain:socket_class_set getattr;
Chris PeBenito 157c69
')
Chris PeBenito 157c69
Chris PeBenito 157c69
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito a5f339
##	Do not audit attempts to get the attributes
Chris PeBenito a5f339
##	of all domains TCP sockets.
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`domain_dontaudit_getattr_all_tcp_sockets',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		attribute domain;
Chris PeBenito a5f339
		class tcp_socket getattr;
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	dontaudit $1 domain:tcp_socket getattr;
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to get the attributes
Chris PeBenito 414e41
##	of all domains UDP sockets.
Chris PeBenito a5f339
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`domain_dontaudit_getattr_all_udp_sockets',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class udp_socket getattr;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 domain:udp_socket getattr;
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito a5f339
##	Do not audit attempts to read or write
Chris PeBenito a5f339
##	all domains UDP sockets.
Chris PeBenito a5f339
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito f5c42b
#
Chris PeBenito a5f339
interface(`domain_dontaudit_rw_all_udp_sockets',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito a5f339
		class udp_socket { read write };
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito a5f339
	dontaudit $1 domain:udp_socket { read write };
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito a5f339
########################################
Chris PeBenito a5f339
## <summary>
Chris PeBenito 4483ee
##	Do not audit attempts to get attribues of
Chris PeBenito 4483ee
##	all domains IPSEC key management sockets.
Chris PeBenito 4483ee
## </summary>
Chris PeBenito 4483ee
## <param name="domain">
Chris PeBenito 4483ee
##	The type of the process performing this action.
Chris PeBenito 4483ee
## </param>
Chris PeBenito 4483ee
#
Chris PeBenito 4483ee
interface(`domain_dontaudit_getattr_all_key_sockets',`
Chris PeBenito 4483ee
	gen_require(`
Chris PeBenito 4483ee
		attribute domain;
Chris PeBenito 4483ee
		class key_socket { read write };
Chris PeBenito 4483ee
	')
Chris PeBenito 4483ee
Chris PeBenito 4483ee
	dontaudit $1 domain:key_socket getattr;
Chris PeBenito 4483ee
')
Chris PeBenito 4483ee
########################################
Chris PeBenito 4483ee
## <summary>
Chris PeBenito a5f339
##	Do not audit attempts to read or write
Chris PeBenito a5f339
##	all domains key sockets.
Chris PeBenito a5f339
## </summary>
Chris PeBenito a5f339
## <param name="domain">
Chris PeBenito a5f339
##	The type of the process performing this action.
Chris PeBenito a5f339
## </param>
Chris PeBenito a5f339
#
Chris PeBenito a5f339
interface(`domain_dontaudit_rw_all_key_sockets',`
Chris PeBenito a5f339
	gen_require(`
Chris PeBenito a5f339
		attribute domain;
Chris PeBenito a5f339
		class key_socket { read write };
Chris PeBenito a5f339
	')
Chris PeBenito a5f339
Chris PeBenito a5f339
	dontaudit $1 domain:key_socket { read write };
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to get the attributes
Chris PeBenito 414e41
##	of all domains unix datagram sockets.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`domain_dontaudit_getattr_all_unix_dgram_sockets',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class unix_dgram_socket getattr;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 domain:unix_dgram_socket getattr;
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Do not audit attempts to get the attributes
Chris PeBenito 414e41
##	of all domains unnamed pipes.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito f5c42b
#
Chris PeBenito 199895
interface(`domain_dontaudit_getattr_all_unnamed_pipes',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute domain;
Chris PeBenito 77c124
		class fifo_file getattr;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 domain:fifo_file getattr;
Chris PeBenito f5c42b
')
Chris PeBenito f5c42b
Chris PeBenito f5c42b
########################################
Chris PeBenito e78430
## <summary>
Chris PeBenito e78430
##	Get the attributes of entry point
Chris PeBenito e78430
##	files for all domains.
Chris PeBenito e78430
## </summary>
Chris PeBenito e78430
## <param name="domain">
Chris PeBenito e78430
##	Domain allowed access.
Chris PeBenito e78430
## </param>
Chris PeBenito 960373
#
Chris PeBenito e78430
interface(`domain_getattr_all_entry_files',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute entry_type;
Chris PeBenito e78430
		class file getattr;
Chris PeBenito e78430
		class lnk_file r_file_perms;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito e78430
	allow $1 entry_type:lnk_file getattr;
Chris PeBenito e78430
	allow $1 entry_type:file r_file_perms;
Chris PeBenito 960373
')
Chris PeBenito f1470e
Chris PeBenito f1470e
########################################
Chris PeBenito f1470e
#
Chris PeBenito c9428d
# domain_read_all_entry_files(domain)
Chris PeBenito f1470e
#
Chris PeBenito 199895
interface(`domain_read_all_entry_files',`
Chris PeBenito 77c124
	gen_require(`
Chris PeBenito 77c124
		attribute entry_type;
Chris PeBenito 77c124
		class file r_file_perms;
Chris PeBenito 77c124
		class lnk_file r_file_perms;
Chris PeBenito 77c124
	')
Chris PeBenito 0c73cd
Chris PeBenito dd8229
	allow $1 entry_type:lnk_file r_file_perms;
Chris PeBenito 0c73cd
	allow $1 entry_type:file r_file_perms;
Chris PeBenito f1470e
')
Chris PeBenito f1470e
Chris PeBenito 9726b3
########################################
Chris PeBenito e78430
#
Chris PeBenito e78430
# domain_exec_all_entry_files(domain)
Chris PeBenito e78430
#
Chris PeBenito e78430
interface(`domain_exec_all_entry_files',`
Chris PeBenito e78430
	gen_require(`
Chris PeBenito e78430
		attribute entry_type;
Chris PeBenito e78430
	')
Chris PeBenito e78430
Chris PeBenito e78430
	can_exec($1,entry_type)
Chris PeBenito e78430
')
Chris PeBenito e78430
Chris PeBenito e78430
########################################
Chris PeBenito 9726b3
## <summary>
Chris PeBenito 9726b3
##	Unconfined access to domains.
Chris PeBenito 9726b3
## </summary>
Chris PeBenito 9726b3
## <param name="domain">
Chris PeBenito 9726b3
##	The type of the process performing this action.
Chris PeBenito 9726b3
## </param>
Chris PeBenito 9726b3
#
Chris PeBenito 9726b3
interface(`domain_unconfined',`
Chris PeBenito 9726b3
	gen_require(`
Chris PeBenito 9726b3
		attribute domain, set_curr_context;
Chris PeBenito 53857c
		attribute can_change_process_identity;
Chris PeBenito 53857c
		attribute can_change_process_role;
Chris PeBenito 53857c
		attribute can_change_object_identity;
Chris PeBenito 41c480
		attribute unconfined_domain;
Chris PeBenito 9726b3
	')
Chris PeBenito 9726b3
Chris PeBenito 605ba2
	typeattribute $1 unconfined_domain;
Chris PeBenito 605ba2
Chris PeBenito 53857c
	# pass all constraints
Chris PeBenito 53857c
	typeattribute $1 can_change_process_identity;
Chris PeBenito 53857c
	typeattribute $1 can_change_process_role;
Chris PeBenito 53857c
	typeattribute $1 can_change_object_identity;
Chris PeBenito 53857c
	typeattribute $1 set_curr_context;
Chris PeBenito 53857c
Chris PeBenito 9726b3
	# Use/sendto/connectto sockets created by any domain.
Chris PeBenito 9726b3
	allow $1 domain:{ socket_class_set socket key_socket } *;
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Use descriptors and pipes created by any domain.
Chris PeBenito 9726b3
	allow $1 domain:fd use;
Chris PeBenito 9726b3
	allow $1 domain:fifo_file rw_file_perms;
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Act upon any other process.
Chris PeBenito 9726b3
	allow $1 domain:process ~{ transition dyntransition execmem };
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# Create/access any System V IPC objects.
Chris PeBenito 9726b3
	allow $1 domain:{ sem msgq shm } *;
Chris PeBenito 9726b3
	allow $1 domain:msg { send receive };
Chris PeBenito 9726b3
Chris PeBenito 9726b3
	# For /proc/pid
Chris PeBenito 9726b3
	allow $1 domain:dir r_dir_perms;
Chris PeBenito 9726b3
	allow $1 domain:file r_file_perms;
Chris PeBenito 9726b3
	allow $1 domain:lnk_file r_file_perms;
Chris PeBenito 9726b3
')
Chris PeBenito a1d2e8
Chris PeBenito a1d2e8
#
Chris PeBenito 0efe52
# These next macros are not templates, but actually are 
Chris PeBenito 066d46
# support macros.  Due to the domain_ prefix, they 
Chris PeBenito 77c124
# are placed in this module, to try to prevent confusion.
Chris PeBenito 0efe52
# They are called templates since regular m4 defines
Chris PeBenito 0efe52
# wont work here.
Chris PeBenito a1d2e8
#
Chris PeBenito a1d2e8
Chris PeBenito a1d2e8
########################################
Chris PeBenito a1d2e8
#
Chris PeBenito a1d2e8
# domain_trans(source_domain,entrypoint_file,target_domain)
Chris PeBenito a1d2e8
#
Chris PeBenito 19ea99
template(`domain_trans',`
Chris PeBenito dd8229
	allow $1 $2:file rx_file_perms;
Chris PeBenito a1d2e8
	allow $1 $3:process transition;
Chris PeBenito a1d2e8
	dontaudit $1 $3:process { noatsecure siginh rlimitinh };
Chris PeBenito a1d2e8
')
Chris PeBenito a1d2e8
Chris PeBenito a1d2e8
########################################
Chris PeBenito a1d2e8
#
Chris PeBenito a1d2e8
# domain_auto_trans(source_domain,entrypoint_file,target_domain)
Chris PeBenito a1d2e8
#
Chris PeBenito 19ea99
template(`domain_auto_trans',`
Chris PeBenito a1d2e8
	domain_trans($1,$2,$3)
Chris PeBenito a1d2e8
	type_transition $1 $2:process $3;
Chris PeBenito a1d2e8
')