## <summary>

## Basic filesystem types and interfaces.

## </summary>

## <desc>

## 

## This module contains basic filesystem types and interfaces. This

## includes:

## 

##	
The concept of different file types including basic

##	files, mount points, tmp files, etc.

##	
Access to groups of files and all files.

##	
Types and interfaces for the basic filesystem layout

##	(/, /etc, /tmp, /usr, etc.).

## 

## 

## </desc>

## <required val="true">

##	Contains the concept of a file.

##	Comains the file initial SID.

## </required>

########################################

## <summary>

##	Make the specified type usable for files

##	in a filesystem.

## </summary>

## <param name="type">

##	Type to be used for files.

## </param>

#

interface(`files_type',`

	gen_require(`

		attribute file_type;

	')

	fs_associate($1)

	fs_associate_noxattr($1)

	typeattribute $1 file_type;

')

########################################

#

# files_lock_file(type)

#

interface(`files_lock_file',`

	gen_require(`

		attribute lockfile;

	')

	files_type($1)

	typeattribute $1 lockfile;

')

########################################

#

# files_mountpoint(type)

#

interface(`files_mountpoint',`

	gen_require(`

		attribute mountpoint;

	')

	files_type($1)

	typeattribute $1 mountpoint;

')

########################################

#

# files_pid_file(type)

#

interface(`files_pid_file',`

	gen_require(`

		attribute pidfile;

	')

	files_type($1)

	typeattribute $1 pidfile;

')

########################################

## <summary>

##	Make the specified type a 

##	polyinstantiated directory.

## </summary>

## <param name="file_type">

##	Type of the file to be used as a

##	polyinstantiated directory.

## </param>

#

interface(`files_poly',`

	gen_require(`

		attribute polydir;

	')

	files_type($1)

	typeattribute $1 polydir;

')

########################################

## <summary>

##	Make the specified type a parent

##	of a polyinstantiated directory.

## </summary>

## <param name="file_type">

##	Type of the file to be used as a

##	parent directory.

## </param>

#

interface(`files_poly_parent',`

	gen_require(`

		attribute polyparent;

	')

	files_type($1)

	typeattribute $1 polyparent;

')

########################################

## <summary>

##	Make the specified type a

##	polyinstantiation member directory.

## </summary>

## <param name="file_type">

##	Type of the file to be used as a

##	member directory.

## </param>

#

interface(`files_poly_member',`

	gen_require(`

		attribute polymember;

	')

	files_type($1)

	typeattribute $1 polymember;

')

########################################

## <summary>

##	Make the domain use the specified

##	type of polyinstantiated directory.

## </summary>

## <param name="domain">

##	Domain using the polyinstantiated

##	directory.

## </param>

## <param name="file_type">

##	Type of the file to be used as a

##	member directory.

## </param>

#

interface(`files_poly_member_tmp',`

	gen_require(`

		type tmp_t;

	')

	type_member $1 tmp_t:dir $2;

')

########################################

## <summary>

##	Make the specified type a file that

##	should not be dontaudited from

##	browsing from user domains.

## </summary>

## <param name="file_type">

##	Type of the file to be used as a

##	member directory.

## </param>

#

interface(`files_security_file',`

	gen_require(`

		attribute security_file_type;

	')

	files_type($1)

	typeattribute $1 security_file_type;

')

########################################

## <summary>

##	Make the specified type a file

##	used for temporary files.

## </summary>

## <param name="file_type">

##	Type of the file to be used as a

##	temporary file.

## </param>

#

interface(`files_tmp_file',`

	gen_require(`

		attribute tmpfile;

		type tmp_t;

	')

	files_type($1)

	files_poly_member($1)

	fs_associate_tmpfs($1)

	typeattribute $1 tmpfile;

	allow $1 tmp_t:filesystem associate;

')

########################################

## <summary>

##	Transform the type into a file, for use on a

##	virtual memory filesystem (tmpfs).

## </summary>

## <param name="type">

##	The type to be transformed.

## </param>

#

interface(`files_tmpfs_file',`

	gen_require(`

		attribute tmpfsfile;

	')

	files_type($1)

	fs_associate_tmpfs($1)

	typeattribute $1 tmpfsfile;

')

########################################

## <summary>

##	Get the attributes of all directories.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

# cjp: this is an odd interface, because to getattr

# all dirs, you need to search all the parent directories

#

interface(`files_getattr_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir { getattr search };

	')

	allow $1 file_type:dir { getattr search };

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all directories.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir getattr;

	')

	dontaudit $1 file_type:dir getattr;

')

########################################

## <summary>

##	Search all directories.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_search_all',`

	gen_require(`

		attribute file_type;

	')

	allow $1 file_type:dir { getattr search };

')

########################################

## <summary>

##	List the contents of all directories.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_list_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir r_dir_perms;

	')

	allow $1 file_type:dir r_dir_perms;

')

########################################

## <summary>

##	Do not audit attempts to list all

##	non security directories.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_list_non_security',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:dir r_dir_perms;

')

########################################

## <summary>

##	Get the attributes of all files.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_getattr_all_files',`

	gen_require(`

		attribute file_type;

		class dir search;

		class file getattr;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all files.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_all_files',`

	gen_require(`

		attribute file_type;

	')

	dontaudit $1 file_type:file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security files.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_non_security_files',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:file getattr;

')

########################################

## <summary>

##	Read all files.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_read_all_files',`

	gen_require(`

		attribute file_type;

		class dir search;

		class file r_file_perms;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:file r_file_perms;

	optional_policy(`authlogin.te',`

		auth_read_shadow($1)

	')

')

########################################

## <summary>

##	Get the attributes of all symbolic links.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_getattr_all_symlinks',`

	gen_require(`

		attribute file_type;

		class dir search;

		class lnk_file getattr;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all symbolic links.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_all_symlinks',`

	gen_require(`

		attribute file_type;

		class lnk_file getattr;

	')

	dontaudit $1 file_type:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security symbolic links.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_non_security_symlinks',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:lnk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security block devices.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_non_security_blk_dev',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:blk_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security character devices.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_non_security_chr_dev',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:chr_file getattr;

')

########################################

## <summary>

##	Read all symbolic links.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_read_all_symlinks',`

	gen_require(`

		attribute file_type;

		class dir search;

		class lnk_file { getattr read };

	')

	allow $1 file_type:dir search;

	allow $1 file_type:lnk_file { getattr read };

')

########################################

## <summary>

##	Get the attributes of all named pipes.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_getattr_all_pipes',`

	gen_require(`

		attribute file_type;

		class dir search;

		class fifo_file getattr;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:fifo_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all named pipes.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_all_pipes',`

	gen_require(`

		attribute file_type;

		class fifo_file getattr;

	')

	dontaudit $1 file_type:fifo_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security named pipes.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_non_security_pipes',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:fifo_file getattr;

')

########################################

## <summary>

##	Get the attributes of all named sockets.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_getattr_all_sockets',`

	gen_require(`

		attribute file_type;

		class dir search;

		class sock_file getattr;

	')

	allow $1 file_type:dir search;

	allow $1 file_type:sock_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of all named sockets.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_all_sockets',`

	gen_require(`

		attribute file_type;

		class sock_file getattr;

	')

	dontaudit $1 file_type:sock_file getattr;

')

########################################

## <summary>

##	Do not audit attempts to get the attributes

##	of non security named sockets.

## </summary>

## <param name="domain">

##	Domain to not audit.

## </param>

#

interface(`files_dontaudit_getattr_non_security_sockets',`

	gen_require(`

		attribute file_type, security_file_type;

	')

	dontaudit $1 { file_type -security_file_type }:sock_file getattr;

')

########################################

## <summary>

##	Relabel all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	The type of the domain perfoming this action.

## </param>

## <param name="exception_types" optional="true">

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

## </param>

#

interface(`files_relabel_all_files',`

	gen_require(`

		attribute file_type;

		class dir { r_dir_perms relabelfrom relabelto };

		class file { relabelfrom relabelto };

		class lnk_file { relabelfrom relabelto };

		class fifo_file { relabelfrom relabelto };

		class sock_file { relabelfrom relabelto };

		class blk_file relabelfrom;

		class chr_file relabelfrom;

	')

	allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };

	allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:blk_file { getattr relabelfrom };

	allow $1 { file_type $2 }:chr_file { getattr relabelfrom };

	# satisfy the assertions:

	seutil_relabelto_binary_pol($1)

')

########################################

## <summary>

##	Manage all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	The type of the domain perfoming this action.

## </param>

## <param name="exception_types" optional="true">

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

## </param>

#

interface(`files_manage_all_files',`

	gen_require(`

		attribute file_type;

		class dir create_dir_perms;

		class file create_file_perms;

		class lnk_file create_lnk_perms;

		class fifo_file create_file_perms;

		class sock_file create_file_perms;

	')

	allow $1 { file_type $2 }:dir create_dir_perms;

	allow $1 { file_type $2 }:file create_file_perms;

	allow $1 { file_type $2 }:lnk_file create_lnk_perms;

	allow $1 { file_type $2 }:fifo_file create_file_perms;

	allow $1 { file_type $2 }:sock_file create_file_perms;

	# satisfy the assertions:

	seutil_create_binary_pol($1)

	bootloader_manage_kernel_modules($1)

')

########################################

#

# files_search_all_dirs(domain)

#

interface(`files_search_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir search;

	')

	allow $1 file_type:dir search;

')

########################################

#

# files_list_all_dirs(domain)

#

interface(`files_list_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir r_dir_perms;

	')

	allow $1 file_type:dir r_dir_perms;

')

########################################

#

# files_dontaudit_search_all_dirs(domain)

#

interface(`files_dontaudit_search_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir search;

	')

	dontaudit $1 file_type:dir search;

')

#######################################

#

# files_relabelto_all_file_type_fs(domain)

#

interface(`files_relabelto_all_file_type_fs',`

	gen_require(`

		attribute file_type;

		class filesystem relabelto;

	')

	allow $1 file_type:filesystem relabelto;

')

#######################################

#

# files_mount_all_file_type_fs(domain)

#

interface(`files_mount_all_file_type_fs',`

	gen_require(`

		attribute file_type;

		class filesystem mount;

	')

	allow $1 file_type:filesystem mount;

')

#######################################

#

# files_unmount_all_file_type_fs(domain)

#

interface(`files_unmount_all_file_type_fs',`

	gen_require(`

		attribute file_type;

		class filesystem unmount;

	')

	allow $1 file_type:filesystem unmount;

')

########################################

#

# files_mounton_all_mountpoints(domain)

#

interface(`files_mounton_all_mountpoints',`

	gen_require(`

		attribute mountpoint;

		class dir { getattr search mounton };

	')

	allow $1 mountpoint:dir { getattr search mounton };

')

########################################

#

# files_list_root(domain)

#

interface(`files_list_root',`

	gen_require(`

		type root_t;

		class dir r_dir_perms;

		class lnk_file r_file_perms;

	')

	allow $1 root_t:dir r_dir_perms;

	allow $1 root_t:lnk_file r_file_perms;

')

########################################

## <summary>

##	Create an object in the root directory, with a private

##	type.  If no object class is specified, the

##	default is file.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

## <param name="private type" optional="true">

##	The type of the object to be created.  If no type

##	is specified, the type of the root directory will

##	be used.

## </param>

## <param name="object" optional="true">

##	The object class of the object being created.  If

##	no class is specified, file will be used.

## </param>

#

interface(`files_create_root',`

	gen_require(`

		type root_t;

		class dir create_dir_perms;

	')

	allow $1 root_t:dir rw_dir_perms;

	ifelse(`$3',`',`

		ifelse(`$2',`',`

			allow $1 root_t:file create_file_perms;

		',`

			type_transition $1 root_t:file $2;

		')

	',`

		ifelse(`$2',`',`

			allow $1 root_t:$3 create_file_perms;

		',`

			type_transition $1 root_t:$3 $2;

		')

	')

')

########################################

#

# files_dontaudit_read_root_file(domain)

#

interface(`files_dontaudit_read_root_file',`

	gen_require(`

		type root_t;

		class file read;

	')

	dontaudit $1 root_t:file read;

')

########################################

#

# files_dontaudit_rw_root_file(domain)

#

interface(`files_dontaudit_rw_root_file',`

	gen_require(`

		type root_t;

		class file { read write };

	')

	dontaudit $1 root_t:file { read write };

')

########################################

#

# files_dontaudit_rw_root_chr_dev(domain)

#

interface(`files_dontaudit_rw_root_chr_dev',`

	gen_require(`

		type root_t;

		class chr_file { read write };

	')

	dontaudit $1 root_t:chr_file { read write };

')

########################################

#

# files_delete_root_dir_entry(domain)

#

interface(`files_delete_root_dir_entry',`

	gen_require(`

		type root_t;

		class dir rw_dir_perms;

	')

	allow $1 root_t:dir rw_dir_perms;

')

########################################

#

# files_unmount_rootfs(domain)

#

interface(`files_unmount_rootfs',`

	gen_require(`

		type root_t;