## <summary>

## Basic filesystem types and interfaces.

## </summary>

## <desc>

## 

## This module contains basic filesystem types and interfaces. This

## includes:

## 

##	
The concept of different file types including basic

##	files, mount points, tmp files, etc.

##	
Access to groups of files and all files.

##	
Types and interfaces for the basic filesystem layout

##	(/, /etc, /tmp, /usr, etc.).

## 

## 

## </desc>

## <required val="true">

##	Contains the concept of a file.

##	Comains the file initial SID.

## </required>

########################################

#

# files_type(type)

#

interface(`files_type',`

	gen_require(`

		attribute file_type;

	')

	fs_associate($1)

	fs_associate_noxattr($1)

	typeattribute $1 file_type;

')

########################################

#

# files_lock_file(type)

#

interface(`files_lock_file',`

	gen_require(`

		attribute lockfile;

	')

	files_type($1)

	typeattribute $1 lockfile;

')

########################################

#

# files_mountpoint(type)

#

interface(`files_mountpoint',`

	gen_require(`

		attribute mountpoint;

	')

	files_type($1)

	typeattribute $1 mountpoint;

')

########################################

#

# files_pid_file(type)

#

interface(`files_pid_file',`

	gen_require(`

		attribute pidfile;

	')

	files_type($1)

	typeattribute $1 pidfile;

')

########################################

#

# files_tmp_file(type)

#

interface(`files_tmp_file',`

	gen_require(`

		attribute tmpfile;

	')

	files_type($1)

	typeattribute $1 tmpfile;

')

########################################

## <summary>

##	Transform the type into a file, for use on a

##	virtual memory filesystem (tmpfs).

## </summary>

## <param name="type">

##	The type to be transformed.

## </param>

#

interface(`files_tmpfs_file',`

	gen_require(`

		attribute tmpfsfile;

	')

	files_type($1)

	fs_associate_tmpfs($1)

	typeattribute $1 tmpfsfile;

')

########################################

#

# files_getattr_all_files(domain)

interface(`files_getattr_all_files',`

	gen_require(`

		attribute file_type;

		class dir { search getattr };

		class file getattr;

		class lnk_file getattr;

		class fifo_file getattr;

		class sock_file getattr;

	')

	allow $1 file_type:dir { search getattr };

	allow $1 file_type:file getattr;

	allow $1 file_type:lnk_file getattr;

	allow $1 file_type:fifo_file getattr;

	allow $1 file_type:sock_file getattr;

')

########################################

## <summary>

##	Relabel all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	The type of the domain perfoming this action.

## </param>

## <param name="exception_types" optional="true">

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

## </param>

#

interface(`files_relabel_all_files',`

	gen_require(`

		attribute file_type;

		class dir { r_dir_perms relabelfrom relabelto };

		class file { relabelfrom relabelto };

		class lnk_file { relabelfrom relabelto };

		class fifo_file { relabelfrom relabelto };

		class sock_file { relabelfrom relabelto };

		class blk_file relabelfrom;

		class chr_file relabelfrom;

	')

	allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };

	allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:blk_file { getattr relabelfrom };

	allow $1 { file_type $2 }:chr_file { getattr relabelfrom };

	# satisfy the assertions:

	seutil_relabelto_binary_pol($1)

')

########################################

## <summary>

##	Manage all files on the filesystem, except

##	the listed exceptions.

## </summary>

## <param name="domain">

##	The type of the domain perfoming this action.

## </param>

## <param name="exception_types" optional="true">

##	The types to be excluded.  Each type or attribute

##	must be negated by the caller.

## </param>

#

interface(`files_manage_all_files',`

	gen_require(`

		attribute file_type;

		class dir create_dir_perms;

		class file create_file_perms;

		class lnk_file create_lnk_perms;

		class fifo_file create_file_perms;

		class sock_file create_file_perms;

	')

	allow $1 { file_type $2 }:dir create_dir_perms;

	allow $1 { file_type $2 }:file create_file_perms;

	allow $1 { file_type $2 }:lnk_file create_lnk_perms;

	allow $1 { file_type $2 }:fifo_file create_file_perms;

	allow $1 { file_type $2 }:sock_file create_file_perms;

	# satisfy the assertions:

	seutil_create_binary_pol($1)

	bootloader_manage_kernel_modules($1)

')

########################################

#

# files_search_all_dirs(domain)

#

interface(`files_search_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir search;

	')

	allow $1 file_type:dir search;

')

########################################

#

# files_list_all_dirs(domain)

#

interface(`files_list_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir r_dir_perms;

	')

	allow $1 file_type:dir r_dir_perms;

')

########################################

#

# files_dontaudit_search_all_dirs(domain)

#

interface(`files_dontaudit_search_all_dirs',`

	gen_require(`

		attribute file_type;

		class dir search;

	')

	dontaudit $1 file_type:dir search;

')

#######################################

#

# files_relabelto_all_file_type_fs(domain)

#

interface(`files_relabelto_all_file_type_fs',`

	gen_require(`

		attribute file_type;

		filesystem relabelto;

	')

	allow $1 file_type:filesystem relabelto;

')

#######################################

#

# files_mount_all_file_type_fs(domain)

#

interface(`files_mount_all_file_type_fs',`

	gen_require(`

		attribute file_type;

		filesystem mount;

	')

	allow $1 file_type:filesystem mount;

')

#######################################

#

# files_unmount_all_file_type_fs(domain)

#

interface(`files_unmount_all_file_type_fs',`

	gen_require(`

		attribute file_type;

		filesystem mount;

	')

	allow $1 file_type:filesystem mount;

')

########################################

#

# files_mounton_all_mountpoints(domain)

#

interface(`files_mounton_all_mountpoints',`

	gen_require(`

		attribute mountpoint;

		class dir { getattr search mounton };

	')

	allow $1 mountpoint:dir { getattr search mounton };

')

########################################

#

# files_list_root(domain)

#

interface(`files_list_root',`

	gen_require(`

		type root_t;

		class dir r_dir_perms;

		class lnk_file r_file_perms;

	')

	allow $1 root_t:dir r_dir_perms;

	allow $1 root_t:lnk_file r_file_perms;

')

########################################

## <summary>

##	Create an object in the root directory, with a private

##	type.  If no object class is specified, the

##	default is file.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

## <param name="private type" optional="true">

##	The type of the object to be created.  If no type

##	is specified, the type of the root directory will

##	be used.

## </param>

## <param name="object" optional="true">

##	The object class of the object being created.  If

##	no class is specified, file will be used.

## </param>

#

interface(`files_create_root',`

	gen_require(`

		type root_t;

		class dir create_dir_perms;

		class file create_file_perms;

		class lnk_file create_lnk_perms;

		class fifo_file create_file_perms;

		class sock_file create_file_perms;

		class blk_file create_file_perms;

		class chr_file create_file_perms;

	')

	allow $1 root_t:dir rw_dir_perms;

	ifelse(`$3',`',`

		ifelse(`$2',`',`

			allow $1 root_t:file create_file_perms;

		',`

			type_transition $1 root_t:file $2;

		')

	',`

		ifelse(`$2',`',`

			allow $1 root_t:$3 create_file_perms;

		',`

			type_transition $1 root_t:$3 $2;

		')

	')

')

########################################

#

# files_dontaudit_read_root_file(domain)

#

interface(`files_dontaudit_read_root_file',`

	gen_require(`

		type root_t;

		class file read;

	')

	dontaudit $1 root_t:file read;

')

########################################

#

# files_dontaudit_rw_root_file(domain)

#

interface(`files_dontaudit_rw_root_file',`

	gen_require(`

		type root_t;

		class file { read write };

	')

	dontaudit $1 root_t:file { read write };

')

########################################

#

# files_dontaudit_rw_root_chr_dev(domain)

#

interface(`files_dontaudit_rw_root_chr_dev',`

	gen_require(`

		type root_t;

		class chr_file { read write };

	')

	dontaudit $1 root_t:chr_file { read write };

')

########################################

#

# files_delete_root_dir_entry(domain)

#

interface(`files_delete_root_dir_entry',`

	gen_require(`

		type root_t;

		class dir rw_dir_perms;

	')

	allow $1 root_t:dir rw_dir_perms;

')

########################################

#

# files_unmount_rootfs(domain)

#

interface(`files_unmount_rootfs',`

	gen_require(`

		type root_t;

		class filesystem unmount;

	')

	allow $1 root_t:filesystem unmount;

')

########################################

## <summary>

##	List contents of directories with the default file type.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_list_default',`

	gen_require(`

		type default_t;

		class dir r_dir_perms;

	')

	allow $1 default_t:dir r_dir_perms;

')

########################################

## <summary>

##	Mount a filesystem on a directory with the default file type.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_mounton_default',`

	gen_require(`

		type default_t;

		class dir { getattr search mounton };

	')

	allow $1 default_t:dir { getattr search mounton };

')

########################################

## <summary>

##	Read files with the default file type.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_read_default_files',`

	gen_require(`

		type default_t;

		class file r_file_perms;

	')

	allow $1 default_t:file r_file_perms;

')

########################################

## <summary>

##	Read symbolic links with the default file type.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_read_default_symlinks',`

	gen_require(`

		type default_t;

		class lnk_file r_file_perms;

	')

	allow $1 default_t:lnk_file r_file_perms;

')

########################################

## <summary>

##	Read sockets with the default file type.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_read_default_sockets',`

	gen_require(`

		type default_t;

		class sock_file r_file_perms;

	')

	allow $1 default_t:sock_file r_file_perms;

')

########################################

## <summary>

##	Read named pipes with the default file type.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_read_default_pipes',`

	gen_require(`

		type default_t;

		class fifo_file r_file_perms;

	')

	allow $1 default_t:fifo_file r_file_perms;

')

########################################

#

# files_search_etc(domain)

#

interface(`files_search_etc',`

	gen_require(`

		type etc_t;

		class dir search;

	')

	allow $1 etc_t:dir search;

')

########################################

## <summary>

##	Set the attributes of the /etc directories.

## </summary>

## <param name="domain">

##	Domain allowed access.

## </param>

#

interface(`files_setattr_etc_dir',`

	gen_require(`

		type etc_t;

		class dir setattr;

	')

	allow $1 etc_t:dir setattr;

')

########################################

#

# files_list_etc(domain)

#

interface(`files_list_etc',`

	gen_require(`

		type etc_t;

		class dir r_dir_perms;

	')

	allow $1 etc_t:dir r_dir_perms;

')

########################################

#

# files_read_etc_files(domain)

#

interface(`files_read_etc_files',`

	gen_require(`

		type etc_t;

		class dir r_dir_perms;

		class file r_file_perms;

		class lnk_file r_file_perms;

	')

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_t:file r_file_perms;

	allow $1 etc_t:lnk_file r_file_perms;

')

########################################

#

# files_rw_etc_files(domain)

#

interface(`files_rw_etc_files',`

	gen_require(`

		type etc_t;

		class dir r_dir_perms;

		class file rw_file_perms;

		class lnk_file r_file_perms;

	')

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_t:file rw_file_perms;

	allow $1 etc_t:lnk_file r_file_perms;

')

########################################

#

# files_manage_etc_files(domain)

#

interface(`files_manage_etc_files',`

	gen_require(`

		type etc_t;

		class dir rw_dir_perms;

		class file create_file_perms;

		class lnk_file r_file_perms;

	')

	allow $1 etc_t:dir rw_dir_perms;

	allow $1 etc_t:file create_file_perms;

	allow $1 etc_t:lnk_file r_file_perms;

')

########################################

## <summary>

##	Delete system configuration files in /etc.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_delete_etc_files',`

	gen_require(`

		type etc_t;

		class dir rw_dir_perms;

		class file unlink;

	')

	allow $1 etc_t:dir rw_dir_perms;

	allow $1 etc_t:file unlink;

')

########################################

#

# files_exec_etc_files(domain)

#

interface(`files_exec_etc_files',`

	gen_require(`

		type etc_t;

		class dir r_dir_perms;

		class lnk_file r_file_perms;

	')

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_t:lnk_file r_file_perms;

	can_exec($1,etc_t)

')

########################################

#

# files_create_boot_flag(domain)

#

# /halt, /.autofsck, etc

#

interface(`files_create_boot_flag',`

	gen_require(`

		type root_t, etc_runtime_t;

		class dir rw_dir_perms;

		class file { create read write setattr unlink};

	')

	allow $1 root_t:dir rw_dir_perms;

	allow $1 etc_runtime_t:file { create read write setattr unlink };

	type_transition $1 root_t:file etc_runtime_t;

')

########################################

#

# files_manage_etc_runtime_files(type)

#

interface(`files_manage_etc_runtime_files',`

	gen_require(`

		type etc_t, etc_runtime_t;

		class dir rw_dir_perms;

		class file create_file_perms;

	')

	allow $1 etc_t:dir rw_dir_perms;

	allow $1 etc_runtime_t:file create_file_perms;

	type_transition $1 etc_t:file etc_runtime_t;

')

########################################

#

# files_read_etc_runtime_files(domain)

#

interface(`files_read_etc_runtime_files',`

	gen_require(`

		type etc_t, etc_runtime_t;

		class dir r_dir_perms;

		class file r_file_perms;

	')

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_runtime_t:file r_file_perms;

')

########################################

#

# files_create_etc_config(domain,privatetype,[class(es)])

#

interface(`files_create_etc_config',`

	gen_require(`

		type etc_t;

		class dir rw_dir_perms;

	')

	allow $1 etc_t:dir rw_dir_perms;

	ifelse(`$3',`',`

		type_transition $1 etc_t:file $2;

	',`

		type_transition $1 etc_t:$3 $2;

	')

')

########################################

## <summary>

##	Do not audit attempts to search directories on new filesystems

##	that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_dontaudit_search_isid_type_dir',`

	gen_require(`

		type file_t;

		class dir search;

	')

	dontaudit $1 file_t:dir search;

')

########################################

## <summary>

##	List the contents of directories on new filesystems

##	that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_list_isid_type_dir',`

	gen_require(`

		type file_t;

		class dir r_dir_perms;

	')

	allow $1 file_t:dir r_dir_perms;

')

########################################

## <summary>

##	Read and write directories on new filesystems

##	that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_rw_isid_type_dir',`

	gen_require(`

		type file_t;

		class dir rw_dir_perms;

	')

	allow $1 file_t:dir rw_dir_perms;

')

########################################

## <summary>

##	Create, read, write, and delete directories

##	on new filesystems that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_manage_isid_type_dir',`

	gen_require(`

		type file_t;

		class dir create_dir_perms;

	')

	allow $1 file_t:dir create_dir_perms;

')

########################################

## <summary>

##	Mount a filesystem on a directory on new filesystems

##	that has not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_mounton_isid_type_dir',`

	gen_require(`

		type file_t;

		class dir { getattr search mounton };

	')

	allow $1 file_t:dir { getattr search mounton };

')

########################################

## <summary>

##	Read files on new filesystems

##	that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_read_isid_type_file',`

	gen_require(`

		type file_t;

		class dir search;

		class file r_file_perms;

	')

	allow $1 file_t:dir search;

	allow $1 file_t:file r_file_perms;

')

########################################

## <summary>

##	Create, read, write, and delete files

##	on new filesystems that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_manage_isid_type_file',`

	gen_require(`

		type file_t;

		class dir rw_dir_perms;

		class file create_file_perms;

	')

	allow $1 file_t:dir rw_dir_perms;

	allow $1 file_t:file create_file_perms;

')

########################################

## <summary>

##	Create, read, write, and delete symbolic links

##	on new filesystems that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_manage_isid_type_symlink',`

	gen_require(`

		type file_t;

		class dir rw_dir_perms;

		class lnk_file create_lnk_perms;

	')

	allow $1 file_t:dir rw_dir_perms;

	allow $1 file_t:lnk_file create_lnk_perms;

')

########################################

## <summary>

##	Read and write block device nodes on new filesystems 

##	that have not yet been labeled.

## </summary>

## <param name="domain">

##	The type of the process performing this action.

## </param>

#

interface(`files_rw_isid_type_blk_node',`

	gen_require(`