## <module name="files" layer="system">

## <summary>

##	Basic filesystem types and interfaces.

## </summary>

## <description>

##	

## 	This module contains basic filesystem types and interfaces. This

##	includes:

##	

##		
The concept of different file types including basic

##		files, mount points, tmp files, etc.

##		
Access to groups of files and all files.

##		
Types and interfaces for the basic filesystem layout

##		(/, /etc, /tmp, /usr, etc.).

##	

##	

## </description>

########################################

#

# files_file_type(type)

#

define(`files_file_type',`

	gen_require(`$0'_depend)

	fs_associate($1)

	fs_associate_noxattr($1)

	typeattribute $1 file_type;

')

define(`files_file_type_depend',`

	attribute file_type;

')

########################################

#

# files_lock_file(type)

#

define(`files_lock_file',`

	gen_require(`$0'_depend)

	files_file_type($1)

	typeattribute $1 lockfile;

')

define(`files_lock_file_depend',`

	attribute lockfile;

')

########################################

#

# files_mountpoint(type)

#

define(`files_mountpoint',`

	gen_require(`$0'_depend)

	files_file_type($1)

	typeattribute $1 mountpoint;

')

define(`files_mountpoint_depend',`

	attribute mountpoint;

')

########################################

#

# files_pid_file(type)

#

define(`files_pid_file',`

	gen_require(`$0'_depend)

	files_file_type($1)

	typeattribute $1 pidfile;

')

define(`files_pid_file_depend',`

	attribute pidfile;

')

########################################

#

# files_tmp_file(type)

#

define(`files_tmp_file',`

	gen_require(`$0'_depend)

	files_file_type($1)

	typeattribute $1 tmpfile;

')

define(`files_tmp_file_depend',`

	attribute tmpfile;

')

########################################

## <interface name="files_tmpfs_file">

##	<description>

##		Transform the type into a file, for use on a

##		virtual memory filesystem (tmpfs).

##	</description>

##	<parameter name="type">

##		The type to be transformed.

##	</parameter>

## </interface>

#

define(`files_tmpfs_file',`

	gen_require(`$0'_depend)

	files_file_type($1)

	fs_associate_tmpfs($1)

	typeattribute $1 tmpfsfile;

')

define(`files_tmpfs_file_depend',`

	attribute tmpfsfile;

')

########################################

#

# files_getattr_all_files(domain)

define(`files_getattr_all_files',`

	gen_require(`$0'_depend)

	allow $1 file_type:dir { search getattr };

	allow $1 file_type:file getattr;

	allow $1 file_type:lnk_file getattr;

	allow $1 file_type:fifo_file getattr;

	allow $1 file_type:sock_file getattr;

')

define(`files_getattr_all_files_depend',`

	attribute file_type;

	class dir { search getattr };

	class file getattr;

	class lnk_file getattr;

	class fifo_file getattr;

	class sock_file getattr;

')

########################################

## <interface name="files_relabel_all_files">

##	<description>

##		Relabel all files on the filesystem, except

##		the listed exceptions.

##	</description>

##	<parameter name="domain">

##		The type of the domain perfoming this action.

##	</parameter>

##	<parameter name="exception_types" optional="true">

##		The types to be excluded.  Each type or attribute

##		must be negated by the caller.

##	</parameter>

## </interface>

#

define(`files_relabel_all_files',`

	gen_require(`$0'_depend)

	allow $1 { file_type $2 }:dir { r_dir_perms relabelfrom relabelto };

	allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };

	allow $1 { file_type $2 }:blk_file { getattr relabelfrom };

	allow $1 { file_type $2 }:chr_file { getattr relabelfrom };

	# satisfy the assertions:

	seutil_relabelto_binary_pol($1)

')

define(`files_relabel_all_files_depend',`

	attribute file_type;

	class dir { r_dir_perms relabelfrom relabelto };

	class file { relabelfrom relabelto };

	class lnk_file { relabelfrom relabelto };

	class fifo_file { relabelfrom relabelto };

	class sock_file { relabelfrom relabelto };

	class blk_file relabelfrom;

	class chr_file relabelfrom;

')

########################################

## <interface name="files_manage_all_files">

##	<description>

##		Manage all files on the filesystem, except

##		the listed exceptions.

##	</description>

##	<parameter name="domain">

##		The type of the domain perfoming this action.

##	</parameter>

##	<parameter name="exception_types" optional="true">

##		The types to be excluded.  Each type or attribute

##		must be negated by the caller.

##	</parameter>

## </interface>

#

define(`files_manage_all_files',`

	gen_require(`$0'_depend)

	allow $1 { file_type $2 }:dir create_dir_perms;

	allow $1 { file_type $2 }:file create_file_perms;

	allow $1 { file_type $2 }:lnk_file create_lnk_perms;

	allow $1 { file_type $2 }:fifo_file create_file_perms;

	allow $1 { file_type $2 }:sock_file create_file_perms;

	# satisfy the assertions:

	seutil_write_binary_pol($1)

	bootloader_manage_kernel_modules($1)

')

define(`files_manage_all_files_depend',`

	attribute file_type;

	class dir create_dir_perms;

	class file create_file_perms;

	class lnk_file create_lnk_perms;

	class fifo_file create_file_perms;

	class sock_file create_file_perms;

')

########################################

#

# files_search_all_dirs(domain)

#

define(`files_search_all_dirs',`

	gen_require(`$0'_depend)

	allow $1 file_type:dir search;

')

define(`files_search_all_dirs_depend',`

	attribute file_type;

	class dir search;

')

########################################

#

# files_list_all_dirs(domain)

#

define(`files_list_all_dirs',`

	gen_require(`$0'_depend)

	allow $1 file_type:dir r_dir_perms;

')

define(`files_list_all_dirs_depend',`

	attribute file_type;

	class dir r_dir_perms;

')

########################################

#

# files_dontaudit_search_all_dirs(domain)

#

define(`files_dontaudit_search_all_dirs',`

	gen_require(`$0'_depend)

	dontaudit $1 file_type:dir search;

')

define(`files_dontaudit_search_all_dirs_depend',`

	attribute file_type;

	class dir search;

')

#######################################

#

# files_relabelto_all_file_type_fs(domain)

#

define(`files_relabelto_all_file_type_fs',`

	gen_require(`$0'_depend)

	allow $1 file_type:filesystem relabelto;

')

define(`files_relabelto_all_file_type_fs_depend',`

	attribute file_type;

	filesystem relabelto;

')

#######################################

#

# files_mount_all_file_type_fs(domain)

#

define(`files_mount_all_file_type_fs',`

	gen_require(`$0'_depend)

	allow $1 file_type:filesystem mount;

')

define(`files_mount_all_file_type_fs_depend',`

	attribute file_type;

	filesystem mount;

')

#######################################

#

# files_unmount_all_file_type_fs(domain)

#

define(`files_unmount_all_file_type_fs',`

	gen_require(`$0'_depend)

	allow $1 file_type:filesystem mount;

')

define(`files_unmount_all_file_type_fs_depend',`

	attribute file_type;

	filesystem mount;

')

########################################

#

# files_mounton_all_mountpoints(domain)

#

define(`files_mounton_all_mountpoints',`

	gen_require(`$0'_depend)

	allow $1 mountpoint:dir { getattr search mounton };

')

define(`files_mounton_all_mountpoints_depend',`

	attribute mountpoint;

	class dir { getattr search mounton };

')

########################################

#

# files_list_root(domain)

#

define(`files_list_root',`

	gen_require(`$0'_depend)

	allow $1 root_t:dir r_dir_perms;

	allow $1 root_t:lnk_file r_file_perms;

')

define(`files_list_root_depend',`

	type root_t;

	class dir r_dir_perms;

	class lnk_file r_file_perms;

')

########################################

## <interface name="files_create_root">

##	<description>

##		Create an object in the root directory, with a private

##		type.  If no object class is specified, the

##		default is file.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<parameter name="private type" optional="true">

##		The type of the object to be created.  If no type

##		is specified, the type of the root directory will

##		be used.

##	</parameter>

##	<parameter name="object" optional="true">

##		The object class of the object being created.  If

##		no class is specified, file will be used.

##	</parameter>

## </interface>

#

define(`files_create_root',`

	gen_require(`$0'_depend)

	allow $1 root_t:dir rw_dir_perms;

	ifelse(`$3',`',`

		ifelse(`$2',`',`

			allow $1 root_t:file create_file_perms;

		',`

			type_transition $1 root_t:file $2;

		')

	',`

		ifelse(`$2',`',`

			allow $1 root_t:$3 create_file_perms;

		',`

			type_transition $1 root_t:$3 $2;

		')

	')

')

define(`files_create_root_depend',`

	type root_t;

	class dir create_dir_perms;

	class file create_file_perms;

	class lnk_file create_lnk_perms;

	class fifo_file create_file_perms;

	class sock_file create_file_perms;

	class blk_file create_file_perms;

	class chr_file create_file_perms;

')

########################################

#

# files_dontaudit_read_root_file(domain)

#

define(`files_dontaudit_read_root_file',`

	gen_require(`$0'_depend)

	dontaudit $1 root_t:file read;

')

define(`files_dontaudit_read_root_file_depend',`

	type root_t;

	class file read;

')

########################################

#

# files_dontaudit_rw_root_file(domain)

#

define(`files_dontaudit_rw_root_file',`

	gen_require(`$0'_depend)

	dontaudit $1 root_t:file { read write };

')

define(`files_dontaudit_rw_root_file_depend',`

	type root_t;

	class file { read write };

')

########################################

#

# files_dontaudit_rw_root_chr_dev(domain)

#

define(`files_dontaudit_rw_root_chr_dev',`

	gen_require(`$0'_depend)

	dontaudit $1 root_t:chr_file { read write };

')

define(`files_dontaudit_rw_root_chr_dev_depend',`

	type root_t;

	class chr_file { read write };

')

########################################

#

# files_delete_root_dir_entry(domain)

#

define(`files_delete_root_dir_entry',`

	gen_require(`$0'_depend)

	allow $1 root_t:dir rw_dir_perms;

')

define(`files_delete_root_dir_entry_depend',`

	type root_t;

	class dir rw_dir_perms;

')

########################################

#

# files_unmount_rootfs(domain)

#

define(`files_unmount_rootfs',`

	gen_require(`$0'_depend)

	allow $1 root_t:filesystem unmount;

')

define(`files_unmount_rootfs_depend',`

	type root_t;

	class filesystem unmount;

')

########################################

#

# files_search_etc(domain)

#

define(`files_search_etc',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir search;

')

define(`files_search_etc_depend',`

	type etc_t;

	class dir search;

')

########################################

#

# files_read_generic_etc_files_directory(domain)

#

define(`files_read_generic_etc_files_directory',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir r_dir_perms;

')

define(`files_read_generic_etc_files_directory_depend',`

	type etc_t;

	class dir r_dir_perms;

')

########################################

#

# files_read_generic_etc_files(domain)

#

define(`files_read_generic_etc_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_t:file r_file_perms;

	allow $1 etc_t:lnk_file r_file_perms;

')

define(`files_read_generic_etc_files_depend',`

	type etc_t;

	class dir r_dir_perms;

	class file r_file_perms;

	class lnk_file r_file_perms;

')

########################################

#

# files_rw_generic_etc_files(domain)

#

define(`files_rw_generic_etc_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_t:file rw_file_perms;

	allow $1 etc_t:lnk_file r_file_perms;

')

define(`files_rw_generic_etc_files_depend',`

	type etc_t;

	class dir r_dir_perms;

	class file rw_file_perms;

	class lnk_file r_file_perms;

')

########################################

#

# files_manage_generic_etc_files(domain)

#

define(`files_manage_generic_etc_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir rw_dir_perms;

	allow $1 etc_t:file create_file_perms;

	allow $1 etc_t:lnk_file r_file_perms;

')

define(`files_manage_generic_etc_files_depend',`

	type etc_t;

	class dir rw_dir_perms;

	class file create_file_perms;

	class lnk_file r_file_perms;

')

########################################

## <interface name="files_delete_generic_etc_files">

##	<description>

##		Delete system configuration files in /etc.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

## </interface>

#

define(`files_delete_generic_etc_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir rw_dir_perms;

	allow $1 etc_t:file unlink;

')

define(`files_delete_generic_etc_files_depend',`

	type etc_t;

	class dir rw_dir_perms;

	class file unlink;

')

########################################

#

# files_exec_generic_etc_files(domain)

#

define(`files_exec_generic_etc_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_t:lnk_file r_file_perms;

	can_exec($1,etc_t)

')

define(`files_exec_generic_etc_files_depend',`

	type etc_t;

	class dir r_dir_perms;

	class lnk_file r_file_perms;

	class file { getattr read execute execute_no_trans };

')

########################################

#

# files_create_boot_flag(domain)

#

# /halt, /.autofsck, etc

#

define(`files_create_boot_flag',`

	gen_require(`$0'_depend)

	allow $1 root_t:dir rw_dir_perms;

	allow $1 etc_runtime_t:file { create read write setattr unlink };

	type_transition $1 root_t:file etc_runtime_t;

')

define(`files_create_boot_flag_depend',`

	type root_t, etc_runtime_t;

	class dir rw_dir_perms;

	class file { create read write setattr unlink};

')

########################################

#

# files_manage_etc_runtime_files(type)

#

define(`files_manage_etc_runtime_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir rw_dir_perms;

	allow $1 etc_runtime_t:file create_file_perms;

	type_transition $1 etc_t:file etc_runtime_t;

')

define(`files_manage_etc_runtime_files_depend',`

	type etc_t, etc_runtime_t;

	class dir rw_dir_perms;

	class file create_file_perms;

')

########################################

#

# files_read_etc_runtime_files(domain)

#

define(`files_read_etc_runtime_files',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir r_dir_perms;

	allow $1 etc_runtime_t:file r_file_perms;

')

define(`files_read_etc_runtime_files_depend',`

	type etc_t, etc_runtime_t;

	class dir r_dir_perms;

	class file r_file_perms;

')

########################################

#

# files_create_etc_config(domain,privatetype,[class(es)])

#

define(`files_create_etc_config',`

	gen_require(`$0'_depend)

	allow $1 etc_t:dir rw_dir_perms;

	ifelse(`$3',`',`

		type_transition $1 etc_t:file $2;

	',`

		type_transition $1 etc_t:$3 $2;

	')

')

define(`files_create_etc_config_depend',`

type etc_t;

class dir rw_dir_perms;

')

########################################

#

# files_rw_isid_type_dir(domain)

#

define(`files_rw_isid_type_dir',`

	gen_require(`$0'_depend)

	allow $1 file_t:dir rw_dir_perms;

')

define(`files_rw_isid_type_dir_depend',`

	type file_t;

	class dir rw_dir_perms;

')

########################################

#

# files_dontaudit_getattr_isid_type_dir(domain)

#

define(`files_dontaudit_getattr_isid_type_dir',`

	gen_require(`$0'_depend)

	dontaudit $1 file_t:dir search;

')

define(`files_dontaudit_getattr_isid_type_dir_depend',`

	type file_t;

	class dir search;

')

########################################

#

# files_dontaudit_search_isid_type_dir(domain)

#

define(`files_dontaudit_search_isid_type_dir',`

	gen_require(`$0'_depend)

	dontaudit $1 file_t:dir search;

')

define(`files_dontaudit_search_isid_type_dir_depend',`

	type file_t;

	class dir search;

')

########################################

## <interface name="files_list_home">

##	<description>

##		Get listing home home directories.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

## </interface>

#

define(`files_list_home',`

	gen_require(`$0'_depend)

	allow $1 home_root_t:dir r_dir_perms;

')

define(`files_list_home_depend',`

	type home_root_t;

	class dir r_dir_perms;

')

########################################

#

# files_list_mnt(domain)

#

define(`files_list_mnt',`

	gen_require(`$0'_depend)

	allow $1 mnt_t:dir r_dir_perms;

')

define(`files_read_etc_runtime_files_depend',`

	type mnt_t;

	class dir r_dir_perms;

')

########################################

#

# files_create_tmp_files(domain,private_type,[object class(es)])

#

define(`files_create_tmp_files',`

	gen_require(`$0'_depend)

	allow $1 tmp_t:dir rw_dir_perms;

	ifelse(`$3',`',`

		type_transition $1 tmp_t:file $2;

	',`

		type_transition $1 tmp_t:$3 $2;

	')

')

define(`files_create_tmp_files_depend',`

	type tmp_t;

	class dir rw_dir_perms;

')

########################################

#

# files_delete_all_tmp_files(domain)

#

define(`files_delete_all_tmp_files',`

	gen_require(`$0'_depend)

	allow $1 tmpfile:dir { getattr search read write add_name remove_name rmdir };

	allow $1 tmpfile:file { getattr unlink };

	allow $1 tmpfile:lnk_file { getattr unlink };

	allow $1 tmpfile:fifo_file { getattr unlink };

	allow $1 tmpfile:sock_file { getattr unlink };

')

define(`files_delete_all_tmp_files_depend',`

	attribute tmpfile;

	class dir { getattr search read write add_name remove_name rmdir };

	class file { getattr unlink };

	class lnk_file { getattr unlink };

	class fifo_file { getattr unlink };

	class sock_file { getattr unlink };

')

########################################

#

# files_search_usr(domain)

#

define(`files_search_usr',`

	gen_require(`$0'_depend)

	allow $1 usr_t:dir search;

')

define(`files_search_usr_depend',`

	type usr_t;

	class dir search;

')

########################################

#

# files_read_usr_files(domain)

#

define(`files_read_usr_files',`

	gen_require(`$0'_depend)

	allow $1 usr_t:dir r_dir_perms;

	allow $1 usr_t:{ file lnk_file } r_file_perms;

')

define(`files_read_usr_files_depend',`

	type usr_t;

	class dir r_dir_perms;

	class file r_file_perms;

	class lnk_file r_file_perms;

')

########################################

## <interface name="files_exec_usr_files">

##	<description>

##		Execute programs in /usr/src in the caller domain.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

## </interface>