# Copyright (C) 2005 Tresys Technology, LLC

## <module name="files" layer="system">

## <summary>Policy controlling access to general files</summary>

########################################

#

# files_make_file(type)

#

define(`files_make_file',`

requires_block_template(`$0'_depend)

typeattribute $1 file_type;

filesystem_associate($1)

filesystem_noxattr_associate($1)

')

define(`files_make_file_depend',`

attribute file_type;

')

########################################

#

# files_make_lock_file(type)

#

define(`files_make_lock_file',`

requires_block_template(`$0'_depend)

files_make_file($1)

typeattribute $1 lockfile;

')

define(`files_make_lock_file_depend',`

attribute lockfile;

')

########################################

#

# files_make_mountpoint(type)

#

define(`files_make_mountpoint',`

requires_block_template(`$0'_depend)

files_make_file($1)

typeattribute $1 mountpoint;

')

define(`files_make_mountpoint_depend',`

attribute mountpoint;

')

########################################

#

# files_make_daemon_runtime_file(type)

#

define(`files_make_daemon_runtime_file',`

requires_block_template(`$0'_depend)

files_make_file($1)

typeattribute $1 pidfile;

')

define(`files_make_daemon_runtime_file_depend',`

attribute pidfile;

')

########################################

#

# files_make_temporary_file(type)

#

define(`files_make_temporary_file',`

requires_block_template(`$0'_depend)

files_make_file($1)

typeattribute $1 tmpfile;

')

define(`files_make_temporary_file_depend',`

attribute tmpfile;

')

########################################

## <interface name="files_make_tmpfs_file">

##	<description>

##		Transform the type into a file, for use on a

##		virtual memory filesystem (tmpfs).

##	</description>

##	<parameter name="type">

##		The type to be transformed.

##	</parameter>

##	<infoflow type="none"/>

## </interface>

#

define(`files_make_tmpfs_file',`

requires_block_template(`$0'_depend)

files_make_file($1)

filesystem_tmpfs_associate($1)

typeattribute $1 tmpfsfile;

')

define(`files_make_tmpfs_file_depend',`

attribute tmpfsfile;

')

########################################

#

# files_get_all_file_attributes(domain)

define(`files_get_all_file_attributes',`

requires_block_template(`$0'_depend)

allow $1 file_type:dir { search getattr };

allow $1 file_type:file getattr;

allow $1 file_type:lnk_file getattr;

allow $1 file_type:fifo_file getattr;

allow $1 file_type:sock_file getattr;

')

define(`files_get_all_file_attributes_depend',`

attribute file_type;

class dir { search getattr };

class file getattr;

class lnk_file getattr;

class fifo_file getattr;

class sock_file getattr;

')

########################################

## <interface name="files_relabel_all_files">

##	<description>

##		Relabel all files on the filesystem, except

##		the listed exceptions.

##	</description>

##	<parameter name="domain">

##		The type of the domain perfoming this action.

##	</parameter>

##	<parameter name="exception_types" optional="true">

##		The types to be excluded.  Each type or attribute

##		must be negated by the caller.

##	</parameter>

##	<infoflow type="both" weight="10"/>

## </interface>

#

define(`files_relabel_all_files',`

requires_block_template(`$0'_depend)

allow $1 { file_type $2 }:dir { getattr search read relabelfrom relabelto };

allow $1 { file_type $2 }:file { getattr relabelfrom relabelto };

allow $1 { file_type $2 }:lnk_file { getattr relabelfrom relabelto };

allow $1 { file_type $2 }:fifo_file { getattr relabelfrom relabelto };

allow $1 { file_type $2 }:sock_file { getattr relabelfrom relabelto };

allow $1 { file_type $2 }:blk_file { getattr relabelfrom };

allow $1 { file_type $2 }:chr_file { getattr relabelfrom };

# satisfy the assertions:

selinux_relabelto_binary_policy($1)

')

define(`files_relabel_all_files_depend',`

attribute file_type;

class dir { getattr search read relabelfrom relabelto };

class file { relabelfrom relabelto };

class lnk_file { relabelfrom relabelto };

class fifo_file { relabelfrom relabelto };

class sock_file { relabelfrom relabelto };

class blk_file relabelfrom;

class chr_file relabelfrom;

')

########################################

## <interface name="files_manage_all_files">

##	<description>

##		Manage all files on the filesystem, except

##		the listed exceptions.

##	</description>

##	<parameter name="domain">

##		The type of the domain perfoming this action.

##	</parameter>

##	<parameter name="exception_types" optional="true">

##		The types to be excluded.  Each type or attribute

##		must be negated by the caller.

##	</parameter>

##	<infoflow type="both" weight="10"/>

## </interface>

#

define(`files_manage_all_files',`

requires_block_template(`$0'_depend)

allow $1 { file_type $2 }:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };

allow $1 { file_type $2 }:file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 { file_type $2 }:lnk_file { create read getattr setattr link unlink rename };

allow $1 { file_type $2 }:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 { file_type $2 }:sock_file { create ioctl read getattr lock write setattr append link unlink rename };

# satisfy the assertions:

selinux_write_binary_policy($1)

bootloader_modify_kernel_modules($1)

')

define(`files_manage_all_files_depend',`

attribute file_type;

class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };

class file { create ioctl read getattr lock write setattr append link unlink rename };

class lnk_file { create read getattr setattr link unlink rename };

class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };

class sock_file { create ioctl read getattr lock write setattr append link unlink rename };

')

########################################

#

# files_search_all_directories(domain)

#

define(`files_search_all_directories',`

requires_block_template(`$0'_depend)

allow $1 file_type:dir search;

')

define(`files_search_all_directories_depend',`

attribute file_type;

class dir search;

')

########################################

#

# files_read_all_directories(domain)

#

define(`files_read_all_directories',`

requires_block_template(`$0'_depend)

allow $1 file_type:dir { getattr search read };

')

define(`files_read_all_directories_depend',`

attribute file_type;

class dir { getattr search read };

')

########################################

#

# files_ignore_search_all_directories(domain)

#

define(`files_ignore_search_all_directories',`

requires_block_template(`$0'_depend)

dontaudit $1 file_type:dir search;

')

define(`files_ignore_search_all_directories_depend',`

attribute file_type;

class dir search;

')

########################################

#

# files_read_all_directories(domain)

#

define(`files_read_all_directories',`

requires_block_template(`$0'_depend)

allow $1 file_type:dir { getattr search read };

')

define(`files_read_all_directories_depend',`

attribute file_type;

class dir { getattr search read };

')

#######################################

#

# files_relabelto_all_file_type_filesystems(domain)

#

define(`files_relabelto_all_file_type_filesystems',`

requires_block_template(`$0'_depend)

allow $1 file_type:filesystem relabelto;

')

define(`files_relabelto_all_file_type_filesystems_depend',`

attribute file_type;

filesystem relabelto;

')

#######################################

#

# files_mount_all_file_type_filesystems(domain)

#

define(`files_mount_all_file_type_filesystems',`

requires_block_template(`$0'_depend)

allow $1 file_type:filesystem mount;

')

define(`files_mount_all_file_type_filesystems_depend',`

attribute file_type;

filesystem mount;

')

#######################################

#

# files_unmount_all_file_type_filesystems(domain)

#

define(`files_unmount_all_file_type_filesystems',`

requires_block_template(`$0'_depend)

allow $1 file_type:filesystem mount;

')

define(`files_unmount_all_file_type_filesystems_depend',`

attribute file_type;

filesystem mount;

')

########################################

#

# files_mount_on_all_mountpoints(domain)

#

define(`files_mount_on_all_mountpoints',`

requires_block_template(`$0'_depend)

allow $1 mountpoint:dir { getattr search mounton };

')

define(`files_mount_on_all_mountpoints_depend',`

attribute mountpoint;

class dir { getattr search mounton };

')

########################################

#

# files_read_root_dir(domain)

#

define(`files_read_root_dir',`

requires_block_template(`$0'_depend)

allow $1 root_t:dir { getattr search read };

allow $1 root_t:lnk_file { getattr read };

')

define(`files_read_root_dir_depend',`

type root_t;

class dir { getattr search read };

class lnk_file { getattr read };

')

########################################

#

# files_create_root_dir_entry(domain)

#

define(`files_create_root_dir_entry',`

requires_block_template(`$0'_depend)

allow $1 root_t:dir { getattr search read write add_name };

')

define(`files_create_root_dir_entry_depend',`

type root_t;

class dir { getattr search read write add_name };

')

########################################

#

# files_ignore_read_rootfs_file(domain)

#

define(`files_ignore_read_rootfs_file',`

requires_block_template(`$0'_depend)

dontaudit $1 root_t:file read;

')

define(`files_ignore_read_rootfs_file_depend',`

type root_t;

class file read;

')

########################################

#

# files_ignore_modify_rootfs_file(domain)

#

define(`files_ignore_modify_rootfs_file',`

requires_block_template(`$0'_depend)

dontaudit $1 root_t:file { read write };

')

define(`files_ignore_modify_rootfs_file_depend',`

type root_t;

class file { read write };

')

########################################

#

# files_ignore_modify_rootfs_device(domain)

#

define(`files_ignore_modify_rootfs_device',`

requires_block_template(`$0'_depend)

dontaudit $1 root_t:chr_file { read write };

')

define(`files_ignore_modify_rootfs_device_depend',`

type root_t;

class chr_file { read write };

')

########################################

## <interface name="files_create_private_root_dir_entry">

##	<description>

##		Create an object in the root directory, with a private

##		type.  If no object class is specified, the

##		default is file.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<parameter name="private type">

##		The type of the object to be created.

##	</parameter>

##	<parameter name="object" optional="true">

##		The type of the process performing this action.

##	</parameter>

##	<infoflow type="write" weight="10"/>

## </interface>

#

define(`files_create_private_root_dir_entry',`

requires_block_template(`$0'_depend)

allow $1 root_t:dir { getattr search read write add_name remove_name };

ifelse(`$3',`',`

type_transition $1 root_t:file $2;

',`

type_transition $1 root_t:$3 $2;

') dnl end ifelse

')

define(`files_create_private_root_dir_entry_depend',`

type root_t;

class dir { getattr search read write add_name remove_name };

')

########################################

#

# files_remove_root_dir_entry(domain)

#

define(`files_remove_root_dir_entry',`

requires_block_template(`$0'_depend)

allow $1 root_t:dir { getattr search read write remove_name };

')

define(`files_remove_root_dir_entry_depend',`

type root_t;

class dir { getattr search read write remove_name };

')

########################################

#

# files_unmount_root_filesystem(domain)

#

define(`files_unmount_root_filesystem',`

requires_block_template(`$0'_depend)

allow $1 root_t:filesystem unmount;

')

define(`files_unmount_root_filesystem_depend',`

type root_t;

class filesystem unmount;

')

########################################

#

# files_search_general_system_config_directory(domain)

#

define(`files_search_general_system_config_directory',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir search;

')

define(`files_search_general_system_config_directory_depend',`

type etc_t;

class dir search;

')

########################################

#

# files_read_general_system_config_directory(domain)

#

define(`files_read_general_system_config_directory',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read };

')

define(`files_read_general_system_config_directory_depend',`

type etc_t;

class dir { getattr search read };

')

########################################

#

# files_read_general_system_config(domain)

#

define(`files_read_general_system_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read };

allow $1 etc_t:file { getattr read };

allow $1 etc_t:lnk_file { getattr read };

')

define(`files_read_general_system_config_depend',`

type etc_t;

class dir { getattr search read };

class file { getattr read };

class lnk_file { getattr read };

')

########################################

#

# files_modify_general_system_config(domain)

#

define(`files_modify_general_system_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read };

allow $1 etc_t:file { getattr read write };

allow $1 etc_t:lnk_file { getattr read };

')

define(`files_modify_general_system_config_depend',`

type etc_t;

class dir { getattr search read };

class file { getattr read write };

class lnk_file { getattr read };

')

########################################

#

# files_manage_general_system_config(domain)

#

define(`files_manage_general_system_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { read getattr lock search ioctl add_name remove_name write };

allow $1 etc_t:file { create ioctl read getattr lock write setattr append link unlink rename };

allow $1 etc_t:lnk_file { getattr read };

')

define(`files_manage_general_system_config_depend',`

type etc_t;

class dir { read getattr lock search ioctl add_name remove_name write };

class file { create ioctl read getattr lock write setattr append link unlink rename };

class lnk_file { getattr read };

')

########################################

## <interface name="files_remove_general_system_config">

##	<description>

##		Delete system configuration files in /etc.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<infoflow type="write" weight="1"/>

## </interface>

#

define(`files_remove_general_system_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read write remove_name };

allow $1 etc_t:file unlink;

')

define(`files_remove_general_system_config_depend',`

type etc_t;

class dir { getattr search read write remove_name };

class file unlink;

')

########################################

#

# files_execute_system_config_script(domain)

#

define(`files_execute_system_config_script',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read };

allow $1 etc_t:lnk_file { getattr read };

allow $1 etc_t:file { getattr read execute execute_no_trans };

')

define(`files_execute_system_config_script_depend',`

type etc_t, etc_runtime_t;

class dir { getattr search read };

class lnk_file { getattr read };

class file { getattr read execute execute_no_trans };

')

########################################

#

# files_create_boot_flag(type)

#

# /halt, /.autofsck, etc

#

define(`files_create_boot_flag',`

requires_block_template(`$0'_depend)

allow $1 root_t:dir { getattr search read write add_name remove_name };

allow $1 etc_runtime_t:file { create read write setattr unlink };

type_transition $1 root_t:file etc_runtime_t;

')

define(`files_create_boot_flag_depend',`

type root_t, etc_runtime_t;

class dir { getattr search read write add_name };

class file { create read write setattr };

')

########################################

#

# files_create_runtime_system_config(type)

#

define(`files_create_runtime_system_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read write add_name remove_name };

allow $1 etc_runtime_t:file { create read write setattr unlink };

type_transition $1 etc_t:file etc_runtime_t;

')

define(`files_create_runtime_system_config_depend',`

type etc_t, etc_runtime_t;

class dir { getattr search read write add_name };

class file { create read write setattr };

')

########################################

#

# files_read_runtime_system_config(domain)

#

define(`files_read_runtime_system_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read };

allow $1 etc_runtime_t:file { getattr read };

')

define(`files_create_runtime_system_config_depend',`

type etc_t, etc_runtime_t;

class dir { getattr search read };

class file { getattr read };

')

########################################

#

# files_create_private_config(domain,privatetype,[class(es)])

#

define(`files_create_private_config',`

requires_block_template(`$0'_depend)

allow $1 etc_t:dir { getattr search read write add_name remove_name };

ifelse(`$3',`',`

type_transition $1 etc_t:file $2;

',`

type_transition $1 etc_t:$3 $2;

') dnl end ifelse

')

define(`files_create_private_config_depend',`

type etc_t;

class dir { getattr search read write add_name remove_name };

')

########################################

## <interface name="files_list_home_directories">

##	<description>

##		Get listing home home directories.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<infoflow type="read" weight="10"/>

## </interface>

#

define(`files_list_home_directories',`

requires_block_template(`$0'_depend)

allow $1 home_root_t:dir { getattr search read };

')

define(`files_list_home_directories_depend',`

type home_root_t;

class dir { getattr search read };

')

########################################

#

# files_create_private_tmp_data(domain,private_type,[object class(es)])

#

define(`files_create_private_tmp_data',`

requires_block_template(`$0'_depend)

allow $1 tmp_t:dir { getattr search read write add_name remove_name };

ifelse(`$3',`',`

type_transition $1 tmp_t:file $2;

',`

type_transition $1 tmp_t:$3 $2;

')

')

define(`files_create_private_tmp_data_depend',`

type tmp_t;

class dir { getattr search read write add_name };

')

########################################

#

# files_remove_all_tmp_data(domain)

#

define(`files_remove_all_tmp_data',`

requires_block_template(`$0'_depend)

allow $1 tmpfile:dir { getattr search read write add_name remove_name rmdir };

allow $1 tmpfile:file { getattr unlink };

allow $1 tmpfile:lnk_file { getattr unlink };

allow $1 tmpfile:fifo_file { getattr unlink };

allow $1 tmpfile:sock_file { getattr unlink };

')

define(`files_remove_all_tmp_data_depend',`

attribute tmpfile;

class dir { getattr search read write add_name remove_name rmdir };

class file { getattr unlink };

class lnk_file { getattr unlink };

class fifo_file { getattr unlink };

class sock_file { getattr unlink };

')

########################################

#

# files_search_general_application_resources_dir(domain)

#

define(`files_search_general_application_resources_dir',`

requires_block_template(`$0'_depend)

allow $1 usr_t:dir search;

')

define(`files_search_general_application_resources_dir_depend',`

type usr_t;

class dir search;

')

########################################

#

# files_read_general_application_resources(domain)

#

define(`files_read_general_application_resources',`

requires_block_template(`$0'_depend)

allow $1 usr_t:dir { getattr search read };

allow $1 usr_t:{ file lnk_file } { getattr read };

')

define(`files_read_general_application_resources_depend',`

type usr_t;

class dir { getattr search read };

class file { getattr read };

class lnk_file { getattr read };

')

########################################

## <interface name="files_execute_system_source_code_scripts">

##	<description>

##		Execute programs in /usr/src in the caller domain.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<infoflow type="none"/>

## </interface>

#

define(`files_execute_system_source_code_scripts',`

requires_block_template(`$0'_depend)

allow $1 usr_t:dir search;

allow $1 src_t:dir { getattr search read };

allow $1 src_t:lnk_file { getattr read };

allow $1 src_t:file { getattr read execute execute_no_trans };

')

define(`files_read_system_source_code_depend',`

type usr_t, src_t;

class dir { getattr search read };

class file { getattr read execute execute_no_trans };

class lnk_file { getattr read };

')

########################################

#

# files_read_system_source_code(domain)

#

define(`files_read_system_source_code',`

requires_block_template(`$0'_depend)

allow $1 usr_t:dir search;

allow $1 src_t:dir { getattr search read };

allow $1 src_t:{ file lnk_file } { getattr read };

')

define(`files_read_system_source_code_depend',`

type usr_t, src_t;

class dir { getattr search read };

class file { getattr read };

class lnk_file { getattr read };

')

########################################

#

# files_search_system_state_data_directory(domain)

#

define(`files_search_system_state_data_directory',`

requires_block_template(`$0'_depend)

allow $1 var_t:dir search;

')

define(`files_search_system_state_data_directory_depend',`

type var_t;

class dir search;

')

########################################

#

# files_ignore_search_system_state_data_directory(domain)

#

define(`files_ignore_search_system_state_data_directory',`

requires_block_template(`$0'_depend)

dontaudit $1 var_t:dir search;

')

define(`files_ignore_search_system_state_data_directory_depend',`

type var_t;

class dir search;

')

########################################

#

# files_manage_pseudorandom_saved_seed(domain)

#

define(`files_manage_pseudorandom_saved_seed',`

requires_block_template(`$0'_depend)

allow $1 var_t:dir search;

allow $1 var_lib_t:dir { getattr search read write add_name remove_name };

allow $1 var_lib_t:file { getattr create read write setattr unlink };

')

define(`files_manage_pseudorandom_saved_seed_depend',`

type var_t, var_lib_t;

class dir { getattr search read write add_name remove_name };

class file { getattr create read write setattr unlink };

')

########################################

#

# files_get_system_lock_file_attributes(domain)

#

define(`files_get_system_lock_file_attributes',`

requires_block_template(`$0'_depend)

allow $1 var_lock_t:dir { getattr search read };

allow $1 var_lock_t:file getattr;

')

define(`files_get_system_lock_file_attributes_depend',`

type var_lock_t;

class dir { getattr search read };

class file getattr;

')

########################################

#

# files_manage_system_lock_files(domain)

#

define(`files_manage_system_lock_files',`

requires_block_template(`$0'_depend)

allow $1 var_lock_t:dir { getattr search create read write setattr add_name remove_name rmdir };

allow $1 var_lock_t:file { getattr create read write setattr unlink };

')

define(`files_manage_system_lock_files_depend',`

type var_lock_t;

class dir { getattr search create read write setattr add_name remove_name rmdir };

class file { getattr create read write setattr unlink };

')

########################################

#

# files_remove_all_lock_files(domain)

#

define(`files_remove_all_lock_files',`

requires_block_template(`$0'_depend)

allow $1 lockfile:dir { getattr search read write add_name remove_name };

allow $1 lockfile:file { getattr unlink };

')

define(`files_remove_all_lock_files_depend',`

attribute lockfile;

class dir { getattr search read write add_name remove_name };

class file { getattr unlink };

')

########################################

#

# files_create_private_lock_file(domain,private_type,[object class(es)])

#

define(`files_create_private_lock_file',`

requires_block_template(`$0'_depend)

allow $1 var_t:dir search;

allow $1 var_lock_t:dir { getattr search read write add_name remove_name };

ifelse(`$3',`',`

type_transition $1 var_lock_t:file $2;