policy_module(modutils,1.0)

########################################

#

# Declarations

#

# module loading config

type modules_conf_t;

files_make_file(modules_conf_t)

# module dependencies

type modules_dep_t;

files_make_file(modules_dep_t)

type insmod_t;

type insmod_exec_t;

kernel_userland_entry(insmod_t,insmod_exec_t)

init_make_system_domain(insmod_t,insmod_exec_t)

role system_r types insmod_t;

type depmod_t;

type depmod_exec_t;

init_make_system_domain(depmod_t,depmod_exec_t)

role system_r types depmod_t;

type update_modules_t;

type update_modules_exec_t;

init_make_system_domain(update_modules_t,update_modules_exec_t)

role system_r types update_modules_t;

type update_modules_tmp_t;

files_make_temporary_file(update_modules_tmp_t)

########################################

#

# insmod local policy

#

allow insmod_t self:capability { dac_override net_raw sys_tty_config };

allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };

allow insmod_t self:udp_socket create_socket_perms; 

allow insmod_t self:rawip_socket create_socket_perms; 

# Read module config and dependency information

allow insmod_t { modules_conf_t modules_dep_t }:file r_file_perms;

can_exec(insmod_t, insmod_exec_t)

kernel_load_module(insmod_t)

kernel_read_system_state(insmod_t)

kernel_search_sysfs(insmod_t)

kernel_search_usbfs(insmod_t)

# Rules for /proc/sys/kernel/tainted

kernel_read_kernel_sysctl(insmod_t)

kernel_rw_kernel_sysctl(insmod_t)

kernel_read_hotplug_sysctl(insmod_t)

bootloader_read_kernel_modules(insmod_t)

# for locking: (cjp: ????)

bootloader_write_kernel_modules(insmod_t)

dev_write_mtrr(insmod_t)

dev_read_urand(insmod_t)

dev_rw_agp_dev(insmod_t)

fs_getattr_xattr_fs(insmod_t)

corecommands_execute_general_programs(insmod_t)

corecommands_execute_system_programs(insmod_t)

corecommands_execute_shell(insmod_t)

domain_signal_all_domains(insmod_t)

domain_use_widely_inheritable_file_descriptors(insmod_t)

files_read_runtime_system_config(insmod_t)

files_read_general_system_config(insmod_t)

files_read_general_application_resources(insmod_t)

files_execute_system_config_script(insmod_t)

# for nscd:

files_ignore_search_runtime_data_directory(insmod_t)

# for when /var is not mounted early in the boot:

files_ignore_search_isid_type_dir(insmod_t)

init_use_control_channel(insmod_t)

init_use_file_descriptors(insmod_t)

init_script_use_file_descriptors(insmod_t)

init_script_use_pseudoterminal(insmod_t)

libraries_use_dynamic_loader(insmod_t)

libraries_use_shared_libraries(insmod_t)

logging_send_system_log_message(insmod_t)

logging_search_system_log_directory(insmod_t)

miscfiles_read_localization(insmod_t)

optional_policy(`mount.te',`

	mount_transition(insmod_t)

')

ifdef(`TODO',`

allow insmod_t apm_bios_t:chr_file { read write };

allow insmod_t sound_device_t:chr_file { read ioctl write };

ifdef(`xserver.te', `

	allow insmod_t xserver_log_t:file getattr;

')

# why is this needed?  insmod cannot mounton any dir

# and it also transitions to mount

allow insmod_t usbfs_t:filesystem mount;

') dnl if TODO

########################################

#

# depmod local policy

#

can_exec(depmod_t, depmod_exec_t)

# Read conf.modules.

allow depmod_t modules_conf_t:file r_file_perms;

allow depmod_t modules_dep_t:file create_file_perms;

bootloader_create_private_module_dir_entry(depmod_t,modules_dep_t)

kernel_read_system_state(depmod_t)

fs_getattr_xattr_fs(depmod_t)

term_use_console(depmod_t)

bootloader_read_kernel_symbol_table(depmod_t)

bootloader_read_kernel_modules(depmod_t)

init_use_file_descriptors(depmod_t)

init_script_use_file_descriptors(depmod_t)

init_script_use_pseudoterminal(depmod_t)

domain_use_widely_inheritable_file_descriptors(depmod_t)

files_read_runtime_system_config(depmod_t)

files_read_general_system_config(depmod_t)

files_read_system_source_code(depmod_t)

libraries_use_dynamic_loader(depmod_t)

libraries_use_shared_libraries(depmod_t)

ifdef(`TODO',`

allow depmod_t { bin_t sbin_t }:dir search;

ifdef(`gnome-pty-helper.te', `allow depmod_t sysadm_gph_t:fd use;')

# Read System.map from home directories.

allow depmod_t { home_root_t staff_home_dir_t sysadm_home_dir_t }:dir r_dir_perms;

r_dir_file(depmod_t, { staff_home_t sysadm_home_t })

') dnl end ifdef TODO

#################################

#

# update-modules local policy

#

allow update_modules_t self:fifo_file rw_file_perms;

allow update_modules_t modules_dep_t:file rw_file_perms;

can_exec(update_modules_t, insmod_exec_t)

can_exec(update_modules_t, update_modules_exec_t)

# manage module loading configuration

allow update_modules_t modules_conf_t:file create_file_perms;

bootloader_create_private_module_dir_entry(update_modules_t,modules_conf_t)

files_create_private_config(update_modules_t,modules_conf_t)

# transition to depmod

domain_auto_trans(update_modules_t, depmod_exec_t, depmod_t)

allow update_modules_t update_modules_tmp_t:dir create_dir_perms;

allow update_modules_t update_modules_tmp_t:file create_file_perms;

files_create_private_tmp_data(update_modules_t, update_modules_tmp_t, { file dir })

kernel_read_kernel_sysctl(update_modules_t)

kernel_read_system_state(update_modules_t)

dev_read_urand(update_modules_t)

fs_getattr_xattr_fs(update_modules_t)

term_use_console(update_modules_t)

init_use_file_descriptors(depmod_t)

init_script_use_file_descriptors(depmod_t)

init_script_use_pseudoterminal(depmod_t)

domain_use_widely_inheritable_file_descriptors(depmod_t)

files_read_runtime_system_config(update_modules_t)

files_read_general_system_config(update_modules_t)

files_execute_system_config_script(update_modules_t)

corecommands_execute_general_programs(update_modules_t)

corecommands_execute_system_programs(update_modules_t)

corecommands_execute_shell(update_modules_t)

libraries_use_dynamic_loader(update_modules_t)

libraries_use_shared_libraries(update_modules_t)

logging_send_system_log_message(update_modules_t)

miscfiles_read_localization(update_modules_t)

ifdef(`TODO',`

dontaudit update_modules_t sysadm_home_dir_t:dir search;

') dnl endif TODO