## <module name="mount" layer="system">

## <summary>Policy for mount.</summary>

########################################

## <interface name="mount_domtrans">

##	<description>

##		Execute mount in the mount domain.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

## </interface>

#

define(`mount_domtrans',`

	requires_block_template(`$0'_depend)

	allow $1 mount_exec_t:file rx_file_perms;

	allow $1 mount_t:process transition;

	type_transition $1 mount_exec_t:process mount_t;

	dontaudit $1 mount_t:process { noatsecure siginh rlimitinh };

	allow $1 mount_t:fd use;

	allow mount_t $1:fd use;

	allow mount_t $1:fifo_file rw_file_perms;

	allow mount_t $1:process sigchld;

')

define(`mount_domtrans_depend',`

	type mount_t, mount_exec_t;

	class file rx_file_perms;

	class process { transition noatsecure siginh rlimitinh sigchld };

	class fd use;

	class fifo_file rw_file_perms;

')

########################################

## <interface name="mount_run">

##	<description>

##		Execute mount in the mount domain, and

##		allow the specified role the mount domain,

##		and use the caller's terminal.

##	</description>

##	<parameter name="domain">

##		The type of the process performing this action.

##	</parameter>

##	<parameter name="role">

##		The role to be allowed the mount domain.

##	</parameter>

##	<parameter name="terminal">

##		The type of the terminal allow the mount domain to use.

##	</parameter>

## </interface>

#

define(`mount_run',`

	requires_block_template(`$0'_depend)

	mount_domtrans($1)

	role $2 types mount_t;

	allow mount_t $3:chr_file rw_file_perms;

')

define(`mount_run_depend',`

	type mount_t;

	class chr_file rw_file_perms;

')

########################################

## <interface name="mount_use_fd">

##     <description>

##             Use file descriptors for mount.

##     </description>

##     <parameter name="domain">

##             The type of the process performing this action.

##     </parameter>

## </interface>

#

define(`mount_use_fd',`

	requires_block_template(`$0'_depend)

	allow $1 mount_t:fd use; 

')

define(`mount_use_fd_depend',`

	type mount_t;

	class fd use;

')

########################################

## <interface name="mount_send_nfs_client_request">

##     <description>

##             Allow the mount domain to send nfs requests for mounting

##             network drives

##     </description>

##     <parameter name="domain">

##             The type of the process performing this action.

##     </parameter>

## </interface>

#

define(`mount_send_nfs_client_request',`

	requires_block_template(`$0'_depend)

	allow $1 mount_t:udp_socket rw_socket_perms;

')

define(`mount_send_nfs_client_request_depend',`

	type mount_t;

	class udp_socket rw_socket_perms;

')

## </module>