Chris PeBenito e32d52
## <summary>Policy for mount.</summary>
Chris PeBenito b5ab18
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute mount in the mount domain.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito b5ab18
#
Chris PeBenito 199895
interface(`mount_domtrans',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type mount_t, mount_exec_t;
Chris PeBenito 139520
		class process sigchld;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
		class fifo_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	domain_auto_trans($1,mount_exec_t,mount_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 mount_t:fd use;
Chris PeBenito 0c73cd
	allow mount_t $1:fd use;
Chris PeBenito 0c73cd
	allow mount_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow mount_t $1:process sigchld;
Chris PeBenito b5ab18
')
Chris PeBenito b5ab18
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 414e41
##	Execute mount in the mount domain, and
Chris PeBenito 414e41
##	allow the specified role the mount domain,
Chris PeBenito 414e41
##	and use the caller's terminal.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="role">
Chris PeBenito 414e41
##	The role to be allowed the mount domain.
Chris PeBenito 414e41
## </param>
Chris PeBenito 414e41
## <param name="terminal">
Chris PeBenito 414e41
##	The type of the terminal allow the mount domain to use.
Chris PeBenito 414e41
## </param>
Chris PeBenito daa0e0
#
Chris PeBenito 199895
interface(`mount_run',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type mount_t;
Chris PeBenito 139520
		class chr_file rw_file_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	mount_domtrans($1)
Chris PeBenito 0c73cd
	role $2 types mount_t;
Chris PeBenito cc41a9
	allow mount_t $3:chr_file rw_file_perms;
Chris PeBenito daa0e0
')
Chris PeBenito daa0e0
Chris PeBenito 3865d6
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 7576fa
##	Execute mount in the caller domain.
Chris PeBenito 7576fa
## </summary>
Chris PeBenito 7576fa
## <param name="domain">
Chris PeBenito 7576fa
##	The type of the process performing this action.
Chris PeBenito 7576fa
## </param>
Chris PeBenito 7576fa
#
Chris PeBenito 7576fa
interface(`mount_exec',`
Chris PeBenito 7576fa
	gen_require(`
Chris PeBenito 7576fa
		type mount_exec_t;
Chris PeBenito 7576fa
	')
Chris PeBenito 7576fa
Chris PeBenito 7576fa
	allow $1 mount_exec_t:dir r_dir_perms;
Chris PeBenito 7576fa
	allow $1 mount_exec_t:lnk_file r_file_perms;
Chris PeBenito 7576fa
	can_exec($1,mount_exec_t)
Chris PeBenito 7576fa
Chris PeBenito 7576fa
')
Chris PeBenito 7576fa
Chris PeBenito 7576fa
########################################
Chris PeBenito 7576fa
## <summary>
Chris PeBenito f7ebea
##	Use file descriptors for mount.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito f7ebea
## <param name="domain">
Chris PeBenito f7ebea
##	The type of the process performing this action.
Chris PeBenito f7ebea
## </param>
Chris PeBenito b5ab18
#
Chris PeBenito 199895
interface(`mount_use_fd',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type mount_t;
Chris PeBenito 139520
		class fd use;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 mount_t:fd use; 
Chris PeBenito b5ab18
')
Chris PeBenito b5ab18
Chris PeBenito 3865d6
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito f7ebea
##	Allow the mount domain to send nfs requests for mounting
Chris PeBenito f7ebea
##	network drives
Chris PeBenito f7ebea
## </summary>
Chris PeBenito f7ebea
## <param name="domain">
Chris PeBenito f7ebea
##	The type of the process performing this action.
Chris PeBenito f7ebea
## </param>
Chris PeBenito b5ab18
#
Chris PeBenito 199895
interface(`mount_send_nfs_client_request',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type mount_t;
Chris PeBenito 139520
		class udp_socket rw_socket_perms;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito cc41a9
	allow $1 mount_t:udp_socket rw_socket_perms;
Chris PeBenito b5ab18
')
Chris PeBenito b5ab18