## <module name="udev" layer="system">

## <summary>Policy for udev.</summary>

########################################

## <interface name="udev_domtrans">

##     <description>

##             Execute udev in the udev domain.

##     </description>

##     <parameter name="domain">

##             The type of the process performing this action.

##     </parameter>

## </interface>

#

define(`udev_domtrans',`

	requires_block_template(`$0'_depend)

	domain_auto_trans($1, udev_exec_t, udev_t)

	allow $1 udev_t:fd use;

	allow udev_t $1:fd use;

	allow udev_t $1:fifo_file rw_file_perms;

	allow udev_t $1:process sigchld;

')

define(`udev_domtrans_depend',`

	type udev_t, udev_exec_t;

	class file { getattr read execute };

	class process { transition noatsecure siginh rlimitinh sigchld };

	class fd use;

	class fifo_file rw_file_perms;

')

########################################

## <interface name="udev_read_db">

##     <description>

##             Allow process to read list of devices.

##     </description>

##     <parameter name="domain">

##             The type of the process performing this action.

##     </parameter>

## </interface>

#

define(`udev_read_db',`

	requires_block_template(`$0'_depend)

	allow $1 udev_tdb_t:file r_file_perms;

')

define(`udev_read_db_depend',`

	type udev_tdb_t;

	class file r_file_perms;

')

########################################

## <interface name="udev_rw_db">

##     <description>

##             Allow process to modify list of devices.

##     </description>

##     <parameter name="domain">

##             The type of the process performing this action.

##     </parameter>

## </interface>

#

define(`udev_rw_db',`

	requires_block_template(`$0'_depend)

	allow $1 udev_tdb_t:file rw_file_perms;

')

define(`udev_rw_db_depend',`

	type udev_tdb_t;

	class file rw_file_perms;

')

## </module>