Chris PeBenito 3865d6
## <summary>Policy for udev.</summary>
Chris PeBenito dfb86a
Chris PeBenito 3865d6
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Execute udev in the udev domain.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito dfb86a
#
Chris PeBenito 199895
interface(`udev_domtrans',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type udev_t, udev_exec_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 7edd02
	domain_auto_trans($1, udev_exec_t, udev_t)
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 udev_t:fd use;
Chris PeBenito 0c73cd
	allow udev_t $1:fd use;
Chris PeBenito 0c73cd
	allow udev_t $1:fifo_file rw_file_perms;
Chris PeBenito 0c73cd
	allow udev_t $1:process sigchld;
Chris PeBenito dfb86a
')
Chris PeBenito dfb86a
Chris PeBenito dfb86a
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito 0500e0
##	Execute a udev helper in the udev domain.
Chris PeBenito 0500e0
## </summary>
Chris PeBenito 0500e0
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 0500e0
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 0500e0
## </param>
Chris PeBenito 0500e0
#
Chris PeBenito 0500e0
interface(`udev_helper_domtrans',`
Chris PeBenito 0500e0
	gen_require(`
Chris PeBenito 0500e0
		type udev_t, udev_helper_exec_t;
Chris PeBenito 0500e0
	')
Chris PeBenito 0500e0
Chris PeBenito 0500e0
	domain_auto_trans($1, udev_helper_exec_t, udev_t)
Chris PeBenito 0500e0
Chris PeBenito 0500e0
	allow $1 udev_t:fd use;
Chris PeBenito 0500e0
	allow udev_t $1:fd use;
Chris PeBenito 0500e0
	allow udev_t $1:fifo_file rw_file_perms;
Chris PeBenito 0500e0
	allow udev_t $1:process sigchld;
Chris PeBenito 0500e0
')
Chris PeBenito 0500e0
Chris PeBenito 0500e0
########################################
Chris PeBenito 0500e0
## <summary>
Chris PeBenito 4483ee
##	Allow process to read udev process state.
Chris PeBenito 4483ee
## </summary>
Chris PeBenito 4483ee
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 4483ee
##	Domain allowed access.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 4483ee
## </param>
Chris PeBenito 4483ee
#
Chris PeBenito 4483ee
interface(`udev_read_state',`
Chris PeBenito 4483ee
	gen_require(`
Chris PeBenito 4483ee
		type udev_t;
Chris PeBenito 4483ee
	')
Chris PeBenito 4483ee
Chris PeBenito 4483ee
	kernel_search_proc($1)
Chris PeBenito 4483ee
	allow $1 udev_t:file r_file_perms;
Chris PeBenito 4483ee
	allow $1 udev_t:lnk_file r_file_perms;
Chris PeBenito 4483ee
')
Chris PeBenito 4483ee
Chris PeBenito 4483ee
########################################
Chris PeBenito 4483ee
## <summary>
Chris PeBenito 98a8ea
##	Do not audit attempts to inherit a
Chris PeBenito 98a8ea
##	udev file descriptor.
Chris PeBenito 98a8ea
## </summary>
Chris PeBenito 98a8ea
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito 98a8ea
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito 98a8ea
## </param>
Chris PeBenito 98a8ea
#
Chris PeBenito 98a8ea
interface(`udev_dontaudit_use_fd',`
Chris PeBenito 98a8ea
	gen_require(`
Chris PeBenito 98a8ea
		type udev_t;
Chris PeBenito 98a8ea
	')
Chris PeBenito 98a8ea
Chris PeBenito 98a8ea
	dontaudit $1 udev_t:fd use;
Chris PeBenito 98a8ea
')
Chris PeBenito 98a8ea
Chris PeBenito 98a8ea
########################################
Chris PeBenito 98a8ea
## <summary>
Chris PeBenito ae9e27
##	Do not audit attempts to read or write
Chris PeBenito ae9e27
##	to a udev unix datagram socket.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	Domain to not audit.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito ae9e27
#
Chris PeBenito 1815ba
interface(`udev_dontaudit_rw_dgram_sockets',`
Chris PeBenito ae9e27
	gen_require(`
Chris PeBenito ae9e27
		type udev_t;
Chris PeBenito ae9e27
	')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
	dontaudit $1 udev_t:unix_dgram_socket { read write };
Chris PeBenito ae9e27
')
Chris PeBenito ae9e27
Chris PeBenito ae9e27
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Allow process to read list of devices.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito dfb86a
#
Chris PeBenito 199895
interface(`udev_read_db',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type udev_tdb_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	dev_list_all_dev_nodes($1)
Chris PeBenito 7edd02
	allow $1 udev_tdb_t:file r_file_perms;
Chris PeBenito dfb86a
')
Chris PeBenito dfb86a
Chris PeBenito 7bba9d
########################################
Chris PeBenito ae9e27
## <summary>
Chris PeBenito ae9e27
##	Allow process to modify list of devices.
Chris PeBenito ae9e27
## </summary>
Chris PeBenito ae9e27
## <param name="domain">
Chris PeBenito 885b83
##	<summary>
Chris PeBenito ae9e27
##	The type of the process performing this action.
Chris PeBenito 885b83
##	</summary>
Chris PeBenito ae9e27
## </param>
Chris PeBenito 7bba9d
#
Chris PeBenito 199895
interface(`udev_rw_db',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type udev_tdb_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 139520
	dev_list_all_dev_nodes($1)
Chris PeBenito 7edd02
	allow $1 udev_tdb_t:file rw_file_perms;
Chris PeBenito 7bba9d
')