## <summary>Policy for udev.</summary>

########################################

##     <desc>

##             Execute udev in the udev domain.

##     </desc>

##     <param name="domain">

##             The type of the process performing this action.

##     </param>

#

interface(`udev_domtrans',`

	gen_require(`

		type udev_t, udev_exec_t;

		class process sigchld;

		class fd use;

		class fifo_file rw_file_perms;

	')

	domain_auto_trans($1, udev_exec_t, udev_t)

	allow $1 udev_t:fd use;

	allow udev_t $1:fd use;

	allow udev_t $1:fifo_file rw_file_perms;

	allow udev_t $1:process sigchld;

')

########################################

##     <desc>

##             Allow process to read list of devices.

##     </desc>

##     <param name="domain">

##             The type of the process performing this action.

##     </param>

#

interface(`udev_read_db',`

	gen_require(`

		type udev_tdb_t;

		class file r_file_perms;

	')

	dev_list_all_dev_nodes($1)

	allow $1 udev_tdb_t:file r_file_perms;

')

########################################

##     <desc>

##             Allow process to modify list of devices.

##     </desc>

##     <param name="domain">

##             The type of the process performing this action.

##     </param>

#

interface(`udev_rw_db',`

	gen_require(`

		type udev_tdb_t;

		class file rw_file_perms;

	')

	dev_list_all_dev_nodes($1)

	allow $1 udev_tdb_t:file rw_file_perms;

')