#DESC kudzu - Red Hat utility to recognise new hardware

#

# Author:  Russell Coker <russell@coker.com.au>

#

daemon_base_domain(kudzu, `, etc_writer, privmodule, sysctl_kernel_writer, fs_domain, privmem')

read_locale(kudzu_t)

# for /etc/sysconfig/hwconf - probably need a new type

allow kudzu_t etc_runtime_t:file rw_file_perms;

# for kmodule

if (allow_execmem) {

allow kudzu_t self:process execmem;

}

allow kudzu_t zero_device_t:chr_file rx_file_perms;

allow kudzu_t memory_device_t:chr_file { read write execute };

allow kudzu_t ramfs_t:dir search;

allow kudzu_t ramfs_t:sock_file write;

allow kudzu_t self:capability { dac_override sys_admin sys_rawio net_admin sys_tty_config mknod };

allow kudzu_t modules_conf_t:file { getattr read unlink rename };

allow kudzu_t modules_object_t:dir r_dir_perms;

allow kudzu_t { modules_object_t modules_dep_t }:file { getattr read };

allow kudzu_t mouse_device_t:chr_file { read write };

allow kudzu_t proc_net_t:dir r_dir_perms;

allow kudzu_t { proc_net_t proc_t }:file { getattr read };

allow kudzu_t { fixed_disk_device_t removable_device_t }:blk_file rw_file_perms;

allow kudzu_t scsi_generic_device_t:chr_file r_file_perms;

allow kudzu_t { bin_t sbin_t }:dir { getattr search };

allow kudzu_t { bin_t sbin_t }:lnk_file read;

read_sysctl(kudzu_t)

allow kudzu_t sysctl_dev_t:dir { getattr search read };

allow kudzu_t sysctl_dev_t:file { getattr read };

allow kudzu_t sysctl_kernel_t:file write;

allow kudzu_t usbdevfs_t:dir search;

allow kudzu_t usbdevfs_t:file { getattr read };

allow kudzu_t usbfs_t:dir search;

allow kudzu_t usbfs_t:file { getattr read };

var_run_domain(kudzu)

allow kudzu_t kernel_t:system syslog_console;

allow kudzu_t self:udp_socket { create ioctl };

allow kudzu_t var_lock_t:dir search;

allow kudzu_t devpts_t:dir search;

# so it can write messages to the console

allow kudzu_t { tty_device_t devtty_t admin_tty_type }:chr_file rw_file_perms;

role sysadm_r types kudzu_t;

ifdef(`targeted_policy', `', `

domain_auto_trans(sysadm_t, kudzu_exec_t, kudzu_t)

')

ifdef(`anaconda.te', `

domain_auto_trans(anaconda_t, kudzu_exec_t, kudzu_t)

')

allow kudzu_t sysadm_home_dir_t:dir search;

rw_dir_create_file(kudzu_t, etc_t)

rw_dir_create_file(kudzu_t, mnt_t)

can_exec(kudzu_t, { bin_t sbin_t init_exec_t })

# Read /usr/lib/gconv/gconv-modules.*

allow kudzu_t lib_t:file { read getattr };

# Read /usr/share/hwdata/.* and /usr/share/terminfo/l/linux

allow kudzu_t usr_t:file { read getattr };

r_dir_file(kudzu_t, hwdata_t)

# Communicate with rhgb-client.

allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };

allow kudzu_t self:unix_dgram_socket create_socket_perms;

ifdef(`rhgb.te', `

allow kudzu_t rhgb_t:unix_stream_socket connectto;

')

allow kudzu_t self:file { getattr read };

allow kudzu_t self:fifo_file rw_file_perms;

ifdef(`gpm.te', `

allow kudzu_t gpmctl_t:sock_file getattr;

')

can_exec(kudzu_t, shell_exec_t)

# Write to /proc/sys/kernel/hotplug.  Why?

allow kudzu_t sysctl_hotplug_t:file { read write };

allow kudzu_t sysfs_t:dir { getattr read search };

allow kudzu_t sysfs_t:file { getattr read };

allow kudzu_t sysfs_t:lnk_file read;

file_type_auto_trans(kudzu_t, etc_t, etc_runtime_t, file)

allow kudzu_t tape_device_t:chr_file r_file_perms;

tmp_domain(kudzu, `', `{ file dir chr_file }')

# for file systems that are not yet mounted

dontaudit kudzu_t file_t:dir search;

ifdef(`lpd.te', `

allow kudzu_t printconf_t:file { getattr read };

')

ifdef(`cups.te', `

allow kudzu_t cupsd_rw_etc_t:dir r_dir_perms;

')

dontaudit kudzu_t src_t:dir search;

ifdef(`xserver.te', `

allow kudzu_t xserver_exec_t:file getattr;

')

ifdef(`userhelper.te', `

role system_r types sysadm_userhelper_t;

domain_auto_trans(kudzu_t, userhelper_exec_t, sysadm_userhelper_t)

')

allow kudzu_t initrc_t:unix_stream_socket connectto;

allow kudzu_t net_conf_t:file { getattr read };