Blame strict/domains/program/readahead.te
|
Chris PeBenito |
77f6e2 |
#DESC readahead - read files in page cache
|
|
Chris PeBenito |
77f6e2 |
#
|
|
Chris PeBenito |
77f6e2 |
# Author: Dan Walsh (dwalsh@redhat.com)
|
|
Chris PeBenito |
77f6e2 |
#
|
|
Chris PeBenito |
77f6e2 |
|
|
Chris PeBenito |
77f6e2 |
#################################
|
|
Chris PeBenito |
77f6e2 |
#
|
|
Chris PeBenito |
77f6e2 |
# Declarations for readahead
|
|
Chris PeBenito |
77f6e2 |
#
|
|
Chris PeBenito |
77f6e2 |
|
|
Chris PeBenito |
77f6e2 |
daemon_domain(readahead)
|
|
Chris PeBenito |
77f6e2 |
#
|
|
Chris PeBenito |
77f6e2 |
# readahead asks for these
|
|
Chris PeBenito |
77f6e2 |
#
|
|
Chris PeBenito |
77f6e2 |
allow readahead_t { file_type -secure_file_type }:{ file lnk_file } { getattr read };
|
|
Chris PeBenito |
77f6e2 |
allow readahead_t { file_type -secure_file_type }:dir r_dir_perms;
|
|
Chris PeBenito |
77f6e2 |
dontaudit readahead_t shadow_t:file { getattr read };
|
|
Chris PeBenito |
77f6e2 |
allow readahead_t { device_t device_type }:{ lnk_file chr_file blk_file } getattr;
|
|
Chris PeBenito |
77f6e2 |
dontaudit readahead_t file_type:sock_file getattr;
|
|
Chris PeBenito |
77f6e2 |
allow readahead_t proc_t:file { getattr read };
|
|
Chris PeBenito |
77f6e2 |
dontaudit readahead_t device_type:blk_file read;
|