# Copyright (C) 2005 Tresys Technology, LLC
## <module name="storage" layer="kernel">
## <summary>Policy for filesystems.</summary>

########################################
#
# filesystem_make_filesystem(type)
#
define(`filesystem_make_filesystem',`
requires_block_template(`$0'_depend)
typeattribute $1 fs_type;
')

define(`filesystem_make_filesystem_depend',`
attribute fs_type;
')

########################################
#
# filesystem_associate(type)
#
define(`filesystem_associate',`
requires_block_template(`$0'_depend)
allow $1 fs_t:filesystem associate;
')

define(`filesystem_associate_depend',`
type fs_t;
class filesystem associate;
')

########################################
#
# filesystem_noxattr_associate(type)
#
define(`filesystem_noxattr_associate',`
requires_block_template(`$0'_depend)
allow $1 autofs_t:filesystem associate;
allow $1 cifs_t:filesystem associate;
allow $1 dosfs_t:filesystem associate;
allow $1 iso9660_t:filesystem associate;
allow $1 nfs_t:filesystem associate;
allow $1 removable_t:filesystem associate;
allow $1 usbfs_t:filesystem associate;
')

define(`filesystem_noxattr_associate_depend',`
type fs_t, nfs_t, cifs_t, dosfs_t, iso9660_t, autofs_t, usbfs_t, removable_t;
class filesystem associate;
')

########################################
#
# filesystem_mount_persistent_filesystem(domain)
#
define(`filesystem_mount_persistent_filesystem',`
requires_block_template(`$0'_depend)
allow $1 fs_t:filesystem mount;
')

define(`filesystem_mount_persistent_filesystem_depend',`
type fs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_persistent_filesystem(domain)
#
define(`filesystem_remount_persistent_filesystem',`
requires_block_template(`$0'_depend)
allow $1 fs_t:filesystem remount;
')

define(`filesystem_remount_persistent_filesystem_depend',`
type fs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_persistent_filesystem(domain)
#
define(`filesystem_unmount_persistent_filesystem',`
requires_block_template(`$0'_depend)
allow $1 fs_t:filesystem mount;
')

define(`filesystem_unmount_persistent_filesystem_depend',`
type fs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_persistent_filesystem_attributes(domain)
#
define(`filesystem_get_persistent_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 fs_t:filesystem getattr;
')

define(`filesystem_get_persistent_filesystem_attributes_depend',`
type fs_t;
class filesystem getattr;
')

########################################
#
# filesystem_ignore_get_persistent_filesystem_attributes(domain)
#
define(`filesystem_ignore_get_persistent_filesystem_attributes',`
requires_block_template(`$0'_depend)
dontaudit $1 fs_t:filesystem getattr;
')

define(`filesystem_ignore_get_persistent_filesystem_attributes_depend',`
type fs_t;
class filesystem getattr;
')

########################################
#
# filesystem_relabelfrom_persistent_filesystem(domain)
#
define(`filesystem_relabelfrom_persistent_filesystem',`
requires_block_template(`$0'_depend)
allow $1 fs_t:filesystem relabelfrom;
')

define(`filesystem_relabelfrom_persistent_filesystem_depend',`
type fs_t;
class filesystem relabelfrom;
')

########################################
#
# filesystem_mount_automount_filesystem(domain)
#
define(`filesystem_mount_automount_filesystem',`
requires_block_template(`$0'_depend)
allow $1 autofs_t:filesystem mount;
')

define(`filesystem_mount_automount_filesystem_depend',`
type autofs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_automount_filesystem(domain)
#
define(`filesystem_remount_automount_filesystem',`
requires_block_template(`$0'_depend)
allow $1 autofs_t:filesystem remount;
')

define(`filesystem_remount_automount_filesystem_depend',`
type autofs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_automount_filesystem(domain)
#
define(`filesystem_unmount_automount_filesystem',`
requires_block_template(`$0'_depend)
allow $1 autofs_t:filesystem mount;
')

define(`filesystem_unmount_automount_filesystem_depend',`
type autofs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_automount_filesystem_attributes(domain)
#
define(`filesystem_get_automount_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 autofs_t:filesystem getattr;
')

define(`filesystem_get_automount_filesystem_attributes_depend',`
type autofs_t;
class filesystem getattr;
')

########################################
#
# filesystem_register_binary_executable_type(domain)
#
define(`filesystem_register_binary_executable_type',`
requires_block_template(`$0'_depend)
allow $1 binfmt_misc_fs_t:dir { getattr search };
allow $1 binfmt_misc_fs_t:file { getattr ioctl write };
')

define(`filesystem_register_binary_executable_type_depend',`
type binfmt_misc_fs_t;
class dir { getattr search };
class file { getattr ioctl write };
')

########################################
#
# filesystem_mount_windows_network_filesystem(domain)
#
define(`filesystem_mount_windows_network_filesystem',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:filesystem mount;
')

define(`filesystem_mount_windows_network_filesystem_depend',`
type cifs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_windows_network_filesystem(domain)
#
define(`filesystem_remount_windows_network_filesystem',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:filesystem remount;
')

define(`filesystem_remount_windows_network_filesystem_depend',`
type cifs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_windows_network_filesystem(domain)
#
define(`filesystem_unmount_windows_network_filesystem',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:filesystem mount;
')

define(`filesystem_unmount_windows_network_filesystem_depend',`
type cifs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_windows_network_filesystem_attributes(domain)
#
define(`filesystem_get_windows_network_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:filesystem getattr;
')

define(`filesystem_get_windows_network_filesystem_attributes_depend',`
type cifs_t;
class filesystem getattr;
')

########################################
#
# filesystem_execute_windows_network_files(domain)
#
define(`filesystem_execute_windows_network_files',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read };
allow $1 cifs_t:file { getattr read execute execute_no_trans };
')

define(`filesystem_execute_windows_network_files_depend',`
type cifs_t;
class dir { getattr search read };
class file { getattr read execute execute_no_trans };
')

########################################
#
# filesystem_manage_windows_network_directories(domain)
#
define(`filesystem_manage_windows_network_directories',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')

define(`filesystem_manage_windows_network_directories_depend',`
type cifs_t;
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')

########################################
#
# filesystem_manage_windows_network_files(domain)
#
define(`filesystem_manage_windows_network_files',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_windows_network_files_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_manage_windows_network_symbolic_links(domain)
#
define(`filesystem_manage_windows_network_symbolic_links',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_windows_network_symbolic_links_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_manage_windows_network_named_pipes(domain)
#
define(`filesystem_manage_windows_network_named_pipes',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_windows_network_named_pipes_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_manage_windows_network_named_sockets(domain)
#
define(`filesystem_manage_windows_network_named_sockets',`
requires_block_template(`$0'_depend)
allow $1 cifs_t:dir { getattr search read write add_name remove_name };
allow $1 cifs_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_windows_network_named_sockets_depend',`
type cifs_t;
class dir { getattr search read write add_name remove_name };
class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_mount_dos_filesystem(domain)
#
define(`filesystem_mount_dos_filesystem',`
requires_block_template(`$0'_depend)
allow $1 dosfs_t:filesystem mount;
')

define(`filesystem_mount_dos_filesystem_depend',`
type dosfs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_dos_filesystem(domain)
#
define(`filesystem_remount_dos_filesystem',`
requires_block_template(`$0'_depend)
allow $1 dosfs_t:filesystem remount;
')

define(`filesystem_remount_dos_filesystem_depend',`
type dosfs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_dos_filesystem(domain)
#
define(`filesystem_unmount_dos_filesystem',`
requires_block_template(`$0'_depend)
allow $1 dosfs_t:filesystem mount;
')

define(`filesystem_unmount_dos_filesystem_depend',`
type dosfs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_dos_filesystem_attributes(domain)
#
define(`filesystem_get_dos_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 dosfs_t:filesystem getattr;
')

define(`filesystem_get_dos_filesystem_attributes_depend',`
type dosfs_t;
class filesystem getattr;
')

########################################
#
# filesystem_relabelfrom_dos_filesystem(domain)
#
define(`filesystem_relabelfrom_dos_filesystem',`
requires_block_template(`$0'_depend)
allow $1 dosfs_t:filesystem relabelfrom;
')

define(`filesystem_relabelfrom_dos_filesystem_depend',`
type dosfs_t;
class filesystem relabelfrom;
')

########################################
#
# filesystem_mount_cd_filesystem(domain)
#
define(`filesystem_mount_cd_filesystem',`
requires_block_template(`$0'_depend)
allow $1 iso9660_t:filesystem mount;
')

define(`filesystem_mount_cd_filesystem_depend',`
type iso9660_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_cd_filesystem(domain)
#
define(`filesystem_remount_cd_filesystem',`
requires_block_template(`$0'_depend)
allow $1 iso9660_t:filesystem remount;
')

define(`filesystem_remount_cd_filesystem_depend',`
type iso9660_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_cd_filesystem(domain)
#
define(`filesystem_unmount_cd_filesystem',`
requires_block_template(`$0'_depend)
allow $1 iso9660_t:filesystem mount;
')

define(`filesystem_unmount_cd_filesystem_depend',`
type iso9660_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_cd_filesystem_attributes(domain)
#
define(`filesystem_get_cd_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 iso9660_t:filesystem getattr;
')

define(`filesystem_get_cd_filesystem_attributes_depend',`
type iso9660_t;
class filesystem getattr;
')

########################################
#
# filesystem_mount_nfs_filesystem(domain)
#
define(`filesystem_mount_nfs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:filesystem mount;
')

define(`filesystem_mount_nfs_filesystem_depend',`
type nfs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_nfs_filesystem(domain)
#
define(`filesystem_remount_nfs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:filesystem remount;
')

define(`filesystem_remount_nfs_filesystem_depend',`
type nfs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_nfs_filesystem(domain)
#
define(`filesystem_unmount_nfs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:filesystem mount;
')

define(`filesystem_unmount_nfs_filesystem_depend',`
type nfs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_nfs_filesystem_attributes(domain)
#
define(`filesystem_get_nfs_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:filesystem getattr;
')

define(`filesystem_get_nfs_filesystem_attributes_depend',`
type nfs_t;
class filesystem getattr;
')

########################################
#
# filesystem_execute_nfs_files(domain)
#
define(`filesystem_execute_nfs_files',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read };
allow $1 nfs_t:file { getattr read execute execute_no_trans };
')

define(`filesystem_execute_nfs_files_depend',`
type nfs_t;
class dir { getattr search read };
class file { getattr read execute execute_no_trans };
')

########################################
#
# filesystem_manage_nfs_directories(domain)
#
define(`filesystem_manage_nfs_directories',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')

define(`filesystem_manage_nfs_directories_depend',`
type nfs_t;
class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir };
')

########################################
#
# filesystem_manage_nfs_files(domain)
#
define(`filesystem_manage_nfs_files',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_nfs_files_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_manage_nfs_symbolic_links(domain)
#
define(`filesystem_manage_nfs_symbolic_links',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_nfs_symbolic_links_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class lnk_file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_manage_nfs_named_pipes(domain)
#
define(`filesystem_manage_nfs_named_pipes',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_nfs_named_pipes_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class fifo_file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_manage_nfs_named_sockets(domain)
#
define(`filesystem_manage_nfs_named_sockets',`
requires_block_template(`$0'_depend)
allow $1 nfs_t:dir { getattr search read write add_name remove_name };
allow $1 nfs_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')

define(`filesystem_manage_nfs_named_sockets_depend',`
type nfs_t;
class dir { getattr search read write add_name remove_name };
class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
')

########################################
#
# filesystem_mount_nfsd_filesystem(domain)
#
define(`filesystem_mount_nfsd_filesystem',`
requires_block_template(`$0'_depend)
allow $1 nfsd_fs_t:filesystem mount;
')

define(`filesystem_mount_nfsd_filesystem_depend',`
type nfsd_fs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_nfsd_filesystem(domain)
#
define(`filesystem_remount_nfsd_filesystem',`
requires_block_template(`$0'_depend)
allow $1 nfsd_fs_t:filesystem remount;
')

define(`filesystem_remount_nfsd_filesystem_depend',`
type nfsd_fs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_nfsd_filesystem(domain)
#
define(`filesystem_unmount_nfsd_filesystem',`
requires_block_template(`$0'_depend)
allow $1 nfsd_fs_t:filesystem mount;
')

define(`filesystem_unmount_nfsd_filesystem_depend',`
type nfsd_fs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_nfsd_filesystem_attributes(domain)
#
define(`filesystem_get_nfsd_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 nfsd_fs_t:filesystem getattr;
')

define(`filesystem_get_nfsd_filesystem_attributes_depend',`
type nfsd_fs_t;
class filesystem getattr;
')

########################################
#
# filesystem_mount_ram_filesystem(domain)
#
define(`filesystem_mount_ram_filesystem',`
requires_block_template(`$0'_depend)
allow $1 ramfs_t:filesystem mount;
')

define(`filesystem_mount_ram_filesystem_depend',`
type ramfs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_ram_filesystem(domain)
#
define(`filesystem_remount_ram_filesystem',`
requires_block_template(`$0'_depend)
allow $1 ramfs_t:filesystem remount;
')

define(`filesystem_remount_ram_filesystem_depend',`
type ramfs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_ram_filesystem(domain)
#
define(`filesystem_unmount_ram_filesystem',`
requires_block_template(`$0'_depend)
allow $1 ramfs_t:filesystem mount;
')

define(`filesystem_unmount_ram_filesystem_depend',`
type ramfs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_ram_filesystem_attributes(domain)
#
define(`filesystem_get_ram_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 ramfs_t:filesystem getattr;
')

define(`filesystem_get_ram_filesystem_attributes_depend',`
type ramfs_t;
class filesystem getattr;
')

########################################
#
# filesystem_mount_rom_filesystem(domain)
#
define(`filesystem_mount_rom_filesystem',`
requires_block_template(`$0'_depend)
allow $1 romfs_t:filesystem mount;
')

define(`filesystem_mount_rom_filesystem_depend',`
type romfs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_rom_filesystem(domain)
#
define(`filesystem_remount_rom_filesystem',`
requires_block_template(`$0'_depend)
allow $1 romfs_t:filesystem remount;
')

define(`filesystem_remount_rom_filesystem_depend',`
type romfs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_rom_filesystem(domain)
#
define(`filesystem_unmount_rom_filesystem',`
requires_block_template(`$0'_depend)
allow $1 romfs_t:filesystem mount;
')

define(`filesystem_unmount_rom_filesystem_depend',`
type romfs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_rom_filesystem_attributes(domain)
#
define(`filesystem_get_rom_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 romfs_t:filesystem getattr;
')

define(`filesystem_get_rom_filesystem_attributes_depend',`
type romfs_t;
class filesystem getattr;
')

########################################
#
# filesystem_mount_rpc_pipefs_filesystem(domain)
#
define(`filesystem_mount_rpc_pipefs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem mount;
')

define(`filesystem_mount_rpc_pipefs_filesystem_depend',`
type rpc_pipefs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_rpc_pipefs_filesystem(domain)
#
define(`filesystem_remount_rpc_pipefs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem remount;
')

define(`filesystem_remount_rpc_pipefs_filesystem_depend',`
type rpc_pipefs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_rpc_pipefs_filesystem(domain)
#
define(`filesystem_unmount_rpc_pipefs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem mount;
')

define(`filesystem_unmount_rpc_pipefs_filesystem_depend',`
type rpc_pipefs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_rpc_pipefs_filesystem_attributes(domain)
#
define(`filesystem_get_rpc_pipefs_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem getattr;
')

define(`filesystem_get_rpc_pipefs_filesystem_attributes_depend',`
type rpc_pipefs_t;
class filesystem getattr;
')

########################################
#
# filesystem_mount_tmpfs_filesystem(domain)
#
define(`filesystem_mount_tmpfs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:filesystem mount;
')

define(`filesystem_mount_tmpfs_filesystem_depend',`
type tmpfs_t;
class filesystem mount;
')

########################################
#
# filesystem_remount_tmpfs_filesystem(domain)
#
define(`filesystem_remount_tmpfs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:filesystem remount;
')

define(`filesystem_remount_tmpfs_filesystem_depend',`
type tmpfs_t;
class filesystem remount;
')

########################################
#
# filesystem_unmount_tmpfs_filesystem(domain)
#
define(`filesystem_unmount_tmpfs_filesystem',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:filesystem mount;
')

define(`filesystem_unmount_tmpfs_filesystem_depend',`
type tmpfs_t;
class filesystem unmount;
')

########################################
#
# filesystem_get_tmpfs_filesystem_attributes(domain)
#
define(`filesystem_get_tmpfs_filesystem_attributes',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:filesystem getattr;
')

define(`filesystem_get_tmpfs_filesystem_attributes_depend',`
type tmpfs_t;
class filesystem getattr;
')

########################################
## <interface name="filesystem_tmpfs_associate">
##	<description>
##		Allow the type to associate to tmpfs filesystems.
##	</description>
##	<parameter name="type">
##		The type of the object to be associated.
##	</parameter>
##	<infoflow type="none"/>
## </interface>
#
define(`filesystem_tmpfs_associate',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:filesystem associate;
')

define(`filesystem_tmpfs_associate_depend',`
type tmpfs_t;
class filesystem associate;
')

########################################
#
# filesystem_create_private_tmpfs_data(domain,derivedtype,[class])
#
define(`filesystem_create_private_tmpfs_data',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read write add_name };
ifelse(`$3',`',`
type_transition $1 tmpfs_t:file $2;
',`
type_transition $1 tmpfs_t:$3 $2;
')
allow $2 tmpfs_t:filesystem associate;
')

define(`filesystem_create_private_tmpfs_data_depend',`
type tmpfs_t;
class dir { getattr search read write add_name }; 
class filesystem associate;
')

########################################
## <interface name="filesystem_use_tmpfs_character_devices">
##	<description>
##		Read and write character nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
##	<infoflow type="both" weight="10"/>
## </interface>
#
define(`filesystem_use_tmpfs_character_devices',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read };
allow $1 tmpfs_t:chr_file { getattr read write ioctl };
')

define(`filesystem_use_tmpfs_character_devices_depend',`
type tmpfs_t;
class dir { getattr search read }; 
class chr_file { getattr read write ioctl };
')

########################################
## <interface name="filesystem_relabel_tmpfs_character_devices">
##	<description>
##		Relabel character nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
##	<infoflow type="both" weight="10"/>
## </interface>
#
define(`filesystem_relabel_tmpfs_character_devices',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read };
allow $1 tmpfs_t:chr_file { getattr relabelfrom relabelto };
')

define(`filesystem_relabel_tmpfs_character_devices_depend',`
type tmpfs_t;
class dir { getattr search read }; 
class chr_file { getattr relabelfrom relabelto };
')

########################################
## <interface name="filesystem_use_tmpfs_block_devices">
##	<description>
##		Read and write block nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
##	<infoflow type="both" weight="10"/>
## </interface>
#
define(`filesystem_use_tmpfs_block_devices',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read };
allow $1 tmpfs_t:blk_file { getattr read write ioctl };
')

define(`filesystem_use_tmpfs_block_devices_depend',`
type tmpfs_t;
class dir { getattr search read }; 
class blk_file { getattr read write ioctl };
')

########################################
## <interface name="filesystem_relabel_tmpfs_block_devices">
##	<description>
##		Relabel block nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
##	<infoflow type="both" weight="10"/>
## </interface>
#
define(`filesystem_relabel_tmpfs_block_devices',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read };
allow $1 tmpfs_t:blk_file { getattr relabelfrom relabelto };
')

define(`filesystem_use_tmpfs_block_devices_depend',`
type tmpfs_t;
class dir { getattr search read }; 
class blk_file { getattr relabelfrom relabelto };
')

########################################
## <interface name="filesystem_manage_tmpfs_character_devices">
##	<description>
##		Read and write, create and delete character
##		nodes on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
##	<infoflow type="both" weight="10"/>
## </interface>
#
define(`filesystem_manage_tmpfs_character_devices',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read write add_name remove_name };
allow $1 tmpfs_t:chr_file { getattr read write ioctl create unlink setattr };
')

define(`filesystem_mange_tmpfs_character_devices_depend',`
type tmpfs_t;
class dir { getattr search read write add_name remove_name }; 
class chr_file { getattr read write ioctl create unlink setattr };
')

########################################
## <interface name="filesystem_manage_tmpfs_block_devices">
##	<description>
##		Read and write, create and delete block nodes
##		on tmpfs filesystems.
##	</description>
##	<parameter name="domain">
##		The type of the process performing this action.
##	</parameter>
##	<infoflow type="both" weight="10"/>
## </interface>
#
define(`filesystem_manage_tmpfs_block_devices',`
requires_block_template(`$0'_depend)
allow $1 tmpfs_t:dir { getattr search read write add_name remove_name };
allow $1 tmpfs_t:blk_file { getattr read write ioctl create unlink setattr };
')

define(`filesystem_manage_tmpfs_block_devices_depend',`
type tmpfs_t;
class dir { getattr search read write add_name remove_name }; 
class blk_file { getattr read write ioctl create unlink setattr };
')

########################################
#
# filesystem_mount_all_filesystems(type)
#
define(`filesystem_mount_all_filesystems',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem mount;
')

define(`filesystem_mount_all_filesystems_depend',`
attribute fs_type;
class filesystem mount;
')

########################################
#
# filesystem_remount_all_filesystems(type)
#
define(`filesystem_remount_all_filesystems',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem remount;
')

define(`filesystem_remount_all_filesystems_depend',`
attribute fs_type;
class filesystem remount;
')

########################################
#
# filesystem_unmount_all_filesystems(type)
#
define(`filesystem_unmount_all_filesystems',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem unmount;
')

define(`filesystem_mount_all_filesystems_depend',`
attribute fs_type;
class filesystem unmount;
')

########################################
#
# filesystem_get_all_filesystems_attributes(type)
#
define(`filesystem_get_all_filesystems_attributes',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem getattr;
')

define(`filesystem_get_all_filesystems_attributes_depend',`
attribute fs_type;
class filesystem getattr;
')

########################################
#
# filesystem_get_all_filesystems_quotas(type)
#
define(`filesystem_get_all_filesystems_quotas',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem quotaget;
')

define(`filesystem_get_all_filesystems_quotas_depend',`
attribute fs_type;
class filesystem quotaget;
')

########################################
#
# filesystem_set_all_filesystems_quotas(type)
#
define(`filesystem_set_all_filesystems_quotas',`
requires_block_template(`$0'_depend)
allow $1 fs_type:filesystem quotamod;
')

define(`filesystem_set_all_filesystems_quotas_depend',`
attribute fs_type;
class filesystem quotamod;
')

########################################
#
# filesystem_get_all_file_attributes(type)
#
define(`filesystem_get_all_file_attributes',`
requires_block_template(`$0'_depend)
allow $1 fs_type:dir { search getattr };
allow $1 fs_type:file getattr;
allow $1 fs_type:lnk_file getattr;
allow $1 fs_type:fifo_file getattr;
allow $1 fs_type:sock_file getattr;
')

define(`filesystem_get_all_file_attributes_depend',`
attribute fs_type;
class dir { search getattr };
class file getattr;
class lnk_file getattr;
class fifo_file getattr;
class sock_file getattr;
')

## </module>