## <module name="selinux">
## <summary>
##	Policy for kernel security interface, in particular, selinuxfs.
## </summary>

########################################
## <interface name="selinux_get_fs_mount">
##	<desc>
## 		Gets the caller the mountpoint of the selinuxfs filesystem.
##	</desc>
##	<param name="domain">
##		The process type requesting the selinuxfs mountpoint.
##	</param>
## </interface>
#
interface(`selinux_get_fs_mount',`
	# read /proc/filesystems to see if selinuxfs is supported
	# then read /proc/self/mount to see where selinuxfs is mounted
	kernel_read_system_state($1)
')

########################################
## <interface name="selinux_get_enforce_mode">
##	<desc>
## 		Allows the caller to get the mode of policy enforcement
## 		(enforcing or permissive mode).
##	</desc>
##	<param name="domain">
##		The process type to allow to get the enforcing mode.
##	</param>
## </interface>
#
interface(`selinux_get_enforce_mode',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read };
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read };
')

########################################
## <interface name="selinux_set_enforce_mode">
##	<desc>
## 		Allow caller to set the mode of policy enforcement
## 		(enforcing or permissive mode).
##	</desc>
##	<param name="domain">
##		The process type to allow to set the enforcement mode.
##	</param>
## </interface>
#
interface(`selinux_set_enforce_mode',`
	gen_require(`
		type security_t;
		attribute can_setenforce;
		class dir { read search getattr };
		class file { getattr read write };
		class security setenforce;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security setenforce;
	auditallow $1 security_t:security setenforce;
	typeattribute $1 can_setenforce;
')

########################################
## <interface name="selinux_load_policy">
##	<desc>
## 		Allow caller to load the policy into the kernel.
##	</desc>
##	<param name="domain">
##		The process type that will load the policy.
##	</param>
## </interface>
#
interface(`selinux_load_policy',`
	gen_require(`
		type security_t;
		attribute can_load_policy;
		class dir { read search getattr };
		class file { getattr read write };
		class security load_policy;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security load_policy;
	auditallow $1 security_t:security load_policy;
	typeattribute $1 can_load_policy;
')

########################################
## <interface name="selinux_set_boolean">
##	<desc>
## 		Allow caller to set the state of Booleans to
## 		enable or disable conditional portions of the policy.
##	</desc>
##	<param name="domain">
##		The process type allowed to set the Boolean.
##	</param>
##	<param name="booltype" optional="true">
##		The type of Booleans the caller is allowed to set.
##	</param>
## </interface>
#
interface(`selinux_set_boolean',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read write };
		class security setbool;
	')

	ifelse(`$2',`',`
		allow $1 security_t:dir { getattr search read };
		allow $1 security_t:file { getattr read write };
	',`
		allow $1 $2:dir { getattr search read };
		allow $1 $2:file { getattr read write };
	')

	allow $1 security_t:dir search;
	allow $1 security_t:security setbool;
	auditallow $1 security_t:security setbool;
')

########################################
## <interface name="selinux_set_parameters">
##	<desc>
## 		Allow caller to set selinux security parameters.
##	</desc>
##	<param name="domain">
##		The process type to allow to set security parameters.
##	</param>
## </interface>
#
interface(`selinux_set_parameters',`
	gen_require(`
		type security_t;
		attribute can_setsecparam;
		class dir { read search getattr };
		class file { getattr read write };
		class security setsecparam;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security setsecparam;
	auditallow $1 security_t:security setsecparam;
	typeattribute $1 can_setsecparam;
')

########################################
## <interface name="selinux_validate_context">
##	<desc>
## 		Allows caller to validate security contexts.
##	</desc>
##	<param name="domain">
##		The process type permitted to validate contexts.
##	</param>
## </interface>
#
interface(`selinux_validate_context',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read write };
		class security check_context;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security check_context;
')

########################################
## <interface name="selinux_compute_access_vector">
##	<desc>
## 		Allows caller to compute an access vector.
##	</desc>
##	<param name="domain">
##		The process type allowed to compute an access vector.
##	</param>
## </interface>
#
interface(`selinux_compute_access_vector',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read write };
		class security compute_av;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security compute_av;
')

########################################
## <interface name="selinux_compute_create_context">
##	<desc>
## 		
##	</desc>
##	<param name="domain">
##		
##	</param>
## </interface>
#
interface(`selinux_compute_create_context',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read write };
		class security compute_create;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security compute_create;
')

########################################
## <interface name="selinux_compute_relabel_context">
##	<desc>
## 		
##	</desc>
##	<param name="domain">
##		The process type to 
##	</param>
## </interface>
#
interface(`selinux_compute_relabel_context',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read write };
		class security compute_relabel;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security compute_relabel;
')

########################################
## <interface name="selinux_compute_user_contexts">
##	<desc>
## 		Allows caller to compute possible contexts for a user.
##	</desc>
##	<param name="domain">
##		The process type allowed to compute user contexts.
##	</param>
## </interface>
#
interface(`selinux_compute_user_contexts',`
	gen_require(`
		type security_t;
		class dir { read search getattr };
		class file { getattr read write };
		class security compute_user;
	')

	allow $1 security_t:dir { read search getattr };
	allow $1 security_t:file { getattr read write };
	allow $1 security_t:security compute_user;
')

## </module>