## <module name="filesystem" layer="kernel">
## <summary>Policy for filesystems.</summary>
########################################
## <interface name="fs_make_fs">
## <description>
## Transform specified type into a filesystem type.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_make_fs',`
gen_require(`$0'_depend)
typeattribute $1 fs_type;
')
define(`fs_make_fs_depend',`
attribute fs_type;
')
########################################
## <interface name="fs_make_noxattr_fs">
## <description>
## Transform specified type into a filesystem
## type which does not have extended attribute
## support.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_make_noxattr_fs',`
gen_require(`$0'_depend)
fs_make_fs($1)
typeattribute $1 noxattrfs;
')
define(`fs_make_noxattr_fs_depend',`
attribute noxattrfs;
')
########################################
## <interface name="fs_associate">
## <description>
## Associate the specified file type to persistent
## filesystems with extended attributes. This
## allows a file of this type to be created on
## a filesystem such as ext3, JFS, and XFS.
## </description>
## <parameter name="file_type">
## The type of the to be associated.
## </parameter>
## </interface>
#
define(`fs_associate',`
gen_require(`$0'_depend)
allow $1 fs_t:filesystem associate;
')
define(`fs_associate_depend',`
type fs_t;
class filesystem associate;
')
########################################
## <interface name="fs_associate_noxattr">
## <description>
## Associate the specified file type to
## filesystems which lack extended attributes
## support. This allows a file of this type
## to be created on a filesystem such as
## FAT32, and NFS.
## </description>
## <parameter name="file_type">
## The type of the to be associated.
## </parameter>
## </interface>
#
define(`fs_associate_noxattr',`
gen_require(`$0'_depend)
allow $1 noxattrfs:filesystem associate;
')
define(`fs_associate_noxattr_depend',`
attribute noxattrfs;
class filesystem associate;
')
########################################
## <interface name="fs_mount_xattr_fs">
## <description>
## Mount a persistent filesystem which
## has extended attributes, such as
## ext3, JFS, or XFS.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_xattr_fs',`
gen_require(`$0'_depend)
allow $1 fs_t:filesystem mount;
')
define(`fs_mount_xattr_fs_depend',`
type fs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_xattr_fs">
## <description>
## Remount a persistent filesystem which
## has extended attributes, such as
## ext3, JFS, or XFS. This allows
## some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_xattr_fs',`
gen_require(`$0'_depend)
allow $1 fs_t:filesystem remount;
')
define(`fs_remount_xattr_fs_depend',`
type fs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_xattr_fs">
## <description>
## Unmount a persistent filesystem which
## has extended attributes, such as
## ext3, JFS, or XFS.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_xattr_fs',`
gen_require(`$0'_depend)
allow $1 fs_t:filesystem mount;
')
define(`fs_unmount_xattr_fs_depend',`
type fs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_xattr_fs">
## <description>
## Get the attributes of a persistent
## filesystem which has extended
## attributes, such as ext3, JFS, or XFS.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_xattr_fs',`
gen_require(`$0'_depend)
allow $1 fs_t:filesystem getattr;
')
define(`fs_getattr_xattr_fs_depend',`
type fs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_dontaudit_getattr_xattr_fs">
## <description>
## Do not audit attempts to
## get the attributes of a persistent
## filesystem which has extended
## attributes, such as ext3, JFS, or XFS.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_dontaudit_getattr_xattr_fs',`
gen_require(`$0'_depend)
dontaudit $1 fs_t:filesystem getattr;
')
define(`fs_dontaudit_getattr_xattr_fs_depend',`
type fs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_relabelfrom_xattr_fs">
## <description>
## Allow changing of the label of a
## filesystem with extended attributes
## using the context= mount option.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_relabelfrom_xattr_fs',`
gen_require(`$0'_depend)
allow $1 fs_t:filesystem relabelfrom;
')
define(`fs_relabelfrom_xattr_fs_depend',`
type fs_t;
class filesystem relabelfrom;
')
########################################
## <interface name="fs_mount_autofs">
## <description>
## Mount an automount pseudo filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_autofs',`
gen_require(`$0'_depend)
allow $1 autofs_t:filesystem mount;
')
define(`fs_mount_autofs_depend',`
type autofs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_autofs">
## <description>
## Remount an automount pseudo filesystem
## This allows some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_autofs',`
gen_require(`$0'_depend)
allow $1 autofs_t:filesystem remount;
')
define(`fs_remount_autofs_depend',`
type autofs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_autofs">
## <description>
## Unmount an automount pseudo filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_autofs',`
gen_require(`$0'_depend)
allow $1 autofs_t:filesystem mount;
')
define(`fs_unmount_autofs_depend',`
type autofs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_autofs">
## <description>
## Get the attributes of an automount
## pseudo filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_autofs',`
gen_require(`$0'_depend)
allow $1 autofs_t:filesystem getattr;
')
define(`fs_getattr_autofs_depend',`
type autofs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_register_binary_executable_type">
## <description>
## Register an interpreter for new binary
## file types, using the kernel binfmt_misc
## support. A common use for this is to
## register a JVM as an interpreter for
## Java byte code. Registered binaries
## can be directly executed on a command line
## without specifying the interpreter.
## </description>
## <parameter name="domain">
## The type of the domain registering
## the interpreter.
## </parameter>
## </interface>
#
define(`fs_register_binary_executable_type',`
gen_require(`$0'_depend)
allow $1 binfmt_misc_fs_t:dir { getattr search };
allow $1 binfmt_misc_fs_t:file { getattr ioctl write };
')
define(`fs_register_binary_executable_type_depend',`
type binfmt_misc_fs_t;
class dir { getattr search };
class file { getattr ioctl write };
')
########################################
## <interface name="fs_mount_cifs">
## <description>
## Mount a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_cifs',`
gen_require(`$0'_depend)
allow $1 cifs_t:filesystem mount;
')
define(`fs_mount_cifs_depend',`
type cifs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_cifs">
## <description>
## Remount a CIFS or SMB network filesystem.
## This allows some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_cifs',`
gen_require(`
type cifs_t;
class filesystem remount;
')
allow $1 cifs_t:filesystem remount;
')
########################################
## <interface name="fs_unmount_cifs">
## <description>
## Unmount a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_cifs',`
gen_require(`
type cifs_t;
class filesystem unmount;
')
allow $1 cifs_t:filesystem mount;
')
########################################
## <interface name="fs_getattr_cifs">
## <description>
## Get the attributes of a CIFS or
## SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_cifs',`
gen_require(`
type cifs_t;
class filesystem getattr;
')
allow $1 cifs_t:filesystem getattr;
')
########################################
## <interface name="fs_read_cifs_files">
## <description>
## Read files on a CIFS or SMB filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the files.
## </parameter>
## </interface>
#
define(`fs_read_cifs_files',`
gen_require(`
type cifs_t;
class dir r_dir_perms;
class file r_file_perms;
')
allow $1 cifs_t:dir r_dir_perms;
allow $1 cifs_t:file r_file_perms;
')
########################################
## <interface name="fs_dontaudit_rw_cifs_files">
## <description>
## Do not audit attempts to read or
## write files on a CIFS or SMB filesystem.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_dontaudit_rw_cifs_files',`
gen_require(`
type cifs_t;
class file { read write };
')
dontaudit $1 cifs_t:file { read write };
')
########################################
## <interface name="fs_read_cifs_symlinks">
## <description>
## Read symbolic links on a CIFS or SMB filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the symbolic links.
## </parameter>
## </interface>
#
define(`fs_read_cifs_symlinks',`
gen_require(`
type cifs_t;
class dir r_dir_perms;
class lnk_file r_file_perms;
')
allow $1 cifs_t:dir r_dir_perms;
allow $1 cifs_t:lnk_file r_file_perms;
')
########################################
## <interface name="fs_execute_cifs_files">
## <description>
## Execute files on a CIFS or SMB
## network filesystem, in the caller
## domain.
## </description>
## <parameter name="domain">
## The type of the domain executing the files.
## </parameter>
## </interface>
#
define(`fs_execute_cifs_files',`
gen_require(`$0'_depend)
allow $1 cifs_t:dir r_dir_perms;
can_exec($1, cifs_t)
')
define(`fs_execute_cifs_files_depend',`
type cifs_t;
class dir r_dir_perms;
class file { getattr read execute execute_no_trans };
')
########################################
## <interface name="fs_dontaudit_rw_cifs_files">
## <description>
## Do not audit attempts to read or
## write files on a CIFS or SMB filesystems.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_read_cifs_files',`
gen_require(`
type cifs_t;
class file { read write };
')
dontaudit $1 cifs_t:file { read write };
')
########################################
## <interface name="fs_manage_cifs_dirs">
## <description>
## Create, read, write, and delete directories
## on a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the directories.
## </parameter>
## </interface>
#
define(`fs_manage_cifs_dirs',`
gen_require(`$0'_depend)
allow $1 cifs_t:dir create_file_perms;
')
define(`fs_manage_cifs_dirs_depend',`
type cifs_t;
class dir create_file_perms;
')
########################################
## <interface name="fs_manage_cifs_files">
## <description>
## Create, read, write, and delete files
## on a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the files.
## </parameter>
## </interface>
#
define(`fs_manage_cifs_files',`
gen_require(`$0'_depend)
allow $1 cifs_t:dir rw_dir_perms;
allow $1 cifs_t:file create_file_perms;
')
define(`fs_manage_cifs_files_depend',`
type cifs_t;
class dir rw_dir_perms;
class file create_file_perms;
')
########################################
## <interface name="fs_manage_cifs_symlinks">
## <description>
## Create, read, write, and delete symbolic links
## on a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the symbolic links.
## </parameter>
## </interface>
#
define(`fs_manage_cifs_symlinks',`
gen_require(`$0'_depend)
allow $1 cifs_t:dir rw_dir_perms;
allow $1 cifs_t:lnk_file create_lnk_perms;
')
define(`fs_manage_cifs_symlinks_depend',`
type cifs_t;
class dir rw_dir_perms;
class lnk_file create_lnk_perms;
')
########################################
## <interface name="fs_manage_cifs_named_pipes">
## <description>
## Create, read, write, and delete named pipes
## on a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the pipes.
## </parameter>
## </interface>
#
define(`fs_manage_cifs_named_pipes',`
gen_require(`$0'_depend)
allow $1 cifs_t:dir rw_dir_perms;
allow $1 cifs_t:fifo_file create_file_perms;
')
define(`fs_manage_cifs_named_pipes_depend',`
type cifs_t;
class dir rw_dir_perms;
class fifo_file create_file_perms;
')
########################################
## <interface name="fs_manage_cifs_named_sockets">
## <description>
## Create, read, write, and delete named sockets
## on a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the sockets.
## </parameter>
## </interface>
#
define(`fs_manage_cifs_named_sockets',`
gen_require(`$0'_depend)
allow $1 cifs_t:dir rw_file_perms;
allow $1 cifs_t:sock_file create_file_perms;
')
define(`fs_manage_cifs_named_sockets_depend',`
type cifs_t;
class dir rw_dir_perms;
class sock_file create_file_perms;
')
########################################
## <interface name="fs_mount_dos_fs">
## <description>
## Mount a DOS filesystem, such as
## FAT32 or NTFS.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_dos_fs',`
gen_require(`$0'_depend)
allow $1 dosfs_t:filesystem mount;
')
define(`fs_mount_dos_fs_depend',`
type dosfs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_dos_fs">
## <description>
## Remount a DOS filesystem, such as
## FAT32 or NTFS. This allows
## some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_dos_fs',`
gen_require(`$0'_depend)
allow $1 dosfs_t:filesystem remount;
')
define(`fs_remount_dos_fs_depend',`
type dosfs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_dos_fs">
## <description>
## Unmount a DOS filesystem, such as
## FAT32 or NTFS.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_dos_fs',`
gen_require(`$0'_depend)
allow $1 dosfs_t:filesystem mount;
')
define(`fs_unmount_dos_fs_depend',`
type dosfs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_dos_fs">
## <description>
## Get the attributes of a DOS
## filesystem, such as FAT32 or NTFS.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_dos_fs',`
gen_require(`$0'_depend)
allow $1 dosfs_t:filesystem getattr;
')
define(`fs_getattr_dos_fs_depend',`
type dosfs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_relabelfrom_dos_fs">
## <description>
## Allow changing of the label of a
## DOS filesystem using the context= mount option.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_relabelfrom_dos_fs',`
gen_require(`$0'_depend)
allow $1 dosfs_t:filesystem relabelfrom;
')
define(`fs_relabelfrom_dos_fs_depend',`
type dosfs_t;
class filesystem relabelfrom;
')
########################################
## <interface name="fs_mount_iso9660_fs">
## <description>
## Mount an iso9660 filesystem, which
## is usually used on CDs.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_iso9660_fs',`
gen_require(`$0'_depend)
allow $1 iso9660_t:filesystem mount;
')
define(`fs_mount_iso9660_fs_depend',`
type iso9660_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_iso9660_fs">
## <description>
## Remount an iso9660 filesystem, which
## is usually used on CDs. This allows
## some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_iso9660_fs',`
gen_require(`$0'_depend)
allow $1 iso9660_t:filesystem remount;
')
define(`fs_remount_iso9660_fs_depend',`
type iso9660_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_iso9660_fs">
## <description>
## Unmount an iso9660 filesystem, which
## is usually used on CDs.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_iso9660_fs',`
gen_require(`$0'_depend)
allow $1 iso9660_t:filesystem mount;
')
define(`fs_unmount_iso9660_fs_depend',`
type iso9660_t;
class filesystem unmount;
')
########################################
## <interface name="fs_mount_iso9660_fs">
## <description>
## Get the attributes of an iso9660
## filesystem, which is usually used on CDs.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_iso9660_fs',`
gen_require(`$0'_depend)
allow $1 iso9660_t:filesystem getattr;
')
define(`fs_getattr_iso9660_fs_depend',`
type iso9660_t;
class filesystem getattr;
')
########################################
## <interface name="fs_mount_nfs">
## <description>
## Mount a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_nfs',`
gen_require(`$0'_depend)
allow $1 nfs_t:filesystem mount;
')
define(`fs_mount_nfs_depend',`
type nfs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_nfs">
## <description>
## Remount a NFS filesystem. This allows
## some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_nfs',`
gen_require(`$0'_depend)
allow $1 nfs_t:filesystem remount;
')
define(`fs_remount_nfs_depend',`
type nfs_t;
class filesystem remount;
')
########################################
## <interface name="fs_mount_nfs">
## <description>
## Unmount a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_nfs',`
gen_require(`$0'_depend)
allow $1 nfs_t:filesystem mount;
')
define(`fs_unmount_nfs_depend',`
type nfs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_nfs">
## <description>
## Get the attributes of a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_nfs',`
gen_require(`$0'_depend)
allow $1 nfs_t:filesystem getattr;
')
define(`fs_getattr_nfs_depend',`
type nfs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_read_nfs_files">
## <description>
## Read files on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the files.
## </parameter>
## </interface>
#
define(`fs_read_nfs_files',`
gen_require(`
type nfs_t;
class dir r_dir_perms;
class file r_file_perms;
')
allow $1 nfs_t:dir r_dir_perms;
allow $1 nfs_t:file r_file_perms;
')
########################################
## <interface name="fs_execute_nfs_files">
## <description>
## Execute files on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain executing the files.
## </parameter>
## </interface>
#
define(`fs_execute_nfs_files',`
gen_require(`
type nfs_t;
class dir r_dir_perms;
')
allow $1 nfs_t:dir r_dir_perms;
can_exec($1, nfs_t)
')
########################################
## <interface name="fs_dontaudit_rw_nfs_files">
## <description>
## Do not audit attempts to read or
## write files on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain to not audit.
## </parameter>
## </interface>
#
define(`fs_dontaudit_rw_nfs_files',`
gen_require(`
type nfs_t;
class file { read write };
')
dontaudit $1 nfs_t:file { read write };
')
########################################
## <interface name="fs_read_nfs_symlinks">
## <description>
## Read symbolic links on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain reading the symbolic links.
## </parameter>
## </interface>
#
define(`fs_read_nfs_symlinks',`
gen_require(`
type nfs_t;
class dir r_dir_perms;
class lnk_file r_file_perms;
')
allow $1 nfs_t:dir r_dir_perms;
allow $1 nfs_t:lnk_file r_file_perms;
')
########################################
## <interface name="fs_manage_nfs_dirs">
## <description>
## Create, read, write, and delete directories
## on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the directories.
## </parameter>
## </interface>
#
define(`fs_manage_nfs_dirs',`
gen_require(`$0'_depend)
allow $1 nfs_t:dir create_dir_perms;
')
define(`fs_manage_nfs_dirs_depend',`
type nfs_t;
class dir create_dir_perms;
')
########################################
## <interface name="fs_manage_nfs_files">
## <description>
## Create, read, write, and delete files
## on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the files.
## </parameter>
## </interface>
#
define(`fs_manage_nfs_files',`
gen_require(`$0'_depend)
allow $1 nfs_t:dir rw_dir_perms;
allow $1 nfs_t:file create_file_perms;
')
define(`fs_manage_nfs_files_depend',`
type nfs_t;
class dir rw_dir_perms;
class file create_file_perms;
')
#########################################
## <interface name="fs_manage_nfs_symlinks">
## <description>
## Create, read, write, and delete symbolic links
## on a CIFS or SMB network filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the symbolic links.
## </parameter>
## </interface>
#
define(`fs_manage_nfs_symlinks',`
gen_require(`
type nfs_t;
class dir r_dir_perms;
class lnk_file create_lnk_perms;
')
allow $1 nfs_t:dir rw_dir_perms;
allow $1 nfs_t:lnk_file create_lnk_perms;
')
#########################################
## <interface name="fs_manage_nfs_named_pipes">
## <description>
## Create, read, write, and delete named pipes
## on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the pipes.
## </parameter>
## </interface>
#
define(`fs_manage_nfs_named_pipes',`
gen_require(`$0'_depend)
allow $1 nfs_t:dir rw_dir_perms;
allow $1 nfs_t:fifo_file create_file_perms;
')
define(`fs_manage_nfs_named_pipes_depend',`
type nfs_t;
class dir rw_dir_perms;
class fifo_file create_file_perms;
')
#########################################
## <interface name="fs_manage_nfs_named_sockets">
## <description>
## Create, read, write, and delete named sockets
## on a NFS filesystem.
## </description>
## <parameter name="domain">
## The type of the domain managing the sockets.
## </parameter>
## </interface>
#
define(`fs_manage_nfs_named_sockets',`
gen_require(`$0'_depend)
allow $1 nfs_t:dir rw_dir_perms;
allow $1 nfs_t:sock_file create_file_perms;
')
define(`fs_manage_nfs_named_sockets_depend',`
type nfs_t;
class dir rw_dir_perms;
class sock_file create_file_perms;
')
########################################
## <interface name="fs_mount_nfsd_fs">
## <description>
## Mount a NFS server pseudo filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_nfsd_fs',`
gen_require(`$0'_depend)
allow $1 nfsd_fs_t:filesystem mount;
')
define(`fs_mount_nfsd_fs_depend',`
type nfsd_fs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_nfsd_fs">
## <description>
## Mount a NFS server pseudo filesystem.
## This allows some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_nfsd_fs',`
gen_require(`$0'_depend)
allow $1 nfsd_fs_t:filesystem remount;
')
define(`fs_remount_nfsd_fs_depend',`
type nfsd_fs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_nfsd_fs">
## <description>
## Unmount a NFS server pseudo filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_nfsd_fs',`
gen_require(`$0'_depend)
allow $1 nfsd_fs_t:filesystem mount;
')
define(`fs_unmount_nfsd_fs_depend',`
type nfsd_fs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_nfsd_fs">
## <description>
## Get the attributes of a NFS server
## pseudo filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_nfsd_fs',`
gen_require(`$0'_depend)
allow $1 nfsd_fs_t:filesystem getattr;
')
define(`fs_getattr_nfsd_fs_depend',`
type nfsd_fs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_mount_ramfs">
## <description>
## Mount a RAM filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_ramfs',`
gen_require(`$0'_depend)
allow $1 ramfs_t:filesystem mount;
')
define(`fs_mount_ramfs_depend',`
type ramfs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_ramfs">
## <description>
## Remount a RAM filesystem. This allows
## some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_ramfs',`
gen_require(`$0'_depend)
allow $1 ramfs_t:filesystem remount;
')
define(`fs_remount_ramfs_depend',`
type ramfs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_ramfs">
## <description>
## Unmount a RAM filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_ramfs',`
gen_require(`$0'_depend)
allow $1 ramfs_t:filesystem mount;
')
define(`fs_unmount_ramfs_depend',`
type ramfs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_ramfs">
## <description>
## Get the attributes of a RAM filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_ramfs',`
gen_require(`$0'_depend)
allow $1 ramfs_t:filesystem getattr;
')
define(`fs_getattr_ramfs_depend',`
type ramfs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_mount_romfs">
## <description>
## Mount a ROM filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_romfs',`
gen_require(`$0'_depend)
allow $1 romfs_t:filesystem mount;
')
define(`fs_mount_romfs_depend',`
type romfs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_romfs">
## <description>
## Remount a ROM filesystem. This allows
## some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_romfs',`
gen_require(`$0'_depend)
allow $1 romfs_t:filesystem remount;
')
define(`fs_remount_romfs_depend',`
type romfs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_romfs">
## <description>
## Unmount a ROM filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_romfs',`
gen_require(`$0'_depend)
allow $1 romfs_t:filesystem mount;
')
define(`fs_unmount_romfs_depend',`
type romfs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_romfs">
## <description>
## Get the attributes of a ROM
## filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_romfs',`
gen_require(`$0'_depend)
allow $1 romfs_t:filesystem getattr;
')
define(`fs_getattr_romfs_depend',`
type romfs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_mount_rpc_pipefs">
## <description>
## Mount a RPC pipe filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_rpc_pipefs',`
gen_require(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem mount;
')
define(`fs_mount_rpc_pipefs_depend',`
type rpc_pipefs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_rpc_pipefs">
## <description>
## Remount a RPC pipe filesystem. This
## allows some mount option to be changed.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_rpc_pipefs',`
gen_require(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem remount;
')
define(`fs_remount_rpc_pipefs_depend',`
type rpc_pipefs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_rpc_pipefs">
## <description>
## Unmount a RPC pipe filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_rpc_pipefs',`
gen_require(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem mount;
')
define(`fs_unmount_rpc_pipefs_depend',`
type rpc_pipefs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_rpc_pipefs">
## <description>
## Get the attributes of a RPC pipe
## filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_rpc_pipefs',`
gen_require(`$0'_depend)
allow $1 rpc_pipefs_t:filesystem getattr;
')
define(`fs_getattr_rpc_pipefs_depend',`
type rpc_pipefs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_mount_tmpfs">
## <description>
## Mount a tmpfs filesystem.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_tmpfs',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:filesystem mount;
')
define(`fs_mount_tmpfs_depend',`
type tmpfs_t;
class filesystem mount;
')
########################################
## <interface name="fs_remount_tmpfs">
## <description>
## Remount a tmpfs filesystem.
## </description>
## <parameter name="domain">
## The type of the domain remounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_tmpfs',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:filesystem remount;
')
define(`fs_remount_tmpfs_depend',`
type tmpfs_t;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_tmpfs">
## <description>
## Unmount a tmpfs filesystem.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_tmpfs',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:filesystem mount;
')
define(`fs_unmount_tmpfs_depend',`
type tmpfs_t;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_tmpfs">
## <description>
## Get the attributes of a tmpfs
## filesystem.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_tmpfs',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:filesystem getattr;
')
define(`fs_getattr_tmpfs_depend',`
type tmpfs_t;
class filesystem getattr;
')
########################################
## <interface name="fs_associate_tmpfs">
## <description>
## Allow the type to associate to tmpfs filesystems.
## </description>
## <parameter name="type">
## The type of the object to be associated.
## </parameter>
## </interface>
#
define(`fs_associate_tmpfs',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:filesystem associate;
')
define(`fs_associate_tmpfs_depend',`
type tmpfs_t;
class filesystem associate;
')
########################################
#
# fs_create_tmpfs_data(domain,derivedtype,[class])
#
define(`fs_create_tmpfs_data',`
gen_require(`$0'_depend)
allow $2 tmpfs_t:filesystem associate;
allow $1 tmpfs_t:dir rw_dir_perms;
ifelse(`$3',`',`
type_transition $1 tmpfs_t:file $2;
',`
type_transition $1 tmpfs_t:$3 $2;
')
')
define(`fs_create_tmpfs_data_depend',`
type tmpfs_t;
class filesystem associate;
class dir rw_dir_perms;
')
########################################
## <interface name="fs_use_tmpfs_character_devices">
## <description>
## Read and write character nodes on tmpfs filesystems.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_use_tmpfs_character_devices',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:dir r_dir_perms;
allow $1 tmpfs_t:chr_file rw_file_perms;
')
define(`fs_use_tmpfs_character_devices_depend',`
type tmpfs_t;
class dir r_dir_perms;
class chr_file rw_file_perms;
')
########################################
## <interface name="fs_relabel_tmpfs_character_devices">
## <description>
## Relabel character nodes on tmpfs filesystems.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_relabel_tmpfs_character_devices',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:dir r_dir_perms;
allow $1 tmpfs_t:chr_file { getattr relabelfrom relabelto };
')
define(`fs_relabel_tmpfs_character_devices_depend',`
type tmpfs_t;
class dir r_dir_perms;
class chr_file { getattr relabelfrom relabelto };
')
########################################
## <interface name="fs_use_tmpfs_block_devices">
## <description>
## Read and write block nodes on tmpfs filesystems.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_use_tmpfs_block_devices',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:dir r_dir_perms;
allow $1 tmpfs_t:blk_file rw_file_perms;
')
define(`fs_use_tmpfs_block_devices_depend',`
type tmpfs_t;
class dir r_dir_perms;
class blk_file rw_file_perms;
')
########################################
## <interface name="fs_relabel_tmpfs_block_devices">
## <description>
## Relabel block nodes on tmpfs filesystems.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_relabel_tmpfs_block_devices',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:dir r_dir_perms;
allow $1 tmpfs_t:blk_file { getattr relabelfrom relabelto };
')
define(`fs_use_tmpfs_block_devices_depend',`
type tmpfs_t;
class dir r_dir_perms;
class blk_file { getattr relabelfrom relabelto };
')
########################################
## <interface name="fs_manage_tmpfs_character_devices">
## <description>
## Read and write, create and delete character
## nodes on tmpfs filesystems.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_manage_tmpfs_character_devices',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:dir rw_dir_perms;
allow $1 tmpfs_t:chr_file create_file_perms;
')
define(`fs_manage_tmpfs_character_devices_depend',`
type tmpfs_t;
class dir rw_dir_perms;
class chr_file create_file_perms;
')
########################################
## <interface name="fs_manage_tmpfs_block_devices">
## <description>
## Read and write, create and delete block nodes
## on tmpfs filesystems.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
## </parameter>
## </interface>
#
define(`fs_manage_tmpfs_block_devices',`
gen_require(`$0'_depend)
allow $1 tmpfs_t:dir rw_dir_perms;
allow $1 tmpfs_t:blk_file create_file_perms;
')
define(`fs_manage_tmpfs_block_devices_depend',`
type tmpfs_t;
class dir rw_dir_perms;
class blk_file create_file_perms;
')
########################################
## <interface name="fs_mount_all_fs">
## <description>
## Mount all filesystems.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_mount_all_fs',`
gen_require(`$0'_depend)
allow $1 fs_type:filesystem mount;
')
define(`fs_mount_all_fs_depend',`
attribute fs_type;
class filesystem mount;
')
########################################
## <interface name="fs_remount_all_fs">
## <description>
## Remount all filesystems. This
## allows some mount options to be changed.
## </description>
## <parameter name="domain">
## The type of the domain mounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_remount_all_fs',`
gen_require(`$0'_depend)
allow $1 fs_type:filesystem remount;
')
define(`fs_remount_all_fs_depend',`
attribute fs_type;
class filesystem remount;
')
########################################
## <interface name="fs_unmount_all_fs">
## <description>
## Unmount all filesystems.
## </description>
## <parameter name="domain">
## The type of the domain unmounting the filesystem.
## </parameter>
## </interface>
#
define(`fs_unmount_all_fs',`
gen_require(`$0'_depend)
allow $1 fs_type:filesystem unmount;
')
define(`fs_mount_all_fs_depend',`
attribute fs_type;
class filesystem unmount;
')
########################################
## <interface name="fs_getattr_all_fs">
## <description>
## Get the attributes of all persistent
## filesystems.
## </description>
## <parameter name="domain">
## The type of the domain doing the
## getattr on the filesystem.
## </parameter>
## </interface>
#
define(`fs_getattr_all_fs',`
gen_require(`$0'_depend)
allow $1 fs_type:filesystem getattr;
')
define(`fs_getattr_all_fs_depend',`
attribute fs_type;
class filesystem getattr;
')
########################################
## <interface name="fs_get_all_fs_quotas">
## <description>
## Get the quotas of all filesystems.
## </description>
## <parameter name="domain">
## The type of the domain getting quotas.
## </parameter>
## </interface>
#
define(`fs_get_all_fs_quotas',`
gen_require(`$0'_depend)
allow $1 fs_type:filesystem quotaget;
')
define(`fs_get_all_fs_quotas_depend',`
attribute fs_type;
class filesystem quotaget;
')
########################################
## <interface name="fs_set_all_quotas">
## <description>
## Set the quotas of all filesystems.
## </description>
## <parameter name="domain">
## The type of the domain setting quotas.
## </parameter>
## </interface>
#
define(`fs_set_all_quotas',`
gen_require(`$0'_depend)
allow $1 fs_type:filesystem quotamod;
')
define(`fs_set_all_quotas_depend',`
attribute fs_type;
class filesystem quotamod;
')
########################################
#
# fs_getattr_all_files(type)
#
define(`fs_getattr_all_files',`
gen_require(`$0'_depend)
allow $1 fs_type:dir { search getattr };
allow $1 fs_type:file getattr;
allow $1 fs_type:lnk_file getattr;
allow $1 fs_type:fifo_file getattr;
allow $1 fs_type:sock_file getattr;
')
define(`fs_getattr_all_files_depend',`
attribute fs_type;
class dir { search getattr };
class file getattr;
class lnk_file getattr;
class fifo_file getattr;
class sock_file getattr;
')
## </module>