From 2aec1461b47da86d4a85eaaf86711dd2a7095222 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Oct 25 2005 18:13:47 +0000 Subject: use our own interface to make maintenance easier --- diff --git a/refpolicy/policy/modules/kernel/devices.te b/refpolicy/policy/modules/kernel/devices.te index 90744c4..cbdc8c9 100644 --- a/refpolicy/policy/modules/kernel/devices.te +++ b/refpolicy/policy/modules/kernel/devices.te @@ -14,9 +14,10 @@ attribute memory_raw_write; # device_t is the type of /dev. # type device_t; +fs_associate_tmpfs(device_t) files_type(device_t) files_mountpoint(device_t) -fs_associate_tmpfs(device_t) +files_associate_tmp(device_t) # Only directories and symlinks should be labeled device_t. # If there are other files with this type, it is wrong. @@ -29,131 +30,111 @@ fs_associate_tmpfs(device_t) # # Type for /dev/agpgart # -type agp_device_t, device_node; -fs_associate(agp_device_t) -fs_associate_tmpfs(agp_device_t) +type agp_device_t; +dev_node(agp_device_t) # # Type for /dev/apm_bios # -type apm_bios_t, device_node; -fs_associate(apm_bios_t) -fs_associate_tmpfs(apm_bios_t) +type apm_bios_t; +dev_node(apm_bios_t) -type cardmgr_dev_t, device_node; -fs_associate(cardmgr_dev_t) -fs_associate_tmpfs(cardmgr_dev_t) +type cardmgr_dev_t; +dev_node(cardmgr_dev_t) files_tmp_file(cardmgr_dev_t) # # clock_device_t is the type of # /dev/rtc. # -type clock_device_t, device_node; -fs_associate(clock_device_t) -fs_associate_tmpfs(clock_device_t) +type clock_device_t; +dev_node(clock_device_t) # # cpu control devices /dev/cpu/0/* # -type cpu_device_t, device_node; -fs_associate(cpu_device_t) -fs_associate_tmpfs(cpu_device_t) +type cpu_device_t; +dev_node(cpu_device_t) # for the IBM zSeries z90crypt hardware ssl accelorator -type crypt_device_t, device_node; -fs_associate(crypt_device_t) -fs_associate_tmpfs(crypt_device_t) +type crypt_device_t; +dev_node(crypt_device_t) -type dri_device_t, device_node; -fs_associate(dri_device_t) -fs_associate_tmpfs(dri_device_t) +type dri_device_t; +dev_node(dri_device_t) -type event_device_t, device_node; -fs_associate(event_device_t) -fs_associate_tmpfs(event_device_t) +type event_device_t; +dev_node(event_device_t) # # Type for framebuffer /dev/fb/* # -type framebuf_device_t, device_node; -fs_associate(framebuf_device_t) -fs_associate_tmpfs(framebuf_device_t) +type framebuf_device_t; +dev_node(framebuf_device_t) # # Type for /dev/mapper/control # -type lvm_control_t, device_node; -fs_associate(lvm_control_t) -fs_associate_tmpfs(lvm_control_t) +type lvm_control_t; +dev_node(lvm_control_t) # # memory_device_t is the type of /dev/kmem, # /dev/mem and /dev/port. # -type memory_device_t, device_node; -fs_associate(memory_device_t) -fs_associate_tmpfs(memory_device_t) +type memory_device_t; +dev_node(memory_device_t) neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read; neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write }; -type misc_device_t, device_node; -fs_associate(misc_device_t) -fs_associate_tmpfs(misc_device_t) +type misc_device_t; +dev_node(misc_device_t) # # A more general type for mouse devices. # -type mouse_device_t, device_node; -fs_associate(mouse_device_t) -fs_associate_tmpfs(mouse_device_t) +type mouse_device_t; +dev_node(mouse_device_t) # # Type for /dev/cpu/mtrr and /proc/mtrr # -type mtrr_device_t, device_node; -fs_associate(mtrr_device_t) -fs_associate_tmpfs(mtrr_device_t) +type mtrr_device_t; +dev_node(mtrr_device_t) genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0) # # null_device_t is the type of /dev/null. # -type null_device_t, device_node; -fs_associate(null_device_t) -fs_associate_tmpfs(null_device_t) +type null_device_t; +dev_node(null_device_t) mls_trusted_object(null_device_t) sid devnull gen_context(system_u:object_r:null_device_t,s0) # # Type for /dev/pmu # -type power_device_t, device_node; -fs_associate(power_device_t) -fs_associate_tmpfs(power_device_t) +type power_device_t; +dev_node(power_device_t) -type printer_device_t, device_node; -fs_associate(printer_device_t) -fs_associate_tmpfs(printer_device_t) +type printer_device_t; +dev_node(printer_device_t) # # random_device_t is the type of /dev/random # -type random_device_t, device_node; -fs_associate(random_device_t) -fs_associate_tmpfs(random_device_t) +type random_device_t; +dev_node(random_device_t) -type scanner_device_t, device_node; -fs_associate(scanner_device_t) -fs_associate_tmpfs(scanner_device_t) +type scanner_device_t; +dev_node(scanner_device_t) # # Type for sound devices and mixers # -type sound_device_t, device_node; -fs_associate(sound_device_t) -fs_associate_tmpfs(sound_device_t) +type sound_device_t; +dev_node(sound_device_t) # # sysfs_t is the type for the /sys pseudofs @@ -166,9 +147,8 @@ genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0) # # urandom_device_t is the type of /dev/urandom # -type urandom_device_t, device_node; -fs_associate(urandom_device_t) -fs_associate_tmpfs(urandom_device_t) +type urandom_device_t; +dev_node(urandom_device_t) # # usbfs_t is the type for the /proc/bus/usb pseudofs @@ -179,20 +159,17 @@ fs_make_noxattr_fs(usbfs_t) genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0) genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0) -type v4l_device_t, device_node; -fs_associate(v4l_device_t) -fs_associate_tmpfs(v4l_device_t) +type v4l_device_t; +dev_node(v4l_device_t) -type xserver_misc_device_t, device_node; -fs_associate(xserver_misc_device_t) -fs_associate_tmpfs(xserver_misc_device_t) +type xserver_misc_device_t; +dev_node(xserver_misc_device_t) # # zero_device_t is the type of /dev/zero. # -type zero_device_t, device_node; -fs_associate(zero_device_t) -fs_associate_tmpfs(zero_device_t) +type zero_device_t; +dev_node(zero_device_t) mls_trusted_object(zero_device_t) @@ -202,9 +179,10 @@ mls_trusted_object(zero_device_t) # move it to xserver type xconsole_device_t; files_type(xconsole_device_t) +fs_associate_tmpfs(xconsole_device_t) +files_associate_tmp(xconsole_device_t) # devfs is dead on selinux # this should be removed -type devfs_control_t, device_node; -fs_associate(devfs_control_t) -fs_associate_tmpfs(devfs_control_t) +type devfs_control_t; +dev_node(devfs_control_t)