From 3c79f954d1151d59b8262e4f872c090577342214 Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Jun 22 2010 14:17:42 +0000
Subject: Rearrage interfaces in filesystem.


---

diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 0df5803..9b79f4a 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -1134,6 +1134,32 @@ interface(`fs_read_noxattr_fs_symlinks',`
 
 ########################################
 ## <summary>
+##	Relabel all objets from filesystems that
+##	do not support extended attributes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`fs_relabelfrom_noxattr_fs',`
+	gen_require(`
+		attribute noxattrfs;
+	')
+
+	allow $1 noxattrfs:dir list_dir_perms;
+	relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs)
+	relabelfrom_files_pattern($1, noxattrfs, noxattrfs)
+	relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs)
+	relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs)
+	relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs)
+	relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
+	relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to read
 ##	files on a CIFS or SMB filesystem.
 ## </summary>
@@ -4441,26 +4467,26 @@ interface(`fs_getattr_all_files',`
 
 ########################################
 ## <summary>
-##	Get the attributes of all symbolic links with
-##	a filesystem type.
+##	Do not audit attempts to get the attributes
+##	of all files with a filesystem type.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	Domain allowed access.
+##	Domain to not audit.
 ##	</summary>
 ## </param>
 #
-interface(`fs_getattr_all_symlinks',`
+interface(`fs_dontaudit_getattr_all_files',`
 	gen_require(`
 		attribute filesystem_type;
 	')
 
-	getattr_lnk_files_pattern($1, filesystem_type, filesystem_type)
+	dontaudit $1 filesystem_type:file getattr;
 ')
 
 ########################################
 ## <summary>
-##	Get the attributes of all named pipes with
+##	Get the attributes of all symbolic links with
 ##	a filesystem type.
 ## </summary>
 ## <param name="domain">
@@ -4469,37 +4495,37 @@ interface(`fs_getattr_all_symlinks',`
 ##	</summary>
 ## </param>
 #
-interface(`fs_getattr_all_pipes',`
+interface(`fs_getattr_all_symlinks',`
 	gen_require(`
 		attribute filesystem_type;
 	')
 
-	getattr_fifo_files_pattern($1, filesystem_type, filesystem_type)
+	getattr_lnk_files_pattern($1, filesystem_type, filesystem_type)
 ')
 
 ########################################
 ## <summary>
-##	Get the attributes of all named sockets with
-##	a filesystem type.
+##	Do not audit attempts to get the attributes
+##	of all symbolic links with a filesystem type.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	Domain allowed access.
+##	Domain to not audit.
 ##	</summary>
 ## </param>
 #
-interface(`fs_getattr_all_sockets',`
+interface(`fs_dontaudit_getattr_all_symlinks',`
 	gen_require(`
 		attribute filesystem_type;
 	')
 
-	getattr_sock_files_pattern($1, filesystem_type, filesystem_type)
+	dontaudit $1 filesystem_type:lnk_file getattr;
 ')
 
 ########################################
 ## <summary>
-##	Do not audit attempts to get the attributes
-##	of all files with a filesystem type.
+##	Get the attributes of all named pipes with
+##	a filesystem type.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -4507,37 +4533,37 @@ interface(`fs_getattr_all_sockets',`
 ##	</summary>
 ## </param>
 #
-interface(`fs_dontaudit_getattr_all_files',`
+interface(`fs_getattr_all_pipes',`
 	gen_require(`
 		attribute filesystem_type;
 	')
 
-	dontaudit $1 filesystem_type:file getattr;
+	getattr_fifo_files_pattern($1, filesystem_type, filesystem_type)
 ')
 
 ########################################
 ## <summary>
 ##	Do not audit attempts to get the attributes
-##	of all symbolic links with a filesystem type.
+##	of all named pipes with a filesystem type.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	Domain allowed access.
+##	Domain to not audit.
 ##	</summary>
 ## </param>
 #
-interface(`fs_dontaudit_getattr_all_symlinks',`
+interface(`fs_dontaudit_getattr_all_pipes',`
 	gen_require(`
 		attribute filesystem_type;
 	')
 
-	dontaudit $1 filesystem_type:lnk_file getattr;
+	dontaudit $1 filesystem_type:fifo_file getattr;
 ')
 
 ########################################
 ## <summary>
-##	Do not audit attempts to get the attributes
-##	of all named pipes with a filesystem type.
+##	Get the attributes of all named sockets with
+##	a filesystem type.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -4545,14 +4571,15 @@ interface(`fs_dontaudit_getattr_all_symlinks',`
 ##	</summary>
 ## </param>
 #
-interface(`fs_dontaudit_getattr_all_pipes',`
+interface(`fs_getattr_all_sockets',`
 	gen_require(`
 		attribute filesystem_type;
 	')
 
-	dontaudit $1 filesystem_type:fifo_file getattr;
+	getattr_sock_files_pattern($1, filesystem_type, filesystem_type)
 ')
 
+
 ########################################
 ## <summary>
 ##	Do not audit attempts to get the attributes
@@ -4560,7 +4587,7 @@ interface(`fs_dontaudit_getattr_all_pipes',`
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	Domain allowed access.
+##	Domain to not audit.
 ##	</summary>
 ## </param>
 #
@@ -4627,29 +4654,3 @@ interface(`fs_unconfined',`
 
 	typeattribute $1 filesystem_unconfined_type;
 ')
-
-########################################
-## <summary>
-##	Relabel all objets from filesystems that
-##	do not support extended attributes.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`fs_relabelfrom_noxattr_fs',`
-	gen_require(`
-		attribute noxattrfs;
-	')
-
-	allow $1 noxattrfs:dir list_dir_perms;
-	relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs)
-	relabelfrom_files_pattern($1, noxattrfs, noxattrfs)
-	relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs)
-	relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs)
-	relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs)
-	relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
-	relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
-')