diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index 0df5803..9b79f4a 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -1134,6 +1134,32 @@ interface(`fs_read_noxattr_fs_symlinks',` ######################################## ## +## Relabel all objets from filesystems that +## do not support extended attributes. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_relabelfrom_noxattr_fs',` + gen_require(` + attribute noxattrfs; + ') + + allow $1 noxattrfs:dir list_dir_perms; + relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs) + relabelfrom_files_pattern($1, noxattrfs, noxattrfs) + relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs) + relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs) + relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs) + relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) + relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) +') + +######################################## +## ## Do not audit attempts to read ## files on a CIFS or SMB filesystem. ## @@ -4441,26 +4467,26 @@ interface(`fs_getattr_all_files',` ######################################## ## -## Get the attributes of all symbolic links with -## a filesystem type. +## Do not audit attempts to get the attributes +## of all files with a filesystem type. ## ## ## -## Domain allowed access. +## Domain to not audit. ## ## # -interface(`fs_getattr_all_symlinks',` +interface(`fs_dontaudit_getattr_all_files',` gen_require(` attribute filesystem_type; ') - getattr_lnk_files_pattern($1, filesystem_type, filesystem_type) + dontaudit $1 filesystem_type:file getattr; ') ######################################## ## -## Get the attributes of all named pipes with +## Get the attributes of all symbolic links with ## a filesystem type. ## ## @@ -4469,37 +4495,37 @@ interface(`fs_getattr_all_symlinks',` ## ## # -interface(`fs_getattr_all_pipes',` +interface(`fs_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') - getattr_fifo_files_pattern($1, filesystem_type, filesystem_type) + getattr_lnk_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## -## Get the attributes of all named sockets with -## a filesystem type. +## Do not audit attempts to get the attributes +## of all symbolic links with a filesystem type. ## ## ## -## Domain allowed access. +## Domain to not audit. ## ## # -interface(`fs_getattr_all_sockets',` +interface(`fs_dontaudit_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') - getattr_sock_files_pattern($1, filesystem_type, filesystem_type) + dontaudit $1 filesystem_type:lnk_file getattr; ') ######################################## ## -## Do not audit attempts to get the attributes -## of all files with a filesystem type. +## Get the attributes of all named pipes with +## a filesystem type. ## ## ## @@ -4507,37 +4533,37 @@ interface(`fs_getattr_all_sockets',` ## ## # -interface(`fs_dontaudit_getattr_all_files',` +interface(`fs_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') - dontaudit $1 filesystem_type:file getattr; + getattr_fifo_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Do not audit attempts to get the attributes -## of all symbolic links with a filesystem type. +## of all named pipes with a filesystem type. ## ## ## -## Domain allowed access. +## Domain to not audit. ## ## # -interface(`fs_dontaudit_getattr_all_symlinks',` +interface(`fs_dontaudit_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') - dontaudit $1 filesystem_type:lnk_file getattr; + dontaudit $1 filesystem_type:fifo_file getattr; ') ######################################## ## -## Do not audit attempts to get the attributes -## of all named pipes with a filesystem type. +## Get the attributes of all named sockets with +## a filesystem type. ## ## ## @@ -4545,14 +4571,15 @@ interface(`fs_dontaudit_getattr_all_symlinks',` ## ## # -interface(`fs_dontaudit_getattr_all_pipes',` +interface(`fs_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') - dontaudit $1 filesystem_type:fifo_file getattr; + getattr_sock_files_pattern($1, filesystem_type, filesystem_type) ') + ######################################## ## ## Do not audit attempts to get the attributes @@ -4560,7 +4587,7 @@ interface(`fs_dontaudit_getattr_all_pipes',` ## ## ## -## Domain allowed access. +## Domain to not audit. ## ## # @@ -4627,29 +4654,3 @@ interface(`fs_unconfined',` typeattribute $1 filesystem_unconfined_type; ') - -######################################## -## -## Relabel all objets from filesystems that -## do not support extended attributes. -## -## -## -## Domain allowed access. -## -## -# -interface(`fs_relabelfrom_noxattr_fs',` - gen_require(` - attribute noxattrfs; - ') - - allow $1 noxattrfs:dir list_dir_perms; - relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs) - relabelfrom_files_pattern($1, noxattrfs, noxattrfs) - relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs) - relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs) - relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs) - relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) - relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) -')