diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if index 0352a19..814da80 100644 --- a/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if @@ -534,6 +534,24 @@ interface(`kernel_request_load_module',` ######################################## ## +## Do not audit requests to the kernel to load a module. +## +## +## +## Domain to not audit. +## +## +# +interface(`kernel_dontaudit_request_load_module',` + gen_require(` + type kernel_t; + ') + + dontaudit $1 kernel_t:system module_request; +') + +######################################## +## ## Get information on all System V IPC objects. ## ## @@ -2046,6 +2064,23 @@ interface(`kernel_mount_unlabeled',` allow $1 unlabeled_t:filesystem mount; ') +######################################## +## +## Unmount a kernel unlabeled filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`kernel_unmount_unlabeled',` + gen_require(` + type unlabeled_t; + ') + + allow $1 unlabeled_t:filesystem unmount; +') ######################################## ## @@ -2195,6 +2230,24 @@ interface(`kernel_rw_unlabeled_dirs',` ######################################## ## +## Read and write unlabeled files. +## +## +## +## Domain allowed access. +## +## +# +interface(`kernel_rw_unlabeled_files',` + gen_require(` + type unlabeled_t; + ') + + allow $1 unlabeled_t:file rw_file_perms; +') + +######################################## +## ## Do not audit attempts by caller to get the ## attributes of an unlabeled file. ## diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 78fb6b2..b0b4617 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -1,5 +1,5 @@ -policy_module(kernel, 1.12.0) +policy_module(kernel, 1.12.1) ######################################## #