diff --git a/refpolicy/policy/modules/admin/dmesg.te b/refpolicy/policy/modules/admin/dmesg.te
index 074246d..ca23adb 100644
--- a/refpolicy/policy/modules/admin/dmesg.te
+++ b/refpolicy/policy/modules/admin/dmesg.te
@@ -22,7 +22,7 @@ dontaudit dmesg_t self:capability sys_tty_config;
allow dmesg_t self:process signal_perms;
kernel_read_kernel_sysctl(dmesg_t)
-kernel_read_hardware_state(dmesg_t)
+dev_read_sysfs(dmesg_t)
kernel_read_ring_buffer(dmesg_t)
kernel_clear_ring_buffer(dmesg_t)
kernel_change_ring_buffer_level(dmesg_t)
diff --git a/refpolicy/policy/modules/admin/rpm.te b/refpolicy/policy/modules/admin/rpm.te
index 2936e1c..a018e06 100644
--- a/refpolicy/policy/modules/admin/rpm.te
+++ b/refpolicy/policy/modules/admin/rpm.te
@@ -9,7 +9,7 @@ policy_module(rpm,1.0)
type rpm_t; #, admin, privmem, priv_system_role;
type rpm_exec_t;
init_system_domain(rpm_t,rpm_exec_t)
-kernel_obj_id_change_exempt(rpm_t)
+domain_obj_id_change_exempt(rpm_t)
domain_wide_inherit_fd(rpm_t)
role system_r types rpm_t;
@@ -31,7 +31,7 @@ typealias rpm_var_lib_t alias var_lib_rpm_t;
type rpm_script_t; #, admin, privmem, priv_system_role;
type rpm_script_exec_t;
-kernel_obj_id_change_exempt(rpm_script_t)
+domain_obj_id_change_exempt(rpm_script_t)
corecmd_shell_entry_type(rpm_script_t)
domain_type(rpm_script_t)
domain_entry_file(rpm_t,rpm_script_t)
diff --git a/refpolicy/policy/modules/admin/usermanage.te b/refpolicy/policy/modules/admin/usermanage.te
index 1e41365..ba4b220 100644
--- a/refpolicy/policy/modules/admin/usermanage.te
+++ b/refpolicy/policy/modules/admin/usermanage.te
@@ -10,7 +10,7 @@ type admin_passwd_exec_t;
files_file_type(admin_passwd_exec_t)
type chfn_t;
-kernel_obj_id_change_exempt(chfn_t)
+domain_obj_id_change_exempt(chfn_t)
domain_type(chfn_t)
role system_r types chfn_t;
@@ -31,12 +31,12 @@ files_tmp_file(crack_tmp_t)
type groupadd_t; #, nscd_client_domain;
type groupadd_exec_t;
-kernel_obj_id_change_exempt(groupadd_t)
+domain_obj_id_change_exempt(groupadd_t)
init_system_domain(groupadd_t,groupadd_exec_t)
role system_r types groupadd_t;
type passwd_t;
-kernel_obj_id_change_exempt(passwd_t)
+domain_obj_id_change_exempt(passwd_t)
domain_type(passwd_t)
role system_r types passwd_t;
@@ -44,7 +44,7 @@ type passwd_exec_t;
domain_entry_file(passwd_t,passwd_exec_t)
type sysadm_passwd_t;
-kernel_obj_id_change_exempt(sysadm_passwd_t)
+domain_obj_id_change_exempt(sysadm_passwd_t)
domain_type(sysadm_passwd_t)
domain_entry_file(sysadm_passwd_t,admin_passwd_exec_t)
@@ -53,7 +53,7 @@ files_file_type(sysadm_passwd_tmp_t)
type useradd_t; # nscd_client_domain;
type useradd_exec_t;
-kernel_obj_id_change_exempt(useradd_t)
+domain_obj_id_change_exempt(useradd_t)
init_system_domain(useradd_t,useradd_exec_t)
role system_r types useradd_t;
diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if
index 5308261..df0f9dc 100644
--- a/refpolicy/policy/modules/kernel/devices.if
+++ b/refpolicy/policy/modules/kernel/devices.if
@@ -1621,4 +1621,177 @@ define(`dev_rw_power_management_depend',`
class chr_file rw_file_perms;
')
+########################################
+##
+##
+## Search the directory containing hardware information.
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+define(`dev_search_sysfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 sysfs_t:dir search;
+')
+
+define(`dev_search_sysfs_depend',`
+ type sysfs_t;
+
+ class dir search;
+')
+
+########################################
+##
+##
+## Allow caller to read hardware state information.
+##
+##
+## The process type reading hardware state information.
+##
+##
+#
+define(`dev_read_sysfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 sysfs_t:dir r_dir_perms;
+ allow $1 sysfs_t:{ file lnk_file } r_file_perms;
+')
+
+define(`dev_read_sysfs_depend',`
+ type sysfs_t;
+
+ class dir r_dir_perms;
+ class file r_file_perms;
+ class lnk_file r_file_perms;
+')
+
+########################################
+##
+##
+## Allow caller to modify hardware state information.
+##
+##
+## The process type modifying hardware state information.
+##
+##
+#
+define(`dev_rw_sysfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 sysfs_t:dir r_dir_perms;
+ allow $1 sysfs_t:lnk_file r_file_perms;
+ allow $1 sysfs_t:file rw_file_perms;
+')
+
+define(`dev_rw_sysfs_depend',`
+ type sysfs_t;
+
+ class dir r_dir_perms;
+ class file rw_file_perms;
+ class lnk_file r_file_perms;
+')
+
+########################################
+##
+##
+## Search the directory containing USB hardware information.
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+define(`dev_search_usbfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 usbfs_t:dir search;
+')
+
+define(`dev_search_usbfs_depend',`
+ type usbfs_t;
+
+ class dir search;
+')
+
+########################################
+##
+##
+## Allow caller to get a list of usb hardware.
+##
+##
+## The process type getting the list.
+##
+##
+#
+define(`dev_list_usbfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 usbfs_t:dir r_dir_perms;
+ allow $1 usbfs_t:lnk_file r_file_perms;
+ allow $1 usbfs_t:file getattr;
+')
+
+define(`dev_list_usbfs_depend',`
+ type usbfs_t;
+
+ class dir r_dir_perms;
+ class file getattr;
+ class lnk_file r_file_perms;
+')
+
+########################################
+##
+##
+## Read USB hardware information using
+## the usbfs filesystem interface.
+##
+##
+## The type of the process performing this action.
+##
+##
+#
+define(`dev_read_usbfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 usbfs_t:dir r_dir_perms;
+ allow $1 usbfs_t:{ file lnk_file } r_file_perms;
+')
+
+define(`dev_read_usbfs_depend',`
+ type usbfs_t;
+
+ class dir r_dir_perms;
+ class file r_file_perms;
+ class lnk_file r_file_perms;
+')
+
+########################################
+##
+##
+## Allow caller to modify usb hardware configuration files.
+##
+##
+## The process type modifying the options.
+##
+##
+#
+define(`dev_rw_usbfs',`
+ gen_require(`$0'_depend)
+
+ allow $1 usbfs_t:dir r_dir_perms;
+ allow $1 usbfs_t:lnk_file r_file_perms;
+ allow $1 usbfs_t:file rw_file_perms;
+')
+
+define(`dev_rw_usbfs_depend',`
+ type usbfs_t;
+
+ class dir r_dir_perms;
+ class file rw_file_perms;
+ class lnk_file r_file_perms;
+')
+
##
diff --git a/refpolicy/policy/modules/kernel/devices.te b/refpolicy/policy/modules/kernel/devices.te
index b69faa2..302796e 100644
--- a/refpolicy/policy/modules/kernel/devices.te
+++ b/refpolicy/policy/modules/kernel/devices.te
@@ -144,12 +144,29 @@ fs_associate(sound_device_t)
fs_associate_tmpfs(sound_device_t)
#
+# sysfs_t is the type for the /sys pseudofs
+#
+type sysfs_t;
+files_mountpoint(sysfs_t)
+fs_make_fs(sysfs_t)
+genfscon sysfs / context_template(system_u:object_r:sysfs_t,s0)
+
+#
# urandom_device_t is the type of /dev/urandom
#
type urandom_device_t, device_node;
fs_associate(urandom_device_t)
fs_associate_tmpfs(urandom_device_t)
+#
+# usbfs_t is the type for the /proc/bus/usb pseudofs
+#
+type usbfs_t alias usbdevfs_t;
+files_mountpoint(usbfs_t)
+fs_make_noxattr_fs(usbfs_t)
+genfscon usbfs / context_template(system_u:object_r:usbfs_t,s0)
+genfscon usbdevfs / context_template(system_u:object_r:usbfs_t,s0)
+
type v4l_device_t, device_node;
fs_associate(v4l_device_t)
fs_associate_tmpfs(v4l_device_t)
diff --git a/refpolicy/policy/modules/kernel/kernel.if b/refpolicy/policy/modules/kernel/kernel.if
index e61d608..8a85ac7 100644
--- a/refpolicy/policy/modules/kernel/kernel.if
+++ b/refpolicy/policy/modules/kernel/kernel.if
@@ -130,69 +130,6 @@ define(`kernel_dontaudit_use_fd_depend',`
')
########################################
-##
-##
-## Makes caller an exception to the constraint preventing
-## changing of user identity.
-##
-##
-## The process type to make an exception to the constraint.
-##
-##
-#
-define(`kernel_subj_id_change_exempt',`
- gen_require(`$0'_depend)
-
- typeattribute $1 can_change_process_identity;
-')
-
-define(`kernel_subj_id_change_exempt_depend',`
- attribute can_change_process_identity;
-')
-
-########################################
-##
-##
-## Makes caller an exception to the constraint preventing
-## changing of role.
-##
-##
-## The process type to make an exception to the constraint.
-##
-##
-#
-define(`kernel_role_change_exempt',`
- gen_require(`$0'_depend)
-
- typeattribute $1 can_change_process_role;
-')
-
-define(`kernel_role_change_exempt_depend',`
- attribute can_change_process_role;
-')
-
-########################################
-##
-##
-## Makes caller an exception to the constraint preventing
-## changing the user identity in object contexts.
-##
-##
-## The process type to make an exception to the constraint.
-##
-##
-#
-define(`kernel_obj_id_change_exempt',`
- gen_require(`$0'_depend)
-
- typeattribute $1 can_change_object_identity;
-')
-
-define(`kernel_obj_id_change_exempt_depend',`
- attribute can_change_object_identity;
-')
-
-########################################
##
##
## Allows caller to load kernel modules
@@ -1458,79 +1395,6 @@ define(`kernel_rw_all_sysctl',`
')
########################################
-##
-##
-## Search the directory containing hardware information.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`kernel_search_sysfs',`
- gen_require(`$0'_depend)
-
- allow $1 sysfs_t:dir search;
-')
-
-define(`kernel_search_sysfs_depend',`
- type sysfs_t;
-
- class dir search;
-')
-
-########################################
-##
-##
-## Allow caller to read hardware state information.
-##
-##
-## The process type reading hardware state information.
-##
-##
-#
-define(`kernel_read_hardware_state',`
- gen_require(`$0'_depend)
-
- allow $1 sysfs_t:dir r_dir_perms;
- allow $1 sysfs_t:{ file lnk_file } r_file_perms;
-')
-
-define(`kernel_read_hardware_state_depend',`
- type sysfs_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
- class lnk_file r_file_perms;
-')
-
-########################################
-##
-##
-## Allow caller to modify hardware state information.
-##
-##
-## The process type modifying hardware state information.
-##
-##
-#
-define(`kernel_rw_hardware_config_option',`
- gen_require(`$0'_depend)
-
- allow $1 sysfs_t:dir r_dir_perms;
- allow $1 sysfs_t:lnk_file r_file_perms;
- allow $1 sysfs_t:file rw_file_perms;
-')
-
-define(`kernel_rw_hardware_config_option_depend',`
- type sysfs_t;
-
- class dir r_dir_perms;
- class file rw_file_perms;
- class lnk_file r_file_perms;
-')
-
-########################################
##
##
## Send a kill signal to unlabeled processes.
@@ -1691,104 +1555,4 @@ define(`kernel_relabel_unlabeled_depend',`
class blk_file { getattr relabelfrom };
')
-########################################
-##
-##
-## Search the directory containing USB hardware information.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`kernel_search_usbfs',`
- gen_require(`$0'_depend)
-
- allow $1 usbfs_t:dir search;
-')
-
-define(`kernel_search_usbfs_depend',`
- type usbfs_t;
-
- class dir search;
-')
-
-########################################
-##
-##
-## Allow caller to get a list of usb hardware.
-##
-##
-## The process type getting the list.
-##
-##
-#
-define(`kernel_list_usb_hardware',`
- gen_require(`$0'_depend)
-
- allow $1 usbfs_t:dir r_dir_perms;
- allow $1 usbfs_t:lnk_file r_file_perms;
- allow $1 usbfs_t:file getattr;
-')
-
-define(`kernel_list_usb_hardware_depend',`
- type usbfs_t;
-
- class dir r_dir_perms;
- class file getattr;
- class lnk_file r_file_perms;
-')
-
-########################################
-##
-##
-## Read USB hardware information using
-## the usbfs filesystem interface.
-##
-##
-## The type of the process performing this action.
-##
-##
-#
-define(`kernel_read_usb_hardware_state',`
- gen_require(`$0'_depend)
-
- allow $1 usbfs_t:dir r_dir_perms;
- allow $1 usbfs_t:{ file lnk_file } r_file_perms;
-')
-
-define(`kernel_read_usb_hardware_state_depend',`
- type usbfs_t;
-
- class dir r_dir_perms;
- class file r_file_perms;
- class lnk_file r_file_perms;
-')
-
-########################################
-##
-##
-## Allow caller to modify usb hardware configuration files.
-##
-##
-## The process type modifying the options.
-##
-##
-#
-define(`kernel_rw_usb_hardware_config_option',`
- gen_require(`$0'_depend)
-
- allow $1 usbfs_t:dir r_dir_perms;
- allow $1 usbfs_t:lnk_file r_file_perms;
- allow $1 usbfs_t:file rw_file_perms;
-')
-
-define(`kernel_rw_usb_hardware_config_option_depend',`
- type usbfs_t;
-
- class dir r_dir_perms;
- class file rw_file_perms;
- class lnk_file r_file_perms;
-')
-
##
diff --git a/refpolicy/policy/modules/kernel/kernel.te b/refpolicy/policy/modules/kernel/kernel.te
index 8881b13..0a582a3 100644
--- a/refpolicy/policy/modules/kernel/kernel.te
+++ b/refpolicy/policy/modules/kernel/kernel.te
@@ -8,11 +8,6 @@ attribute can_setsecparam;
attribute can_load_kernmodule;
attribute can_receive_kernel_messages;
-# constraint related attributes
-attribute can_change_process_identity;
-attribute can_change_process_role;
-attribute can_change_object_identity;
-
#
# kernel_t is the domain of kernel threads.
# It is also the target type when checking permissions in the system class.
@@ -60,14 +55,6 @@ sid security context_template(system_u:object_r:security_t,s0)
genfscon selinuxfs / context_template(system_u:object_r:security_t,s0)
#
-# sysfs_t is the type for /sys
-#
-type sysfs_t;
-files_mountpoint(sysfs_t)
-fs_make_fs(sysfs_t)
-genfscon sysfs / context_template(system_u:object_r:sysfs_t,s0)
-
-#
# Procfs types
#
@@ -144,15 +131,6 @@ genfscon proc /sys/vm context_template(system_u:object_r:sysctl_vm_t,s0)
type sysctl_dev_t;
genfscon proc /sys/dev context_template(system_u:object_r:sysctl_dev_t,s0)
-#
-# usbfs_t is the type for /proc/bus/usb
-#
-type usbfs_t alias usbdevfs_t;
-files_mountpoint(usbfs_t)
-fs_make_noxattr_fs(usbfs_t)
-genfscon usbfs / context_template(system_u:object_r:usbfs_t,s0)
-genfscon usbdevfs / context_template(system_u:object_r:usbfs_t,s0)
-
########################################
#
# kernel local policy
diff --git a/refpolicy/policy/modules/services/cron.te b/refpolicy/policy/modules/services/cron.te
index 7d25e80..6a3a773 100644
--- a/refpolicy/policy/modules/services/cron.te
+++ b/refpolicy/policy/modules/services/cron.te
@@ -76,7 +76,7 @@ allow crond_t system_cron_spool_t:dir r_dir_perms;
allow crond_t system_cron_spool_t:file r_file_perms;
kernel_read_kernel_sysctl(crond_t)
-kernel_read_hardware_state(crond_t)
+dev_read_sysfs(crond_t)
kernel_get_selinuxfs_mount_point(crond_t)
kernel_validate_context(crond_t)
kernel_compute_access_vector(crond_t)
diff --git a/refpolicy/policy/modules/services/remotelogin.te b/refpolicy/policy/modules/services/remotelogin.te
index 3d00299..3058991 100644
--- a/refpolicy/policy/modules/services/remotelogin.te
+++ b/refpolicy/policy/modules/services/remotelogin.te
@@ -7,9 +7,9 @@ policy_module(authlogin,1.0)
#
type remote_login_t; #, nscd_client_domain;
-kernel_obj_id_change_exempt(remote_login_t)
-kernel_subj_id_change_exempt(remote_login_t)
-kernel_role_change_exempt(remote_login_t)
+domain_obj_id_change_exempt(remote_login_t)
+domain_subj_id_change_exempt(remote_login_t)
+domain_role_change_exempt(remote_login_t)
domain_type(remote_login_t)
domain_wide_inherit_fd(remote_login_t)
auth_login_entry_type(remote_login_t)
diff --git a/refpolicy/policy/modules/services/sendmail.te b/refpolicy/policy/modules/services/sendmail.te
index 7bce7c0..d14ab32 100644
--- a/refpolicy/policy/modules/services/sendmail.te
+++ b/refpolicy/policy/modules/services/sendmail.te
@@ -40,7 +40,7 @@ allow sendmail_t sendmail_var_run_t:file { getattr create read write append seta
files_create_pid(sendmail_t,sendmail_var_run_t)
kernel_read_kernel_sysctl(sendmail_t)
-kernel_read_hardware_state(sendmail_t)
+dev_read_sysfs(sendmail_t)
corenet_tcp_sendrecv_all_if(sendmail_t)
corenet_raw_sendrecv_all_if(sendmail_t)
diff --git a/refpolicy/policy/modules/system/authlogin.te b/refpolicy/policy/modules/system/authlogin.te
index ab39a7c..e085b1f 100644
--- a/refpolicy/policy/modules/system/authlogin.te
+++ b/refpolicy/policy/modules/system/authlogin.te
@@ -138,7 +138,7 @@ allow pam_console_t pam_var_console_t:lnk_file r_file_perms;
kernel_read_kernel_sysctl(pam_console_t)
kernel_read_system_state(pam_console_t)
-kernel_read_hardware_state(pam_console_t)
+dev_read_sysfs(pam_console_t)
kernel_use_fd(pam_console_t)
# Allow to set attributes on /dev entries
diff --git a/refpolicy/policy/modules/system/clock.te b/refpolicy/policy/modules/system/clock.te
index df0aa9e..6c40663 100644
--- a/refpolicy/policy/modules/system/clock.te
+++ b/refpolicy/policy/modules/system/clock.te
@@ -30,7 +30,7 @@ dontaudit hwclock_t self:capability sys_tty_config;
allow hwclock_t adjtime_t:file { setattr ioctl read getattr lock write append };
kernel_read_kernel_sysctl(hwclock_t)
-kernel_read_hardware_state(hwclock_t)
+dev_read_sysfs(hwclock_t)
dev_rw_realtime_clock(hwclock_t)
diff --git a/refpolicy/policy/modules/system/domain.if b/refpolicy/policy/modules/system/domain.if
index 57f6fec..481c201 100644
--- a/refpolicy/policy/modules/system/domain.if
+++ b/refpolicy/policy/modules/system/domain.if
@@ -86,6 +86,69 @@ define(`domain_wide_inherit_fd_depend',`
')
########################################
+##
+##
+## Makes caller an exception to the constraint preventing
+## changing of user identity.
+##
+##
+## The process type to make an exception to the constraint.
+##
+##
+#
+define(`domain_subj_id_change_exempt',`
+ gen_require(`$0'_depend)
+
+ typeattribute $1 can_change_process_identity;
+')
+
+define(`domain_subj_id_change_exempt_depend',`
+ attribute can_change_process_identity;
+')
+
+########################################
+##
+##
+## Makes caller an exception to the constraint preventing
+## changing of role.
+##
+##
+## The process type to make an exception to the constraint.
+##
+##
+#
+define(`domain_role_change_exempt',`
+ gen_require(`$0'_depend)
+
+ typeattribute $1 can_change_process_role;
+')
+
+define(`domain_role_change_exempt_depend',`
+ attribute can_change_process_role;
+')
+
+########################################
+##
+##
+## Makes caller an exception to the constraint preventing
+## changing the user identity in object contexts.
+##
+##
+## The process type to make an exception to the constraint.
+##
+##
+#
+define(`domain_obj_id_change_exempt',`
+ gen_require(`$0'_depend)
+
+ typeattribute $1 can_change_object_identity;
+')
+
+define(`domain_obj_id_change_exempt_depend',`
+ attribute can_change_object_identity;
+')
+
+########################################
#
# domain_use_wide_inherit_fd(domain)
#
diff --git a/refpolicy/policy/modules/system/domain.te b/refpolicy/policy/modules/system/domain.te
index bc5e387..cb3306d 100644
--- a/refpolicy/policy/modules/system/domain.te
+++ b/refpolicy/policy/modules/system/domain.te
@@ -10,6 +10,11 @@ attribute entry_type;
# widely-inheritable file descriptors
attribute privfd;
+# constraint related attributes
+attribute can_change_process_identity;
+attribute can_change_process_role;
+attribute can_change_object_identity;
+
neverallow domain ~domain:process { transition dyntransition };
# enabling setcurrent breaks process tranquility. If you do not
diff --git a/refpolicy/policy/modules/system/getty.te b/refpolicy/policy/modules/system/getty.te
index 46e3772..235375e 100644
--- a/refpolicy/policy/modules/system/getty.te
+++ b/refpolicy/policy/modules/system/getty.te
@@ -42,7 +42,7 @@ files_create_tmp_files(getty_t,getty_tmp_t,{ file dir })
allow getty_t getty_log_t:file { getattr append setattr };
-kernel_read_hardware_state(getty_t)
+dev_read_sysfs(getty_t)
# for error condition handling
fs_getattr_xattr_fs(getty_t)
diff --git a/refpolicy/policy/modules/system/hostname.te b/refpolicy/policy/modules/system/hostname.te
index 34ec9a9..3d99ae2 100644
--- a/refpolicy/policy/modules/system/hostname.te
+++ b/refpolicy/policy/modules/system/hostname.te
@@ -26,7 +26,7 @@ dontaudit hostname_t self:capability sys_tty_config;
sysnet_read_config(hostname_t)
kernel_read_kernel_sysctl(hostname_t)
-kernel_read_hardware_state(hostname_t)
+dev_read_sysfs(hostname_t)
kernel_dontaudit_use_fd(hostname_t)
fs_getattr_xattr_fs(hostname_t)
diff --git a/refpolicy/policy/modules/system/hotplug.te b/refpolicy/policy/modules/system/hotplug.te
index a35f1d0..72de977 100644
--- a/refpolicy/policy/modules/system/hotplug.te
+++ b/refpolicy/policy/modules/system/hotplug.te
@@ -45,9 +45,9 @@ files_create_pid(hotplug_t,hotplug_var_run_t)
kernel_read_system_state(hotplug_t)
kernel_read_kernel_sysctl(hotplug_t)
-kernel_read_hardware_state(hotplug_t)
+dev_read_sysfs(hotplug_t)
kernel_read_net_sysctl(hotplug_t)
-kernel_read_usb_hardware_state(hotplug_t)
+dev_read_usbfs(hotplug_t)
bootloader_read_kernel_modules(hotplug_t)
diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
index 303f8d9..9a3708a 100644
--- a/refpolicy/policy/modules/system/init.te
+++ b/refpolicy/policy/modules/system/init.te
@@ -90,7 +90,7 @@ domain_auto_trans(init_t,initrc_exec_t,initrc_t)
kernel_set_boolean(init_t)
kernel_read_system_state(init_t)
-kernel_read_hardware_state(init_t)
+dev_read_sysfs(init_t)
kernel_share_state(init_t)
term_use_all_terms(init_t)
@@ -180,12 +180,12 @@ kernel_read_ring_buffer(initrc_t)
kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t)
-kernel_read_hardware_state(initrc_t)
-kernel_rw_hardware_config_option(initrc_t)
+dev_read_sysfs(initrc_t)
+dev_rw_sysfs(initrc_t)
kernel_read_all_sysctl(initrc_t)
kernel_rw_all_sysctl(initrc_t)
kernel_get_selinux_enforcement_mode(initrc_t)
-kernel_list_usb_hardware(initrc_t)
+dev_list_usbfs(initrc_t)
# for lsof which is used by alsa shutdown:
kernel_dontaudit_getattr_message_if(initrc_t)
@@ -333,7 +333,7 @@ ifdef(`distro_redhat',`
')
optional_policy(`hotplug.te',`
- kernel_read_usb_hardware_state(initrc_t)
+ dev_read_usbfs(initrc_t)
# init scripts run /etc/hotplug/usb.rc
hotplug_read_config(initrc_t)
diff --git a/refpolicy/policy/modules/system/iptables.te b/refpolicy/policy/modules/system/iptables.te
index 8e6d477..9064b0f 100644
--- a/refpolicy/policy/modules/system/iptables.te
+++ b/refpolicy/policy/modules/system/iptables.te
@@ -39,7 +39,7 @@ allow iptables_t self:rawip_socket create_socket_perms;
kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
-kernel_read_hardware_state(iptables_t)
+dev_read_sysfs(iptables_t)
kernel_read_kernel_sysctl(iptables_t)
kernel_read_modprobe_sysctl(iptables_t)
kernel_use_fd(iptables_t)
diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
index e93ac69..fc98a88 100644
--- a/refpolicy/policy/modules/system/locallogin.te
+++ b/refpolicy/policy/modules/system/locallogin.te
@@ -7,9 +7,9 @@ policy_module(locallogin,1.0)
#
type local_login_t; #, nscd_client_domain;
-kernel_obj_id_change_exempt(local_login_t)
-kernel_subj_id_change_exempt(local_login_t)
-kernel_role_change_exempt(local_login_t)
+domain_obj_id_change_exempt(local_login_t)
+domain_subj_id_change_exempt(local_login_t)
+domain_role_change_exempt(local_login_t)
auth_login_entry_type(local_login_t)
domain_type(local_login_t)
domain_wide_inherit_fd(local_login_t)
@@ -20,9 +20,9 @@ files_file_type(local_login_tmp_t)
type sulogin_t;
type sulogin_exec_t;
-kernel_obj_id_change_exempt(sulogin_t)
-kernel_subj_id_change_exempt(sulogin_t)
-kernel_role_change_exempt(sulogin_t)
+domain_obj_id_change_exempt(sulogin_t)
+domain_subj_id_change_exempt(sulogin_t)
+domain_role_change_exempt(sulogin_t)
domain_wide_inherit_fd(sulogin_t)
init_domain(sulogin_t,sulogin_exec_t)
init_system_domain(sulogin_t,sulogin_exec_t)
diff --git a/refpolicy/policy/modules/system/logging.te b/refpolicy/policy/modules/system/logging.te
index 3b6ba04..69f178f 100644
--- a/refpolicy/policy/modules/system/logging.te
+++ b/refpolicy/policy/modules/system/logging.te
@@ -59,7 +59,7 @@ allow auditd_t auditd_var_run_t:file create_file_perms;
files_create_pid(auditd_t,auditd_var_run_t)
kernel_read_kernel_sysctl(auditd_t)
-kernel_read_hardware_state(auditd_t)
+dev_read_sysfs(auditd_t)
fs_getattr_all_fs(auditd_t)
@@ -186,7 +186,7 @@ allow syslogd_t devlog_t:unix_dgram_socket name_bind;
allow syslogd_t syslogd_var_run_t:file create_file_perms;
files_create_pid(syslogd_t,syslogd_var_run_t)
-kernel_read_hardware_state(syslogd_t)
+dev_read_sysfs(syslogd_t)
kernel_read_kernel_sysctl(syslogd_t)
dev_create_dev_node(syslogd_t,devlog_t,sock_file)
diff --git a/refpolicy/policy/modules/system/lvm.te b/refpolicy/policy/modules/system/lvm.te
index 382379a..390a82e 100644
--- a/refpolicy/policy/modules/system/lvm.te
+++ b/refpolicy/policy/modules/system/lvm.te
@@ -11,7 +11,7 @@ type lvm_exec_t;
init_system_domain(lvm_t,lvm_exec_t)
# needs privowner because it assigns the identity system_u to device nodes
# but runs as the identity of the sysadmin
-kernel_obj_id_change_exempt(lvm_t)
+domain_obj_id_change_exempt(lvm_t)
role system_r types lvm_t;
type lvm_etc_t;
@@ -76,9 +76,9 @@ kernel_compute_create_context(lvm_t)
kernel_compute_relabel_context(lvm_t)
kernel_compute_reachable_user_contexts(lvm_t)
kernel_read_kernel_sysctl(lvm_t)
-kernel_read_hardware_state(lvm_t)
+dev_read_sysfs(lvm_t)
# Read /sys/block. Device mapper metadata is kept there.
-kernel_read_hardware_state(sysfs_t)
+dev_read_sysfs(sysfs_t)
# Read system variables in /proc/sys
kernel_read_kernel_sysctl(lvm_t)
# it has no reason to need this
diff --git a/refpolicy/policy/modules/system/modutils.te b/refpolicy/policy/modules/system/modutils.te
index d9cdace..c8f80f0 100644
--- a/refpolicy/policy/modules/system/modutils.te
+++ b/refpolicy/policy/modules/system/modutils.te
@@ -51,8 +51,6 @@ can_exec(insmod_t, insmod_exec_t)
kernel_load_module(insmod_t)
kernel_read_system_state(insmod_t)
-kernel_search_sysfs(insmod_t)
-kernel_search_usbfs(insmod_t)
# Rules for /proc/sys/kernel/tainted
kernel_read_kernel_sysctl(insmod_t)
kernel_rw_kernel_sysctl(insmod_t)
@@ -62,6 +60,8 @@ bootloader_read_kernel_modules(insmod_t)
# for locking: (cjp: ????)
bootloader_write_kernel_modules(insmod_t)
+dev_search_sysfs(insmod_t)
+dev_search_usbfs(insmod_t)
dev_write_mtrr(insmod_t)
dev_read_urand(insmod_t)
dev_rw_agp_dev(insmod_t)
diff --git a/refpolicy/policy/modules/system/selinux.te b/refpolicy/policy/modules/system/selinux.te
index 4926625..6027d4a 100644
--- a/refpolicy/policy/modules/system/selinux.te
+++ b/refpolicy/policy/modules/system/selinux.te
@@ -38,8 +38,8 @@ type load_policy_exec_t;
domain_entry_file(load_policy_t,load_policy_exec_t)
type newrole_t; # nscd_client_domain, mlsfileread, mlsfilewrite, mlsfileupgrade, mlsfiledowngrade, mlsprocsetsl;
-kernel_role_change_exempt(newrole_t)
-kernel_obj_id_change_exempt(newrole_t)
+domain_role_change_exempt(newrole_t)
+domain_obj_id_change_exempt(newrole_t)
domain_type(newrole_t)
domain_wide_inherit_fd(newrole_t)
@@ -65,7 +65,7 @@ files_file_type(policy_src_t)
type restorecon_t, can_relabelto_binary_policy;
type restorecon_exec_t;
-kernel_obj_id_change_exempt(restorecon_t)
+domain_obj_id_change_exempt(restorecon_t)
init_system_domain(restorecon_t,restorecon_exec_t)
role system_r types restorecon_t;
@@ -83,7 +83,7 @@ type selinux_config_t;
files_file_type(selinux_config_t)
type setfiles_t, can_relabelto_binary_policy;
-kernel_obj_id_change_exempt(setfiles_t)
+domain_obj_id_change_exempt(setfiles_t)
domain_type(setfiles_t)
role system_r types setfiles_t;
diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te
index 4926625..6027d4a 100644
--- a/refpolicy/policy/modules/system/selinuxutil.te
+++ b/refpolicy/policy/modules/system/selinuxutil.te
@@ -38,8 +38,8 @@ type load_policy_exec_t;
domain_entry_file(load_policy_t,load_policy_exec_t)
type newrole_t; # nscd_client_domain, mlsfileread, mlsfilewrite, mlsfileupgrade, mlsfiledowngrade, mlsprocsetsl;
-kernel_role_change_exempt(newrole_t)
-kernel_obj_id_change_exempt(newrole_t)
+domain_role_change_exempt(newrole_t)
+domain_obj_id_change_exempt(newrole_t)
domain_type(newrole_t)
domain_wide_inherit_fd(newrole_t)
@@ -65,7 +65,7 @@ files_file_type(policy_src_t)
type restorecon_t, can_relabelto_binary_policy;
type restorecon_exec_t;
-kernel_obj_id_change_exempt(restorecon_t)
+domain_obj_id_change_exempt(restorecon_t)
init_system_domain(restorecon_t,restorecon_exec_t)
role system_r types restorecon_t;
@@ -83,7 +83,7 @@ type selinux_config_t;
files_file_type(selinux_config_t)
type setfiles_t, can_relabelto_binary_policy;
-kernel_obj_id_change_exempt(setfiles_t)
+domain_obj_id_change_exempt(setfiles_t)
domain_type(setfiles_t)
role system_r types setfiles_t;
diff --git a/refpolicy/policy/modules/system/sysnetwork.te b/refpolicy/policy/modules/system/sysnetwork.te
index efb45c8..1237c5c 100644
--- a/refpolicy/policy/modules/system/sysnetwork.te
+++ b/refpolicy/policy/modules/system/sysnetwork.te
@@ -86,7 +86,7 @@ allow ifconfig_t dhcpc_t:process sigchld;
kernel_read_system_state(dhcpc_t)
kernel_read_network_state(dhcpc_t)
kernel_read_kernel_sysctl(dhcpc_t)
-kernel_read_hardware_state(dhcpc_t)
+dev_read_sysfs(dhcpc_t)
kernel_use_fd(dhcpc_t)
corenet_tcp_sendrecv_all_if(dhcpc_t)
diff --git a/refpolicy/policy/modules/system/udev.te b/refpolicy/policy/modules/system/udev.te
index bd6cc1a..bfeb6f6 100644
--- a/refpolicy/policy/modules/system/udev.te
+++ b/refpolicy/policy/modules/system/udev.te
@@ -10,7 +10,7 @@ type udev_t; # nscd_client_domain
type udev_exec_t;
type udev_helper_exec_t;
kernel_userland_entry(udev_t,udev_exec_t)
-kernel_obj_id_change_exempt(udev_t)
+domain_obj_id_change_exempt(udev_t)
domain_entry_file(udev_t,udev_helper_exec_t)
domain_wide_inherit_fd(udev_t)
init_daemon_domain(udev_t,udev_exec_t)
@@ -70,7 +70,7 @@ kernel_read_device_sysctl(udev_t)
kernel_read_hotplug_sysctl(udev_t)
kernel_read_modprobe_sysctl(udev_t)
kernel_read_kernel_sysctl(udev_t)
-kernel_read_hardware_state(udev_t)
+dev_read_sysfs(udev_t)
kernel_get_selinuxfs_mount_point(udev_t)
kernel_validate_context(udev_t)
kernel_compute_access_vector(udev_t)
diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if
index d1118e7..b626591 100644
--- a/refpolicy/policy/modules/system/userdomain.if
+++ b/refpolicy/policy/modules/system/userdomain.if
@@ -108,7 +108,7 @@ define(`base_user_domain',`
# Find CDROM devices:
kernel_read_device_sysctl($1_t)
# GNOME checks for usb and other devices:
- kernel_rw_usb_hardware_config_option($1_t)
+ dev_rw_usbfs($1_t)
corenet_tcp_sendrecv_all_if($1_t)
corenet_raw_sendrecv_all_if($1_t)
@@ -453,7 +453,7 @@ define(`user_domain_template', `
kernel_read_system_state($1_t)
kernel_read_network_state($1_t)
- kernel_read_hardware_state($1_t)
+ dev_read_sysfs($1_t)
# cjp: why?
bootloader_read_kernel_symbol_table($1_t)
@@ -614,7 +614,7 @@ define(`admin_domain_template',`
base_user_domain($1)
typeattribute $1_t privhome; #, admin, web_client_domain, nscd_client_domain;
- kernel_obj_id_change_exempt($1_t)
+ domain_obj_id_change_exempt($1_t)
role system_r types $1_t;
#ifdef(`direct_sysadm_daemon', `, priv_system_role')