diff --git a/refpolicy/policy/modules/system/files.if b/refpolicy/policy/modules/system/files.if index 8adce40..439e70c 100644 --- a/refpolicy/policy/modules/system/files.if +++ b/refpolicy/policy/modules/system/files.if @@ -80,10 +80,10 @@ class chr_file relabelfrom; ######################################## # -# files_search_all_directories(type,[`optional']) +# files_search_all_directories(domain) # define(`files_search_all_directories',` -requires_block_template(files_search_all_directories_depend,$2) +requires_block_template(files_search_all_directories_depend) allow $1 file_type:dir search; ') @@ -94,6 +94,20 @@ class dir search; ######################################## # +# files_ignore_search_all_directories(domain) +# +define(`files_ignore_search_all_directories',` +requires_block_template(files_ignore_search_all_directories_depend) +dontaudit $1 file_type:dir search; +') + +define(`files_ignore_search_all_directories_depend',` +attribute file_type; +class dir search; +') + +######################################## +# # files_read_all_directories(type,[`optional']) # define(`files_read_all_directories',` @@ -152,6 +166,20 @@ class dir { getattr search read write add_name }; ######################################## # +# files_ignore_read_rootfs_file(domain) +# +define(`files_ignore_read_rootfs_file',` +requires_block_template(files_ignore_read_rootfs_file_depend) +dontaudit $1 root_t:file read; +') + +define(`files_ignore_read_rootfs_file_depend',` +type root_t; +class file read; +') + +######################################## +# # files_ignore_modify_rootfs_file(domain,[`optional']) # define(`files_ignore_modify_rootfs_file',`