diff --git a/refpolicy/policy/modules/kernel/devices.if b/refpolicy/policy/modules/kernel/devices.if index ce95b8b..3a94fc2 100644 --- a/refpolicy/policy/modules/kernel/devices.if +++ b/refpolicy/policy/modules/kernel/devices.if @@ -74,6 +74,20 @@ type device_t; class dir { getattr read search }; ') +######################################## +# +# devices_get_generic_block_device_attributes(domain) +# +define(`devices_get_generic_block_device_attributes',` +requires_block_template(`$0'_depend) +allow $1 device_t:dir { getattr search read }; +allow $1 device_t:blk_file getattr; +') + +define(`devices_get_generic_block_device_attributes_depend',` +type device_t; +class blk_file getattr; +') ######################################## # @@ -91,6 +105,21 @@ class blk_file getattr; ######################################## # +# devices_get_generic_character_device_attributes(domain) +# +define(`devices_get_generic_character_device_attributes',` +requires_block_template(`$0'_depend) +allow $1 device_t:dir { getattr search read }; +allow $1 device_t:chr_file getattr; +') + +define(`devices_get_generic_character_device_attributes_depend',` +type device_t; +class chr_file getattr; +') + +######################################## +# # devices_ignore_get_generic_character_device_attributes(domain) # define(`devices_ignore_get_generic_character_device_attributes',`