selinux-refpolicy/policy/modules/system/clock.te

policy_module(clock, 1.11.0)

########################################
#
# Declarations
#

type adjtime_t;
files_type(adjtime_t)

type hwclock_t;
type hwclock_exec_t;
init_system_domain(hwclock_t, hwclock_exec_t)
role system_r types hwclock_t;

########################################
#
# Local policy
#

# Give hwclock the capabilities it requires.  dac_override is a surprise,
# but hwclock does require it.
allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config };
dontaudit hwclock_t self:capability sys_tty_config;
allow hwclock_t self:process signal_perms;
allow hwclock_t self:fifo_file rw_fifo_file_perms;

# Allow hwclock to store & retrieve correction factors.
allow hwclock_t adjtime_t:file { rw_file_perms setattr };

kernel_read_kernel_sysctls(hwclock_t)
kernel_read_system_state(hwclock_t)
# for when /usr is not mounted:
kernel_dontaudit_search_unlabeled(hwclock_t)

corecmd_exec_bin(hwclock_t)
corecmd_exec_shell(hwclock_t)

dev_read_sysfs(hwclock_t)
dev_rw_realtime_clock(hwclock_t)

files_read_etc_files(hwclock_t)

fs_getattr_xattr_fs(hwclock_t)
fs_search_auto_mountpoints(hwclock_t)

term_dontaudit_use_console(hwclock_t)
term_use_unallocated_ttys(hwclock_t)
term_use_all_ttys(hwclock_t)
term_use_all_ptys(hwclock_t)

domain_use_interactive_fds(hwclock_t)

init_use_fds(hwclock_t)
init_use_script_ptys(hwclock_t)

logging_send_audit_msgs(hwclock_t)
logging_send_syslog_msg(hwclock_t)

miscfiles_read_localization(hwclock_t)

optional_policy(`
	acpi_append_log(hwclock_t)
	acpi_rw_stream_sockets(hwclock_t)
')

optional_policy(`
	nscd_use(hwclock_t)
')

optional_policy(`
	seutil_sigchld_newrole(hwclock_t)
')

optional_policy(`
	userdom_dontaudit_use_unpriv_user_fds(hwclock_t)
')
Bump module versions for release. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2021-02-03 13:38:26 +00:00			`policy_module(clock, 1.11.0)`
initial commit 2005-05-05 21:18:27 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type adjtime_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(adjtime_t)`
initial commit 2005-05-05 21:18:27 +00:00
			`type hwclock_t;`
			`type hwclock_exec_t;`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`init_system_domain(hwclock_t, hwclock_exec_t)`
initial commit 2005-05-05 21:18:27 +00:00			`role system_r types hwclock_t;`

			`########################################`
			`#`
			`# Local policy`
			`#`

			`# Give hwclock the capabilities it requires. dac_override is a surprise,`
			`# but hwclock does require it.`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config };`
initial commit 2005-05-05 21:18:27 +00:00			`dontaudit hwclock_t self:capability sys_tty_config;`
add audit_write and a little style cleanup. 2006-07-07 14:51:08 +00:00			`allow hwclock_t self:process signal_perms;`
trunk: Enable open permission checks policy capability. 2008-10-16 16:09:20 +00:00			`allow hwclock_t self:fifo_file rw_fifo_file_perms;`
initial commit 2005-05-05 21:18:27 +00:00
			`# Allow hwclock to store & retrieve correction factors.`
add audit_write and a little style cleanup. 2006-07-07 14:51:08 +00:00			`allow hwclock_t adjtime_t:file { rw_file_perms setattr };`
initial commit 2005-05-05 21:18:27 +00:00
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(hwclock_t)`
patch from dan, Thu, 2007-01-25 at 08:12 -0500 2007-02-16 23:01:42 +00:00			`kernel_read_system_state(hwclock_t)`
Update modules for file_t merge into unlabeled_t. 2014-01-16 16:24:25 +00:00			`# for when /usr is not mounted:`
			`kernel_dontaudit_search_unlabeled(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`corecmd_exec_bin(hwclock_t)`
			`corecmd_exec_shell(hwclock_t)`
patch from dan Tue, 24 Oct 2006 11:00:28 -0400 2006-10-31 21:01:48 +00:00
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`dev_read_sysfs(hwclock_t)`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_rw_realtime_clock(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00
fix ordering of interface calls in clock. 2009-08-05 13:52:34 +00:00			`files_read_etc_files(hwclock_t)`

renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_xattr_fs(hwclock_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`fs_search_auto_mountpoints(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00
renaming insanity 2005-06-10 01:01:13 +00:00			`term_dontaudit_use_console(hwclock_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`term_use_unallocated_ttys(hwclock_t)`
Remove concept of user from terminal module interfaces dealing with ptynode and ttynode since these attributes are not specific to users. 2010-02-11 19:20:10 +00:00			`term_use_all_ttys(hwclock_t)`
			`term_use_all_ptys(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(hwclock_t)`
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(hwclock_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00
trunk: Add logging_send_audit_msgs() interface and deprecate send_audit_msgs_pattern(). 2007-06-12 18:46:14 +00:00			`logging_send_audit_msgs(hwclock_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00
			`miscfiles_read_localization(hwclock_t)`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
Rename apm to acpi from Russell Coker. This patch is slightly more involved than just running sed. It also adds typealias rules and doesn't change the FC entries. The /dev/apm_bios device doesn't exist on modern systems. I have left that policy in for the moment on the principle of making one change per patch. But I might send another patch to remove that as it won't exist with modern kernels. 2017-04-26 10:36:20 +00:00			`acpi_append_log(hwclock_t)`
			`acpi_rw_stream_sockets(hwclock_t)`
add apm and arpwatch. fix implementation error on fs_getattr_all_files, splitting it up into correct interfaces. 2005-10-10 18:11:46 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
NSCD related changes in various policy modules Use nscd_use instead of nscd_socket_use. This conditionally allows nscd_shm_use Remove the nscd_socket_use from ssh_keygen since it was redundant already allowed by auth_use_nsswitch Had to make some ssh_keysign_t rules unconditional else nscd_use(ssh_keysign_t) would not build (nested booleans) but that does not matter, the only actual domain transition to ssh_keysign_t is conditional so the other unconditional ssh_keygen_t rules are conditional in practice Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2012-12-17 20:06:29 +00:00			`nscd_use(hwclock_t)`
add nscd 2005-10-24 22:13:41 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`seutil_sigchld_newrole(hwclock_t)`
initial commit 2005-05-05 21:18:27 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
another round of renaming 2006-02-20 21:33:25 +00:00			`userdom_dontaudit_use_unpriv_user_fds(hwclock_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`')`