selinux-refpolicy/refpolicy/policy/modules/kernel/devices.te

196 lines
4.5 KiB
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
policy_module(devices,1.0)
2005-06-30 18:54:08 +00:00
########################################
#
# Declarations
#
2005-04-14 20:18:17 +00:00
attribute device_node;
2005-05-10 20:24:26 +00:00
attribute memory_raw_read;
attribute memory_raw_write;
2005-04-14 20:18:17 +00:00
#
# device_t is the type of /dev.
#
type device_t;
files_type(device_t)
2005-06-13 17:35:46 +00:00
files_mountpoint(device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(device_t)
2005-04-14 20:18:17 +00:00
# Only directories and symlinks should be labeled device_t.
# If there are other files with this type, it is wrong.
# Relabelto is allowed for setfiles to function, in case
# a device node has no specific type yet, but is for some
# reason labeled with a specific type
#cjp: want this, but udev policy breaks this
2005-06-30 18:54:08 +00:00
#neverallow domain device_t:{ file fifo_file sock_file chr_file blk_file } ~{ getattr setattr relabelfrom relabelto };
2005-04-14 20:18:17 +00:00
#
# Type for /dev/agpgart
#
type agp_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(agp_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(agp_device_t)
2005-04-14 20:18:17 +00:00
#
# Type for /dev/apm_bios
#
type apm_bios_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(apm_bios_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(apm_bios_t)
2005-04-14 20:18:17 +00:00
2005-05-10 20:25:20 +00:00
type cardmgr_dev_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(cardmgr_dev_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(cardmgr_dev_t)
2005-05-10 20:25:20 +00:00
2005-04-14 20:18:17 +00:00
#
# clock_device_t is the type of
# /dev/rtc.
#
type clock_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(clock_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(clock_device_t)
2005-04-14 20:18:17 +00:00
#
# cpu control devices /dev/cpu/0/*
#
type cpu_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(cpu_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(cpu_device_t)
2005-04-14 20:18:17 +00:00
2005-09-13 13:06:07 +00:00
# for the IBM zSeries z90crypt hardware ssl accelorator
type crypt_device_t, device_node;
fs_associate(crypt_device_t)
fs_associate_tmpfs(crypt_device_t)
2005-05-10 20:24:26 +00:00
type dri_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(dri_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(dri_device_t)
2005-05-10 20:24:26 +00:00
type event_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(event_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(event_device_t)
2005-05-10 20:24:26 +00:00
2005-04-14 20:18:17 +00:00
#
# Type for framebuffer /dev/fb/*
#
type framebuf_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(framebuf_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(framebuf_device_t)
2005-04-14 20:18:17 +00:00
2005-04-29 20:35:49 +00:00
#
# Type for /dev/mapper/control
#
type lvm_control_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(lvm_control_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(lvm_control_t)
2005-04-29 20:35:49 +00:00
2005-05-10 20:24:26 +00:00
#
# memory_device_t is the type of /dev/kmem,
# /dev/mem and /dev/port.
#
type memory_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(memory_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(memory_device_t)
2005-05-10 20:24:26 +00:00
neverallow ~memory_raw_read memory_device_t:{ chr_file blk_file } read;
neverallow ~memory_raw_write memory_device_t:{ chr_file blk_file } { append write };
type misc_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(misc_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(misc_device_t)
2005-05-10 20:24:26 +00:00
#
# A more general type for mouse devices.
#
type mouse_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(mouse_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(mouse_device_t)
2005-05-10 20:24:26 +00:00
2005-04-14 20:18:17 +00:00
#
# Type for /dev/cpu/mtrr and /proc/mtrr
#
type mtrr_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(mtrr_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(mtrr_device_t)
genfscon proc /mtrr context_template(system_u:object_r:mtrr_device_t,s0)
2005-04-14 20:18:17 +00:00
2005-05-10 20:24:26 +00:00
#
# null_device_t is the type of /dev/null.
#
type null_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(null_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(null_device_t)
2005-09-26 20:26:32 +00:00
mls_trusted_object(null_device_t)
sid devnull context_template(system_u:object_r:null_device_t,s0)
2005-05-10 20:24:26 +00:00
2005-04-14 20:18:17 +00:00
#
# Type for /dev/pmu
#
type power_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(power_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(power_device_t)
2005-04-14 20:18:17 +00:00
2005-05-10 13:59:10 +00:00
type printer_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(printer_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(printer_device_t)
2005-05-10 13:59:10 +00:00
2005-05-10 20:24:26 +00:00
#
# random_device_t is the type of /dev/random
#
type random_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(random_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(random_device_t)
2005-05-10 20:24:26 +00:00
type scanner_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(scanner_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(scanner_device_t)
2005-05-10 20:24:26 +00:00
2005-04-14 20:18:17 +00:00
#
# Type for sound devices and mixers
#
type sound_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(sound_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(sound_device_t)
2005-04-29 20:35:49 +00:00
#
# sysfs_t is the type for the /sys pseudofs
#
type sysfs_t;
files_mountpoint(sysfs_t)
fs_type(sysfs_t)
genfscon sysfs / context_template(system_u:object_r:sysfs_t,s0)
2005-05-10 20:24:26 +00:00
#
# urandom_device_t is the type of /dev/urandom
#
type urandom_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(urandom_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(urandom_device_t)
2005-05-10 20:24:26 +00:00
#
# usbfs_t is the type for the /proc/bus/usb pseudofs
#
type usbfs_t alias usbdevfs_t;
files_mountpoint(usbfs_t)
fs_make_noxattr_fs(usbfs_t)
genfscon usbfs / context_template(system_u:object_r:usbfs_t,s0)
genfscon usbdevfs / context_template(system_u:object_r:usbfs_t,s0)
2005-05-10 14:12:10 +00:00
type v4l_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(v4l_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(v4l_device_t)
2005-05-10 14:12:10 +00:00
2005-04-29 20:35:49 +00:00
type xserver_misc_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(xserver_misc_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(xserver_misc_device_t)
2005-05-10 20:24:26 +00:00
#
# zero_device_t is the type of /dev/zero.
#
type zero_device_t, device_node;
2005-06-08 13:12:00 +00:00
fs_associate(zero_device_t)
2005-06-10 01:01:13 +00:00
fs_associate_tmpfs(zero_device_t)
2005-09-26 20:26:32 +00:00
mls_trusted_object(zero_device_t)