selinux-refpolicy/policy/modules/apps/lockdev.if

34 lines
709 B
Plaintext
Raw Normal View History

2006-01-11 20:18:56 +00:00
## <summary>device locking policy for lockdev</summary>
2008-11-05 16:10:46 +00:00
########################################
2006-01-11 20:18:56 +00:00
## <summary>
2008-11-05 16:10:46 +00:00
## Role access for lockdev
2006-01-11 20:18:56 +00:00
## </summary>
2008-11-05 16:10:46 +00:00
## <param name="role">
## <summary>
2008-11-05 16:10:46 +00:00
## Role allowed access
## </summary>
2006-01-11 20:18:56 +00:00
## </param>
2008-11-05 16:10:46 +00:00
## <param name="domain">
## <summary>
2008-11-05 16:10:46 +00:00
## User domain for the role
## </summary>
2006-01-11 20:18:56 +00:00
## </param>
#
2008-11-05 16:10:46 +00:00
interface(`lockdev_role',`
2006-01-11 20:18:56 +00:00
gen_require(`
2008-11-05 16:10:46 +00:00
type lockdev_t, lockdev_exec_t;
type lockdev_lock_t;
2006-01-11 20:18:56 +00:00
')
2008-11-05 16:10:46 +00:00
role $1 types lockdev_t;
2006-01-11 20:18:56 +00:00
# Transition from the user domain to the derived domain.
2008-11-05 16:10:46 +00:00
domtrans_pattern($2, lockdev_exec_t, lockdev_t)
allow lockdev_t $2:process signull;
2006-01-11 20:18:56 +00:00
2008-11-05 16:10:46 +00:00
# allow ps to show lockdev
ps_process_pattern($2, lockdev_t)
allow $2 lockdev_t:process signal;
2006-01-11 20:18:56 +00:00
')