selinux-refpolicy/policy/modules/kernel/terminal.te

policy_module(terminal)

########################################
#
# Declarations
#
attribute ttynode;
attribute ptynode;
attribute server_ptynode;
attribute serial_device;

#
# bsdpty_device_t is the type of /dev/[tp]ty[abcdepqrstuvwxyz][0-9a-f]
type bsdpty_device_t;
dev_node(bsdpty_device_t)

#
# console_device_t is the type of /dev/console.
#
type console_device_t;
dev_node(console_device_t)

#
# devpts_t is the type of the devpts file system and
# the type of the root directory of the file system.
#
type devpts_t;
dev_associate(devpts_t)
files_mountpoint(devpts_t)
fs_associate_tmpfs(devpts_t)
fs_xattr_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);

#
# devtty_t is the type of /dev/tty.
#
type devtty_t;
dev_node(devtty_t)
mls_trusted_object(devtty_t)

optional_policy(`
	container_mountpoint(devtty_t)
')

#
# ptmx_t is the type for /dev/ptmx.
#
type ptmx_t;
dev_node(ptmx_t)
mls_trusted_object(ptmx_t)
allow ptmx_t devpts_t:filesystem associate;

#
# tty_device_t is the type of /dev/*tty*
#
type tty_device_t, serial_device;
dev_node(tty_device_t)

#
# usbtty_device_t is the type of /dev/usr/tty*
#
type usbtty_device_t, serial_device;
dev_node(usbtty_device_t)

type virtio_device_t, serial_device;
dev_node(virtio_device_t)
Drop module versioning. Semodule stopped using this many years ago. The policy_module() macro will continue to support an optional second parameter as version. If it is not specified, a default value of 1 is set. Signed-off-by: Chris PeBenito <pebenito@ieee.org> 2022-01-06 13:55:54 +00:00			`policy_module(terminal)`
add module statement macro and entrypoint executable attribute to replicate can_exec($1,exec_type) 2005-04-26 17:00:25 +00:00
more work on current modules 2005-06-30 18:54:08 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`
initial commit 2005-04-14 20:18:17 +00:00			`attribute ttynode;`
			`attribute ptynode;`
start adding user domains. fix ttynode and ptynode handling, as they're more then user terminals (at least ptynode is). start adding XML comments 2005-05-16 21:10:33 +00:00			`attribute server_ptynode;`
add cups 2005-10-23 22:10:59 +00:00			`attribute serial_device;`
initial commit 2005-04-14 20:18:17 +00:00
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00			`#`
			`# bsdpty_device_t is the type of /dev/[tp]ty[abcdepqrstuvwxyz][0-9a-f]`
			`type bsdpty_device_t;`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(bsdpty_device_t)`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# console_device_t is the type of /dev/console.`
			`#`
			`type console_device_t;`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(console_device_t)`
initial commit 2005-04-14 20:18:17 +00:00
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00			`#`
Whitespace cleanup. 2009-11-24 16:11:38 +00:00			`# devpts_t is the type of the devpts file system and`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00			`# the type of the root directory of the file system.`
			`#`
			`type devpts_t;`
terminal: /dev/pts exists in /dev filesystem systemd tries to create /dev/pts directly with its context type "devpts_t", but this is not allowed: avc: denied { associate } for pid=1 comm="systemd" name="pts" scontext=system_u:object_r:devpts_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 2017-08-12 08:34:59 +00:00			`dev_associate(devpts_t)`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_mountpoint(devpts_t)`
pile o fixes 2005-10-26 16:00:13 +00:00			`fs_associate_tmpfs(devpts_t)`
Associate the new xattrfs attribute to fs_t and some pseudo-fs Associate the new xattrfs attribute to fs_t and the pseudo filesystems that we know support xattr This patch adds the attribute to the following (pseudo) filesystems - device_t - devpts_t - fs_t - hugetlbfs - sysfs_t - tmpfs_t 2014-04-04 20:52:53 +00:00			`fs_xattr_type(devpts_t)`
rename context_template() to gen_context() 2005-10-06 19:33:06 +00:00			`fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00
initial commit 2005-04-14 20:18:17 +00:00			`#`
			`# devtty_t is the type of /dev/tty.`
			`#`
			`type devtty_t;`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(devtty_t)`
add mls privileges 2005-09-26 20:26:32 +00:00			`mls_trusted_object(devtty_t)`
initial commit 2005-04-14 20:18:17 +00:00
various: make various types a mountpoint for containers Signed-off-by: Kenton Groombridge <me@concord.sh> 2021-12-16 15:34:25 +00:00			optional_policy(`
			`container_mountpoint(devtty_t)`
			`')`

initial commit 2005-04-14 20:18:17 +00:00			`#`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00			`# ptmx_t is the type for /dev/ptmx.`
initial commit 2005-04-14 20:18:17 +00:00			`#`
add mls privileges 2005-09-26 20:26:32 +00:00			`type ptmx_t;`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(ptmx_t)`
add mls privileges 2005-09-26 20:26:32 +00:00			`mls_trusted_object(ptmx_t)`
Add terminal patch from Dan Walsh. 2009-11-19 19:57:49 +00:00			`allow ptmx_t devpts_t:filesystem associate;`
initial commit 2005-04-14 20:18:17 +00:00
			`#`
make mountpoints work, plus misc 2005-04-28 21:41:09 +00:00			`# tty_device_t is the type of /dev/tty`
			`#`
add cups 2005-10-23 22:10:59 +00:00			`type tty_device_t, serial_device;`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(tty_device_t)`
initial commit 2005-04-14 20:18:17 +00:00
clean up some filesystem assoc 2005-04-21 22:46:49 +00:00			`#`
			`# usbtty_device_t is the type of /dev/usr/tty*`
			`#`
add cups 2005-10-23 22:10:59 +00:00			`type usbtty_device_t, serial_device;`
Devices rename. 2005-06-13 16:22:32 +00:00			`dev_node(usbtty_device_t)`
Initial virtio console device Also known as 'vmchannel', a transport mechanism is needed for communication between the host userspace and guest userspace for achieving things like making clipboard copy/paste work seamlessly across the host and guest, locking the guest screen in case the vnc session to the guest is closed and so on. This can be used in offline cases as well, for example with libguestfs to probe which file systems the guest uses, the apps installed, etc. Virtio-serial is just the transport protocol that will enable such applications to be written. It has two parts: (a) device emulation in qemu that presents a virtio-pci device to the guest and (b) a guest driver that presents a char device interface to userspace applications. Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-09-24 13:39:56 +00:00
			`type virtio_device_t, serial_device;`
			`dev_node(virtio_device_t)`