rename

refpolicy/policy/modules/kernel/storage.if

@@ -2,7 +2,7 @@
 ## <summary>Policy controlling access to storage devices</summary>
 
 ########################################
-## <interface name="storage_get_fixed_disk_attributes">
+## <interface name="storage_getattr_fixed_disk">
 ##	<description>
 ##		Allow the caller to get the attributes of fixed disk
 ##		device nodes.
@@ -12,21 +12,21 @@
 ##	</parameter>
 ## </interface>
 #
-define(`storage_get_fixed_disk_attributes',`
+define(`storage_getattr_fixed_disk',`
 	requires_block_template(`$0'_depend)
 
 	devices_list_device_nodes($1)
 	allow $1 fixed_disk_device_t:blk_file getattr;
 ')
 
-define(`storage_get_fixed_disk_attributes_depend',`
+define(`storage_getattr_fixed_disk_depend',`
 	type fixed_disk_device_t;
 
 	class blk_file getattr;
 ')
 
 ########################################
-## <interface name="storage_ignore_get_fixed_disk_attributes">
+## <interface name="storage_dontaudit_getattr_fixed_disk">
 ##	<description>
 ##		Do not audit attempts made by the caller to get
 ##		the attributes of fixed disk device nodes.
@@ -36,20 +36,20 @@ define(`storage_get_fixed_disk_attributes_depend',`
 ##	</parameter>
 ## </interface>
 #
-define(`storage_ignore_get_fixed_disk_attributes',`
+define(`storage_dontaudit_getattr_fixed_disk',`
 	requires_block_template(`$0'_depend)
 
 	dontaudit $1 fixed_disk_device_t:blk_file getattr;
 ')
 
-define(`storage_ignore_get_fixed_disk_attributes_depend',`
+define(`storage_dontaudit_getattr_fixed_disk_depend',`
 	type fixed_disk_device_t;
 
 	class blk_file getattr;
 ')
 
 ########################################
-## <interface name="storage_set_fixed_disk_attributes">
+## <interface name="storage_setattr_fixed_disk">
 ##	<description>
 ##		Allow the caller to set the attributes of fixed disk
 ##		device nodes.
@@ -59,14 +59,14 @@ define(`storage_ignore_get_fixed_disk_attributes_depend',`
 ##	</parameter>
 ## </interface>
 #
-define(`storage_set_fixed_disk_attributes',`
+define(`storage_setattr_fixed_disk',`
 	requires_block_template(`$0'_depend)
 
 	devices_list_device_nodes($1)
 	allow $1 fixed_disk_device_t:blk_file setattr;
 ')
 
-define(`storage_set_fixed_disk_attributes_depend',`
+define(`storage_setattr_fixed_disk_depend',`
 	type fixed_disk_device_t;
 
 	class blk_file setattr;
@@ -131,7 +131,7 @@ define(`storage_raw_write_fixed_disk_depend',`
 ')
 
 ########################################
-## <interface name="storage_create_fixed_disk_dev_entry">
+## <interface name="storage_create_fixed_disk">
 ##	<description>
 ##		Create block devices in /dev with the fixed disk type.
 ##	</description>
@@ -157,7 +157,7 @@ define(`storage_create_fixed_disk_dev_entry_depend',`
 ########################################
 ## <interface name="storage_manage_fixed_disk">
 ##	<description>
-##		Manage fixed disk device nodes.
+##		Create, read, write, and delete fixed disk device nodes.
 ##	</description>
 ##	<parameter name="domain">
 ##		The type of the process performing this action.
@@ -299,25 +299,39 @@ define(`storage_write_scsi_generic_depend',`
 ')
 
 ########################################
+## <interface name="storage_getattr_scsi_generic">
+##	<description>
+##		Get attributes of the device nodes
+##		for the SCSI generic inerface.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# storage_get_scsi_generic_attributes(domain)
-#
-define(`storage_get_scsi_generic_attributes',`
+define(`storage_getattr_scsi_generic',`
 	requires_block_template(`$0'_depend)
 
 	devices_list_device_nodes($1)
 	allow $1 scsi_generic_device_t:blk_file getattr;
 ')
 
-define(`storage_get_scsi_generic_attributes_depend',`
+define(`storage_getattr_scsi_generic_depend',`
 	type scsi_generic_device_t;
 
 	class blk_file getattr;
 ')
 
 ########################################
-#
-# storage_set_scsi_generic_attributes(domain)
+## <interface name="storage_setattr_scsi_generic">
+##	<description>
+##		Set attributes of the device nodes
+##		for the SCSI generic inerface.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`storage_set_scsi_generic_attributes',`
 	requires_block_template(`$0'_depend)
@@ -333,7 +347,7 @@ define(`storage_set_scsi_generic_attributes_depend',`
 ')
 
 ########################################
-## <interface name="storage_get_removable_device_attributes">
+## <interface name="storage_getattr_removable_device">
 ##	<description>
 ##		Allow the caller to get the attributes of removable
 ##		devices device nodes.
@@ -343,21 +357,21 @@ define(`storage_set_scsi_generic_attributes_depend',`
 ##	</parameter>
 ## </interface>
 #
-define(`storage_get_removable_device_attributes',`
+define(`storage_getattr_removable_device',`
 	requires_block_template(`$0'_depend)
 
 	devices_list_device_nodes($1)
 	allow $1 removable_device_t:blk_file getattr;
 ')
 
-define(`storage_get_removable_device_attributes_depend',`
+define(`storage_getattr_removable_device_depend',`
 	type removable_device_t;
 
 	class blk_file getattr;
 ')
 
 ########################################
-## <interface name="storage_ignore_get_removable_device_attributes">
+## <interface name="storage_dontaudit_getattr_removable_device">
 ##	<description>
 ##		Do not audit attempts made by the caller to get
 ##		the attributes of removable devices device nodes.
@@ -367,21 +381,28 @@ define(`storage_get_removable_device_attributes_depend',`
 ##	</parameter>
 ## </interface>
 #
-define(`storage_ignore_get_removable_device_attributes',`
+define(`storage_dontaudit_getattr_removable_device',`
 	requires_block_template(`$0'_depend)
 
 	dontaudit $1 removable_device_t:blk_file getattr;
 ')
 
-define(`storage_ignore_get_removable_device_attributes_depend',`
+define(`storage_dontaudit_getattr_removable_device_depend',`
 	type removable_device_t;
 
 	class blk_file getattr;
 ')
 
 ########################################
-#
-# storage_set_removable_device_attributes(domain)
+## <interface name="storage_setattr_removable_device">
+##	<description>
+##		Allow the caller to set the attributes of removable
+##		devices device nodes.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`storage_set_removable_device_attributes',`
 	requires_block_template(`$0'_depend)
@@ -397,8 +418,18 @@ define(`storage_set_removable_device_attributes_depend',`
 ')
 
 ########################################
-#
-# storage_raw_read_removable_device(domain)
+## <interface name="storage_raw_read_removable_device">
+##	<description>
+##		Allow the caller to directly read from
+##		a removable device.
+##		This is extremly dangerous as it can bypass the
+##		SELinux protections for filesystem objects, and
+##		should only be used by trusted domains.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`storage_raw_read_removable_device',`
 	requires_block_template(`$0'_depend)
@@ -414,8 +445,18 @@ define(`storage_raw_read_removable_device_depend',`
 ')
 
 ########################################
-#
-# storage_raw_write_removable_device(domain)
+## <interface name="storage_raw_write_removable_device">
+##	<description>
+##		Allow the caller to directly write to
+##		a removable device.
+##		This is extremly dangerous as it can bypass the
+##		SELinux protections for filesystem objects, and
+##		should only be used by trusted domains.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`storage_raw_write_removable_device',`
 	requires_block_template(`$0'_depend)
@@ -431,8 +472,15 @@ define(`storage_raw_write_removable_device_depend',`
 ')
 
 ########################################
-#
-# storage_read_tape_device(domain)
+## <interface name="storage_read_tape_device">
+##	<description>
+##		Allow the caller to directly read
+##		a tape device.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`storage_read_tape_device',`
 	requires_block_template(`$0'_depend)
@@ -448,8 +496,15 @@ define(`storage_read_tape_device_depend',`
 ')
 
 ########################################
-#
-# storage_write_tape_device(domain)
+## <interface name="storage_write_tape_device">
+##	<description>
+##		Allow the caller to directly read
+##		a tape device.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
 define(`storage_write_tape_device',`
 	requires_block_template(`$0'_depend)
@@ -465,34 +520,48 @@ define(`storage_write_tape_device_depend',`
 ')
 
 ########################################
+## <interface name="storage_getattr_tape_device">
+##	<description>
+##		Allow the caller to get the attributes
+##		of device nodes of tape devices.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# storage_get_tape_device_attributes(domain)
-#
-define(`storage_get_tape_device_attributes',`
+define(`storage_getattr_tape_device',`
 	requires_block_template(`$0'_depend)
 
 	devices_list_device_nodes($1)
 	allow $1 tape_device_t:blk_file getattr;
 ')
 
-define(`storage_get_tape_device_attributes_depend',`
+define(`storage_getattr_tape_device_depend',`
 	type tape_device_t;
 
 	class blk_file getattr;
 ')
 
 ########################################
+## <interface name="storage_setattr_tape_device">
+##	<description>
+##		Allow the caller to set the attributes
+##		of device nodes of tape devices.
+##	</description>
+##	<parameter name="domain">
+##		The type of the process performing this action.
+##	</parameter>
+## </interface>
 #
-# storage_set_tape_device_attributes(domain)
-#
-define(`storage_set_tape_device_attributes',`
+define(`storage_setattr_tape_device',`
 	requires_block_template(`$0'_depend)
 
 	devices_list_device_nodes($1)
 	allow $1 tape_device_t:blk_file setattr;
 ')
 
-define(`storage_set_tape_device_attributes_depend',`
+define(`storage_setattr_tape_device_depend',`
 	type tape_device_t;
 	class blk_file setattr;
 ')