diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index ad49b9e38..dd261be1f 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -2306,6 +2306,24 @@ interface(`fs_unmount_fusefs',` allow $1 fusefs_t:filesystem unmount; ') +######################################## +## +## Remount a FUSE filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_remount_fusefs',` + gen_require(` + type fusefs_t; + ') + + allow $1 fusefs_t:filesystem remount; +') + ######################################## ## ## Mounton a FUSEFS filesystem. @@ -2324,6 +2342,58 @@ interface(`fs_mounton_fusefs',` allow $1 fusefs_t:dir mounton; ') +######################################## +## +## Make FUSEFS files an entrypoint for the +## specified domain. +## +## +## +## The domain for which fusefs_t is an entrypoint. +## +## +# +interface(`fs_fusefs_entry_type',` + gen_require(` + type fusefs_t; + ') + + domain_entry_file($1, fusefs_t) +') + +######################################## +## +## Execute FUSEFS files in a specified domain. +## +## +##

+## Execute FUSEFS files in a specified domain. +##

+##

+## No interprocess communication (signals, pipes, +## etc.) is provided by this interface since +## the domains are not owned by this module. +##

+##
+## +## +## Domain allowed to transition. +## +## +## +## +## Domain to transition to. +## +## +# +interface(`fs_fusefs_domtrans',` + gen_require(` + type fusefs_t; + ') + + domain_auto_transition_pattern($1, fusefs_t, $2) +') + ######################################## ## ## Search directories @@ -2500,6 +2570,25 @@ interface(`fs_read_fusefs_symlinks',` read_lnk_files_pattern($1, fusefs_t, fusefs_t) ') +######################################## +## +## Manage symlinks on a FUSEFS filesystem. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`fs_manage_fusefs_symlinks',` + gen_require(` + type fusefs_t; + ') + + manage_lnk_files_pattern($1, fusefs_t, fusefs_t) +') + ######################################## ## ## Get the attributes of an hugetlbfs