## Policy for filesystems. ## ## Contains the initial SID for the filesystems. ## ######################################## ## ## Transform specified type into a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_type',` gen_require(` attribute filesystem_type; ') typeattribute $1 filesystem_type; ') ######################################## ## ## Transform specified type into a filesystem ## type which does not have extended attribute ## support. ## ## ## ## Domain allowed access. ## ## # interface(`fs_noxattr_type',` gen_require(` attribute noxattrfs; ') fs_type($1) typeattribute $1 noxattrfs; ') ######################################## ## ## Associate the specified file type to persistent ## filesystems with extended attributes. This ## allows a file of this type to be created on ## a filesystem such as ext3, JFS, and XFS. ## ## ## ## The type of the to be associated. ## ## # interface(`fs_associate',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem associate; ') ######################################## ## ## Associate the specified file type to ## filesystems which lack extended attributes ## support. This allows a file of this type ## to be created on a filesystem such as ## FAT32, and NFS. ## ## ## ## The type of the to be associated. ## ## # interface(`fs_associate_noxattr',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:filesystem associate; ') ######################################## ## ## Execute files on a filesystem that does ## not support extended attributes. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_noxattr',` gen_require(` attribute noxattrfs; ') can_exec($1, noxattrfs) ') ######################################## ## ## Transform specified type into a filesystem ## type which has extended attribute ## support. ## ## ## ## Domain allowed access. ## ## # interface(`fs_xattr_type',` gen_require(` attribute xattrfs; ') fs_type($1) typeattribute $1 xattrfs; ') ######################################## ## ## Get the attributes of all the ## filesystems which have extended ## attributes. ## This includes pseudo filesystems. ## ## ##

## Allow the specified domain to ## get the attributes of a filesystems ## which have extended attributes. ## Example attributes: ##

## ## ## ## ## Domain allowed access. ## ## ## ## # interface(`fs_getattr_all_xattr_fs',` gen_require(` attribute xattrfs; ') allow $1 xattrfs:filesystem getattr; ') ######################################## ## ## Mount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem mount; ') ######################################## ## ## Remount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem remount; ') ######################################## ## ## Unmount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of persistent ## filesystems which have extended ## attributes, such as ext3, JFS, or XFS. ## ## ##

## Allow the specified domain to ## get the attributes of a persistent ## filesystems which have extended ## attributes, such as ext3, JFS, or XFS. ## Example attributes: ##

##
    ##
  • Type of the file system (e.g., ext3)
    • ##
  • Size of the file system
    • ##
  • Available space on the file system
    • ##
## ## ## ## Domain allowed access. ## ## ## ## # interface(`fs_getattr_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem getattr; ') ######################################## ## ## Do not audit attempts to ## get the attributes of a persistent ## filesystem which has extended ## attributes, such as ext3, JFS, or XFS. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_xattr_fs',` gen_require(` type fs_t; ') dontaudit $1 fs_t:filesystem getattr; ') ######################################## ## ## Allow changing of the label of a ## filesystem with extended attributes ## using the context= mount option. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_xattr_fs',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem relabelfrom; ') ######################################## ## ## Get the filesystem quotas of a filesystem ## with extended attributes. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_get_xattr_fs_quotas',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem quotaget; ') ######################################## ## ## Set the filesystem quotas of a filesystem ## with extended attributes. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_set_xattr_fs_quotas',` gen_require(` type fs_t; ') allow $1 fs_t:filesystem quotamod; ') ######################################## ## ## Read files on anon_inodefs file systems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_anon_inodefs_files',` gen_require(` type anon_inodefs_t; ') read_files_pattern($1, anon_inodefs_t, anon_inodefs_t) ') ######################################## ## ## Read and write files on anon_inodefs ## file systems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_anon_inodefs_files',` gen_require(` type anon_inodefs_t; ') rw_files_pattern($1, anon_inodefs_t, anon_inodefs_t) ') ######################################## ## ## Do not audit attempts to read or write files on ## anon_inodefs file systems. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_anon_inodefs_files',` gen_require(` type anon_inodefs_t; ') dontaudit $1 anon_inodefs_t:file rw_file_perms; ') ######################################## ## ## Mount an automount pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem mount; ') ######################################## ## ## Remount an automount pseudo filesystem ## This allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem remount; ') ######################################## ## ## Unmount an automount pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of an automount ## pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_autofs',` gen_require(` type autofs_t; ') allow $1 autofs_t:filesystem getattr; ') ######################################## ## ## Search automount filesystem to use automatically ## mounted filesystems. ## ## ## Allow the specified domain to search mount points ## that have filesystems that are mounted by ## the automount service. Generally this will ## be required for any domain that accesses objects ## on these filesystems. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_search_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir search_dir_perms; ') ######################################## ## ## Read directories of automatically ## mounted filesystems. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_list_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list directories of automatically ## mounted filesystems. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_auto_mountpoints',` gen_require(` type autofs_t; ') dontaudit $1 autofs_t:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete symbolic links ## on an autofs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_autofs_symlinks',` gen_require(` type autofs_t; ') manage_lnk_files_pattern($1, autofs_t, autofs_t) ') ######################################## ## ## Get the attributes of directories on ## binfmt_misc filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_binfmt_misc_dirs',` gen_require(` type binfmt_misc_fs_t; ') allow $1 binfmt_misc_fs_t:dir getattr; ') ######################################## ## ## Register an interpreter for new binary ## file types, using the kernel binfmt_misc ## support. ## ## ##

## Register an interpreter for new binary ## file types, using the kernel binfmt_misc ## support. ##

##

## A common use for this is to ## register a JVM as an interpreter for ## Java byte code. Registered binaries ## can be directly executed on a command line ## without specifying the interpreter. ##

## ## ## ## Domain allowed access. ## ## ## # interface(`fs_register_binary_executable_type',` gen_require(` type binfmt_misc_fs_t; ') # binfmt_misc filesystem is usually mounted on /proc/sys/fs/binfmt_misc kernel_search_fs_sysctls($1) rw_files_pattern($1, binfmt_misc_fs_t, binfmt_misc_fs_t) ') ######################################## ## ## Mount cgroup filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_cgroup', ` gen_require(` type cgroup_t; ') allow $1 cgroup_t:filesystem mount; ') ######################################## ## ## Remount cgroup filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_cgroup', ` gen_require(` type cgroup_t; ') allow $1 cgroup_t:filesystem remount; ') ######################################## ## ## Unmount cgroup filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_cgroup', ` gen_require(` type cgroup_t; ') allow $1 cgroup_t:filesystem unmount; ') ######################################## ## ## Get attributes of cgroup filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_cgroup',` gen_require(` type cgroup_t; ') allow $1 cgroup_t:filesystem getattr; ') ######################################## ## ## Search cgroup directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_cgroup_dirs',` gen_require(` type cgroup_t; ') search_dirs_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## list cgroup directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_cgroup_dirs', ` gen_require(` type cgroup_t; ') list_dirs_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Delete cgroup directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_delete_cgroup_dirs', ` gen_require(` type cgroup_t; ') delete_dirs_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Manage cgroup directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cgroup_dirs',` gen_require(` type cgroup_t; ') manage_dirs_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Relabel cgroup directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_cgroup_dirs',` gen_require(` type cgroup_t; ') relabel_dirs_pattern($1, cgroup_t, cgroup_t) ') ######################################## ## ## Get attributes of cgroup files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_cgroup_files',` gen_require(` type cgroup_t; ') getattr_files_pattern($1, cgroup_t, cgroup_t) fs_search_tmpfs($1) dev_search_sysfs($1) ') ######################################## ## ## Read cgroup files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cgroup_files',` gen_require(` type cgroup_t; ') read_files_pattern($1, cgroup_t, cgroup_t) read_lnk_files_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Create cgroup lnk_files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_create_cgroup_links',` gen_require(` type cgroup_t; ') create_lnk_files_pattern($1, cgroup_t, cgroup_t) rw_lnk_files_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Write cgroup files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_cgroup_files', ` gen_require(` type cgroup_t; ') write_files_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Read and write cgroup files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_cgroup_files',` gen_require(` type cgroup_t; ') rw_files_pattern($1, cgroup_t, cgroup_t) read_lnk_files_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Do not audit attempts to open, ## get attributes, read and write ## cgroup files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_cgroup_files',` gen_require(` type cgroup_t; ') dontaudit $1 cgroup_t:file rw_file_perms; ') ######################################## ## ## Manage cgroup files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cgroup_files',` gen_require(` type cgroup_t; ') manage_files_pattern($1, cgroup_t, cgroup_t) dev_search_sysfs($1) ') ######################################## ## ## Relabel cgroup symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_cgroup_symlinks',` gen_require(` type cgroup_t; ') relabel_lnk_files_pattern($1, cgroup_t, cgroup_t) ') ######################################## ## ## Mount on cgroup directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mounton_cgroup', ` gen_require(` type cgroup_t; ') allow $1 cgroup_t:dir mounton; ') ######################################## ## ## Create an object in a cgroup tmpfs filesystem, with a private ## type using a type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the object to be created. ## ## ## ## ## The object class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`fs_cgroup_filetrans',` gen_require(` type cgroup_t, tmpfs_t; ') allow $2 tmpfs_t:filesystem associate; filetrans_pattern($1, cgroup_t, $2, $3, $4) dev_search_sysfs($1) ') ######################################## ## ## Do not audit attempts to read ## dirs on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_cifs_dirs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir list_dir_perms; ') ######################################## ## ## Mount a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem mount; ') ######################################## ## ## Remount a CIFS or SMB network filesystem. ## This allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem remount; ') ######################################## ## ## Unmount a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a CIFS or ## SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:filesystem getattr; ') ######################################## ## ## Search directories on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir search_dir_perms; ') ######################################## ## ## List the contents of directories on a ## CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_cifs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir list_dir_perms; ') ######################################## ## ## Mounton a CIFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mounton_cifs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir mounton; ') ######################################## ## ## Read files on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; read_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Get the attributes of filesystems that ## do not have extended attribute support. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:filesystem getattr; ') ######################################## ## ## Read all noxattrfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list all ## noxattrfs directories. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_noxattr_fs',` gen_require(` attribute noxattrfs; ') dontaudit $1 noxattrfs:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete all noxattrfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_noxattr_fs_dirs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir manage_dir_perms; ') ######################################## ## ## Read all noxattrfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') fs_list_noxattr_fs($1) read_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Do not audit attempts to read all ## noxattrfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') dontaudit $1 noxattrfs:file read_file_perms; ') ######################################## ## ## Dont audit attempts to write to noxattrfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_write_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') dontaudit $1 noxattrfs:file write; ') ######################################## ## ## Create, read, write, and delete all noxattrfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_noxattr_fs_files',` gen_require(` attribute noxattrfs; ') fs_list_noxattr_fs($1) manage_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Read all noxattrfs symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_noxattr_fs_symlinks',` gen_require(` attribute noxattrfs; ') fs_list_noxattr_fs($1) read_lnk_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Manage all noxattrfs symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_noxattr_fs_symlinks',` gen_require(` attribute noxattrfs; ') fs_list_noxattr_fs($1) manage_lnk_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Relabel all objets from filesystems that ## do not support extended attributes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_noxattr_fs',` gen_require(` attribute noxattrfs; ') allow $1 noxattrfs:dir list_dir_perms; relabelfrom_dirs_pattern($1, noxattrfs, noxattrfs) relabelfrom_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_lnk_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_fifo_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_sock_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) ') ######################################## ## ## Do not audit attempts to read ## files on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file read_file_perms; ') ######################################## ## ## Append files ## on a CIFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_append_cifs_files',` gen_require(` type cifs_t; ') append_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## dontaudit Append files ## on a CIFS filesystem. ## ## ## ## Domain to not audit. ## ## ## # interface(`fs_dontaudit_append_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file append_file_perms; ') ######################################## ## ## Do not audit attempts to read or ## write files on a CIFS or SMB filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file rw_file_perms; ') ######################################## ## ## Read symbolic links on a CIFS or SMB filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_symlinks',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; read_lnk_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Read named pipes ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_named_pipes',` gen_require(` type cifs_t; ') read_fifo_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Read named sockets ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_cifs_named_sockets',` gen_require(` type cifs_t; ') read_sock_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Execute files on a CIFS or SMB ## network filesystem, in the caller ## domain. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_cifs_files',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir list_dir_perms; exec_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Create, read, write, and delete directories ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_cifs_dirs',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a CIFS or SMB network filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_cifs_dirs',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:dir manage_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_cifs_files',` gen_require(` type cifs_t; ') manage_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete files ## on a CIFS or SMB network filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_cifs_files',` gen_require(` type cifs_t; ') dontaudit $1 cifs_t:file manage_file_perms; ') ######################################## ## ## Create, read, write, and delete symbolic links ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cifs_symlinks',` gen_require(` type cifs_t; ') manage_lnk_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Create, read, write, and delete named pipes ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cifs_named_pipes',` gen_require(` type cifs_t; ') manage_fifo_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Create, read, write, and delete named sockets ## on a CIFS or SMB network filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_cifs_named_sockets',` gen_require(` type cifs_t; ') manage_sock_files_pattern($1, cifs_t, cifs_t) ') ######################################## ## ## Execute a file on a CIFS or SMB filesystem ## in the specified domain. ## ## ##

## Execute a file on a CIFS or SMB filesystem ## in the specified domain. This allows ## the specified domain to execute any file ## on these filesystems in the specified ## domain. This is not suggested. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##

## This interface was added to handle ## home directories on CIFS/SMB filesystems, ## in particular used by the ssh-agent policy. ##

## ## ## ## Domain allowed to transition. ## ## ## ## ## The type of the new process. ## ## # interface(`fs_cifs_domtrans',` gen_require(` type cifs_t; ') allow $1 cifs_t:dir search_dir_perms; domain_auto_transition_pattern($1, cifs_t, $2) ') ####################################### ## ## Create, read, write, and delete dirs ## on a configfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_configfs_dirs',` gen_require(` type configfs_t; ') manage_dirs_pattern($1, configfs_t, configfs_t) ') ####################################### ## ## Create, read, write, and delete files ## on a configfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_configfs_files',` gen_require(` type configfs_t; ') manage_files_pattern($1, configfs_t, configfs_t) ') ######################################## ## ## Mount a DOS filesystem, such as ## FAT32 or NTFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem mount; ') ######################################## ## ## Remount a DOS filesystem, such as ## FAT32 or NTFS. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem remount; ') ######################################## ## ## Unmount a DOS filesystem, such as ## FAT32 or NTFS. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a DOS ## filesystem, such as FAT32 or NTFS. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem getattr; ') ######################################## ## ## Allow changing of the label of a ## DOS filesystem using the context= mount option. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_dos_fs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:filesystem relabelfrom; ') ######################################## ## ## Get attributes of directories on a dosfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_dos_dirs',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:dir getattr; ') ######################################## ## ## Search dosfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_dos',` gen_require(` type dosfs_t; ') allow $1 dosfs_t:dir search_dir_perms; ') ######################################## ## ## List dirs DOS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_dos',` gen_require(` type dosfs_t; ') list_dirs_pattern($1, dosfs_t, dosfs_t) ') ######################################## ## ## Create, read, write, and delete dirs ## on a DOS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_dos_dirs',` gen_require(` type dosfs_t; ') manage_dirs_pattern($1, dosfs_t, dosfs_t) ') ######################################## ## ## Read files on a DOS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_dos_files',` gen_require(` type dosfs_t; ') read_files_pattern($1, dosfs_t, dosfs_t) ') ######################################## ## ## Create, read, write, and delete files ## on a DOS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_dos_files',` gen_require(` type dosfs_t; ') manage_files_pattern($1, dosfs_t, dosfs_t) ') ######################################## ## ## List dirs in efivarfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_efivars',` gen_require(` type efivarfs_t; ') list_dirs_pattern($1, efivarfs_t, efivarfs_t) ') ####################################### ## ## Read files in efivarfs ## - contains Linux Kernel configuration options for UEFI systems ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_efivarfs_files',` gen_require(` type efivarfs_t; ') read_files_pattern($1, efivarfs_t, efivarfs_t) ') ######################################## ## ## stat a FUSE filesystem ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:filesystem getattr; ') ######################################## ## ## Mount a FUSE filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:filesystem mount; ') ######################################## ## ## Unmount a FUSE filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:filesystem unmount; ') ######################################## ## ## Mounton a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mounton_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:dir mounton; ') ######################################## ## ## Search directories ## on a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_search_fusefs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a FUSEFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_fusefs',` gen_require(` type fusefs_t; ') dontaudit $1 fusefs_t:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete directories ## on a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_fusefs_dirs',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a FUSEFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_fusefs_dirs',` gen_require(` type fusefs_t; ') dontaudit $1 fusefs_t:dir manage_dir_perms; ') ######################################## ## ## Read, a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_fusefs_files',` gen_require(` type fusefs_t; ') read_files_pattern($1, fusefs_t, fusefs_t) ') ######################################## ## ## Execute files on a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_fusefs_files',` gen_require(` type fusefs_t; ') exec_files_pattern($1, fusefs_t, fusefs_t) ') ######################################## ## ## Create, read, write, and delete files ## on a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_fusefs_files',` gen_require(` type fusefs_t; ') manage_files_pattern($1, fusefs_t, fusefs_t) ') ######################################## ## ## Do not audit attempts to create, ## read, write, and delete files ## on a FUSEFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_fusefs_files',` gen_require(` type fusefs_t; ') dontaudit $1 fusefs_t:file manage_file_perms; ') ######################################## ## ## Read symbolic links on a FUSEFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_fusefs_symlinks',` gen_require(` type fusefs_t; ') allow $1 fusefs_t:dir list_dir_perms; read_lnk_files_pattern($1, fusefs_t, fusefs_t) ') ######################################## ## ## Get the attributes of an hugetlbfs ## filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_hugetlbfs',` gen_require(` type hugetlbfs_t; ') allow $1 hugetlbfs_t:filesystem getattr; ') ######################################## ## ## List hugetlbfs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_hugetlbfs',` gen_require(` type hugetlbfs_t; ') allow $1 hugetlbfs_t:dir list_dir_perms; ') ######################################## ## ## Manage hugetlbfs dirs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_hugetlbfs_dirs',` gen_require(` type hugetlbfs_t; ') manage_dirs_pattern($1, hugetlbfs_t, hugetlbfs_t) ') ######################################## ## ## Read and write inherited hugetlbfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_inherited_hugetlbfs_files',` gen_require(` type hugetlbfs_t; ') allow $1 hugetlbfs_t:file rw_inherited_file_perms; ') ######################################## ## ## Read and write hugetlbfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_hugetlbfs_files',` gen_require(` type hugetlbfs_t; ') rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t) ') ######################################## ## ## Read, map and write hugetlbfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mmap_rw_hugetlbfs_files',` gen_require(` type hugetlbfs_t; ') fs_rw_hugetlbfs_files($1) allow $1 hugetlbfs_t:file map; ') ######################################## ## ## Allow the type to associate to hugetlbfs filesystems. ## ## ## ## The type of the object to be associated. ## ## # interface(`fs_associate_hugetlbfs',` gen_require(` type hugetlbfs_t; ') allow $1 hugetlbfs_t:filesystem associate; ') ######################################## ## ## Search inotifyfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_inotifyfs',` gen_require(` type inotifyfs_t; ') allow $1 inotifyfs_t:dir search_dir_perms; ') ######################################## ## ## List inotifyfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_inotifyfs',` gen_require(` type inotifyfs_t; ') allow $1 inotifyfs_t:dir list_dir_perms; ') ######################################## ## ## Dontaudit List inotifyfs filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_inotifyfs',` gen_require(` type inotifyfs_t; ') dontaudit $1 inotifyfs_t:dir list_dir_perms; ') ######################################## ## ## Create an object in a hugetlbfs filesystem, with a private ## type using a type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the object to be created. ## ## ## ## ## The object class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`fs_hugetlbfs_filetrans',` gen_require(` type hugetlbfs_t; ') allow $2 hugetlbfs_t:filesystem associate; filetrans_pattern($1, hugetlbfs_t, $2, $3, $4) ') ######################################## ## ## Mount an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem mount; ') ######################################## ## ## Remount an iso9660 filesystem, which ## is usually used on CDs. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem remount; ') ######################################## ## ## Allow changing of the label of a ## filesystem with iso9660 type ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem relabelfrom; ') ######################################## ## ## Unmount an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem unmount; ') ######################################## ## ## Get the attributes of an iso9660 ## filesystem, which is usually used on CDs. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_iso9660_fs',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:filesystem getattr; ') ######################################## ## ## Get the attributes of files on an iso9660 ## filesystem, which is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_iso9660_files',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:dir list_dir_perms; allow $1 iso9660_t:file getattr; ') ######################################## ## ## Read files on an iso9660 filesystem, which ## is usually used on CDs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_iso9660_files',` gen_require(` type iso9660_t; ') allow $1 iso9660_t:dir list_dir_perms; read_files_pattern($1, iso9660_t, iso9660_t) read_lnk_files_pattern($1, iso9660_t, iso9660_t) ') ######################################## ## ## Mount a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem mount; ') ######################################## ## ## Remount a NFS filesystem. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem remount; ') ######################################## ## ## Unmount a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:filesystem getattr; ') ######################################## ## ## Search directories on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir search_dir_perms; ') ######################################## ## ## List NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list the contents ## of directories on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_nfs',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:dir list_dir_perms; ') ######################################## ## ## Mounton a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mounton_nfs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir mounton; ') ######################################## ## ## Read files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; read_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Do not audit attempts to read ## files on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file read_file_perms; ') ######################################## ## ## Read files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; write_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Execute files on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_exec_nfs_files',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; exec_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Append files ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_append_nfs_files',` gen_require(` type nfs_t; ') append_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## dontaudit Append files ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## ## # interface(`fs_dontaudit_append_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file append_file_perms; ') ######################################## ## ## Do not audit attempts to read or ## write files on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file rw_file_perms; ') ######################################## ## ## Read symbolic links on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_nfs_symlinks',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir list_dir_perms; read_lnk_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Dontaudit read symbolic links on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_nfs_symlinks',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:lnk_file read_lnk_file_perms; ') ######################################### ## ## Read named sockets on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_nfs_named_sockets',` gen_require(` type nfs_t; ') read_sock_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Read named pipes on a NFS network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_read_nfs_named_pipes',` gen_require(` type nfs_t; ') read_fifo_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Get the attributes of directories of RPC ## file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_rpc_dirs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir getattr; ') ######################################## ## ## Search directories of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_rpc',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir search_dir_perms; ') ######################################## ## ## Search removable storage directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_removable',` gen_require(` type removable_t; ') allow $1 removable_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to list removable storage directories. ## ## ## ## Domain not to audit. ## ## # interface(`fs_dontaudit_list_removable',` gen_require(` type removable_t; ') dontaudit $1 removable_t:dir list_dir_perms; ') ######################################## ## ## Read removable storage files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_files',` gen_require(` type removable_t; ') read_files_pattern($1, removable_t, removable_t) ') ######################################## ## ## Do not audit attempts to read removable storage files. ## ## ## ## Domain not to audit. ## ## # interface(`fs_dontaudit_read_removable_files',` gen_require(` type removable_t; ') dontaudit $1 removable_t:file read_file_perms; ') ######################################## ## ## Do not audit attempts to write removable storage files. ## ## ## ## Domain not to audit. ## ## # interface(`fs_dontaudit_write_removable_files',` gen_require(` type removable_t; ') dontaudit $1 removable_t:file write_file_perms; ') ######################################## ## ## Read removable storage symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_symlinks',` gen_require(` type removable_t; ') read_lnk_files_pattern($1, removable_t, removable_t) ') ###################################### ## ## Read block nodes on removable filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_removable_blk_files',` gen_require(` type removable_t; ') allow $1 removable_t:dir list_dir_perms; read_blk_files_pattern($1, removable_t, removable_t) ') ######################################## ## ## Read and write block nodes on removable filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_removable_blk_files',` gen_require(` type removable_t; ') allow $1 removable_t:dir list_dir_perms; rw_blk_files_pattern($1, removable_t, removable_t) ') ######################################## ## ## Read directories of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_rpc',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:dir list_dir_perms; ') ######################################## ## ## Read files of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_rpc_files',` gen_require(` type rpc_pipefs_t; ') read_files_pattern($1, rpc_pipefs_t, rpc_pipefs_t) ') ######################################## ## ## Read symbolic links of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_rpc_symlinks',` gen_require(` type rpc_pipefs_t; ') read_lnk_files_pattern($1, rpc_pipefs_t, rpc_pipefs_t) ') ######################################## ## ## Read sockets of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_rpc_sockets',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:sock_file read; ') ######################################## ## ## Read and write sockets of RPC file system pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_rpc_sockets',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:sock_file { read write }; ') ######################################## ## ## Create, read, write, and delete directories ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_nfs_dirs',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_nfs_dirs',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:dir manage_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_nfs_files',` gen_require(` type nfs_t; ') manage_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Do not audit attempts to create, ## read, write, and delete files ## on a NFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_nfs_files',` gen_require(` type nfs_t; ') dontaudit $1 nfs_t:file manage_file_perms; ') ######################################### ## ## Create, read, write, and delete symbolic links ## on a NFS network filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_nfs_symlinks',` gen_require(` type nfs_t; ') manage_lnk_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Create, read, write, and delete named pipes ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_nfs_named_pipes',` gen_require(` type nfs_t; ') manage_fifo_files_pattern($1, nfs_t, nfs_t) ') ######################################### ## ## Create, read, write, and delete named sockets ## on a NFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_nfs_named_sockets',` gen_require(` type nfs_t; ') manage_sock_files_pattern($1, nfs_t, nfs_t) ') ######################################## ## ## Execute a file on a NFS filesystem ## in the specified domain. ## ## ##

## Execute a file on a NFS filesystem ## in the specified domain. This allows ## the specified domain to execute any file ## on a NFS filesystem in the specified ## domain. This is not suggested. ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##

## This interface was added to handle ## home directories on NFS filesystems, ## in particular used by the ssh-agent policy. ##

## ## ## ## Domain allowed to transition. ## ## ## ## ## The type of the new process. ## ## # interface(`fs_nfs_domtrans',` gen_require(` type nfs_t; ') allow $1 nfs_t:dir search_dir_perms; domain_auto_transition_pattern($1, nfs_t, $2) ') ######################################## ## ## Mount a NFS server pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem mount; ') ######################################## ## ## Mount a NFS server pseudo filesystem. ## This allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem remount; ') ######################################## ## ## Unmount a NFS server pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a NFS server ## pseudo filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:filesystem getattr; ') ######################################## ## ## Search NFS server directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:dir search_dir_perms; ') ######################################## ## ## List NFS server directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_nfsd_fs',` gen_require(` type nfsd_fs_t; ') allow $1 nfsd_fs_t:dir list_dir_perms; ') ######################################## ## ## Getattr files on an nfsd filesystem ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_nfsd_files',` gen_require(` type nfsd_fs_t; ') getattr_files_pattern($1, nfsd_fs_t, nfsd_fs_t) ') ######################################## ## ## Read and write NFS server files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_nfsd_fs',` gen_require(` type nfsd_fs_t; ') rw_files_pattern($1, nfsd_fs_t, nfsd_fs_t) ') ######################################## ## ## Read nsfs inodes (e.g. /proc/pid/ns/uts) ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_nsfs_files',` gen_require(` type nsfs_t; ') allow $1 nsfs_t:file read_file_perms; ') ######################################## ## ## Get the attributes of a pstore filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_pstorefs',` gen_require(` type pstore_t; ') allow $1 pstore_t:filesystem getattr; ') ######################################## ## ## Get the attributes of directories ## of a pstore filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_pstore_dirs',` gen_require(` type pstore_t; ') getattr_files_pattern($1, pstore_t, pstore_t) dev_search_sysfs($1) ') ######################################## ## ## Relabel to/from pstore_t directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_pstore_dirs',` gen_require(` type pstore_t; ') relabel_dirs_pattern($1, pstore_t, pstore_t) ') ######################################## ## ## Allow the type to associate to ramfs filesystems. ## ## ## ## The type of the object to be associated. ## ## # interface(`fs_associate_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem associate; ') ######################################## ## ## Mount a RAM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem mount; ') ######################################## ## ## Remount a RAM filesystem. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem remount; ') ######################################## ## ## Unmount a RAM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a RAM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:filesystem getattr; ') ######################################## ## ## Search directories on a ramfs ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_ramfs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir search_dir_perms; ') ######################################## ## ## Dontaudit Search directories on a ramfs ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_search_ramfs',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:dir search_dir_perms; ') ######################################## ## ## Create, read, write, and delete ## directories on a ramfs. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_dirs',` gen_require(` type ramfs_t; ') allow $1 ramfs_t:dir manage_dir_perms; ') ######################################## ## ## Dontaudit read on a ramfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_ramfs_files',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:file read; ') ######################################## ## ## Dontaudit read on a ramfs fifo_files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_read_ramfs_pipes',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:fifo_file read; ') ######################################## ## ## Create, read, write, and delete ## files on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_files',` gen_require(` type ramfs_t; ') manage_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Write to named pipe on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_ramfs_pipes',` gen_require(` type ramfs_t; ') write_fifo_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Do not audit attempts to write to named ## pipes on a ramfs filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_write_ramfs_pipes',` gen_require(` type ramfs_t; ') dontaudit $1 ramfs_t:fifo_file write; ') ######################################## ## ## Read and write a named pipe on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_ramfs_pipes',` gen_require(` type ramfs_t; ') rw_fifo_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Create, read, write, and delete ## named pipes on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_pipes',` gen_require(` type ramfs_t; ') manage_fifo_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Write to named socket on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_write_ramfs_sockets',` gen_require(` type ramfs_t; ') write_sock_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Create, read, write, and delete ## named sockets on a ramfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_ramfs_sockets',` gen_require(` type ramfs_t; ') manage_sock_files_pattern($1, ramfs_t, ramfs_t) ') ######################################## ## ## Mount a ROM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem mount; ') ######################################## ## ## Remount a ROM filesystem. This allows ## some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem remount; ') ######################################## ## ## Unmount a ROM filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a ROM ## filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_romfs',` gen_require(` type romfs_t; ') allow $1 romfs_t:filesystem getattr; ') ######################################## ## ## Mount a RPC pipe filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem mount; ') ######################################## ## ## Remount a RPC pipe filesystem. This ## allows some mount option to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem remount; ') ######################################## ## ## Unmount a RPC pipe filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a RPC pipe ## filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_rpc_pipefs',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:filesystem getattr; ') ######################################### ## ## Read and write RPC pipe filesystem named pipes. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_rpc_named_pipes',` gen_require(` type rpc_pipefs_t; ') allow $1 rpc_pipefs_t:fifo_file rw_fifo_file_perms; ') ######################################## ## ## Mount a tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem mount; ') ######################################## ## ## Remount a tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem remount; ') ######################################## ## ## Unmount a tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem unmount; ') ######################################## ## ## Get the attributes of a tmpfs ## filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_getattr_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem getattr; ') ######################################## ## ## Allow the type to associate to tmpfs filesystems. ## ## ## ## The type of the object to be associated. ## ## # interface(`fs_associate_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem associate; ') ######################################## ## ## Relabel from tmpfs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:filesystem relabelfrom; ') ######################################## ## ## Get the attributes of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir getattr; ') ######################################## ## ## Do not audit attempts to get the attributes ## of tmpfs directories. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir getattr; ') ######################################## ## ## Mount on tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mounton_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir mounton; ') ######################################## ## ## Mount on tmpfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mounton_tmpfs_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:file mounton; ') ######################################## ## ## Set the attributes of tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_setattr_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir setattr; ') ######################################## ## ## Search tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir search_dir_perms; ') ######################################## ## ## List the contents of generic tmpfs directories. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_tmpfs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; ') ######################################## ## ## Do not audit attempts to list the ## contents of generic tmpfs directories. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_list_tmpfs',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir list_dir_perms; ') ######################################## ## ## Create, read, write, and delete ## tmpfs directories ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to write ## tmpfs directories ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_write_tmpfs_dirs',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir write; ') ######################################## ## ## Relabel from tmpfs_t dir ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_tmpfs_dirs',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir relabelfrom; ') ######################################## ## ## Relabel directory on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_tmpfs_dirs',` gen_require(` type tmpfs_t; ') relabel_dirs_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Create an object in a tmpfs filesystem, with a private ## type using a type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the object to be created. ## ## ## ## ## The object class of the object being created. ## ## ## ## ## The name of the object being created. ## ## # interface(`fs_tmpfs_filetrans',` gen_require(` type tmpfs_t; ') allow $2 tmpfs_t:filesystem associate; filetrans_pattern($1, tmpfs_t, $2, $3, $4) ') ######################################## ## ## Do not audit attempts to getattr ## generic tmpfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_tmpfs_files',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:file getattr; ') ######################################## ## ## Do not audit attempts to read or write ## generic tmpfs files. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_rw_tmpfs_files',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:file rw_file_perms; ') ######################################## ## ## Delete tmpfs symbolic links. ## ## ## ## Domain allowed access. ## ## # interface(`fs_delete_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:lnk_file delete_lnk_file_perms; ') ######################################## ## ## Create, read, write, and delete ## auto moutpoints. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_auto_mountpoints',` gen_require(` type autofs_t; ') allow $1 autofs_t:dir manage_dir_perms; ') ######################################## ## ## Read generic tmpfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_tmpfs_files',` gen_require(` type tmpfs_t; ') read_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write generic tmpfs files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_tmpfs_files',` gen_require(` type tmpfs_t; ') rw_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Relabel files on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_tmpfs_files',` gen_require(` type tmpfs_t; ') relabel_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read tmpfs link files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_read_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') read_lnk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Relabelfrom socket files on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_tmpfs_sockets',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:sock_file relabelfrom_sock_file_perms; ') ######################################## ## ## Relabelfrom tmpfs link files. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:lnk_file { getattr relabelfrom }; ') ######################################## ## ## Read and write character nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_tmpfs_chr_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; rw_chr_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## dontaudit Read and write character nodes on tmpfs filesystems. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_use_tmpfs_chr_dev',` gen_require(` type tmpfs_t; ') dontaudit $1 tmpfs_t:dir list_dir_perms; dontaudit $1 tmpfs_t:chr_file rw_chr_file_perms; ') ######################################## ## ## Relabel character nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_tmpfs_chr_file',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; relabel_chr_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write block nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_rw_tmpfs_blk_files',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; rw_blk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Relabel block nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabel_tmpfs_blk_file',` gen_require(` type tmpfs_t; ') allow $1 tmpfs_t:dir list_dir_perms; relabel_blk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete generic ## files on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_files',` gen_require(` type tmpfs_t; ') manage_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete symbolic ## links on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_symlinks',` gen_require(` type tmpfs_t; ') manage_lnk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete socket ## files on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_sockets',` gen_require(` type tmpfs_t; ') manage_sock_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete character ## nodes on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_chr_files',` gen_require(` type tmpfs_t; ') manage_chr_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Read and write, create and delete block nodes ## on tmpfs filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_manage_tmpfs_blk_files',` gen_require(` type tmpfs_t; ') manage_blk_files_pattern($1, tmpfs_t, tmpfs_t) ') ######################################## ## ## Get the attributes of a trace filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_tracefs',` gen_require(` type tracefs_t; ') allow $1 tracefs_t:filesystem getattr; ') ######################################## ## ## Get attributes of dirs on tracefs filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_tracefs_dirs',` gen_require(` type tracefs_t; ') allow $1 tracefs_t:dir getattr; ') ######################################## ## ## search directories on a tracefs filesystem ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_tracefs',` gen_require(` type tracefs_t; ') allow $1 tracefs_t:dir search_dir_perms; ') ######################################## ## ## Get the attributes of files ## on a trace filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_tracefs_files',` gen_require(` type tracefs_t; ') allow $1 tracefs_t:file getattr; ') ######################################## ## ## Mount a XENFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_xenfs',` gen_require(` type xenfs_t; ') allow $1 xenfs_t:filesystem mount; ') ######################################## ## ## Search the XENFS filesystem. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_xenfs',` gen_require(` type xenfs_t; ') allow $1 xenfs_t:dir search_dir_perms; ') ######################################## ## ## Create, read, write, and delete directories ## on a XENFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_xenfs_dirs',` gen_require(` type xenfs_t; ') allow $1 xenfs_t:dir manage_dir_perms; ') ######################################## ## ## Do not audit attempts to create, read, ## write, and delete directories ## on a XENFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_xenfs_dirs',` gen_require(` type xenfs_t; ') dontaudit $1 xenfs_t:dir manage_dir_perms; ') ######################################## ## ## Create, read, write, and delete files ## on a XENFS filesystem. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_manage_xenfs_files',` gen_require(` type xenfs_t; ') manage_files_pattern($1, xenfs_t, xenfs_t) ') ######################################## ## ## Do not audit attempts to create, ## read, write, and delete files ## on a XENFS filesystem. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_manage_xenfs_files',` gen_require(` type xenfs_t; ') dontaudit $1 xenfs_t:file manage_file_perms; ') ######################################## ## ## Mount all filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_mount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem mount; ') ######################################## ## ## Remount all filesystems. This ## allows some mount options to be changed. ## ## ## ## Domain allowed access. ## ## # interface(`fs_remount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem remount; ') ######################################## ## ## Unmount all filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_unmount_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem unmount; ') ######################################## ## ## Get the attributes of all filesystems. ## ## ##

## Allow the specified domain to ## get the attributes of all filesystems. ## Example attributes: ##

##
    ##
  • Type of the file system (e.g., ext3)
    • ##
  • Size of the file system
    • ##
  • Available space on the file system
    • ##
## ## ## ## Domain allowed access. ## ## ## ## # interface(`fs_getattr_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem getattr; files_getattr_all_file_type_fs($1) ') ######################################## ## ## Do not audit attempts to get the attributes ## all filesystems. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_fs',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:filesystem getattr; ') ######################################## ## ## Get the quotas of all filesystems. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_get_all_fs_quotas',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem quotaget; ') ######################################## ## ## Set the quotas of all filesystems. ## ## ## ## Domain allowed access. ## ## ## # interface(`fs_set_all_quotas',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem quotamod; ') ######################################## ## ## Relabelfrom all filesystems. ## ## ## ## Domain allowed access. ## ## # interface(`fs_relabelfrom_all_fs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:filesystem relabelfrom; ') ######################################## ## ## Get the attributes of all directories ## with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_dirs',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir getattr; ') ######################################## ## ## Search all directories with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_search_all',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir search_dir_perms; ') ######################################## ## ## List all directories with a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_list_all',` gen_require(` attribute filesystem_type; ') allow $1 filesystem_type:dir list_dir_perms; ') ######################################## ## ## Get the attributes of all files with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_files',` gen_require(` attribute filesystem_type; ') getattr_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Do not audit attempts to get the attributes ## of all files with a filesystem type. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_files',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:file getattr; ') ######################################## ## ## Get the attributes of all symbolic links with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') getattr_lnk_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Do not audit attempts to get the attributes ## of all symbolic links with a filesystem type. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_symlinks',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:lnk_file getattr; ') ######################################## ## ## Get the attributes of all named pipes with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') getattr_fifo_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Do not audit attempts to get the attributes ## of all named pipes with a filesystem type. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_pipes',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:fifo_file getattr; ') ######################################## ## ## Get the attributes of all named sockets with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') getattr_sock_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Do not audit attempts to get the attributes ## of all named sockets with a filesystem type. ## ## ## ## Domain to not audit. ## ## # interface(`fs_dontaudit_getattr_all_sockets',` gen_require(` attribute filesystem_type; ') dontaudit $1 filesystem_type:sock_file getattr; ') ######################################## ## ## Get the attributes of all block device nodes with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_blk_files',` gen_require(` attribute filesystem_type; ') getattr_blk_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Get the attributes of all character device nodes with ## a filesystem type. ## ## ## ## Domain allowed access. ## ## # interface(`fs_getattr_all_chr_files',` gen_require(` attribute filesystem_type; ') getattr_chr_files_pattern($1, filesystem_type, filesystem_type) ') ######################################## ## ## Unconfined access to filesystems ## ## ## ## Domain allowed access. ## ## # interface(`fs_unconfined',` gen_require(` attribute filesystem_unconfined_type; ') typeattribute $1 filesystem_unconfined_type; ')