## Policy for system libraries. ######################################## ## ## Execute ldconfig in the ldconfig domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`libs_domtrans_ldconfig',` gen_require(` type ldconfig_t, ldconfig_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, ldconfig_exec_t, ldconfig_t) ') ######################################## ## ## Execute ldconfig in the ldconfig domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## The role to allow the ldconfig domain. ## ## ## # interface(`libs_run_ldconfig',` gen_require(` type ldconfig_t; ') libs_domtrans_ldconfig($1) role $2 types ldconfig_t; ') ######################################## ## ## Use the dynamic link/loader for automatic loading ## of shared libraries. ## ## ## ## Domain allowed access. ## ## # interface(`libs_use_ld_so',` gen_require(` type lib_t, ld_so_t, ld_so_cache_t; ') files_list_etc($1) allow $1 lib_t:dir list_dir_perms; read_lnk_files_pattern($1, lib_t, { lib_t ld_so_t }) mmap_files_pattern($1, lib_t, ld_so_t) allow $1 ld_so_cache_t:file read_file_perms; ') ######################################## ## ## Use the dynamic link/loader for automatic loading ## of shared libraries with legacy support. ## ## ## ## Domain allowed access. ## ## # interface(`libs_legacy_use_ld_so',` gen_require(` type ld_so_t, ld_so_cache_t; ') libs_use_ld_so($1) allow $1 ld_so_t:file execmod; allow $1 ld_so_cache_t:file execute; ') ######################################## ## ## Execute the dynamic link/loader in the caller's domain. ## ## ## ## Domain allowed access. ## ## # interface(`libs_exec_ld_so',` gen_require(` type lib_t, ld_so_t; ') allow $1 lib_t:dir list_dir_perms; read_lnk_files_pattern($1, lib_t, { lib_t ld_so_t }) exec_files_pattern($1, lib_t, ld_so_t) ') ######################################## ## ## Create, read, write, and delete the ## dynamic link/loader. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_manage_ld_so',` gen_require(` type lib_t, ld_so_t; ') manage_files_pattern($1, lib_t, ld_so_t) ') ######################################## ## ## Relabel to and from the type used for ## the dynamic link/loader. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_relabel_ld_so',` gen_require(` type lib_t, ld_so_t; ') relabel_files_pattern($1, lib_t, ld_so_t) ') ######################################## ## ## Modify the dynamic link/loader's cached listing ## of shared libraries. ## ## ## ## Domain allowed access. ## ## # interface(`libs_rw_ld_so_cache',` gen_require(` type ld_so_cache_t; ') files_list_etc($1) allow $1 ld_so_cache_t:file rw_file_perms; ') ######################################## ## ## Search library directories. ## ## ## ## Domain allowed access. ## ## # interface(`libs_search_lib',` gen_require(` type lib_t; ') allow $1 lib_t:dir search_dir_perms; ') ######################################## ## ## Do not audit attempts to write to library directories. ## ## ##

## Do not audit attempts to write to library directories. ## Typically this is used to quiet attempts to recompile ## python byte code. ##

##
## ## ## Domain to not audit. ## ## # interface(`libs_dontaudit_write_lib_dirs',` gen_require(` type lib_t; ') dontaudit $1 lib_t:dir write; ') ######################################## ## ## Create, read, write, and delete library directories. ## ## ## ## Domain allowed access. ## ## # interface(`libs_manage_lib_dirs',` gen_require(` type lib_t; ') allow $1 lib_t:dir manage_dir_perms; ') ######################################## ## ## Read files in the library directories, such ## as static libraries. ## ## ## ## Domain allowed access. ## ## # interface(`libs_read_lib_files',` gen_require(` type lib_t; ') files_list_usr($1) list_dirs_pattern($1, lib_t, lib_t) read_files_pattern($1, lib_t, lib_t) read_lnk_files_pattern($1, lib_t, lib_t) ') ######################################## ## ## Execute library scripts in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`libs_exec_lib_files',` gen_require(` type lib_t; ') files_search_usr($1) allow $1 lib_t:dir list_dir_perms; read_lnk_files_pattern($1, lib_t, lib_t) exec_files_pattern($1, lib_t, lib_t) ') ######################################## ## ## Load and execute functions from generic ## lib files as shared libraries. ## ## ## ## Domain allowed access. ## ## # interface(`libs_use_lib_files',` refpolicywarn(`$0($*) has been deprecated, use libs_use_shared_libs() instead.') libs_use_shared_libs($1) ') ######################################## ## ## Create, read, write, and delete generic ## files in library directories. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_manage_lib_files',` gen_require(` type lib_t; ') manage_files_pattern($1, lib_t, lib_t) ') ######################################## ## ## Relabel files to the type used in library directories. ## ## ## ## Domain allowed access. ## ## # interface(`libs_relabelto_lib_files',` gen_require(` type lib_t; ') relabelto_files_pattern($1, lib_t, lib_t) ') ######################################## ## ## Relabel to and from the type used ## for generic lib files. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_relabel_lib_files',` gen_require(` type lib_t; ') relabel_files_pattern($1, lib_t, lib_t) ') ######################################## ## ## Delete generic symlinks in library directories. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_delete_lib_symlinks',` gen_require(` type lib_t; ') delete_lnk_files_pattern($1, lib_t, lib_t) ') ######################################## ## ## Create, read, write, and delete shared libraries. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_manage_shared_libs',` gen_require(` type lib_t, textrel_shlib_t; ') manage_files_pattern($1, lib_t, { lib_t textrel_shlib_t }) ') ######################################## ## ## Load and execute functions from shared libraries. ## ## ## ## Domain allowed access. ## ## # interface(`libs_use_shared_libs',` gen_require(` type lib_t, textrel_shlib_t; ') files_search_usr($1) allow $1 lib_t:dir list_dir_perms; read_lnk_files_pattern($1, lib_t, { lib_t textrel_shlib_t }) mmap_files_pattern($1, lib_t, { lib_t textrel_shlib_t }) allow $1 textrel_shlib_t:file execmod; ') ######################################## ## ## Load and execute functions from shared libraries, ## with legacy support. ## ## ## ## Domain allowed access. ## ## # interface(`libs_legacy_use_shared_libs',` gen_require(` type lib_t; ') libs_use_shared_libs($1) allow $1 lib_t:file execmod; ') ######################################## ## ## Relabel to and from the type used for ## shared libraries. ## ## ## ## Domain allowed access. ## ## # # cjp: added for prelink interface(`libs_relabel_shared_libs',` gen_require(` type lib_t, textrel_shlib_t; ') relabel_files_pattern($1, lib_t, { lib_t textrel_shlib_t }) ') ######################################## ## ## Create an object in lib directories, with ## the shared libraries type using a type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## The object class of the object being created. ## ## # interface(`lib_filetrans_shared_lib',` refpolicywarn(`$0($*) has been deprecated.') ') ######################################## ## ## Create an object in lib directories, with ## the shared libraries type using a type transition. (Deprecated) ## ## ##

## Create an object in lib directories, with ## the shared libraries type using a type transition. (Deprecated) ##

##

## lib_filetrans_shared_lib() should be used instead. ##

##
## ## ## Domain allowed access. ## ## ## ## ## The object class of the object being created. ## ## # interface(`files_lib_filetrans_shared_lib',` refpolicywarn(`$0($*) has been deprecated.') ')