policy_module(bootloader, 1.22.0)

########################################
#
# Declarations
#

attribute_role bootloader_roles;
roleattribute system_r bootloader_roles;

#
# boot_runtime_t is the type for /boot/kernel.h,
# which is automatically generated at boot time.
# only for Red Hat
#
type boot_runtime_t;
files_type(boot_runtime_t)

type bootloader_t;
type bootloader_exec_t;
application_domain(bootloader_t, bootloader_exec_t)
role bootloader_roles types bootloader_t;

#
# bootloader_etc_t is the configuration file,
# grub.conf, lilo.conf, etc.
#
type bootloader_etc_t;
files_type(bootloader_etc_t)

#
# The temp file is used for initrd creation;
# it consists of files and device nodes
#
type bootloader_tmp_t;
files_tmp_file(bootloader_tmp_t)
dev_node(bootloader_tmp_t)

########################################
#
# bootloader local policy
#

allow bootloader_t self:capability { chown dac_override dac_read_search fsetid mknod setgid sys_admin sys_rawio };
allow bootloader_t self:process { signal_perms execmem };
allow bootloader_t self:fifo_file rw_fifo_file_perms;

allow bootloader_t bootloader_etc_t:file read_file_perms;
# uncomment the following lines if you use "lilo -p"
#allow bootloader_t bootloader_etc_t:file manage_file_perms;
#files_etc_filetrans(bootloader_t,bootloader_etc_t,file)

manage_dirs_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_lnk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_blk_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
manage_chr_files_pattern(bootloader_t, bootloader_tmp_t, bootloader_tmp_t)
files_tmp_filetrans(bootloader_t, bootloader_tmp_t, { dir file lnk_file chr_file blk_file })
allow bootloader_t bootloader_tmp_t:dir mounton;
# for tune2fs (cjp: ?)
files_root_filetrans(bootloader_t, bootloader_tmp_t, file)

kernel_getattr_core_if(bootloader_t)
kernel_read_network_state(bootloader_t)
kernel_read_system_state(bootloader_t)
kernel_read_software_raid_state(bootloader_t)
kernel_read_kernel_sysctls(bootloader_t)
kernel_search_debugfs(bootloader_t)
kernel_setsched(bootloader_t)
# for grub-probe
kernel_request_load_module(bootloader_t)

storage_raw_read_fixed_disk(bootloader_t)
storage_raw_write_fixed_disk(bootloader_t)
storage_raw_read_removable_device(bootloader_t)
storage_raw_write_removable_device(bootloader_t)
storage_rw_fuse(bootloader_t)

dev_getattr_all_chr_files(bootloader_t)
dev_getattr_all_blk_files(bootloader_t)
dev_dontaudit_rw_generic_dev_nodes(bootloader_t)
dev_read_rand(bootloader_t)
dev_read_urand(bootloader_t)
dev_read_sysfs(bootloader_t)
# needed on some hardware
dev_rw_nvram(bootloader_t)

fs_getattr_xattr_fs(bootloader_t)
fs_getattr_dos_fs(bootloader_t)
fs_getattr_tmpfs(bootloader_t)
fs_read_tmpfs_symlinks(bootloader_t)
#Needed for EFI
fs_manage_dos_files(bootloader_t)
fs_mmap_read_dos_files(bootloader_t)

mls_file_read_all_levels(bootloader_t)
mls_file_write_all_levels(bootloader_t)

term_getattr_all_ttys(bootloader_t)
term_getattr_generic_ptys(bootloader_t)
term_dontaudit_manage_pty_dirs(bootloader_t)

corecmd_exec_all_executables(bootloader_t)

domain_use_interactive_fds(bootloader_t)

files_create_boot_dirs(bootloader_t)
files_getattr_default_dirs(bootloader_t)
files_manage_boot_files(bootloader_t)
files_manage_boot_symlinks(bootloader_t)
files_read_etc_files(bootloader_t)
files_exec_etc_files(bootloader_t)
files_read_usr_src_files(bootloader_t)
files_read_usr_files(bootloader_t)
files_read_var_files(bootloader_t)
files_read_kernel_modules(bootloader_t)
files_search_mnt(bootloader_t)
# for nscd
files_dontaudit_search_runtime(bootloader_t)
# for blkid.tab
files_manage_etc_runtime_files(bootloader_t)
files_etc_filetrans_etc_runtime(bootloader_t, file)
files_dontaudit_search_home(bootloader_t)

fs_list_efivars(bootloader_t)
fs_manage_efivarfs_files(bootloader_t)

fs_list_hugetlbfs(bootloader_t)
fs_mount_fusefs(bootloader_t)
fs_mount_xattr_fs(bootloader_t)
fs_mounton_fusefs(bootloader_t)
fs_read_fusefs_symlinks(bootloader_t)
fs_read_fusefs_files(bootloader_t)
fs_getattr_fusefs(bootloader_t)
fs_unmount_fusefs(bootloader_t)
fs_unmount_xattr_fs(bootloader_t)

fstools_manage_runtime_files(bootloader_t)

init_getattr_initctl(bootloader_t)
init_use_script_ptys(bootloader_t)
init_use_script_fds(bootloader_t)
init_rw_script_pipes(bootloader_t)

libs_read_lib_files(bootloader_t)
libs_exec_lib_files(bootloader_t)

logging_send_syslog_msg(bootloader_t)
logging_rw_generic_logs(bootloader_t)

miscfiles_read_localization(bootloader_t)

mount_rw_runtime_files(bootloader_t)

selinux_getattr_fs(bootloader_t)
seutil_read_bin_policy(bootloader_t)
seutil_read_file_contexts(bootloader_t)
seutil_read_loadpolicy(bootloader_t)
seutil_dontaudit_search_config(bootloader_t)

udev_read_runtime_files(bootloader_t)

userdom_use_user_terminals(bootloader_t)
userdom_dontaudit_search_user_home_dirs(bootloader_t)

ifdef(`distro_debian',`
	allow bootloader_t bootloader_tmp_t:{ dir file } { relabelfrom relabelto };
	fs_list_tmpfs(bootloader_t)

	files_relabel_kernel_modules(bootloader_t)
	files_relabelfrom_boot_files(bootloader_t)
	files_delete_kernel_modules(bootloader_t)
	files_relabelto_usr_files(bootloader_t)
	files_search_var_lib(bootloader_t)
	# for /usr/share/initrd-tools/scripts
	files_exec_usr_files(bootloader_t)

	fstools_manage_entry_files(bootloader_t)
	fstools_relabelto_entry_files(bootloader_t)

	libs_relabelto_lib_files(bootloader_t)

	apt_use_fds(bootloader_t)
	apt_use_ptys(bootloader_t)
	# for apt-cache
	apt_read_db(bootloader_t)
	apt_manage_cache(bootloader_t)

	dpkg_read_db(bootloader_t)
	dpkg_rw_pipes(bootloader_t)
')

ifdef(`distro_redhat',`
	# for memlock
	allow bootloader_t self:capability ipc_lock;

	allow bootloader_t boot_runtime_t:file { read_file_perms delete_file_perms };

	# new file system defaults to unlabeled, granting unlabeled access is still bad.
	kernel_manage_unlabeled_dirs(bootloader_t)
	kernel_manage_unlabeled_files(bootloader_t)
	kernel_manage_unlabeled_symlinks(bootloader_t)
	kernel_manage_unlabeled_blk_files(bootloader_t)
	kernel_manage_unlabeled_chr_files(bootloader_t)

	# for mke2fs
	mount_run(bootloader_t, bootloader_roles)

	optional_policy(`
		unconfined_domain(bootloader_t)
	')
')

optional_policy(`
	fstools_exec(bootloader_t)
')

optional_policy(`
	gpm_getattr_gpmctl(bootloader_t)
')

optional_policy(`
	dev_rw_lvm_control(bootloader_t)

	lvm_domtrans(bootloader_t)
	lvm_read_config(bootloader_t)
')

optional_policy(`
	modutils_domtrans(bootloader_t)
	modutils_read_module_config(bootloader_t)
	modutils_read_module_deps(bootloader_t)
')

optional_policy(`
	nscd_use(bootloader_t)
')

optional_policy(`
	raid_read_mdadm_runtime_files(bootloader_t)
')

optional_policy(`
	rpm_rw_pipes(bootloader_t)
')