419 lines
7.4 KiB
Plaintext
419 lines
7.4 KiB
Plaintext
policy_module(devices)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute device_node;
|
|
attribute memory_raw_read;
|
|
attribute memory_raw_write;
|
|
attribute devices_unconfined_type;
|
|
attribute sysfs_types;
|
|
|
|
#
|
|
# device_t is the type of /dev.
|
|
#
|
|
type device_t;
|
|
fs_associate_tmpfs(device_t)
|
|
files_type(device_t)
|
|
files_mountpoint(device_t)
|
|
files_associate_tmp(device_t)
|
|
fs_xattr_type(device_t)
|
|
fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0);
|
|
|
|
optional_policy(`
|
|
systemd_tmpfilesd_managed(device_t)
|
|
')
|
|
|
|
#
|
|
# Type for /dev/agpgart
|
|
#
|
|
type agp_device_t;
|
|
dev_node(agp_device_t)
|
|
|
|
#
|
|
# Type for /dev/apm_bios
|
|
#
|
|
type acpi_bios_t;
|
|
dev_node(acpi_bios_t)
|
|
|
|
#
|
|
# Type for /dev/autofs
|
|
#
|
|
type autofs_device_t;
|
|
dev_node(autofs_device_t)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(autofs_device_t)
|
|
')
|
|
|
|
type cardmgr_dev_t;
|
|
dev_node(cardmgr_dev_t)
|
|
files_tmp_file(cardmgr_dev_t)
|
|
|
|
type cachefiles_device_t;
|
|
dev_node(cachefiles_device_t)
|
|
|
|
#
|
|
# clock_device_t is the type of
|
|
# /dev/rtc.
|
|
#
|
|
type clock_device_t;
|
|
dev_node(clock_device_t)
|
|
|
|
#
|
|
# cpu control devices /dev/cpu/0/*
|
|
#
|
|
type cpu_device_t;
|
|
dev_node(cpu_device_t)
|
|
|
|
#
|
|
# /sys/devices/system/cpu/online device
|
|
#
|
|
type cpu_online_t, sysfs_types;
|
|
files_type(cpu_online_t)
|
|
dev_associate_sysfs(cpu_online_t)
|
|
genfscon sysfs /devices/system/cpu/online gen_context(system_u:object_r:cpu_online_t,s0)
|
|
|
|
#
|
|
# Type for /dev/crash
|
|
#
|
|
type crash_device_t;
|
|
dev_node(crash_device_t)
|
|
|
|
# for the IBM zSeries z90crypt hardware ssl accelorator
|
|
type crypt_device_t;
|
|
dev_node(crypt_device_t)
|
|
|
|
#
|
|
# Type for /dev/dax*.*
|
|
#
|
|
type dax_device_t;
|
|
dev_node(dax_device_t)
|
|
|
|
#
|
|
# dlm_misc_device_t is the type of /dev/misc/dlm.*
|
|
#
|
|
type dlm_control_device_t;
|
|
dev_node(dlm_control_device_t)
|
|
|
|
type dri_device_t;
|
|
dev_node(dri_device_t)
|
|
|
|
type event_device_t;
|
|
dev_node(event_device_t)
|
|
|
|
#
|
|
# Type for framebuffer /dev/fb/*
|
|
#
|
|
type framebuf_device_t;
|
|
dev_node(framebuf_device_t)
|
|
|
|
#
|
|
# Type for Dell (others?) freefall detection device /dev/freefall
|
|
#
|
|
type freefall_device_t;
|
|
dev_node(freefall_device_t)
|
|
|
|
#
|
|
# Type for GPIO chip /dev/gpiochip*
|
|
#
|
|
type gpiochip_device_t;
|
|
dev_node(gpiochip_device_t)
|
|
|
|
#
|
|
# Type for /dev/ipmi/0
|
|
#
|
|
type ipmi_device_t;
|
|
dev_node(ipmi_device_t)
|
|
|
|
#
|
|
# Type for /dev/kmsg
|
|
#
|
|
type kmsg_device_t;
|
|
dev_node(kmsg_device_t)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(kmsg_device_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
init_mountpoint(kmsg_device_t)
|
|
')
|
|
|
|
#
|
|
# ksm_device_t is the type of /dev/ksm
|
|
#
|
|
type ksm_device_t;
|
|
dev_node(ksm_device_t)
|
|
|
|
#
|
|
# kvm_device_t is the type of
|
|
# /dev/kvm
|
|
#
|
|
type kvm_device_t;
|
|
dev_node(kvm_device_t)
|
|
|
|
#
|
|
# Type for /dev/lirc
|
|
#
|
|
type lirc_device_t;
|
|
dev_node(lirc_device_t)
|
|
|
|
type loop_control_device_t;
|
|
dev_node(loop_control_device_t)
|
|
|
|
#
|
|
# Type for /dev/mapper/control
|
|
#
|
|
type lvm_control_t;
|
|
dev_node(lvm_control_t)
|
|
|
|
type mei_device_t;
|
|
dev_node(mei_device_t)
|
|
|
|
#
|
|
# memory_device_t is the type of /dev/kmem,
|
|
# /dev/mem and /dev/port.
|
|
#
|
|
type memory_device_t;
|
|
dev_node(memory_device_t)
|
|
|
|
neverallow ~{ memory_raw_read devices_unconfined_type } memory_device_t:{ chr_file blk_file } read;
|
|
neverallow ~{ memory_raw_write devices_unconfined_type } memory_device_t:{ chr_file blk_file } { append write };
|
|
|
|
type misc_device_t;
|
|
dev_node(misc_device_t)
|
|
|
|
#
|
|
# A general type for modem devices.
|
|
#
|
|
type modem_device_t;
|
|
dev_node(modem_device_t)
|
|
|
|
#
|
|
# A more general type for mouse devices.
|
|
#
|
|
type mouse_device_t;
|
|
dev_node(mouse_device_t)
|
|
|
|
#
|
|
# Type for /dev/cpu/mtrr and /proc/mtrr
|
|
#
|
|
type mtrr_device_t;
|
|
dev_node(mtrr_device_t)
|
|
genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
|
|
|
|
optional_policy(`
|
|
init_mountpoint(mtrr_device_t)
|
|
')
|
|
|
|
#
|
|
# null_device_t is the type of /dev/null.
|
|
#
|
|
type null_device_t;
|
|
dev_node(null_device_t)
|
|
mls_trusted_object(null_device_t)
|
|
sid devnull gen_context(system_u:object_r:null_device_t,s0)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(null_device_t)
|
|
')
|
|
|
|
#
|
|
# Type for /dev/nvram
|
|
#
|
|
type nvram_device_t;
|
|
dev_node(nvram_device_t)
|
|
|
|
#
|
|
# Type for /dev/pmu
|
|
#
|
|
type power_device_t;
|
|
dev_node(power_device_t)
|
|
|
|
#
|
|
# PM QoS Interface, /dev/cpu_dma_latency, network_latency,
|
|
# network_throughput, and memory_bandwidth
|
|
#
|
|
type pmqos_device_t alias netcontrol_device_t;
|
|
dev_node(pmqos_device_t)
|
|
|
|
type printer_device_t;
|
|
dev_node(printer_device_t)
|
|
mls_file_write_within_range(printer_device_t)
|
|
|
|
#
|
|
# qemu control devices
|
|
#
|
|
type qemu_device_t;
|
|
dev_node(qemu_device_t)
|
|
|
|
#
|
|
# random_device_t is the type of /dev/random
|
|
#
|
|
type random_device_t;
|
|
dev_node(random_device_t)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(random_device_t)
|
|
')
|
|
|
|
type scanner_device_t;
|
|
dev_node(scanner_device_t)
|
|
|
|
#
|
|
# Type for smartcards
|
|
#
|
|
type smartcard_device_t;
|
|
dev_node(smartcard_device_t)
|
|
|
|
#
|
|
# Type for sound devices and mixers
|
|
#
|
|
type sound_device_t;
|
|
dev_node(sound_device_t)
|
|
|
|
#
|
|
# Type for sysdig device
|
|
#
|
|
type sysdig_device_t;
|
|
dev_node(sysdig_device_t)
|
|
|
|
#
|
|
# sysfs_t is the type for the /sys pseudofs
|
|
#
|
|
type sysfs_t, sysfs_types;
|
|
files_mountpoint(sysfs_t)
|
|
fs_xattr_type(sysfs_t)
|
|
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
|
|
|
|
#
|
|
# Types for trusted execution environment interface
|
|
#
|
|
type tee_device_t;
|
|
dev_node(tee_device_t)
|
|
|
|
type tee_priv_device_t;
|
|
dev_node(tee_priv_device_t)
|
|
|
|
#
|
|
# Type for /dev/tpm
|
|
#
|
|
type tpm_device_t;
|
|
dev_node(tpm_device_t)
|
|
|
|
#
|
|
# uhid_device_t is the type of /dev/uhid -
|
|
# User-space I/O driver support for HID subsystem
|
|
#
|
|
type uhid_device_t;
|
|
dev_node(uhid_device_t)
|
|
|
|
#
|
|
# urandom_device_t is the type of /dev/urandom
|
|
#
|
|
type urandom_device_t;
|
|
dev_node(urandom_device_t)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(urandom_device_t)
|
|
')
|
|
|
|
#
|
|
# usbfs_t is the type for the /proc/bus/usb pseudofs
|
|
#
|
|
type usbfs_t;
|
|
files_mountpoint(usbfs_t)
|
|
fs_pseudo_type(usbfs_t)
|
|
genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0)
|
|
genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
|
|
|
|
#
|
|
# usb_device_t is the type for /dev/bus/usb/[0-9]+/[0-9]+
|
|
#
|
|
type usb_device_t;
|
|
dev_node(usb_device_t)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(usb_device_t)
|
|
')
|
|
|
|
#
|
|
# usb_device_t is the type for /dev/usbmon
|
|
#
|
|
type usbmon_device_t;
|
|
dev_node(usbmon_device_t)
|
|
|
|
#
|
|
# userio_device_t is the type for /dev/uio[0-9]+
|
|
#
|
|
type userio_device_t;
|
|
dev_node(userio_device_t)
|
|
|
|
type vfio_device_t;
|
|
dev_node(vfio_device_t)
|
|
|
|
type v4l_device_t;
|
|
dev_node(v4l_device_t)
|
|
|
|
#
|
|
# vhost_device_t is the type for vhost devices like
|
|
# /dev/vhost-net and /dev/vhost-scsi
|
|
#
|
|
type vhost_device_t;
|
|
dev_node(vhost_device_t)
|
|
|
|
# Type for vmware devices.
|
|
type vmware_device_t;
|
|
dev_node(vmware_device_t)
|
|
|
|
type watchdog_device_t;
|
|
dev_node(watchdog_device_t)
|
|
|
|
#
|
|
# wireless control devices
|
|
#
|
|
type wireless_device_t;
|
|
dev_node(wireless_device_t)
|
|
|
|
type xen_device_t;
|
|
dev_node(xen_device_t)
|
|
|
|
type xserver_misc_device_t;
|
|
dev_node(xserver_misc_device_t)
|
|
|
|
#
|
|
# zero_device_t is the type of /dev/zero.
|
|
#
|
|
type zero_device_t;
|
|
dev_node(zero_device_t)
|
|
mls_trusted_object(zero_device_t)
|
|
|
|
optional_policy(`
|
|
container_mountpoint(zero_device_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# Rules for all device nodes
|
|
#
|
|
|
|
allow device_node device_t:filesystem associate;
|
|
|
|
fs_associate(device_node)
|
|
fs_associate_tmpfs(device_node)
|
|
|
|
files_associate_tmp(device_node)
|
|
|
|
########################################
|
|
#
|
|
# Unconfined access to this module
|
|
#
|
|
|
|
allow devices_unconfined_type self:capability sys_rawio;
|
|
allow devices_unconfined_type device_node:blk_file { manage_blk_file_perms relabel_blk_file_perms map execute quotaon mounton audit_access execmod watch };
|
|
allow devices_unconfined_type device_node:chr_file { manage_chr_file_perms relabel_chr_file_perms map execute quotaon mounton execmod audit_access watch };
|
|
allow devices_unconfined_type mtrr_device_t:file { manage_file_perms relabel_file_perms exec_file_perms quotaon mounton entrypoint execmod audit_access watch };
|