165 lines
3.0 KiB
Plaintext
165 lines
3.0 KiB
Plaintext
## <summary>Trusted Platform Module 2.0</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute tpm2_* processes
|
|
## in the caller domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_exec',`
|
|
gen_require(`
|
|
type tpm2_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
can_exec($1, tpm2_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute tpm2_* processes in the tpm2 domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_domtrans',`
|
|
gen_require(`
|
|
type tpm2_t, tpm2_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, tpm2_exec_t, tpm2_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute tpm2_* processes in the tpm2
|
|
## domain and allow the specified role
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_run',`
|
|
gen_require(`
|
|
type tpm2_t;
|
|
')
|
|
|
|
role $2 types tpm2_t;
|
|
|
|
tpm2_domtrans($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send and receive messages from
|
|
## tpm2-abrmd over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_dbus_chat_abrmd',`
|
|
gen_require(`
|
|
type tpm2_abrmd_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 tpm2_abrmd_t:dbus send_msg;
|
|
allow tpm2_abrmd_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow specified domain to enable/disable tpm2-abrmd unit
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_enabledisable_abrmd',`
|
|
gen_require(`
|
|
type tpm2_abrmd_unit_t;
|
|
class service { enable disable };
|
|
')
|
|
|
|
allow $1 tpm2_abrmd_unit_t:service { enable disable };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow specified domain to start/stop tpm2-abrmd unit
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_startstop_abrmd',`
|
|
gen_require(`
|
|
type tpm2_abrmd_unit_t;
|
|
class service { start stop };
|
|
')
|
|
|
|
allow $1 tpm2_abrmd_unit_t:service { start stop };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow specified domain to get status of tpm2-abrmd unit
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_status_abrmd',`
|
|
gen_require(`
|
|
type tpm2_abrmd_unit_t;
|
|
class service status;
|
|
')
|
|
|
|
allow $1 tpm2_abrmd_unit_t:service status;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## access tpm2-abrmd fifos
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`tpm2_rw_abrmd_pipes',`
|
|
gen_require(`
|
|
type tpm2_abrmd_t;
|
|
')
|
|
|
|
allow $1 tpm2_abrmd_t:fd use;
|
|
allow $1 tpm2_abrmd_t:fifo_file rw_fifo_file_perms;
|
|
')
|
|
|