diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if index f8b357c3a..786449aee 100644 --- a/policy/modules/kernel/selinux.if +++ b/policy/modules/kernel/selinux.if @@ -94,6 +94,61 @@ interface(`selinux_dontaudit_get_fs_mount',` kernel_dontaudit_read_system_state($1) ') +######################################## +## +## Mount the selinuxfs filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`selinux_mount_fs',` + gen_require(` + type security_t; + ') + + allow $1 security_t:filesystem mount; +') + +######################################## +## +## Remount the selinuxfs filesystem. +## This allows some mount options to be changed. +## +## +## +## Domain allowed access. +## +## +# +interface(`selinux_remount_fs',` + gen_require(` + type security_t; + ') + + allow $1 security_t:filesystem remount; +') + +######################################## +## +## Unmount the selinuxfs filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`selinux_unmount_fs',` + gen_require(` + type security_t; + ') + + allow $1 security_t:filesystem unmount; +') + ######################################## ## ## Get the attributes of the selinuxfs filesystem diff --git a/policy/modules/kernel/selinux.te b/policy/modules/kernel/selinux.te index 499e997fe..bd4690a62 100644 --- a/policy/modules/kernel/selinux.te +++ b/policy/modules/kernel/selinux.te @@ -1,4 +1,4 @@ -policy_module(selinux, 1.8.0) +policy_module(selinux, 1.8.1) ######################################## #