495e2c203b
Remove complement (~) and wildcard (*) in allow rules so that there are no unintentional additions when new permissions are declared. This patch does not add or remove permissions from any rules.
60 lines
1.7 KiB
Plaintext
60 lines
1.7 KiB
Plaintext
policy_module(storage, 1.15.0)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute fixed_disk_raw_read;
|
|
attribute fixed_disk_raw_write;
|
|
attribute scsi_generic_read;
|
|
attribute scsi_generic_write;
|
|
attribute storage_unconfined_type;
|
|
|
|
#
|
|
# fixed_disk_device_t is the type of
|
|
# /dev/hd* and /dev/sd*.
|
|
#
|
|
type fixed_disk_device_t;
|
|
dev_node(fixed_disk_device_t)
|
|
|
|
neverallow ~{ fixed_disk_raw_read storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } read;
|
|
neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write };
|
|
|
|
#
|
|
# fuse_device_t is the type of /dev/fuse
|
|
#
|
|
type fuse_device_t;
|
|
dev_node(fuse_device_t)
|
|
|
|
#
|
|
# scsi_generic_device_t is the type of /dev/sg*
|
|
# it gives access to ALL SCSI devices (both fixed and removable)
|
|
#
|
|
type scsi_generic_device_t;
|
|
dev_node(scsi_generic_device_t)
|
|
|
|
neverallow ~{ scsi_generic_read storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } read;
|
|
neverallow ~{ scsi_generic_write storage_unconfined_type } scsi_generic_device_t:{ chr_file blk_file } { append write };
|
|
|
|
#
|
|
# removable_device_t is the type of
|
|
# /dev/scd* and /dev/fd*.
|
|
#
|
|
type removable_device_t;
|
|
dev_node(removable_device_t)
|
|
|
|
#
|
|
# tape_device_t is the type of
|
|
#
|
|
type tape_device_t;
|
|
dev_node(tape_device_t)
|
|
|
|
########################################
|
|
#
|
|
# Unconfined access to this module
|
|
#
|
|
|
|
allow storage_unconfined_type { fixed_disk_device_t removable_device_t }:blk_file { manage_blk_file_perms relabelfrom relabelto map execute swapon quotaon mounton audit_access execmod };
|
|
allow storage_unconfined_type { scsi_generic_device_t tape_device_t }:chr_file { manage_chr_file_perms relabelfrom relabelto map execute swapon quotaon mounton execute_no_trans entrypoint execmod audit_access };
|