|
Chris PeBenito |
e181fe0 |
|
|
Chris PeBenito |
123a990 |
policy_module(filesystem,1.3.11)
|
|
Chris PeBenito |
960373d |
|
|
Chris PeBenito |
fd89e19 |
########################################
|
|
Chris PeBenito |
fd89e19 |
#
|
|
Chris PeBenito |
fd89e19 |
# Declarations
|
|
Chris PeBenito |
fd89e19 |
#
|
|
Chris PeBenito |
fd89e19 |
|
|
Chris PeBenito |
cbca03f |
attribute filesystem_type;
|
|
Chris PeBenito |
b518fc2 |
attribute filesystem_unconfined_type;
|
|
Chris PeBenito |
fe040c9 |
attribute noxattrfs;
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
fd89e19 |
##############################
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# fs_t is the default type for persistent
|
|
Chris PeBenito |
b4cd153 |
# filesystems with extended attributes
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
c3cf669 |
type fs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(fs_t)
|
|
Chris PeBenito |
e02c61c |
sid fs gen_context(system_u:object_r:fs_t,s0)
|
|
Chris PeBenito |
cabfa52 |
|
|
Chris PeBenito |
cabfa52 |
# Use xattrs for the following filesystem types.
|
|
Chris PeBenito |
cabfa52 |
# Requires that a security xattr handler exist for the filesystem.
|
|
Chris PeBenito |
e02c61c |
fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
e02c61c |
fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
2dbd382 |
fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
e02c61c |
fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
e02c61c |
fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
cabfa52 |
|
|
Chris PeBenito |
cabfa52 |
# Use the allocating task SID to label inodes in the following filesystem
|
|
Chris PeBenito |
cabfa52 |
# types, and label the filesystem itself with the specified context.
|
|
Chris PeBenito |
cabfa52 |
# This is appropriate for pseudo filesystems that represent objects
|
|
Chris PeBenito |
cabfa52 |
# like pipes and sockets, so that these objects are labeled with the same
|
|
Chris PeBenito |
cabfa52 |
# type as the creating task.
|
|
Chris PeBenito |
e02c61c |
fs_use_task pipefs gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
e02c61c |
fs_use_task sockfs gen_context(system_u:object_r:fs_t,s0);
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
fd89e19 |
##############################
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# Non-persistent/pseudo filesystems
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
c3cf669 |
type bdev_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(bdev_t)
|
|
Chris PeBenito |
e02c61c |
genfscon bdev / gen_context(system_u:object_r:bdev_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c3cf669 |
type binfmt_misc_fs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(binfmt_misc_fs_t)
|
|
Chris PeBenito |
0907bda |
files_mountpoint(binfmt_misc_fs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c3cf669 |
type capifs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(capifs_t)
|
|
Chris PeBenito |
77f6e2c |
genfscon capifs / gen_context(system_u:object_r:capifs_t,s0)
|
|
Chris PeBenito |
77f6e2c |
|
|
Chris PeBenito |
c3cf669 |
type configfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(configfs_t)
|
|
Chris PeBenito |
19b5555 |
genfscon configfs / gen_context(system_u:object_r:configfs_t,s0)
|
|
Chris PeBenito |
19b5555 |
|
|
Chris PeBenito |
c3cf669 |
type eventpollfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(eventpollfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon eventpollfs / gen_context(system_u:object_r:eventpollfs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c3cf669 |
type futexfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(futexfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c3cf669 |
type hugetlbfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(hugetlbfs_t)
|
|
Chris PeBenito |
0907bda |
files_mountpoint(hugetlbfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon hugetlbfs / gen_context(system_u:object_r:hugetlbfs_t,s0)
|
|
Chris PeBenito |
0907bda |
|
|
Chris PeBenito |
123a990 |
type ibmasmfs_t;
|
|
Chris PeBenito |
123a990 |
fs_type(ibmasmfs_t)
|
|
Chris PeBenito |
123a990 |
allow ibmasmfs_t self:filesystem associate;
|
|
Chris PeBenito |
123a990 |
genfscon ibmasmfs / gen_context(system_u:object_r:ibmasmfs_t,s0)
|
|
Chris PeBenito |
123a990 |
|
|
Chris PeBenito |
c3cf669 |
type inotifyfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(inotifyfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)
|
|
Chris PeBenito |
0907bda |
|
|
Chris PeBenito |
c3cf669 |
type nfsd_fs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(nfsd_fs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
522b59b |
type oprofilefs_t;
|
|
Chris PeBenito |
522b59b |
fs_type(oprofilefs_t)
|
|
Chris PeBenito |
522b59b |
genfscon oprofilefs / gen_context(system_u:object_r:oprofilefs_t,s0)
|
|
Chris PeBenito |
522b59b |
|
|
Chris PeBenito |
c3cf669 |
type ramfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(ramfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c3cf669 |
type romfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(romfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon romfs / gen_context(system_u:object_r:romfs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon cramfs / gen_context(system_u:object_r:romfs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
c3cf669 |
type rpc_pipefs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(rpc_pipefs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon rpc_pipefs / gen_context(system_u:object_r:rpc_pipefs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# tmpfs_t is the type for tmpfs filesystems
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
c3cf669 |
type tmpfs_t;
|
|
Chris PeBenito |
c3cf669 |
fs_type(tmpfs_t)
|
|
Chris PeBenito |
8fd3673 |
files_type(tmpfs_t)
|
|
Chris PeBenito |
cff75c9 |
files_mountpoint(tmpfs_t)
|
|
Chris PeBenito |
f5c42bd |
|
|
Chris PeBenito |
cabfa52 |
# Use a transition SID based on the allocating task SID and the
|
|
Chris PeBenito |
cabfa52 |
# filesystem SID to label inodes in the following filesystem types,
|
|
Chris PeBenito |
cabfa52 |
# and label the filesystem itself with the specified context.
|
|
Chris PeBenito |
cabfa52 |
# This is appropriate for pseudo filesystems like devpts and tmpfs
|
|
Chris PeBenito |
cabfa52 |
# where we want to label objects with a derived type.
|
|
Chris PeBenito |
e02c61c |
fs_use_trans mqueue gen_context(system_u:object_r:tmpfs_t,s0);
|
|
Chris PeBenito |
e02c61c |
fs_use_trans shm gen_context(system_u:object_r:tmpfs_t,s0);
|
|
Chris PeBenito |
e02c61c |
fs_use_trans tmpfs gen_context(system_u:object_r:tmpfs_t,s0);
|
|
Chris PeBenito |
cabfa52 |
|
|
Chris PeBenito |
fe040c9 |
allow tmpfs_t noxattrfs:filesystem associate;
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
fd89e19 |
##############################
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# Filesystems without extended attribute support
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
da14da8 |
type autofs_t;
|
|
Chris PeBenito |
da14da8 |
fs_noxattr_type(autofs_t)
|
|
Chris PeBenito |
af23450 |
files_mountpoint(autofs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon autofs / gen_context(system_u:object_r:autofs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon automount / gen_context(system_u:object_r:autofs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# cifs_t is the type for filesystems and their
|
|
Chris PeBenito |
b4cd153 |
# files shared from Windows servers
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
da14da8 |
type cifs_t alias sambafs_t;
|
|
Chris PeBenito |
da14da8 |
fs_noxattr_type(cifs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon cifs / gen_context(system_u:object_r:cifs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon smbfs / gen_context(system_u:object_r:cifs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# dosfs_t is the type for fat and vfat
|
|
Chris PeBenito |
b4cd153 |
# filesystems and their files.
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
da14da8 |
type dosfs_t;
|
|
Chris PeBenito |
da14da8 |
fs_noxattr_type(dosfs_t)
|
|
Chris PeBenito |
9550194 |
allow dosfs_t fs_t:filesystem associate;
|
|
Chris PeBenito |
e02c61c |
genfscon fat / gen_context(system_u:object_r:dosfs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon msdos / gen_context(system_u:object_r:dosfs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
b4cd153 |
# iso9660_t is the type for CD filesystems
|
|
Chris PeBenito |
b4cd153 |
# and their files.
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
da14da8 |
type iso9660_t;
|
|
Chris PeBenito |
da14da8 |
fs_noxattr_type(iso9660_t)
|
|
Chris PeBenito |
e02c61c |
genfscon iso9660 / gen_context(system_u:object_r:iso9660_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
|
|
Chris PeBenito |
b4cd153 |
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
33bc0dd |
# removable_t is the default type of all removable media
|
|
Chris PeBenito |
33bc0dd |
#
|
|
Chris PeBenito |
da14da8 |
type removable_t;
|
|
Chris PeBenito |
fe040c9 |
allow removable_t noxattrfs:filesystem associate;
|
|
Chris PeBenito |
da14da8 |
fs_noxattr_type(removable_t)
|
|
Chris PeBenito |
b68a85c |
files_type(removable_t)
|
|
Chris PeBenito |
33bc0dd |
|
|
Chris PeBenito |
33bc0dd |
#
|
|
Chris PeBenito |
b4cd153 |
# nfs_t is the default type for NFS file systems
|
|
Chris PeBenito |
b4cd153 |
# and their files.
|
|
Chris PeBenito |
b4cd153 |
#
|
|
Chris PeBenito |
da14da8 |
type nfs_t;
|
|
Chris PeBenito |
da14da8 |
fs_noxattr_type(nfs_t)
|
|
Chris PeBenito |
c9428d3 |
files_mountpoint(nfs_t)
|
|
Chris PeBenito |
e02c61c |
genfscon nfs / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon nfs4 / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
e02c61c |
genfscon afs / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
a3cf80d |
genfscon hfs / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
a3cf80d |
genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
d2a9030 |
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
2dbd382 |
genfscon gfs / gen_context(system_u:object_r:nfs_t,s0)
|
|
Chris PeBenito |
da14da8 |
|
|
Chris PeBenito |
da14da8 |
########################################
|
|
Chris PeBenito |
da14da8 |
#
|
|
Chris PeBenito |
da14da8 |
# Rules for all filesystem types
|
|
Chris PeBenito |
da14da8 |
#
|
|
Chris PeBenito |
da14da8 |
|
|
Chris PeBenito |
da14da8 |
allow filesystem_type self:filesystem associate;
|
|
Chris PeBenito |
b518fc2 |
|
|
Chris PeBenito |
b518fc2 |
########################################
|
|
Chris PeBenito |
b518fc2 |
#
|
|
Chris PeBenito |
b518fc2 |
# Unconfined access to this module
|
|
Chris PeBenito |
b518fc2 |
#
|
|
Chris PeBenito |
b518fc2 |
|
|
Chris PeBenito |
b518fc2 |
allow filesystem_unconfined_type filesystem_type:filesystem *;
|
|
Chris PeBenito |
b518fc2 |
|
|
Chris PeBenito |
b518fc2 |
# Create/access other files. fs_type is to pick up various
|
|
Chris PeBenito |
b518fc2 |
# pseudo filesystem types that are applied to both the filesystem
|
|
Chris PeBenito |
b518fc2 |
# and its files.
|
|
Chris PeBenito |
b518fc2 |
allow filesystem_unconfined_type filesystem_type:{ dir file lnk_file sock_file fifo_file chr_file blk_file } *;
|