461 lines
8.2 KiB
Text
461 lines
8.2 KiB
Text
|
policy_module(devices, 1.15.0)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Declarations
|
||
|
|
#
|
||
|
|
|
||
|
|
attribute device_node;
|
||
|
|
attribute memory_raw_read;
|
||
|
|
attribute memory_raw_write;
|
||
|
|
attribute devices_unconfined_type;
|
||
|
|
|
||
|
|
#
|
||
|
|
# device_t is the type of /dev.
|
||
|
|
#
|
||
|
|
type device_t;
|
||
|
|
fs_associate_tmpfs(device_t)
|
||
|
|
files_base_file(device_t)
|
||
|
|
files_mountpoint(device_t)
|
||
|
|
files_associate_tmp(device_t)
|
||
|
|
fs_type(device_t)
|
||
|
|
fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0);
|
||
|
|
dev_node(device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/acpi_* devices
|
||
|
|
#
|
||
|
|
type acpi_device_t;
|
||
|
|
dev_node(acpi_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/agpgart
|
||
|
|
#
|
||
|
|
type agp_device_t;
|
||
|
|
dev_node(agp_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/apm_bios
|
||
|
|
#
|
||
|
|
type apm_bios_t;
|
||
|
|
dev_node(apm_bios_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/autofs
|
||
|
|
#
|
||
|
|
type autofs_device_t;
|
||
|
|
dev_node(autofs_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/binderfs
|
||
|
|
#
|
||
|
|
type binder_device_t;
|
||
|
|
dev_node(binder_device_t)
|
||
|
|
# Default Android binder devices
|
||
|
|
## /dev/binderfs/binder - IPC between framework/app processes with Android Interface Definition Language (AIDL) interfaces
|
||
|
|
genfscon binder /binder gen_context(system_u:object_r:binder_device_t,s0)
|
||
|
|
## /dev/binderfs/hwbinder - IPC between framework/vendor and vendor/vendor processes with HAL Interface Definition Language (HIDL) interfaces
|
||
|
|
genfscon binder /hwbinder gen_context(system_u:object_r:binder_device_t,s0)
|
||
|
|
## /dev/binderfs/vndbinder - IPC between vendor/vendor processes with AIDL interfaces
|
||
|
|
genfscon binder /vndbinder gen_context(system_u:object_r:binder_device_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# cardmgr_dev_t is type for PCMCIA manager devices
|
||
|
|
#
|
||
|
|
type cardmgr_dev_t;
|
||
|
|
dev_node(cardmgr_dev_t)
|
||
|
|
files_tmp_file(cardmgr_dev_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# clock_device_t is the type of
|
||
|
|
# /dev/rtc.
|
||
|
|
#
|
||
|
|
type clock_device_t;
|
||
|
|
dev_node(clock_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# cpu control devices /dev/cpu/0/*
|
||
|
|
#
|
||
|
|
type cpu_device_t;
|
||
|
|
dev_node(cpu_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/cachefilesd
|
||
|
|
#
|
||
|
|
type cachefiles_device_t alias cachefiles_dev_t;
|
||
|
|
dev_node(cachefiles_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/crash
|
||
|
|
#
|
||
|
|
type crash_device_t;
|
||
|
|
dev_node(crash_device_t)
|
||
|
|
|
||
|
|
type ecryptfs_device_t;
|
||
|
|
dev_node(ecryptfs_device_t)
|
||
|
|
|
||
|
|
# for the IBM zSeries z90crypt hardware ssl accelorator
|
||
|
|
type crypt_device_t;
|
||
|
|
dev_node(crypt_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/crypto/nx-gzip
|
||
|
|
#
|
||
|
|
type accelerator_device_t;
|
||
|
|
dev_node(accelerator_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# dlm_misc_device_t is the type of /dev/misc/dlm.*
|
||
|
|
#
|
||
|
|
type dlm_control_device_t;
|
||
|
|
dev_node(dlm_control_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/dma_heap/* devices
|
||
|
|
#
|
||
|
|
type dma_device_t;
|
||
|
|
dev_node(dma_device_t)
|
||
|
|
|
||
|
|
type dri_device_t;
|
||
|
|
dev_node(dri_device_t)
|
||
|
|
|
||
|
|
type hsa_device_t;
|
||
|
|
dev_node(hsa_device_t)
|
||
|
|
|
||
|
|
type event_device_t;
|
||
|
|
dev_node(event_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for framebuffer /dev/fb/*
|
||
|
|
#
|
||
|
|
type framebuf_device_t;
|
||
|
|
dev_node(framebuf_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for hyperv devices
|
||
|
|
#
|
||
|
|
type hypervkvp_device_t;
|
||
|
|
dev_node(hypervkvp_device_t)
|
||
|
|
|
||
|
|
type hypervvssd_device_t;
|
||
|
|
dev_node(hypervvssd_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/ss0
|
||
|
|
#
|
||
|
|
type gpfs_device_t;
|
||
|
|
dev_node(gpfs_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/gpiochip*
|
||
|
|
#
|
||
|
|
type gpio_device_t;
|
||
|
|
dev_node(gpio_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/ipmi/0
|
||
|
|
#
|
||
|
|
type ipmi_device_t;
|
||
|
|
dev_node(ipmi_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/infiniband
|
||
|
|
#
|
||
|
|
type infiniband_device_t;
|
||
|
|
dev_node(infiniband_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/infiniband mgmt devices
|
||
|
|
#
|
||
|
|
type infiniband_mgmt_device_t;
|
||
|
|
dev_node(infiniband_mgmt_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/kmsg
|
||
|
|
#
|
||
|
|
type kmsg_device_t;
|
||
|
|
dev_node(kmsg_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# ksm_device_t is the type of /dev/ksm
|
||
|
|
#
|
||
|
|
type ksm_device_t;
|
||
|
|
dev_node(ksm_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# kvm_device_t is the type of
|
||
|
|
# /dev/kvm
|
||
|
|
#
|
||
|
|
type kvm_device_t;
|
||
|
|
dev_node(kvm_device_t)
|
||
|
|
mls_trusted_object(kvm_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# sev_device_t is the type of
|
||
|
|
# /dev/sev
|
||
|
|
#
|
||
|
|
type sev_device_t;
|
||
|
|
dev_node(sev_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/lirc
|
||
|
|
#
|
||
|
|
type lirc_device_t;
|
||
|
|
dev_node(lirc_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/mapper/control
|
||
|
|
#
|
||
|
|
type loop_control_device_t;
|
||
|
|
dev_node(loop_control_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/mapper/control
|
||
|
|
#
|
||
|
|
type lvm_control_t;
|
||
|
|
dev_node(lvm_control_t)
|
||
|
|
|
||
|
|
type mei_device_t;
|
||
|
|
dev_node(mei_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# memory_device_t is the type of /dev/kmem,
|
||
|
|
# /dev/mem and /dev/port.
|
||
|
|
#
|
||
|
|
type memory_device_t;
|
||
|
|
dev_node(memory_device_t)
|
||
|
|
|
||
|
|
neverallow ~{ memory_raw_read devices_unconfined_type } memory_device_t:{ chr_file blk_file } read;
|
||
|
|
neverallow ~{ memory_raw_write devices_unconfined_type } memory_device_t:{ chr_file blk_file } { append write };
|
||
|
|
|
||
|
|
type misc_device_t;
|
||
|
|
dev_node(misc_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# A general type for modem devices.
|
||
|
|
#
|
||
|
|
type modem_device_t;
|
||
|
|
dev_node(modem_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# A general type for monitor devices.
|
||
|
|
#
|
||
|
|
type monitor_device_t;
|
||
|
|
dev_node(monitor_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# A more general type for mouse devices.
|
||
|
|
#
|
||
|
|
type mouse_device_t;
|
||
|
|
dev_node(mouse_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/mptctl used to check RAID status.
|
||
|
|
#
|
||
|
|
type mptctl_device_t;
|
||
|
|
dev_node(mptctl_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/cpu/mtrr and /proc/mtrr
|
||
|
|
#
|
||
|
|
type mtrr_device_t;
|
||
|
|
dev_node(mtrr_device_t)
|
||
|
|
files_mountpoint(mtrr_device_t)
|
||
|
|
genfscon proc /mtrr gen_context(system_u:object_r:mtrr_device_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# network control devices
|
||
|
|
#
|
||
|
|
type netcontrol_device_t;
|
||
|
|
dev_node(netcontrol_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# null_device_t is the type of /dev/null.
|
||
|
|
#
|
||
|
|
type null_device_t;
|
||
|
|
dev_node(null_device_t)
|
||
|
|
mls_trusted_object(null_device_t)
|
||
|
|
sid devnull gen_context(system_u:object_r:null_device_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/nvram
|
||
|
|
#
|
||
|
|
type nvram_device_t;
|
||
|
|
dev_node(nvram_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/op_panel
|
||
|
|
# Type for /dev/opal-prd
|
||
|
|
#
|
||
|
|
type opal_device_t;
|
||
|
|
dev_node(opal_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/pmu
|
||
|
|
#
|
||
|
|
type power_device_t;
|
||
|
|
dev_node(power_device_t)
|
||
|
|
|
||
|
|
type printer_device_t;
|
||
|
|
dev_node(printer_device_t)
|
||
|
|
mls_file_write_within_range(printer_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# qemu control devices
|
||
|
|
#
|
||
|
|
type qemu_device_t;
|
||
|
|
dev_node(qemu_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# random_device_t is the type of /dev/random
|
||
|
|
#
|
||
|
|
type random_device_t;
|
||
|
|
dev_node(random_device_t)
|
||
|
|
|
||
|
|
type scanner_device_t;
|
||
|
|
dev_node(scanner_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for smartcards
|
||
|
|
#
|
||
|
|
type smartcard_device_t;
|
||
|
|
dev_node(smartcard_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for sound devices and mixers
|
||
|
|
#
|
||
|
|
type sound_device_t;
|
||
|
|
dev_node(sound_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# sysfs_t is the type for the /sys pseudofs
|
||
|
|
#
|
||
|
|
type sysfs_t;
|
||
|
|
files_mountpoint(sysfs_t)
|
||
|
|
fs_type(sysfs_t)
|
||
|
|
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
|
||
|
|
|
||
|
|
type cpu_online_t;
|
||
|
|
files_type(cpu_online_t)
|
||
|
|
dev_associate_sysfs(cpu_online_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/tmc_etb[0-9]+ /dev/tmc_etf[0-9]+ /dev/tmc_etr[0-9]+
|
||
|
|
#
|
||
|
|
type hwtracing_device_t;
|
||
|
|
dev_node(hwtracing_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# Type for /dev/tpm
|
||
|
|
#
|
||
|
|
type tpm_device_t;
|
||
|
|
dev_node(tpm_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# urandom_device_t is the type of /dev/urandom
|
||
|
|
#
|
||
|
|
type urandom_device_t;
|
||
|
|
dev_node(urandom_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# usbfs_t is the type for the /proc/bus/usb pseudofs
|
||
|
|
#
|
||
|
|
type usbfs_t alias usbdevfs_t;
|
||
|
|
files_mountpoint(usbfs_t)
|
||
|
|
fs_noxattr_type(usbfs_t)
|
||
|
|
genfscon usbfs / gen_context(system_u:object_r:usbfs_t,s0)
|
||
|
|
genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
|
||
|
|
|
||
|
|
#
|
||
|
|
# usb_device_t is the type for /dev/bus/usb/[0-9]+/[0-9]+
|
||
|
|
#
|
||
|
|
type usb_device_t;
|
||
|
|
dev_node(usb_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# usb_device_t is the type for /dev/usbmon
|
||
|
|
#
|
||
|
|
type usbmon_device_t;
|
||
|
|
dev_node(usbmon_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# userio_device_t is the type for /dev/uio[0-9]+
|
||
|
|
#
|
||
|
|
type userio_device_t;
|
||
|
|
dev_node(userio_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# uhid_device_t is the type for /dev/uhid
|
||
|
|
#
|
||
|
|
type uhid_device_t;
|
||
|
|
dev_node(uhid_device_t)
|
||
|
|
|
||
|
|
type vfio_device_t;
|
||
|
|
dev_node(vfio_device_t)
|
||
|
|
|
||
|
|
type v4l_device_t;
|
||
|
|
dev_node(v4l_device_t)
|
||
|
|
|
||
|
|
type vsock_device_t;
|
||
|
|
dev_node(vsock_device_t)
|
||
|
|
|
||
|
|
type vmci_device_t;
|
||
|
|
dev_node(vmci_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# vhost_device_t is the type for /dev/vhost-net
|
||
|
|
#
|
||
|
|
type vhost_device_t;
|
||
|
|
dev_node(vhost_device_t)
|
||
|
|
mls_trusted_object(vhost_device_t)
|
||
|
|
|
||
|
|
# Type for vmware devices.
|
||
|
|
type vmware_device_t;
|
||
|
|
dev_node(vmware_device_t)
|
||
|
|
|
||
|
|
type watchdog_device_t;
|
||
|
|
dev_node(watchdog_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# wireless control devices
|
||
|
|
#
|
||
|
|
type wireless_device_t;
|
||
|
|
dev_node(wireless_device_t)
|
||
|
|
|
||
|
|
type xen_device_t;
|
||
|
|
dev_node(xen_device_t)
|
||
|
|
|
||
|
|
type xserver_misc_device_t;
|
||
|
|
dev_node(xserver_misc_device_t)
|
||
|
|
|
||
|
|
#
|
||
|
|
# zero_device_t is the type of /dev/zero.
|
||
|
|
#
|
||
|
|
type zero_device_t;
|
||
|
|
dev_node(zero_device_t)
|
||
|
|
mls_trusted_object(zero_device_t)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Rules for all device nodes
|
||
|
|
#
|
||
|
|
|
||
|
|
allow device_node device_t:filesystem associate;
|
||
|
|
|
||
|
|
fs_associate(device_node)
|
||
|
|
fs_associate_tmpfs(device_node)
|
||
|
|
|
||
|
|
files_associate_tmp(device_node)
|
||
|
|
|
||
|
|
########################################
|
||
|
|
#
|
||
|
|
# Unconfined access to this module
|
||
|
|
#
|
||
|
|
|
||
|
|
allow devices_unconfined_type self:capability sys_rawio;
|
||
|
|
allow devices_unconfined_type device_node:{ blk_file lnk_file } *;
|
||
|
|
allow devices_unconfined_type device_node:{ file chr_file } ~{ execmod entrypoint };
|
||
|
|
allow devices_unconfined_type mtrr_device_t:file ~{ execmod entrypoint };
|
||
|
|
dev_getattr_all(devices_unconfined_type)
|
||
|
|
|