Oreon-Lime-R2/selinux-policy/selinux-policy-d9f4a2b/selinux-policy-d9f4a2bbeb91fd95d0c35a90936efb9ea99d2455/policy/modules/system/fstools.if

## <summary>Tools for filesystem management, such as mkfs and fsck.</summary>

########################################
## <summary>
##	Execute fs tools in the fstools domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
#
interface(`fstools_domtrans',`
	gen_require(`
		type fsadm_t, fsadm_exec_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1, fsadm_exec_t, fsadm_t)
')

########################################
## <summary>
##	Execute fs tools in the fstools domain, and
##	allow the specified role the fs tools domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed to transition.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	Role allowed access.
##	</summary>
## </param>
## <rolecap/>
#
interface(`fstools_run',`
	gen_require(`
		type fsadm_t;
	')

	fstools_domtrans($1)
	role $2 types fsadm_t;
')

########################################
## <summary>
##	Execute fsadm in the caller domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_exec',`
	gen_require(`
		type fsadm_exec_t;
	')

	can_exec($1, fsadm_exec_t)
')

########################################
## <summary>
##	Send signal to fsadm process
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_signal',`
	gen_require(`
		type fsadm_t;
	')

	allow $1 fsadm_t:process signal;
')

########################################
## <summary>
##	Read fstools unnamed pipes.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_read_pipes',`
	gen_require(`
		type fsadm_t;
	')

	allow $1 fsadm_t:fifo_file read_fifo_file_perms;
')

########################################
## <summary>
##	Relabel a file to the type used by the
##	filesystem tools programs.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_relabelto_entry_files',`
	gen_require(`
		type fsadm_exec_t;
	')

	allow $1 fsadm_exec_t:file relabelto;
')

########################################
## <summary>
##	Create, read, write, and delete a file used by the
##	filesystem tools programs.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_manage_entry_files',`
	gen_require(`
		type fsadm_exec_t;
	')

	allow $1 fsadm_exec_t:file manage_file_perms;
')

########################################
## <summary>
##	Getattr swapfile
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_getattr_swap_files',`
	gen_require(`
		type swapfile_t;
	')

	allow $1 swapfile_t:file getattr;
')

########################################
## <summary>
##	Read swapfile
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_read_swap_files',`
	gen_require(`
		type swapfile_t;
	')

	allow $1 swapfile_t:file read_file_perms;
')

########################################
## <summary>
##	Read/Write swapfile
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_rw_swap_files',`
	gen_require(`
		type swapfile_t;
	')

	allow $1 swapfile_t:file rw_file_perms;
')

########################################
## <summary>
##	Create, read, write, and delete the FSADM pid files.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`fsadm_manage_pid',`
	gen_require(`
		type fsadm_var_run_t;
	')

	files_search_pids($1)
	manage_dirs_pattern($1, fsadm_var_run_t, fsadm_var_run_t)
	manage_files_pattern($1, fsadm_var_run_t, fsadm_var_run_t)
    fstools_filetrans_named_content_fsadm($1)
')

########################################
## <summary>
##	Transition to systemd  content
## </summary>
## <param name="domain">
##	<summary>
##      Domain allowed access.
##	</summary>
## </param>
#
interface(`fstools_filetrans_named_content_fsadm',`
	gen_require(`
		type fsadm_var_run_t;
	')

	files_pid_filetrans($1, fsadm_var_run_t, dir, "blkid")
	files_pid_filetrans($1, fsadm_var_run_t, dir, "fsck")
')