1429 lines
47 KiB
Text
1429 lines
47 KiB
Text
## <summary>Policy controlling access to storage devices</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to get the attributes of fixed disk
|
|
## device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_getattr_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to read/write inherited fixed disk
|
|
## device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## The domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_rw_inherited_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
attribute fixed_disk_raw_read;
|
|
attribute fixed_disk_raw_write;
|
|
')
|
|
|
|
allow $1 fixed_disk_device_t:chr_file { read write };
|
|
allow $1 fixed_disk_device_t:blk_file { read write };
|
|
typeattribute $1 fixed_disk_raw_read;
|
|
typeattribute $1 fixed_disk_raw_write;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to get
|
|
## the attributes of fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_getattr_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dontaudit $1 fixed_disk_device_t:blk_file getattr;
|
|
dontaudit $1 fixed_disk_device_t:chr_file getattr; # /dev/rawctl
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to set the attributes of fixed disk
|
|
## device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_setattr_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to set
|
|
## the attributes of fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_setattr_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dontaudit $1 fixed_disk_device_t:blk_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read from a fixed disk.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_raw_read_fixed_disk',`
|
|
gen_require(`
|
|
attribute fixed_disk_raw_read;
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file read_blk_file_perms;
|
|
allow $1 fixed_disk_device_t:chr_file read_chr_file_perms;
|
|
#577012
|
|
allow $1 fixed_disk_device_t:lnk_file read_lnk_file_perms;
|
|
typeattribute $1 fixed_disk_raw_read;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to read
|
|
## fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_read_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
|
|
')
|
|
|
|
dontaudit $1 fixed_disk_device_t:blk_file read_blk_file_perms;
|
|
dontaudit $1 fixed_disk_device_t:chr_file read_chr_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly write to a fixed disk.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_raw_write_fixed_disk',`
|
|
gen_require(`
|
|
attribute fixed_disk_raw_write;
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file write_blk_file_perms;
|
|
allow $1 fixed_disk_device_t:chr_file write_chr_file_perms;
|
|
typeattribute $1 fixed_disk_raw_write;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to write
|
|
## fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_write_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
|
|
')
|
|
|
|
dontaudit $1 fixed_disk_device_t:blk_file write_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read and write to a fixed disk.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_raw_rw_fixed_disk',`
|
|
storage_raw_read_fixed_disk($1)
|
|
storage_raw_write_fixed_disk($1)
|
|
dev_rw_generic_blk_files($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to watch fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_watch_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file watch_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to create fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_create_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
allow $1 self:capability mknod;
|
|
allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
|
|
allow $1 fixed_disk_device_t:chr_file create_chr_file_perms;
|
|
dev_add_entry_generic_dirs($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to create fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_delete_fixed_disk_dev',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
allow $1 fixed_disk_device_t:blk_file delete_blk_file_perms;
|
|
dev_remove_entry_generic_dirs($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create, read, write, and delete fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_manage_fixed_disk',`
|
|
gen_require(`
|
|
attribute fixed_disk_raw_read, fixed_disk_raw_write;
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 self:capability mknod;
|
|
allow $1 fixed_disk_device_t:blk_file manage_blk_file_perms;
|
|
allow $1 fixed_disk_device_t:chr_file manage_chr_file_perms;
|
|
typeattribute $1 fixed_disk_raw_read, fixed_disk_raw_write;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create block devices in /dev with the fixed disk type
|
|
## via an automatic type transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="filename" optional="true">
|
|
## <summary>
|
|
## Optional filename of the block device to be created
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dev_filetrans_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, $2)
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Create block devices in /dev with the fixed disk type
|
|
## via an automatic type transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dev_filetrans_named_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "jsflash")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "lvm")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megaraid_sas_ioctl_node")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev9")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "device-mapper")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw9")
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create block devices in on a tmpfs filesystem with the
|
|
## fixed disk type via an automatic type transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_tmpfs_filetrans_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
fs_tmpfs_filetrans($1, fixed_disk_device_t, blk_file)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create block devices in on a tmp filesystem with the
|
|
## fixed disk type via an automatic type transition.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_tmp_filetrans_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
files_tmp_filetrans($1, fixed_disk_device_t, blk_file)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Relabel fixed disk device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_relabel_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file relabel_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Enable a fixed disk device as swap space
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_swapon_fixed_disk',`
|
|
gen_require(`
|
|
type fixed_disk_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fixed_disk_device_t:blk_file { getattr swapon };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to get the attributes
|
|
## of device nodes of fuse devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_getattr_fuse_dev',`
|
|
gen_require(`
|
|
type fuse_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 fuse_device_t:chr_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## read or write fuse device interfaces.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_rw_fuse',`
|
|
gen_require(`
|
|
type fuse_device_t;
|
|
')
|
|
|
|
allow $1 fuse_device_t:chr_file rw_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read or write
|
|
## fuse device interfaces.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_rw_fuse',`
|
|
gen_require(`
|
|
type fuse_device_t;
|
|
')
|
|
|
|
dontaudit $1 fuse_device_t:chr_file rw_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to get the attributes of
|
|
## the generic SCSI interface device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_getattr_scsi_generic_dev',`
|
|
gen_require(`
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 scsi_generic_device_t:chr_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to set the attributes of
|
|
## the generic SCSI interface device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_setattr_scsi_generic_dev',`
|
|
gen_require(`
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 scsi_generic_device_t:chr_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read, in a
|
|
## generic fashion, from any SCSI device.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_read_scsi_generic',`
|
|
gen_require(`
|
|
attribute scsi_generic_read;
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 scsi_generic_device_t:chr_file read_chr_file_perms;
|
|
typeattribute $1 scsi_generic_read;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly write, in a
|
|
## generic fashion, from any SCSI device.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_write_scsi_generic',`
|
|
gen_require(`
|
|
attribute scsi_generic_write;
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 scsi_generic_device_t:chr_file write_chr_file_perms;
|
|
typeattribute $1 scsi_generic_write;
|
|
')
|
|
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read and write, in a
|
|
## generic fashion, from any SCSI device.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_rw_inherited_scsi_generic',`
|
|
gen_require(`
|
|
attribute scsi_generic_read;
|
|
attribute scsi_generic_write;
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 scsi_generic_device_t:chr_file rw_inherited_chr_file_perms;
|
|
allow $1 scsi_generic_device_t:chr_file rw_inherited_blk_file_perms;
|
|
typeattribute $1 scsi_generic_write;
|
|
typeattribute $1 scsi_generic_read;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Set attributes of the device nodes
|
|
## for the SCSI generic inerface.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_setattr_scsi_generic_dev_dev',`
|
|
gen_require(`
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 scsi_generic_device_t:chr_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read or write
|
|
## SCSI generic device interfaces.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_rw_scsi_generic',`
|
|
gen_require(`
|
|
type scsi_generic_device_t;
|
|
')
|
|
|
|
dontaudit $1 scsi_generic_device_t:chr_file rw_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to get the attributes of removable
|
|
## devices device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_getattr_removable_dev',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 removable_device_t:blk_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to get
|
|
## the attributes of removable devices device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_getattr_removable_dev',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to read
|
|
## removable devices device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_read_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to write
|
|
## removable devices device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_write_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file write_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to set the attributes of removable
|
|
## devices device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_setattr_removable_dev',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 removable_device_t:blk_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts made by the caller to set
|
|
## the attributes of removable devices device nodes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_setattr_removable_dev',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read from
|
|
## a removable device.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_raw_read_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 removable_device_t:blk_file read_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to directly read removable devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_raw_read_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly write to
|
|
## a removable device.
|
|
## This is extremly dangerous as it can bypass the
|
|
## SELinux protections for filesystem objects, and
|
|
## should only be used by trusted domains.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_raw_write_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 removable_device_t:blk_file write_blk_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to directly write removable devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_dontaudit_raw_write_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file write_blk_file_perms;
|
|
')
|
|
|
|
#######################################
|
|
## <summary>
|
|
## Alow read and write inherited removable devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_rw_inherited_removable_device',`
|
|
gen_require(`
|
|
type removable_device_t;
|
|
')
|
|
|
|
dontaudit $1 removable_device_t:blk_file { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read
|
|
## a tape device.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_read_tape',`
|
|
gen_require(`
|
|
type tape_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 tape_device_t:chr_file read_chr_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to directly read
|
|
## a tape device.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_write_tape',`
|
|
gen_require(`
|
|
type tape_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 tape_device_t:chr_file write_chr_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to get the attributes
|
|
## of device nodes of tape devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_getattr_tape_dev',`
|
|
gen_require(`
|
|
type tape_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 tape_device_t:chr_file getattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the caller to set the attributes
|
|
## of device nodes of tape devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_setattr_tape_dev',`
|
|
gen_require(`
|
|
type tape_device_t;
|
|
')
|
|
|
|
dev_list_all_dev_nodes($1)
|
|
allow $1 tape_device_t:chr_file setattr;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Unconfined access to storage devices.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_unconfined',`
|
|
gen_require(`
|
|
attribute storage_unconfined_type;
|
|
')
|
|
|
|
typeattribute $1 storage_unconfined_type;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create all named devices with the correct label
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`storage_filetrans_all_named_dev',`
|
|
|
|
gen_require(`
|
|
type tape_device_t;
|
|
type fixed_disk_device_t;
|
|
type removable_device_t;
|
|
type scsi_generic_device_t;
|
|
type fuse_device_t;
|
|
')
|
|
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht00")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht01")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht02")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht03")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht04")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht05")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht06")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht07")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht08")
|
|
dev_filetrans($1, tape_device_t, chr_file, "ht09")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st00")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st01")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st02")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st03")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st04")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st05")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st06")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st07")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st08")
|
|
dev_filetrans($1, tape_device_t, chr_file, "st09")
|
|
dev_filetrans($1, tape_device_t, chr_file, "qft0")
|
|
dev_filetrans($1, tape_device_t, chr_file, "qft1")
|
|
dev_filetrans($1, tape_device_t, chr_file, "qft2")
|
|
dev_filetrans($1, tape_device_t, chr_file, "qft3")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst00")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst01")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst02")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst03")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst04")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst05")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst06")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst07")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst08")
|
|
dev_filetrans($1, tape_device_t, chr_file, "osst09")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt0")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt1")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt2")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt3")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt4")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt5")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt6")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt7")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt8")
|
|
dev_filetrans($1, tape_device_t, chr_file, "pt9")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic0")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic1")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic2")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic3")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic4")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic5")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic6")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic7")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic8")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tpqic9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "aztcd")
|
|
dev_filetrans($1, removable_device_t, blk_file, "bpcd")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu4")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu5")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu6")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu7")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu8")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cdu9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm200")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm201")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm202")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm203")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm204")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm205")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm206")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm207")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm208")
|
|
dev_filetrans($1, removable_device_t, blk_file, "cm209")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "bcache9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "md126p1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sda9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdb9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdc9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdd9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sde9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdf9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "sdg9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "dm-9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "gscd")
|
|
dev_filetrans($1, removable_device_t, blk_file, "hitcd")
|
|
dev_filetrans($1, tape_device_t, blk_file, "ht0")
|
|
dev_filetrans($1, tape_device_t, blk_file, "ht1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "hwcdrom")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "initrd")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "jsfd")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "jsflash")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "loop9")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "lvm")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mcd")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mcdx")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megaraid_sas_ioctl_node")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "megadev9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk4")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk5")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk6")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk7")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk8")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mmcblk9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk4")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk5")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk6")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk7")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk8")
|
|
dev_filetrans($1, removable_device_t, blk_file, "mspblk9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "mtd9")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "mtd9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "optcd")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pf0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pf1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pf2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pf3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pg0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pg1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pg2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pg3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pcd0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pcd1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pcd2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "pcd3")
|
|
dev_filetrans($1, removable_device_t, chr_file, "pg0")
|
|
dev_filetrans($1, removable_device_t, chr_file, "pg1")
|
|
dev_filetrans($1, removable_device_t, chr_file, "pg2")
|
|
dev_filetrans($1, removable_device_t, chr_file, "pg3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ps3d9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram10")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram11")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram12")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram13")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram14")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "ram15")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd0")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd1")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd2")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd3")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd4")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd5")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd6")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd7")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd8")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "rd9")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "root")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd4")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd5")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd6")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd7")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd8")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sbpcd9")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg0")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg1")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg2")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg3")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg4")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg5")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg6")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg7")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg8")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg9")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg10")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg11")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg12")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg13")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg14")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg15")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg16")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg17")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg18")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg19")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg20")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg21")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg22")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg23")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg24")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg25")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg26")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg27")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg28")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg29")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg30")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg31")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg32")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg33")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg34")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg35")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg36")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg37")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg38")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg39")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg40")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg41")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg42")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg43")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg44")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg45")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg46")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg47")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg48")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg49")
|
|
dev_filetrans($1, scsi_generic_device_t, chr_file, "sg50")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr0")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr1")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr2")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr3")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr4")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr5")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr6")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr7")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr8")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sr9")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sjcd")
|
|
dev_filetrans($1, removable_device_t, blk_file, "sonycd")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape0")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape1")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape2")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape3")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape4")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape5")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape6")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape7")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape8")
|
|
dev_filetrans($1, tape_device_t, chr_file, "tape9")
|
|
dev_filetrans($1, fuse_device_t, chr_file, "fuse")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "device-mapper")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "raw9")
|
|
dev_filetrans($1, removable_device_t, chr_file, "rio500")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "tw9")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa0")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa1")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa2")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa3")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa4")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa5")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa6")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa7")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa8")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa9")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa10")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa11")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa12")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa13")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa14")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa15")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa16")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa17")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa18")
|
|
dev_filetrans($1, fixed_disk_device_t, chr_file, "twa19")
|
|
dev_filetrans($1, fixed_disk_device_t, blk_file, "zram0")
|
|
')
|