[selinux-policy: 311/3172] rename
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 19:31:49 UTC 2010
commit eca5b2dd7931d903dff8e632b52b13ad5df95854
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Thu Jun 9 19:22:27 2005 +0000
rename
refpolicy/policy/modules/kernel/bootloader.if | 234 +++++++++++++++++--------
1 files changed, 157 insertions(+), 77 deletions(-)
---
diff --git a/refpolicy/policy/modules/kernel/bootloader.if b/refpolicy/policy/modules/kernel/bootloader.if
index 66bbae6..72ba947 100644
--- a/refpolicy/policy/modules/kernel/bootloader.if
+++ b/refpolicy/policy/modules/kernel/bootloader.if
@@ -34,9 +34,8 @@ define(`bootloader_domtrans_depend',`
########################################
## <interface name="bootloader_run">
## <description>
-## Execute bootloader in the bootloader domain, and
-## allow the specified role the bootloader domain,
-## and use the caller's terminal.
+## Execute bootloader interactively and do
+## a domain transition to the bootloader domain.
## </description>
## <parameter name="domain">
## The type of the process performing this action.
@@ -64,49 +63,68 @@ define(`bootloader_run_depend',`
')
########################################
+## <interface name="bootloader_search_boot_dir">
+## <description>
+## Search the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_search_bootloader_data_directory(domain)
-#
-define(`bootloader_search_bootloader_data_directory',`
+define(`bootloader_search_boot_dir',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir search;
')
-define(`bootloader_search_bootloader_data_directory_depend',`
+define(`bootloader_search_boot_dir_depend',`
type boot_t;
class dir search;
')
########################################
+## <interface name="bootloader_dontaudit_search_boot_dir">
+## <description>
+## Do not audit attempts to search the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_ignore_search_bootloader_data_directory(domain)
-#
-define(`bootloader_ignore_search_bootloader_data_directory',`
+define(`bootloader_dontaudit_search_boot_dir',`
requires_block_template(`$0'_depend)
dontaudit $1 boot_t:dir search;
')
-define(`bootloader_ignore_search_bootloader_data_directory_depend',`
+define(`bootloader_dontaudit_search_boot_dir_depend',`
type boot_t;
class dir search;
')
########################################
+## <interface name="bootloader_rw_boot_symlinks">
+## <description>
+## Read and write symbolic links
+## in the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_modify_bootloader_data_directory_symbolic_links(domain)
-#
-define(`bootloader_modify_bootloader_data_directory_symbolic_links',`
+define(`bootloader_rw_boot_symlinks',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir r_dir_perms;
allow $1 boot_t:lnk_file rw_file_perms;
')
-define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',`
+define(`bootloader_rw_boot_symlinks_depend',`
type boot_t;
class dir r_dir_perms;
@@ -114,30 +132,16 @@ define(`bootloader_modify_bootloader_data_directory_symbolic_links_depend',`
')
########################################
+## <interface name="bootloader_create_kernel">
+## <description>
+## Install a kernel into the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_install_kernel(domain)
-#
-define(`bootloader_install_kernel',`
- requires_block_template(`$0'_depend)
-
- allow $1 boot_t:dir ra_dir_perms;
- allow $1 boot_t:file { getattr read write create };
- allow $1 boot_t:lnk_file { getattr read create unlink };
-')
-
-define(`bootloader_install_kernel_depend',`
- type boot_t;
-
- class dir ra_dir_perms;
- class file { getattr read write create };
- class lnk_file { getattr read create unlink };
-')
-
-########################################
-#
-# bootloader_install_initrd(domain)
-#
-define(`bootloader_install_initrd',`
+define(`bootloader_create_kernel',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir ra_dir_perms;
@@ -145,7 +149,7 @@ define(`bootloader_install_initrd',`
allow $1 boot_t:lnk_file { getattr read create unlink };
')
-define(`bootloader_install_initrd_depend',`
+define(`bootloader_create_kernel_depend',`
type boot_t;
class dir ra_dir_perms;
@@ -154,17 +158,23 @@ define(`bootloader_install_initrd_depend',`
')
########################################
+## <interface name="bootloader_create_kernel_symbol_table">
+## <description>
+## Install a system.map into the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_install_kernel_symbol_table(domain)
-#
-define(`bootloader_install_kernel_symbol_table',`
+define(`bootloader_create_kernel_symbol_table',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir ra_dir_perms;
allow $1 system_map_t:file { rw_file_perms create };
')
-define(`bootloader_install_kernel_symbol_table_depend',`
+define(`bootloader_create_kernel_symbol_table_depend',`
type boot_t, system_map_t;
class dir ra_dir_perms;
@@ -172,8 +182,14 @@ define(`bootloader_install_kernel_symbol_table_depend',`
')
########################################
-#
-# bootloader_read_kernel_symbol_table(domain)
+## <interface name="bootloader_read_kernel_symbol_table">
+## <description>
+## Read system.map in the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
define(`bootloader_read_kernel_symbol_table',`
requires_block_template(`$0'_depend)
@@ -190,17 +206,23 @@ define(`bootloader_read_kernel_symbol_table_depend',`
')
########################################
+## <interface name="bootloader_delete_kernel">
+## <description>
+## Delete a kernel from /boot.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_remove_kernel(domain)
-#
-define(`bootloader_remove_kernel',`
+define(`bootloader_delete_kernel',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { r_dir_perms write remove_name };
allow $1 boot_t:file { getattr unlink };
')
-define(`bootloader_remove_kernel_depend',`
+define(`bootloader_delete_kernel_depend',`
type boot_t;
class dir { r_dir_perms write remove_name };
@@ -208,17 +230,23 @@ define(`bootloader_remove_kernel_depend',`
')
########################################
+## <interface name="bootloader_delete_kernel_symbol_table">
+## <description>
+## Delete a system.map in the /boot directory.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_remove_kernel_symbol_table(domain)
-#
-define(`bootloader_remove_kernel_symbol_table',`
+define(`bootloader_delete_kernel_symbol_table',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir { r_dir_perms write remove_name };
allow $1 system_map_t:file { getattr unlink };
')
-define(`bootloader_remove_kernel_symbol_table_depend',`
+define(`bootloader_delete_kernel_symbol_table_depend',`
type boot_t, system_map_t;
class dir { r_dir_perms write remove_name };
@@ -226,8 +254,14 @@ define(`bootloader_remove_kernel_symbol_table_depend',`
')
########################################
-#
-# bootloader_read_config(domain)
+## <interface name="bootloader_read_config">
+## <description>
+## Read the bootloader configuration file.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
define(`bootloader_read_config',`
requires_block_template(`$0'_depend)
@@ -242,43 +276,64 @@ define(`bootloader_read_config_depend',`
')
########################################
+## <interface name="bootloader_rw_config">
+## <description>
+## Read and write the bootloader
+## configuration file.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_rw_config(domain)
-#
-define(`bootloader_rw_bootloader_config',`
+define(`bootloader_rw_config',`
requires_block_template(`$0'_depend)
allow $1 bootloader_etc_t:file rw_file_perms;
')
-define(`bootloader_rw_bootloader_config_depend',`
+define(`bootloader_rw_config_depend',`
type bootloader_etc_t;
class file rw_file_perms;
')
########################################
+## <interface name="bootloader_rw_tmp_file">
+## <description>
+## Read and write the bootloader
+## temporary data in /tmp.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_rw_temp_data(domain)
-#
-define(`bootloader_rw_temp_data',`
+define(`bootloader_rw_tmp_file',`
requires_block_template(`$0'_depend)
# FIXME: read tmp_t
allow $1 bootloader_tmp_t:file rw_file_perms;
')
-define(`bootloader_rw_temp_data_depend',`
+define(`bootloader_rw_tmp_file_depend',`
type bootloader_tmp_t;
class file rw_file_perms;
')
########################################
+## <interface name="bootloader_create_runtime_file">
+## <description>
+## Read and write the bootloader
+## temporary data in /tmp.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
-# bootloader_create_runtime_data(domain)
-#
-define(`bootloader_create_runtime_data',`
+define(`bootloader_create_runtime_file',`
requires_block_template(`$0'_depend)
allow $1 boot_t:dir rw_dir_perms;
@@ -286,7 +341,7 @@ define(`bootloader_create_runtime_data',`
type_transition $1 boot_t:file boot_runtime_t;
')
-define(`bootloader_create_runtime_data_depend',`
+define(`bootloader_create_runtime_file_depend',`
type boot_t, boot_runtime_t;
class dir rw_dir_perms;
@@ -294,8 +349,14 @@ define(`bootloader_create_runtime_data_depend',`
')
########################################
-#
-# bootloader_list_kernel_modules(domain)
+## <interface name="bootloader_list_kernel_modules">
+## <description>
+## List the contents of the kernel module directories.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
define(`bootloader_list_kernel_modules',`
requires_block_template(`$0'_depend)
@@ -310,8 +371,14 @@ define(`bootloader_list_kernel_modules_depend',`
')
########################################
-#
-# bootloader_read_kernel_modules(domain)
+## <interface name="bootloader_read_kernel_modules">
+## <description>
+## Read kernel module files.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
define(`bootloader_read_kernel_modules',`
requires_block_template(`$0'_depend)
@@ -330,14 +397,20 @@ define(`bootloader_read_kernel_modules_depend',`
')
########################################
-#
-# bootloader_write_kernel_modules(domain)
+## <interface name="bootloader_write_kernel_modules">
+## <description>
+## Write kernel module files.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
define(`bootloader_write_kernel_modules',`
requires_block_template(`$0'_depend)
allow $1 modules_object_t:dir r_dir_perms;
- allow $1 modules_object_t:file write;
+ allow $1 modules_object_t:file { write append };
typeattribute $1 can_modify_kernel_modules;
')
@@ -348,12 +421,19 @@ define(`bootloader_write_kernel_modules_depend',`
type modules_object_t;
class dir r_dir_perms;
- class file write;
+ class file { write append };
')
########################################
-#
-# bootloader_manage_kernel_modules(domain)
+## <interface name="bootloader_manage_kernel_modules">
+## <description>
+## Create, read, write, and delete
+## kernel module files.
+## </description>
+## <parameter name="domain">
+## The type of the process performing this action.
+## </parameter>
+## </interface>
#
define(`bootloader_manage_kernel_modules',`
requires_block_template(`$0'_depend)
More information about the scm-commits
mailing list