[selinux-policy: 86/3172] add tty_device_t and devpts_t chr_file interfaces

[Daniel J Walsh]

commit de2cee68172ecbe1d586547e080c5f3ff32b2141
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Mon May 2 18:42:10 2005 +0000

    add tty_device_t and devpts_t chr_file interfaces

 refpolicy/policy/modules/kernel/terminal.if |  113 ++++++++++++++++++++-------
 1 files changed, 85 insertions(+), 28 deletions(-)
---
diff --git a/refpolicy/policy/modules/kernel/terminal.if b/refpolicy/policy/modules/kernel/terminal.if
index bf48426..0640dec 100644
--- a/refpolicy/policy/modules/kernel/terminal.if
+++ b/refpolicy/policy/modules/kernel/terminal.if
@@ -27,6 +27,24 @@ devices_list_device_nodes_depend
 
 ########################################
 #
+# terminal_use_all_terminals(domain,[`optional'])
+#
+define(`terminal_use_all_terminals',`
+requires_block_template(terminal_use_all_terminals_depend,$2)
+devices_list_device_nodes($1,optional)
+allow $1 devpts_t:dir { getattr read search };
+allow $1 { console_device_t devtty_t ttynode ptynode }:chr_file { read write };
+')
+
+define(`terminal_use_all_terminals_depend',`
+attribute ttynode, ptynode;
+type console_device_t, devtty_t, devpts_t;
+class chr_file { read write };
+devices_list_device_nodes_depend
+')
+
+########################################
+#
 # terminal_use_console(domain,[`optional'])
 #
 define(`terminal_use_console',`
@@ -89,39 +107,65 @@ devices_list_device_nodes_depend
 
 ########################################
 #
-# terminal_use_all_terminals(domain,[`optional'])
+# terminal_reset_physical_terminal_labels(domain)
 #
-define(`terminal_use_all_terminals',`
-requires_block_template(terminal_use_all_terminals_depend,$2)
-devices_list_device_nodes($1,optional)
-allow $1 devpts_t:dir { getattr read search };
-allow $1 { console_device_t devtty_t ttynode ptynode }:chr_file { read write };
+define(`terminal_reset_physical_terminal_labels',`
+requires_block_template(terminal_reset_physical_terminal_labels_depend)
+devices_list_device_nodes($1)
+allow $1 ttynode:chr_file relabelfrom;
+allow $1 tty_device_t:chr_file relabelto;
 ')
 
-define(`terminal_use_all_terminals_depend',`
-attribute ttynode, ptynode;
-type console_device_t, devtty_t, devpts_t;
-class chr_file { read write };
+define(`terminal_reset_physical_terminal_labels_depend',`
+attribute ttynode;
+type tty_device_t;
+class chr_file { relabelfrom relabelto };
 devices_list_device_nodes_depend
 ')
 
 ########################################
 #
-# terminal_reset_labels(domain,[`optional'])
+# terminal_use_general_physical_terminal(domain)
+#
+define(`terminal_use_general_physical_terminal',`
+requires_block_template(terminal_use_general_physical_terminal_depend)
+devices_list_device_nodes($1)
+allow $1 tty_device_t:chr_file { read write };
+')
+
+define(`terminal_use_general_physical_terminal_depend',`
+type tty_device_t;
+class chr_file { read write };
+')
+
+########################################
 #
-define(`terminal_reset_labels',`
-requires_block_template(terminal_reset_labels_depend,$2)
+# terminal_ignore_use_general_physical_terminal(domain)
+#
+define(`terminal_ignore_use_general_physical_terminal',`
+requires_block_template(terminal_ignore_use_general_physical_terminal_depend)
+dontaudit $1 tty_device_t:chr_file { read write };
+')
+
+define(`terminal_ignore_use_general_physical_terminal_depend',`
+type tty_device_t;
+class chr_file { read write };
+')
+
+########################################
+#
+# terminal_get_user_terminal_attributes(domain,[`optional'])
+#
+define(`terminal_get_user_terminal_attributes',`
+requires_block_template(terminal_get_user_terminal_attributes_depend,$2)
 devices_list_device_nodes($1,optional)
-allow $1 ttynode:chr_file relabelfrom;
-allow $1 tty_device_t:chr_file relabelto;
+allow $1 ttynode:chr_file getattr;
 ')
 
-define(`terminal_reset_labels_depend',`
+define(`terminal_get_user_terminal_attributes_depend',`
 attribute ttynode;
-type tty_device_t;
-class chr_file { relabelfrom relabelto };
+class chr_file getattr;
 devices_list_device_nodes_depend
-kernel_relabeling_privilege_depend
 ')
 
 ########################################
@@ -156,16 +200,29 @@ class dir { getattr search read };
 
 ########################################
 #
-# terminal_get_user_terminal_attributes(domain,[`optional'])
+# terminal_use_general_pseudoterminal(domain)
 #
-define(`terminal_get_user_terminal_attributes',`
-requires_block_template(terminal_get_user_terminal_attributes_depend,$2)
-devices_list_device_nodes($1,optional)
-allow $1 ttynode:chr_file getattr;
+define(`terminal_use_general_pseudoterminal',`
+requires_block_template(terminal_use_general_pseudoterminal_depend)
+devices_list_device_nodes($1)
+allow $1 devpts_t:chr_file { read write };
 ')
 
-define(`terminal_get_user_terminal_attributes_depend',`
-attribute ttynode;
-class chr_file getattr;
-devices_list_device_nodes_depend
+define(`terminal_use_general_pseudoterminal_depend',`
+type devpts_t;
+class chr_file { read write };
+')
+
+########################################
+#
+# terminal_ignore_use_general_pseudoterminal(domain)
+#
+define(`terminal_ignore_use_general_pseudoterminal',`
+requires_block_template(terminal_ignore_use_general_pseudoterminal_depend)
+dontaudit $1 devpts_t:chr_file { read write };
+')
+
+define(`terminal_ignore_use_general_pseudoterminal_depend',`
+type devpts_t;
+class chr_file { read write };
 ')