commit: fccd438443de08a9d13f8795297efc63f0e6cd19
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Thu Dec 2 18:32:04 2021 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:12:42 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fccd4384
kernel: add filetrans interface for unlabeled dirs
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/kernel/kernel.if | 34 ++++++++++++++++++++++++++++++++++
1 file changed, 34 insertions(+)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 30aca9ae..4cd35959 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -2911,6 +2911,40 @@ interface(`kernel_dontaudit_read_unlabeled_files',`
dontaudit $1 unlabeled_t:file { getattr read };
')
+########################################
+## <summary>
+## Create an object in unlabeled directories
+## with a private type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="private type">
+## <summary>
+## The type of the object to be created.
+## </summary>
+## </param>
+## <param name="object">
+## <summary>
+## The object class of the object being created.
+## </summary>
+## </param>
+## <param name="name" optional="true">
+## <summary>
+## The name of the object being created.
+## </summary>
+## </param>
+#
+interface(`kernel_unlabeled_filetrans',`
+ gen_require(`
+ type unlabeled_t;
+ ')
+
+ filetrans_pattern($1, unlabeled_t, $2, $3, $4)
+')
+
########################################
## <summary>
## Delete unlabeled symbolic links.
