1 files changed, 116 insertions, 0 deletions
diff --git a/src/dev/nodedev.cil b/src/dev/nodedev.cil
new file mode 100644
index 0000000..b681759
--- /dev/null
+++ b/src/dev/nodedev.cil
@@ -0,0 +1,116 @@
+;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
+;; SPDX-License-Identifier: Unlicense
+
+(block nodedev
+
+  (macro type ((type ARG1))
+	 (typeattributeset typeattr ARG1))
+
+  (typeattribute typeattr)
+
+  (macro mounton_all_chr_files ((type ARG1))
+	 (allow ARG1 typeattr mounton_chr_file))
+
+  (blockinherit .file.all_macro_template_chr_files)
+
+  (call .dev.type (typeattr))
+
+  (block base_template
+
+    (blockabstract base_template)
+
+    (context nodedev_context (.sys.id .sys.role nodedev lowlevelrange))
+
+    (type nodedev)
+    (call .nodedev.type (nodedev)))
+
+  (block except
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (blockinherit file.all_macro_template_chr_files)
+
+    (typeattribute typeattr)
+
+    (typeattributeset typeattr
+		      (and nodedev.typeattr (not (exception.typeattr)))))
+
+  (block exception
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (call nodedev.type (typeattr))
+
+    (call .dev.exception.type (typeattr)))
+
+  (block macro_template_chr_files
+
+    (blockabstract macro_template_chr_files)
+
+    (macro append_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev append_chr_file))
+
+    (macro appendinherited_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev appendinherited_chr_file))
+
+    (macro create_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev create_chr_file))
+
+    (macro delete_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev delete_chr_file))
+
+    (macro manage_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev manage_chr_file))
+
+    (macro mapexecute_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev mapexecute_chr_file))
+
+    (macro read_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev read_chr_file))
+
+    (macro readinherited_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev readinherited_chr_file))
+
+    (macro readwrite_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev readwrite_chr_file))
+
+    (macro readwriteinherited_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev readwriteinherited_chr_file))
+
+    (macro relabel_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev relabel_chr_file))
+
+    (macro relabelfrom_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev relabelfrom_chr_file))
+
+    (macro relabelto_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev relabelto_chr_file))
+
+    (macro rename_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev rename_chr_file))
+
+    (macro write_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev write_chr_file))
+
+    (macro writeinherited_nodedev_chr_files ((type ARG1))
+	   (allow ARG1 nodedev writeinherited_chr_file)))
+
+  (block template
+
+    (blockabstract template)
+
+    (blockinherit .nodedev.base_template)
+    (blockinherit .nodedev.macro_template_chr_files))
+
+  (block unconfined
+
+    (macro type ((type ARG1))
+	   (typeattributeset typeattr ARG1))
+
+    (typeattribute typeattr)
+
+    (allow typeattr nodedev.typeattr (chr_file (not (audit_access execmod))))))