diff options
Diffstat (limited to 'src/dev/termdev.cil')
| -rw-r--r-- | src/dev/termdev.cil | 43 |
1 files changed, 43 insertions, 0 deletions
diff --git a/src/dev/termdev.cil b/src/dev/termdev.cil new file mode 100644 index 0000000..93655b3 --- /dev/null +++ b/src/dev/termdev.cil @@ -0,0 +1,43 @@ +;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl> +;; SPDX-License-Identifier: Unlicense + +(block termdev + + (macro appendinherited_all_chr_files ((type ARG1)) + (allow ARG1 typeattr appendinherited_chr_file) + (allowx ARG1 typeattr FIOCLEX_FIONCLEX_CHRFILE) + (allowx ARG1 typeattr IOCTLCONSOLE) + (allowx ARG1 typeattr IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 typeattr IOCTLVT)) + + (macro readwriteinherited_all_chr_files ((type ARG1)) + (allow ARG1 typeattr readwriteinherited_chr_file) + (allowx ARG1 typeattr FIOCLEX_FIONCLEX_CHRFILE) + (allowx ARG1 typeattr IOCTLCONSOLE) + (allowx ARG1 typeattr IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 typeattr IOCTLVT)) + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (macro writeinherited_all_chr_files ((type ARG1)) + (allow ARG1 typeattr writeinherited_chr_file) + (allowx ARG1 typeattr FIOCLEX_FIONCLEX_CHRFILE) + (allowx ARG1 typeattr IOCTLCONSOLE) + (allowx ARG1 typeattr IOCTLTTY_NOT_TIOCSTI) + (allowx ARG1 typeattr IOCTLVT)) + + (typeattribute typeattr) + + (blockinherit .file.all_macro_template_chr_files) + + (call .dev.type (typeattr)) + + (block unconfined + + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (allow typeattr termdev.typeattr (chr_file (not (audit_access execmod)))))) |