src/dev/termdev.cil


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

;; SPDX-FileCopyrightText: © 2023 Dominick Grift <dominick.grift@defensec.nl>
;; SPDX-License-Identifier: Unlicense

(block termdev

  (macro appendinherited_all_chr_files ((type ARG1))
	 (allow ARG1 typeattr appendinherited_chr_file)
	 (allowx ARG1 typeattr FIOCLEX_FIONCLEX_CHRFILE)
	 (allowx ARG1 typeattr IOCTLCONSOLE)
	 (allowx ARG1 typeattr IOCTLTTY_NOT_TIOCSTI)
	 (allowx ARG1 typeattr IOCTLVT))

  (macro readwriteinherited_all_chr_files ((type ARG1))
	 (allow ARG1 typeattr readwriteinherited_chr_file)
	 (allowx ARG1 typeattr FIOCLEX_FIONCLEX_CHRFILE)
	 (allowx ARG1 typeattr IOCTLCONSOLE)
	 (allowx ARG1 typeattr IOCTLTTY_NOT_TIOCSTI)
	 (allowx ARG1 typeattr IOCTLVT))

  (macro type ((type ARG1))
	 (typeattributeset typeattr ARG1))

  (macro writeinherited_all_chr_files ((type ARG1))
	 (allow ARG1 typeattr writeinherited_chr_file)
	 (allowx ARG1 typeattr FIOCLEX_FIONCLEX_CHRFILE)
	 (allowx ARG1 typeattr IOCTLCONSOLE)
	 (allowx ARG1 typeattr IOCTLTTY_NOT_TIOCSTI)
	 (allowx ARG1 typeattr IOCTLVT))

  (typeattribute typeattr)

  (blockinherit .file.all_macro_template_chr_files)

  (call .dev.type (typeattr))

  (block unconfined

    (macro type ((type ARG1))
	   (typeattributeset typeattr ARG1))

    (typeattribute typeattr)

    (allow typeattr termdev.typeattr (chr_file (not (audit_access execmod))))))