## <module name="devices">
## <summary>
##	Device nodes and interfaces for many basic system devices.
## </summary>
## <desc>
##	<p>
##	This module creates the device node concept and provides
##	the policy for many of the device files. Notable exceptions are
##	the mass storage and terminal devices that are covered by other
##	modules.
##	</p>
##	<p>
##	This module creates the concept of a device node. That is a
##	char or block device file, usually in /dev. All types that
##	are used to label device nodes should use the dev_node macro.
##	</p>
##	<p>
##	Additionally, this module controls access to three things:
##		<ul>
##			<li>the device directories containing device nodes</li>
##			<li>device nodes as a group</li>
##			<li>individual access to specific device nodes covered by
##		  	this module.</li>
##		</ul>
##	</p>
## </desc>

########################################
## <interface name="dev_node">
##	<summary>
##		Make the passed in type a type appropriate for
##		use on device nodes (usually files in /dev).
##	</summary>
##	<param name="object_type">
##		The object type that will be used on device nodes.
##	</param>
## </interface>
#
interface(`dev_node',`
	gen_require(`
		attribute device_node;
	')

	typeattribute $1 device_node;

	fs_associate($1)

	optional_policy(`distro_redhat',`
		fs_associate_tmpfs($1)
	')
')

########################################
## <interface name="dev_relabel_all_dev_nodes">
##	<summary>
##		Allow full relabeling (to and from) of all device nodes.
##	</summary>
##	<param name="domain">
##		Domain allowed to relabel.
##	</param>
## </interface>
#
interface(`dev_relabel_all_dev_nodes',`
	gen_require(`
		attribute device_node;
		type device_t;
		class dir { getattr relabelfrom };
		class file { getattr relabelfrom };
		class lnk_file { getattr relabelfrom };
		class fifo_file { getattr relabelfrom };
		class sock_file { getattr relabelfrom };
		class blk_file { getattr relabelfrom relabelto };
		class chr_file { getattr relabelfrom relabelto };
	')

	allow $1 device_node:dir { getattr relabelfrom };
	allow $1 device_node:file { getattr relabelfrom };
	allow $1 device_node:lnk_file { getattr relabelfrom };
	allow $1 device_node:fifo_file { getattr relabelfrom };
	allow $1 device_node:sock_file { getattr relabelfrom };
	allow $1 { device_t device_node }:blk_file { getattr relabelfrom relabelto };
	allow $1 { device_t device_node }:chr_file { getattr relabelfrom relabelto };
')

########################################
## <interface name="dev_list_all_dev_nodes">
##	<summary>
##		List all of the device nodes in a device directory.
##	</summary>
##	<param name="domain">
##		Domain allowed to list device nodes.
##	</param>
## </interface>
#
interface(`dev_list_all_dev_nodes',`
	gen_require(`
		type device_t;
		class dir r_dir_perms;
		class lnk_file { getattr read };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_t:lnk_file { getattr read };
')

########################################
## <interface name="dev_dontaudit_list_all_dev_nodes">
##	<summary>
##		Dontaudit attempts to list all device nodes.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit listing of device nodes.
##	</param>
## </interface>
#
interface(`dev_dontaudit_list_all_dev_nodes',`
	gen_require(`
		type device_t;
		class dir r_dir_perms;
	')

	dontaudit $1 device_t:dir r_dir_perms;
')

########################################
## <interface name="dev_create_dir">
##	<summary>
##		Create a directory in the device directory.
##	</summary>
##	<param name="domain">
##		Domain allowed to create the directory.
##	</param>
## </interface>
#
interface(`dev_create_dir',`
	gen_require(`
		type device_t;
		class dir { ra_dir_perms create };
	')

	allow $1 device_t:dir { ra_dir_perms create };
')

########################################
## <interface name="dev_relabel_dev_dirs">
##	<summary>
##		Allow full relabeling (to and from) of directories in /dev.
##	</summary>
##	<param name="domain">
##		Domain allowed to relabel.
##	</param>
## </interface>
#
interface(`dev_relabel_dev_dirs',`
	gen_require(`
		type device_t;
		class dir { r_dir_perms relabelfrom relabelto };
	')

	allow $1 device_t:dir { r_dir_perms relabelfrom relabelto };
')

########################################
## <interface name="dev_dontaudit_getattr_generic_pipe">
##	<summary>
##		Dontaudit getattr on generic pipes.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_generic_pipe',`
	gen_require(`
		type device_t;
		class fifo_file getattr;
	')

	dontaudit $1 device_t:fifo_file getattr;
')

########################################
## <interface name="dev_getattr_generic_blk_file">
##	<summary>
##		Allow getattr on generic block devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_generic_blk_file',`
	gen_require(`
		type device_t;
		class dir r_dir_perms;
		class blk_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_t:blk_file getattr;
')

########################################
## <interface name="dev_dontaudit_getattr_generic_blk_file">
##	<summary>
##		Dontaudit getattr on generic block devices.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_generic_blk_file',`
	gen_require(`
		type device_t;
		class blk_file getattr;
	')

	dontaudit $1 device_t:blk_file getattr;
')

########################################
## <interface name="dev_dontaudit_setattr_generic_blk_file">
##	<summary>
##		Dontaudit setattr on generic block devices.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_setattr_generic_blk_file',`
	gen_require(`
		type device_t;
		class blk_file setattr;
	')

	dontaudit $1 device_t:blk_file setattr;
')

########################################
## <interface name="dev_manage_generic_blk_file">
##	<summary>
##		Allow read, write, create, and delete for generic
##		block files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_generic_blk_file',`
	gen_require(`
		type device_t;
		class blk_file create_file_perms;
	')

	allow $1 device_t:dir rw_dir_perms;
	allow $1 device_t:blk_file create_file_perms;
')

########################################
## <interface name="dev_create_generic_chr_file">
##	<summary>
##		Allow read, write, and create for generic character device files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_create_generic_chr_file',`
	gen_require(`
		type device_t;
		class dir ra_dir_perms;
		class chr_file create;
		class capability mknod;
	')

	allow $1 device_t:dir ra_dir_perms;
	allow $1 device_t:chr_file create;

	allow $1 self:capability mknod;
')

########################################
## <interface name="dev_getattr_generic_chr_file">
##	<summary>
##		Allow getattr for generic character device files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_generic_chr_file',`
	gen_require(`
		type device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_t:chr_file getattr;
')

########################################
## <interface name="dev_dontaudit_getattr_generic_chr_file">
##	<summary>
##		Dontaudit getattr for generic character device files.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_generic_chr_file',`
	gen_require(`
		type device_t;
		class chr_file getattr;
	')

	dontaudit $1 device_t:chr_file getattr;
')

########################################
## <interface name="dev_dontaudit_setattr_generic_chr_file">
##	<summary>
##		Dontaudit setattr for generic character device files.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_setattr_generic_chr_file',`
	gen_require(`
		type device_t;
		class chr_file setattr;
	')

	dontaudit $1 device_t:chr_file setattr;
')

########################################
## <interface name="dev_del_generic_symlinks">
##	<summary>
##		Delete symbolic links in device directories.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_del_generic_symlinks',`
	gen_require(`
		type device_t;
		class dir { getattr read write remove_name };
		class lnk_file unlink;
	')

	allow $1 device_t:dir { getattr read write remove_name };
	allow $1 device_t:lnk_file unlink;
')

########################################
## <interface name="dev_manage_generic_symlinks">
##	<summary>
##		Create, delete, read, and write symbolic links in device directories.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_generic_symlinks',`
	gen_require(`
		type device_t;
		class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
		class lnk_file { create read getattr setattr link unlink rename };
	')

	allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
	allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };
')

########################################
## <interface name="dev_manage_dev_nodes">
##	<summary>
##		Create, delete, read, and write device nodes in device directories.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_dev_nodes',`
	gen_require(`
		attribute device_node, memory_raw_read, memory_raw_write;
		type device_t;
		class dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
		class sock_file { create ioctl read getattr lock write setattr append link unlink rename };
		class lnk_file { create read getattr setattr link unlink rename };
		class chr_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
		class blk_file { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
	')

	allow $1 device_t:dir { create read getattr lock setattr ioctl link unlink rename search add_name remove_name reparent write rmdir relabelfrom relabelto };
	allow $1 device_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
	allow $1 device_t:lnk_file { create read getattr setattr link unlink rename };
	allow $1 device_t:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };
	allow $1 device_node:{ chr_file blk_file } { create ioctl read getattr lock write setattr append link unlink rename relabelfrom relabelto };

	# these next rules are to satisfy assertions broken by the above lines.
	# the permissions hopefully can be cut back a lot
	storage_raw_read_fixed_disk($1)
	storage_raw_write_fixed_disk($1)
	storage_read_scsi_generic($1)
	storage_write_scsi_generic($1)

	typeattribute $1 memory_raw_read;
	typeattribute $1 memory_raw_write;
')

########################################
## <interface name="dev_dontaudit_rw_generic_dev_nodes">
##	<summary>
##		Dontaudit getattr for generic device files.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_rw_generic_dev_nodes',`
	gen_require(`
		type device_t;
		class chr_file { getattr read write ioctl };
		class blk_file { getattr read write ioctl };
	')

	dontaudit $1 device_t:{ chr_file blk_file } { getattr read write ioctl };
')

########################################
## <interface name="dev_manage_generic_blk_file">
##	<summary>
##		Create, delete, read, and write block device files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_generic_blk_file',`
	gen_require(`
		type device_t;
		class dir rw_dir_perms;
		class blk_file create_file_perms;
	')

	allow $1 device_t:dir rw_dir_perms;
	allow $1 device_t:blk_file create_file_perms;
')

########################################
## <interface name="dev_manage_generic_chr_file">
##	<summary>
##		Create, delete, read, and write character device files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_generic_chr_file',`
	gen_require(`
		type device_t;
		class dir rw_dir_perms;
		class chr_file create_file_perms;
	')

	allow $1 device_t:dir rw_dir_perms;
	allow $1 device_t:chr_file create_file_perms;
')

########################################
## <interface name="dev_create_dev_node">
##	<summary>
##		Create, read, and write device nodes. The node
##		will be transitioned to the type provided.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
##	<param name="file">
##		Type to which the created node will be transitioned.
##	</param>
##	<param name="objectclass(es)">
##		Object class(es) (single or set including {}) for which this
##		the transition will occur.
##	</param>
## </interface>
#
interface(`dev_create_dev_node',`
	gen_require(`
		type device_t;
		class dir rw_dir_perms;
	')

	allow $1 device_t:dir rw_dir_perms;
	type_transition $1 device_t:$3 $2;

	optional_policy(`distro_redhat',`
		fs_associate_tmpfs($2)
	')
')

########################################
## <interface name="dev_getattr_all_blk_files">
##	<summary>
##		Getattr on all block file device nodes.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_all_blk_files',`
	gen_require(`
		attribute device_node;
		class blk_file getattr;
		class dir r_dir_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_node:blk_file getattr;
')

########################################
## <interface name="dev_dontaudit_getattr_all_blk_files">
##	<summary>
##		Dontaudit getattr on all block file device nodes.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_all_blk_files',`
	gen_require(`
		attribute device_node;
		class blk_file getattr;
	')

	allow $1 device_node:blk_file getattr;
')

########################################
## <interface name="dev_getattr_all_chr_files">
##	<summary>
##		Getattr on all character file device nodes.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_all_chr_files',`
	gen_require(`
		attribute device_node;
		class chr_file getattr;
		class dir r_dir_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_node:chr_file getattr;
')

########################################
## <interface name="dev_dontaudit_getattr_all_chr_files">
##	<summary>
##		Dontaudit getattr on all character file device nodes.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_all_chr_files',`
	gen_require(`
		attribute device_node;
		class chr_file getattr;
	')

	dontaudit $1 device_node:chr_file getattr;
')

########################################
## <interface name="dev_setattr_all_blk_files">
##	<summary>
##		Setattr on all block file device nodes.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_all_blk_files',`
	gen_require(`
		attribute device_node;
		class dir r_dir_perms;
		class blk_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_node:blk_file setattr;
')

########################################
## <interface name="dev_setattr_all_chr_files">
##	<summary>
##		Setattr on all character file device nodes.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_all_chr_files',`
	gen_require(`
		attribute device_node;
		class dir r_dir_perms;
		class chr_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 device_node:chr_file setattr;
')

########################################
## <interface name="dev_manage_all_blk_files">
##	<summary>
##		Read, write, create, and delete all block device files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_all_blk_files',`
	gen_require(`
		attribute device_node;
		class dir rw_dir_perms;
		class blk_file create_file_perms;
	')

	allow $1 device_t:dir rw_dir_perms;
	allow $1 device_node:blk_file create_file_perms;

	# these next rules are to satisfy assertions broken by the above lines.
	storage_raw_read_fixed_disk($1)
	storage_raw_write_fixed_disk($1)
	storage_read_scsi_generic($1)
	storage_write_scsi_generic($1)
')

########################################
## <interface name="dev_manage_all_chr_files">
##	<summary>
##		Read, write, create, and delete all character device files.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_manage_all_chr_files',`
	gen_require(`
		attribute device_node, memory_raw_read, memory_raw_write;
		class dir rw_dir_perms;
		class chr_file create_file_perms;
	')

	allow $1 device_t:dir rw_dir_perms;
	allow $1 device_node:chr_file create_file_perms;

	typeattribute $1 memory_raw_read, memory_raw_write;
')

########################################
## <interface name="dev_read_raw_memory">
##	<summary>
##		Read raw memory devices (e.g. /dev/mem).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_raw_memory',`
	gen_require(`
		type device_t, memory_device_t;
		attribute memory_raw_read;
		class dir r_dir_perms;
		class chr_file r_file_perms;
		class capability sys_rawio;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 memory_device_t:chr_file r_file_perms;

	allow $1 self:capability sys_rawio;
	typeattribute $1 memory_raw_read;
')

########################################
## <interface name="dev_write_raw_memory">
##	<summary>
##		Write raw memory devices (e.g. /dev/mem).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_raw_memory',`
	gen_require(`
		type device_t, memory_device_t;
		attribute memory_raw_write;
		class dir r_dir_perms;
		class chr_file write;
		class capability sys_rawio;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 memory_device_t:chr_file write;

	allow $1 self:capability sys_rawio;
	typeattribute $1 memory_raw_write;
')

########################################
## <interface name="dev_rx_raw_memory">
##	<summary>
##		Read and execute raw memory devices (e.g. /dev/mem).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rx_raw_memory',`
	gen_require(`
		type device_t, memory_device_t;
		class chr_file execute;
	')

	dev_read_raw_memory($1)
	allow $1 memory_device_t:chr_file execute;
')

########################################
## <interface name="dev_wx_raw_memory">
##	<summary>
##		Write and execute raw memory devices (e.g. /dev/mem).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_wx_raw_memory',`
	gen_require(`
		type device_t, memory_device_t;
		class chr_file execute;
	')

	dev_write_raw_memory($1)
	allow $1 memory_device_t:chr_file execute;
')

########################################
## <interface name="dev_read_rand">
##	<summary>
##		Read from random devices (e.g., /dev/random)
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_rand',`
	gen_require(`
		type device_t, random_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 random_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_read_urand">
##	<summary>
##		Read from pseudo random devices (e.g., /dev/urandom)
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_urand',`
	gen_require(`
		type device_t, urandom_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 urandom_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_write_rand">
##	<summary>
##		Write to the random device (e.g., /dev/random). This adds
##		entropy used to generate the random data read from the
##		random device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_rand',`
	gen_require(`
		type device_t, random_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 random_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_write_urand">
##	<summary>
##		Write to the pseudo random device (e.g., /dev/urandom). This
##		sets the random number generator seed.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_urand',`
	gen_require(`
		type device_t, urandom_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 urandom_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_rw_null_dev">
##	<summary>
##		Read and write to the null device (/dev/null).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_null_dev',`
	gen_require(`
		type device_t, null_device_t;
		class device_t:dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 null_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_rw_zero_dev">
##	<summary>
##		Read and write to the zero device (/dev/zero).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_zero_dev',`
	gen_require(`
		type device_t, zero_device_t;
		class device_t:dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 zero_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_rwx_zero_dev">
##	<summary>
##		Read, write, and execute the zero device (/dev/zero).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rwx_zero_dev',`
	gen_require(`
		type zero_device_t;
		class chr_file execute;
	')

	dev_rw_zero_dev($1)
	allow $1 zero_device_t:chr_file execute;
')

########################################
## <interface name="dev_read_realtime_clock">
##	<summary>
##		Read the realtime clock (/dev/rtc).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_realtime_clock',`
	gen_require(`
		type device_t, clock_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 clock_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_write_realtime_clock">
##	<summary>
##		Read the realtime clock (/dev/rtc).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_realtime_clock',`
	gen_require(`
		type device_t, clock_device_t;
		class dir r_dir_perms;
		class chr_file { setattr lock write append ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 clock_device_t:chr_file { setattr lock write append ioctl };
')

########################################
## <interface name="dev_rw_realtime_clock">
##	<summary>
##		Read the realtime clock (/dev/rtc).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_realtime_clock',`
	dev_read_realtime_clock($1)
	dev_write_realtime_clock($1)
')

########################################
## <interface name="dev_getattr_snd_dev">
##	<summary>
##		Get the attributes of the sound devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_snd_dev',`
	gen_require(`
		type device_t, sound_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 sound_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_snd_dev">
##	<summary>
##		Set the attributes of the sound devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_snd_dev',`
	gen_require(`
		type device_t, sound_device_t;
		class dir r_dir_perms;
		class chr_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 sound_device_t:chr_file setattr;
')

########################################
## <interface name="dev_read_snd_dev">
##	<summary>
##		Read the sound devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_snd_dev',`
	gen_require(`
		type device_t, sound_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 sound_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_write_snd_dev">
##	<summary>
##		Write the sound devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_snd_dev',`
	gen_require(`
		type device_t, sound_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 sound_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_read_snd_mixer_dev">
##	<summary>
##		Read the sound mixer devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_snd_mixer_dev',`
	gen_require(`
		type device_t, sound_device_t;
		class dir r_dir_perms;
		class chr_file { getattr read ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 sound_device_t:chr_file { getattr read ioctl };
')

########################################
## <interface name="dev_write_snd_mixer_dev">
##	<summary>
##		Write the sound mixer devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_snd_mixer_dev',`
	gen_require(`
		type device_t, sound_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 sound_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_rw_agp_dev">
##	<summary>
##		Read and write the agp devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_agp_dev',`
	gen_require(`
		type device_t, agp_device_t;
		class dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 agp_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_getattr_agp_dev">
##	<summary>
##		Getattr the agp devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_agp_dev',`
	gen_require(`
		type device_t, dri_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 dri_device_t:chr_file getattr;
')

########################################
## <interface name="dev_rw_dri_dev">
##	<summary>
##		Read and write the dri devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_dri_dev',`
	gen_require(`
		type device_t, dri_device_t;
		class dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 dri_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_dontaudit_rw_dri_dev">
##	<summary>
##		Dontaudit read and write on the dri devices.
##	</summary>
##	<param name="domain">
##		Domain to dontaudit access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_rw_dri_dev',`
	gen_require(`
		type dri_device_t;
		class chr_file { getattr read write ioctl };
	')

	dontaudit $1 dri_device_t:chr_file { getattr read write ioctl };
')

########################################
## <interface name="dev_read_mtrr">
##	<summary>
##		Read the mtrr device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_mtrr',`
	gen_require(`
		type device_t, mtrr_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 mtrr_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_write_mtrr">
##	<summary>
##		Write the mtrr device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_mtrr',`
	gen_require(`
		type device_t, mtrr_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 mtrr_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_getattr_framebuffer">
##	<summary>
##		Get the attributes of the framebuffer device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_framebuffer',`
	gen_require(`
		type framebuf_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 framebuf_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_framebuffer">
##	<summary>
##		Set the attributes of the framebuffer device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_framebuffer',`
	gen_require(`
		type framebuf_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 framebuf_device_t:chr_file setattr;
')

########################################
## <interface name="dev_read_framebuffer">
##	<summary>
##		Read the framebuffer device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_framebuffer',`
	gen_require(`
		type framebuf_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 framebuf_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_write_framebuffer">
##	<summary>
##		Write the framebuffer device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_framebuffer',`
	gen_require(`
		type device_t, framebuf_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 framebuf_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_read_lvm_control">
##	<summary>
##		Read the lvm comtrol device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_lvm_control',`
	gen_require(`
		type device_t, lvm_control_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 lvm_control_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_rw_lvm_control">
##	<summary>
##		Read and write the lvm control device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_lvm_control',`
	gen_require(`
		type device_t, lvm_control_t;
		class dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 lvm_control_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_delete_lvm_control">
##	<summary>
##		Delete the lvm control device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_delete_lvm_control',`
	gen_require(`
		type device_t, lvm_control_t;
		class dir { getattr search read write remove_name };
		class chr_file unlink;
	')

	allow $1 device_t:dir { getattr search read write remove_name };
	allow $1 lvm_control_t:chr_file unlink;
')

########################################
## <interface name="dev_getattr_misc">
##	<summary>
##		Get the attributes of miscellaneous devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_misc',`
	gen_require(`
		type device_t, misc_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 misc_device_t:chr_file getattr;
')

########################################
## <interface name="dev_dontaudit_getattr_misc">
##	<summary>
##		Do not audit attempts to get the attributes
##		of miscellaneous devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_misc',`
	gen_require(`
		type misc_device_t;
		class chr_file getattr;
	')

	dontaudit $1 misc_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_misc">
##	<summary>
##		Set the attributes of miscellaneous devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_misc',`
	gen_require(`
		type device_t, misc_device_t;
		class dir r_dir_perms;
		class chr_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 misc_device_t:chr_file setattr;
')

########################################
## <interface name="dev_dontaudit_setattr_misc">
##	<summary>
##		Do not audit attempts to set the attributes
##		of miscellaneous devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_dontaudit_setattr_misc',`
	gen_require(`
		type misc_device_t;
		class chr_file setattr;
	')

	dontaudit $1 misc_device_t:chr_file setattr;
')

########################################
## <interface name="dev_read_misc">
##	<summary>
##		Read miscellaneous devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_misc',`
	gen_require(`
		type device_t, misc_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 misc_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_write_misc">
##	<summary>
##		Write miscellaneous devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_write_misc',`
	gen_require(`
		type device_t, misc_device_t;
		class dir r_dir_perms;
		class chr_file { getattr write ioctl };
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 misc_device_t:chr_file { getattr write ioctl };
')

########################################
## <interface name="dev_getattr_mouse">
##	<summary>
##		Get the attributes of the mouse devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_mouse',`
	gen_require(`
		type device_t, mouse_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 mouse_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_mouse">
##	<summary>
##		Set the attributes of the mouse devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_mouse',`
	gen_require(`
		type device_t, mouse_device_t;
		class dir r_dir_perms;
		class chr_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 mouse_device_t:chr_file setattr;
')

########################################
## <interface name="dev_read_mouse">
##	<summary>
##		Read the mouse devices.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_mouse',`
	gen_require(`
		type device_t, mouse_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 mouse_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_read_input">
##	<summary>
##		Read the multiplexed input device (/dev/input).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_input',`
	gen_require(`
		type device_t, event_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 event_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_read_cpuid">
##	<summary>
##		Read the multiplexed input device (/dev/input).
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_read_cpuid',`
	gen_require(`
		type device_t, cpu_device_t;
		class dir r_dir_perms;
		class chr_file r_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 cpu_device_t:chr_file r_file_perms;
')

########################################
## <interface name="dev_rw_cpu_microcode">
##	<summary>
##		Read and write the the cpu microcode device. This
##		is required to load cpu microcode.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_cpu_microcode',`
	gen_require(`
		type device_t, cpu_device_t;
		class dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 cpu_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_getattr_scanner">
##	<summary>
##		Get the attributes of the scanner device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_scanner',`
	gen_require(`
		type device_t, scanner_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 scanner_device_t:chr_file getattr;
')

########################################
## <interface name="dev_dontaudit_getattr_scanner">
##	<summary>
##		Do not audit attempts to get the attributes of
##		the scanner device.
##	</summary>
##	<param name="domain">
##		Domain to not audit.
##	</param>
## </interface>
#
interface(`dev_dontaudit_getattr_scanner',`
	gen_require(`
		type scanner_device_t;
		class chr_file getattr;
	')

	dontaudit $1 scanner_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_scanner">
##	<summary>
##		Set the attributes of the scanner device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_scanner',`
	gen_require(`
		type device_t, scanner_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 scanner_device_t:chr_file setattr;
')

########################################
## <interface name="dev_dontaudit_setattr_scanner">
##	<summary>
##		Do not audit attempts to set the attributes of
##		the scanner device.
##	</summary>
##	<param name="domain">
##		Domain to not audit.
##	</param>
## </interface>
#
interface(`dev_dontaudit_setattr_scanner',`
	gen_require(`
		type scanner_device_t;
		class chr_file getattr;
	')

	dontaudit $1 scanner_device_t:chr_file setattr;
')

########################################
## <interface name="dev_rw_scanner">
##	<summary>
##		Read and write the scanner device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_scanner',`
	gen_require(`
		type device_t, scanner_device_t;
		class dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 scanner_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_getattr_power_management">
##	<summary>
##		Get the attributes of the the power management device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_getattr_power_management',`
	gen_require(`
		type device_t, power_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 power_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_power_management">
##	<summary>
##		Set the attributes of the the power management device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_setattr_power_management',`
	gen_require(`
		type device_t, power_device_t;
		class dir r_dir_perms;
		class chr_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 power_device_t:chr_file setattr;
')

########################################
## <interface name="dev_rw_power_management">
##	<summary>
##		Read and write the the power management device.
##	</summary>
##	<param name="domain">
##		Domain allowed access.
##	</param>
## </interface>
#
interface(`dev_rw_power_management',`
	gen_require(`
		type device_t, power_device_t;
		class dir r_dir_perms;
		class chr_file rw_file_perms;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 power_device_t:chr_file rw_file_perms;
')

########################################
## <interface name="dev_getattr_sysfs_dir">
##	<summary>
##		Get the attributes of sysfs directories.
##	</summary>
##	<param name="domain">
##		The type of the process performing this action.
##	</param>
## </interface>
#
interface(`dev_getattr_sysfs_dir',`
	gen_require(`
		type sysfs_t;
		class dir getattr;
	')

	allow $1 sysfs_t:dir getattr;
')

########################################
## <interface name="dev_search_sysfs">
##	<summary>
##		Search the directory containing hardware information.
##	</summary>
##	<param name="domain">
##		The type of the process performing this action.
##	</param>
## </interface>
#
interface(`dev_search_sysfs',`
	gen_require(`
		type sysfs_t;
		class dir search;
	')

	allow $1 sysfs_t:dir search;
')

########################################
## <interface name="dev_read_sysfs">
##	<summary>
## 		Allow caller to read hardware state information.
##	</summary>
##	<param name="domain">
##		The process type reading hardware state information.
##	</param>
## </interface>
#
interface(`dev_read_sysfs',`
	gen_require(`
		type sysfs_t;
		class dir r_dir_perms;
		class file r_file_perms;
		class lnk_file r_file_perms;
	')

	allow $1 sysfs_t:dir r_dir_perms;
	allow $1 sysfs_t:{ file lnk_file } r_file_perms;
')

########################################
## <interface name="dev_rw_sysfs">
##	<summary>
## 		Allow caller to modify hardware state information.
##	</summary>
##	<param name="domain">
##		The process type modifying hardware state information.
##	</param>
## </interface>
#
interface(`dev_rw_sysfs',`
	gen_require(`
		type sysfs_t;
		class dir r_dir_perms;
		class file rw_file_perms;
		class lnk_file r_file_perms;
	')

	allow $1 sysfs_t:dir r_dir_perms;
	allow $1 sysfs_t:lnk_file r_file_perms;
	allow $1 sysfs_t:file rw_file_perms;
')

########################################
## <interface name="dev_search_usbfs">
##	<summary>
##		Search the directory containing USB hardware information.
##	</summary>
##	<param name="domain">
##		The type of the process performing this action.
##	</param>
## </interface>
#
interface(`dev_search_usbfs',`
	gen_require(`
		type usbfs_t;
		class dir search;
	')

	allow $1 usbfs_t:dir search;
')

########################################
## <interface name="dev_list_usbfs">
##	<summary>
## 		Allow caller to get a list of usb hardware.
##	</summary>
##	<param name="domain">
##		The process type getting the list.
##	</param>
## </interface>
#
interface(`dev_list_usbfs',`
	gen_require(`
		type usbfs_t;
		class dir r_dir_perms;
		class file getattr;
		class lnk_file r_file_perms;
	')

	allow $1 usbfs_t:dir r_dir_perms;
	allow $1 usbfs_t:lnk_file r_file_perms;
	allow $1 usbfs_t:file getattr;
')

########################################
## <interface name="dev_read_usbfs">
##	<summary>
##		Read USB hardware information using
##		the usbfs filesystem interface.
##	</summary>
##	<param name="domain">
##		The type of the process performing this action.
##	</param>
## </interface>
#
interface(`dev_read_usbfs',`
	gen_require(`
		type usbfs_t;
		class dir r_dir_perms;
		class file r_file_perms;
		class lnk_file r_file_perms;
	')

	allow $1 usbfs_t:dir r_dir_perms;
	allow $1 usbfs_t:{ file lnk_file } r_file_perms;
')

########################################
## <interface name="dev_rw_usbfs">
##	<summary>
## 		Allow caller to modify usb hardware configuration files.
##	</summary>
##	<param name="domain">
##		The process type modifying the options.
##	</param>
## </interface>
#
interface(`dev_rw_usbfs',`
	gen_require(`
		type usbfs_t;
		class dir r_dir_perms;
		class file rw_file_perms;
		class lnk_file r_file_perms;
	')

	allow $1 usbfs_t:dir r_dir_perms;
	allow $1 usbfs_t:lnk_file r_file_perms;
	allow $1 usbfs_t:file rw_file_perms;
')

########################################
## <interface name="dev_getattr_video_dev">
##	<summary>
## 		Get the attributes of video4linux devices.
##	</summary>
##	<param name="domain">
##		The process type modifying the options.
##	</param>
## </interface>
#
interface(`dev_getattr_video_dev',`
	gen_require(`
		type device_t, v4l_device_t;
		class dir r_dir_perms;
		class chr_file getattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 v4l_device_t:chr_file getattr;
')

########################################
## <interface name="dev_setattr_video_dev">
##	<summary>
## 		Set the attributes of video4linux devices.
##	</summary>
##	<param name="domain">
##		The process type modifying the options.
##	</param>
## </interface>
#
interface(`dev_setattr_video_dev',`
	gen_require(`
		type device_t, v4l_device_t;
		class dir r_dir_perms;
		class chr_file setattr;
	')

	allow $1 device_t:dir r_dir_perms;
	allow $1 v4l_device_t:chr_file setattr;
')

## </module>