Layer: kernel

Module: devices

Description:

This module creates the device node concept and provides the policy for many of the device files. Notable exceptions are the mass storage and terminal devices that are covered by other modules.

This module creates the concept of a device node. That is a char or block device file, usually in /dev. All types that are used to label device nodes should use the dev_node macro.

Additionally, this module controls access to three things:

the device directories containing device nodes

device nodes as a group

individual access to specific device nodes covered by this module.

This module is required to be included in all policies.

Interfaces:

dev_add_entry_generic_dirs(
	
		domain
		
	)

Summary

Add entries to directories in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_append_printer(
	
		domain
		
	)

Summary

Append the printer device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_associate(
	
		file_type
		
	)

Summary

Associate the specified file type with device filesystem.

Parameters

Parameter:	Description:
file_type	The type of the file to be associated.

dev_associate_sysfs(
	
		file_type
		
	)

Summary

Associate a file to a sysfs filesystem.

Parameters

Parameter:	Description:
file_type	The type of the file to be associated to sysfs.

dev_associate_usbfs(
	
		file_type
		
	)

Summary

Associate a file to a usbfs filesystem.

Parameters

Parameter:	Description:
file_type	The type of the file to be associated to usbfs.

dev_create_all_blk_files(
	
		domain
		
	)

Summary

Create all block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_all_chr_files(
	
		domain
		
	)

Summary

Create all character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_cardmgr_dev(
	
		domain
		
	)

Summary

Create, read, write, and delete the PCMCIA card manager device with the correct type.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_generic_blk_files(
	
		domain
		
	)

Summary

Create generic block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_generic_chr_files(
	
		domain
		
	)

Summary

Create generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_generic_dirs(
	
		domain
		
	)

Summary

Create a directory in the device directory.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_generic_symlinks(
	
		domain
		
	)

Summary

Create symbolic links in device directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_null_dev(
	
		domain
		
	)

Summary

Create the null device (/dev/null).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_rand_dev(
	
		domain
		
	)

Summary

Create the random device (/dev/random).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_sysfs_files(
	
		domain
		
	)

Summary

Add a sysfs file

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_urand_dev(
	
		domain
		
	)

Summary

Create the urandom device (/dev/urandom).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_create_zero_dev(
	
		domain
		
	)

Summary

Create the zero device (/dev/zero).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_all_blk_files(
	
		domain
		
	)

Summary

Delete all block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_all_chr_files(
	
		domain
		
	)

Summary

Delete all character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_generic_blk_files(
	
		domain
		
	)

Summary

Delete generic block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_generic_chr_files(
	
		domain
		
	)

Summary

Delete generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_generic_dirs(
	
		domain
		
	)

Summary

Delete a directory in the device directory.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_generic_files(
	
		domain
		
	)

Summary

Delete generic files in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_generic_symlinks(
	
		domain
		
	)

Summary

Delete symbolic links in device directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_lvm_control_dev(
	
		domain
		
	)

Summary

Delete the lvm control device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_delete_null(
	
		domain
		
	)

Summary

Delete the null device (/dev/null).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_dontaudit_append_rand(
	
		domain
		
	)

Summary

Do not audit attempts to append to random number generator devices (e.g., /dev/random)

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_acpi_bios_dev(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of the apm bios device node.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_all_blk_files(
	
		domain
		
	)

Summary

Dontaudit getattr on all block file device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_all_chr_files(
	
		domain
		
	)

Summary

Dontaudit getattr on all character file device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_autofs_dev(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of the autofs device node.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_generic_blk_files(
	
		domain
		
	)

Summary

Dontaudit getattr on generic block devices.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_generic_chr_files(
	
		domain
		
	)

Summary

Dontaudit getattr for generic character device files.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_generic_files(
	
		domain
		
	)

Summary

dontaudit getattr generic files in /dev.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_generic_pipes(
	
		domain
		
	)

Summary

Dontaudit getattr on generic pipes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_memory_dev(
	
		domain
		
	)

Summary

dontaudit getattr raw memory devices (e.g. /dev/mem).

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_misc_dev(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_nvram_dev(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of the BIOS non-volatile RAM device.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_scanner_dev(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of the scanner device.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_smartcard_dev(
	
		domain
		
	)

Summary

dontaudit getattr on smartcard devices

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_sysfs(
	
		domain
		
	)

Summary

Do not audit getting the attributes of sysfs filesystem

Parameters

Parameter:	Description:
domain	Domain to dontaudit access from

dev_dontaudit_getattr_usbfs_dirs(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of a directory in the usb filesystem.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_getattr_video_dev(
	
		domain
		
	)

Summary

Do not audit attempts to get the attributes of video4linux device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_list_all_dev_nodes(
	
		domain
		
	)

Summary

Dontaudit attempts to list all device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_all_blk_files(
	
		domain
		
	)

Summary

Dontaudit read on all block file device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_all_chr_files(
	
		domain
		
	)

Summary

Dontaudit read on all character file device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_framebuffer(
	
		domain
		
	)

Summary

Do not audit attempts to read the framebuffer.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_kmsg(
	
		domain
		
	)

Summary

Do not audit attempts to read the kernel messages

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_rand(
	
		domain
		
	)

Summary

Do not audit attempts to read from random number generator devices (e.g., /dev/random)

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_raw_memory(
	
		domain
		
	)

Summary

Do not audit attempts to read raw memory devices (e.g. /dev/mem). This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_read_sysfs(
	
		domain
		
	)

Summary

Dont audit attempts to read hardware state information

Parameters

Parameter:	Description:
domain	Domain for which the attempts do not need to be audited

dev_dontaudit_read_urand(
	
		domain
		
	)

Summary

Do not audit attempts to read from pseudo random devices (e.g., /dev/urandom)

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_rw_cardmgr(
	
		domain
		
	)

Summary

Do not audit attempts to read and write the PCMCIA card manager device.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_rw_dri(
	
		domain
		
	)

Summary

Dontaudit read and write on the dri devices.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_rw_generic_chr_files(
	
		domain
		
	)

Summary

Dontaudit attempts to read/write generic character device files.

Parameters

Parameter:	Description:
domain	Domain to dontaudit access.

dev_dontaudit_rw_generic_dev_nodes(
	
		domain
		
	)

Summary

Dontaudit getattr for generic device files.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_rw_lvm_control(
	
		domain
		
	)

Summary

Do not audit attempts to read and write lvm control device.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_rw_misc(
	
		domain
		
	)

Summary

Do not audit attempts to read and write miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_dontaudit_search_sysfs(
	
		domain
		
	)

Summary

Do not audit attempts to search sysfs.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_acpi_bios_dev(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of the apm bios device node.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_autofs_dev(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of the autofs device node.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_framebuffer_dev(
	
		domain
		
	)

Summary

Dot not audit attempts to set the attributes of the framebuffer device node.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_generic_blk_files(
	
		domain
		
	)

Summary

Dontaudit setattr on generic block devices.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_generic_chr_files(
	
		domain
		
	)

Summary

Dontaudit setattr for generic character device files.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_generic_symlinks(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of symbolic links in device directories (/dev).

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_misc_dev(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_null_dev(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of the null device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_scanner_dev(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of the scanner device.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_setattr_video_dev(
	
		domain
		
	)

Summary

Do not audit attempts to set the attributes of video4linux device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_write_all_blk_files(
	
		domain
		
	)

Summary

Dontaudit write on all block file device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_write_all_chr_files(
	
		domain
		
	)

Summary

Dontaudit write on all character file device nodes.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_write_mtrr(
	
		domain
		
	)

Summary

Do not audit attempts to write the memory type range registers (MTRR).

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_write_sysfs_dirs(
	
		domain
		
	)

Summary

Do not audit attempts to write in a sysfs directory.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_dontaudit_write_sysfs_files(
	
		domain
		
	)

Summary

Do not audit attempts to write to a sysfs file.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_execmod_zero(
	
		domain
		
	)

Summary

Execmod the zero device (/dev/zero).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_filetrans(
	
		domain
		
			,
		
		file_type
		
			,
		
		objectclass(es)
		
			,
		
		name
		
	)

Summary

Create, read, and write device nodes. The node will be transitioned to the type provided.

Parameters

Parameter:	Description:
domain	Domain allowed access.
file_type	Type to which the created node will be transitioned.
objectclass(es)	Object class(es) (single or set including {}) for which this the transition will occur.
name	The name of the object being created.

dev_filetrans_cardmgr(
	
		domain
		
			,
		
		name
		
	)

Summary

Automatic type transition to the type for PCMCIA card manager device nodes when created in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.
name	The name of the object being created.

dev_filetrans_dri(
	
		domain
		
			,
		
		name
		
	)

Summary

Automatic type transition to the type for DRI device nodes when created in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.
name	The name of the object being created.

dev_filetrans_input_dev(
	
		domain
		
			,
		
		name
		
	)

Summary

Automatic type transition to the type for event device nodes when created in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.
name	The name of the object being created.

dev_filetrans_lirc(
	
		domain
		
			,
		
		name
		
	)

Summary

Automatic type transition to the type for lirc device nodes when created in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.
name	The name of the object being created.

dev_filetrans_xen(
	
		domain
		
			,
		
		name
		
	)

Summary

Automatic type transition to the type for xen device nodes when created in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.
name	The name of the object being created.

dev_getattr_acpi_bios_dev(
	
		domain
		
	)

Summary

Get the attributes of the apm bios device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_agp_dev(
	
		domain
		
	)

Summary

Getattr the agp devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_all_blk_files(
	
		domain
		
	)

Summary

Getattr on all block file device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_all_chr_files(
	
		domain
		
	)

Summary

Getattr on all character file device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_autofs_dev(
	
		domain
		
	)

Summary

Get the attributes of the autofs device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_cpu_dev(
	
		domain
		
	)

Summary

Get the attributes of the CPU microcode and id interfaces.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_dri_dev(
	
		domain
		
	)

Summary

getattr the dri devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_framebuffer_dev(
	
		domain
		
	)

Summary

Get the attributes of the framebuffer device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_fs(
	
		domain
		
	)

Summary

Get attributes of device filesystems.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_generic_blk_files(
	
		domain
		
	)

Summary

Allow getattr on generic block devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_generic_chr_files(
	
		domain
		
	)

Summary

Allow getattr for generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_generic_usb_dev(
	
		domain
		
	)

Summary

Getattr generic the USB devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_input_dev(
	
		domain
		
	)

Summary

Get the attributes of the event devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_ksm_dev(
	
		domain
		
	)

Summary

Get the attributes of the ksm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_kvm_dev(
	
		domain
		
	)

Summary

Get the attributes of the kvm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_lvm_control(
	
		domain
		
	)

Summary

Get the attributes of the lvm comtrol device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_misc_dev(
	
		domain
		
	)

Summary

Get the attributes of miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_modem_dev(
	
		domain
		
	)

Summary

Get the attributes of the modem devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_mouse_dev(
	
		domain
		
	)

Summary

Get the attributes of the mouse devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_mtrr_dev(
	
		domain
		
	)

Summary

Get the attributes of the memory type range registers (MTRR) device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_null_dev(
	
		domain
		
	)

Summary

Get the attributes of the null device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_pmqos_dev(
	
		domain
		
	)

Summary

Get the attributes of PM QoS devices

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_power_mgmt_dev(
	
		domain
		
	)

Summary

Get the attributes of the the power management device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_printer_dev(
	
		domain
		
	)

Summary

Get the attributes of the printer device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_qemu_dev(
	
		domain
		
	)

Summary

Get the attributes of the QEMU microcode and id interfaces.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_scanner_dev(
	
		domain
		
	)

Summary

Get the attributes of the scanner device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_smartcard_dev(
	
		domain
		
	)

Summary

Getattr on smartcard devices

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_sound_dev(
	
		domain
		
	)

Summary

Get the attributes of the sound devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_sysfs(
	
		domain
		
	)

Summary

Get the attributes of sysfs filesystem

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_sysfs_dirs(
	
		domain
		
	)

Summary

Get the attributes of sysfs directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_usbfs_dirs(
	
		domain
		
	)

Summary

Get the attributes of a directory in the usb filesystem.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_video_dev(
	
		domain
		
	)

Summary

Get the attributes of video4linux devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_getattr_xserver_misc_dev(
	
		domain
		
	)

Summary

Get the attributes of X server miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_ioctl_dri_dev(
	
		domain
		
	)

Summary

IOCTL the dri devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_ioctl_input_dev(
	
		domain
		
	)

Summary

IOCTL the input event devices (/dev/input).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_list_all_dev_nodes(
	
		domain
		
	)

Summary

List all of the device nodes in a device directory.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_list_sysfs(
	
		domain
		
	)

Summary

List the contents of the sysfs directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_list_usbfs(
	
		domain
		
	)

Summary

Allow caller to get a list of usb hardware.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_all_blk_files(
	
		domain
		
	)

Summary

Read, write, create, and delete all block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_all_chr_files(
	
		domain
		
	)

Summary

Read, write, create, and delete all character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_all_dev_nodes(
	
		domain
		
	)

Summary

Create, delete, read, and write device nodes in device directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_cardmgr_dev(
	
		domain
		
	)

Summary

Create, read, write, and delete the PCMCIA card manager device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_dri_dev(
	
		domain
		
	)

Summary

Create, read, write, and delete the dri devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_generic_blk_files(
	
		domain
		
	)

Summary

Create, delete, read, and write block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_generic_chr_files(
	
		domain
		
	)

Summary

Create, delete, read, and write character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_generic_dirs(
	
		domain
		
	)

Summary

Manage of directories in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_generic_files(
	
		domain
		
	)

Summary

Create a file in the device directory.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_generic_symlinks(
	
		domain
		
	)

Summary

Create, delete, read, and write symbolic links in device directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_input_dev(
	
		domain
		
	)

Summary

Create, read, write, and delete input event devices (/dev/input).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_null_service(
	
		domain
		
	)

Summary

Manage services with script type null_device_t for when /lib/systemd/system/something.service is a link to /dev/null

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_smartcard(
	
		domain
		
	)

Summary

Create, read, write, and delete smartcard devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_sysfs_dirs(
	
		domain
		
	)

Summary

Create, read, write, and delete sysfs directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_wireless(
	
		domain
		
	)

Summary

manage the wireless device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_manage_xen(
	
		domain
		
	)

Summary

Create, read, write, and delete Xen devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_map_xserver_misc(
	
		domain
		
	)

Summary

Map X server miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_mount_sysfs(
	
		domain
		
	)

Summary

mount a sysfs filesystem

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_mount_usbfs(
	
		domain
		
	)

Summary

Mount a usbfs filesystem.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_mounton(
	
		domain
		
	)

Summary

Mount a filesystem on /dev

Parameters

Parameter:	Description:
domain	Domain allow access.

dev_mounton_kmsg(
	
		domain
		
	)

Summary

Mount on the kernel messages device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_mounton_sysfs(
	
		domain
		
	)

Summary

Mount a filesystem on sysfs. (Deprecated)

Parameters

Parameter:	Description:
domain	Domain allow access.

dev_mounton_sysfs_dirs(
	
		domain
		
	)

Summary

Mount on sysfs directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_node(
	
		type
		
	)

Summary

Make the specified type usable for device nodes in a filesystem.

Description

Make the specified type usable for device nodes in a filesystem. Types used for device nodes that do not use this interface, or an interface that calls this one, will have unexpected behaviors while the system is running.

Example:

type mydev_t; dev_node(mydev_t) allow mydomain_t mydev_t:chr_file read_chr_file_perms;

Related interfaces:

term_tty()

term_pty()

Parameters

Parameter:	Description:
type	Type to be used for device nodes.

dev_read_cpu_online(
	
		domain
		
	)

Summary

Read cpu online hardware state information

Description

Allow the specified domain to read /sys/devices/system/cpu/online

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_cpuid(
	
		domain
		
	)

Summary

Read the CPU identity.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_crash(
	
		domain
		
	)

Summary

Read the kernel crash device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_framebuffer(
	
		domain
		
	)

Summary

Read the framebuffer.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_generic_chr_files(
	
		domain
		
	)

Summary

Read generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_generic_files(
	
		domain
		
	)

Summary

Read generic files in /dev.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_read_generic_symlinks(
	
		domain
		
	)

Summary

Read symbolic links in device directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_generic_usb_dev(
	
		domain
		
	)

Summary

Read generic the USB devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_input(
	
		domain
		
	)

Summary

Read input event devices (/dev/input).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_kmsg(
	
		domain
		
	)

Summary

Read the kernel messages

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_ksm(
	
		domain
		
	)

Summary

Read the ksm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_kvm(
	
		domain
		
	)

Summary

Read the kvm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_lirc(
	
		domain
		
	)

Summary

Read the lirc device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_lvm_control(
	
		domain
		
	)

Summary

Read the lvm comtrol device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_misc(
	
		domain
		
	)

Summary

Read miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_modem(
	
		domain
		
	)

Summary

Read the modem devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_mouse(
	
		domain
		
	)

Summary

Read the mouse devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_pmqos(
	
		domain
		
	)

Summary

Read the PM QoS devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_qemu(
	
		domain
		
	)

Summary

Read the QEMU device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_rand(
	
		domain
		
	)

Summary

Read from random number generator devices (e.g., /dev/random).

Description

Allow the specified domain to read from random number generator devices (e.g., /dev/random). Typically this is used in situations when a cryptographically secure random number is needed.

Related interface:

dev_read_urand()

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_raw_memory(
	
		domain
		
	)

Summary

Read raw memory devices (e.g. /dev/mem). This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_raw_memory_cond(
	
		domain
		
			,
		
		tunable
		
	)

Summary

Read raw memory devices (e.g. /dev/mem) if a tunable is set. This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.
tunable	Tunable to depend on

dev_read_realtime_clock(
	
		domain
		
	)

Summary

Read the realtime clock (/dev/rtc).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_sound(
	
		domain
		
	)

Summary

Read the sound devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_sound_mixer(
	
		domain
		
	)

Summary

Read the sound mixer devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_sysfs(
	
		domain
		
	)

Summary

Read hardware state information.

Description

Allow the specified domain to read the contents of the sysfs filesystem. This filesystem contains information, parameters, and other settings on the hardware installed on the system.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_urand(
	
		domain
		
	)

Summary

Read from pseudo random number generator devices (e.g., /dev/urandom).

Description

Allow the specified domain to read from pseudo random number generator devices (e.g., /dev/urandom). Typically this is used in situations when a cryptographically secure random number is not necessarily needed. One example is the Stack Smashing Protector (SSP, formerly known as ProPolice) support that may be compiled into programs.

Related interface:

dev_read_rand()

Related tunable:

global_ssp

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_usbfs(
	
		domain
		
	)

Summary

Read USB hardware information using the usbfs filesystem interface.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_usbmon_dev(
	
		domain
		
	)

Summary

Read USB monitor devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_video_dev(
	
		domain
		
	)

Summary

Read the video4linux devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_watchdog(
	
		domain
		
	)

Summary

Read from watchdog devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_read_wireless(
	
		domain
		
	)

Summary

Read the wireless device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_all_dev_files(
	
		domain
		
	)

Summary

Allow full relabeling (to and from) of all device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_all_dev_nodes(
	
		domain
		
	)

Summary

Allow full relabeling (to and from) of all device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_all_sysfs(
	
		domain
		
	)

Summary

Relabel from/to all sysfs types.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_autofs_dev(
	
		domain
		
	)

Summary

Relabel the autofs device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_generic_dev_dirs(
	
		domain
		
	)

Summary

Allow full relabeling (to and from) of directories in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_generic_symlinks(
	
		domain
		
	)

Summary

Relabel symbolic links in device directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_generic_usb_dev(
	
		domain
		
	)

Summary

Relabel generic the USB devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabel_sysfs_dirs(
	
		domain
		
	)

Summary

Relabel hardware state directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabelfrom_generic_chr_files(
	
		domain
		
	)

Summary

Relabel from generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_relabelfrom_vfio_dev(
	
		domain
		
	)

Summary

Relabel vfio devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_remount_fs(
	
		domain
		
	)

Summary

Remount device filesystems.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_remount_sysfs(
	
		domain
		
	)

Summary

Remount a sysfs filesystem.

Parameters

Parameter:	Description:
domain	Domain allow access.

dev_remove_entry_generic_dirs(
	
		domain
		
	)

Summary

Remove entries from directories in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rename_all_blk_files(
	
		domain
		
	)

Summary

Rename all block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rename_all_chr_files(
	
		domain
		
	)

Summary

Rename all character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_acpi_bios(
	
		domain
		
	)

Summary

Read and write the apm bios.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_agp(
	
		domain
		
	)

Summary

Read and write the agp devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_autofs(
	
		domain
		
	)

Summary

Read and write the autofs device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_cachefiles(
	
		domain
		
	)

Summary

Read and write cachefiles character device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_cardmgr(
	
		domain
		
	)

Summary

Read and write the PCMCIA card manager device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_cpu_microcode(
	
		domain
		
	)

Summary

Read and write the the CPU microcode device. This is required to load CPU microcode.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_crypto(
	
		domain
		
	)

Summary

Read and write the the hardware SSL accelerator.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_dlm_control(
	
		domain
		
	)

Summary

Read and write the the dlm control device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_dri(
	
		domain
		
	)

Summary

Read and write the dri devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_framebuffer(
	
		domain
		
	)

Summary

Read and write the framebuffer.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_generic_blk_files(
	
		domain
		
	)

Summary

Read and write generic block device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_generic_chr_files(
	
		domain
		
	)

Summary

Read and write generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_generic_files(
	
		domain
		
	)

Summary

Read and write generic files in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_generic_usb_dev(
	
		domain
		
	)

Summary

Read and write generic the USB devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_hyperv_kvp(
	
		domain
		
	)

Summary

Allow read/write the hypervkvp device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_hyperv_vss(
	
		domain
		
	)

Summary

Allow read/write the hypervvssd device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_infiniband(
	
		domain
		
	)

Summary

Allow read/write access to InfiniBand devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_input_dev(
	
		domain
		
	)

Summary

Read and write input event devices (/dev/input).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_ipmi_dev(
	
		domain
		
	)

Summary

Read and write ipmi devices (/dev/ipmi*).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_kmsg(
	
		domain
		
	)

Summary

Read and write to the kernel messages device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_ksm(
	
		domain
		
	)

Summary

Read and write to ksm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_kvm(
	
		domain
		
	)

Summary

Read and write to kvm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_lirc(
	
		domain
		
	)

Summary

Read and write the lirc device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_loop_control(
	
		domain
		
	)

Summary

Read and write the loop-control device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_lvm_control(
	
		domain
		
	)

Summary

Read and write the lvm control device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_mei_device(
	
		domain
		
	)

Summary

Read and write the Intel mei control device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_modem(
	
		domain
		
	)

Summary

Read and write to modem devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_mouse(
	
		domain
		
	)

Summary

Read and write to mouse devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_mtrr(
	
		domain
		
	)

Summary

Read and write the memory type range registers (MTRR).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_null(
	
		domain
		
	)

Summary

Read and write to the null device (/dev/null).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_nvram(
	
		domain
		
	)

Summary

Read and write BIOS non-volatile RAM.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_pmqos(
	
		domain
		
	)

Summary

Read and write the the PM QoS devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_power_management(
	
		domain
		
	)

Summary

Read and write the the power management device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_printer(
	
		domain
		
	)

Summary

Read and write the printer device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_qemu(
	
		domain
		
	)

Summary

Read and write the the QEMU device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_realtime_clock(
	
		domain
		
	)

Summary

Read and set the realtime clock (/dev/rtc).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_scanner(
	
		domain
		
	)

Summary

Read and write the scanner device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_smartcard(
	
		domain
		
	)

Summary

Read and write smartcard devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_sysdig(
	
		domain
		
	)

Summary

Read, write and map the sysdig device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_sysfs(
	
		domain
		
	)

Summary

Allow caller to modify hardware state information.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_tpm(
	
		domain
		
	)

Summary

Read and write the TPM device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_usbfs(
	
		domain
		
	)

Summary

Allow caller to modify usb hardware configuration files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_userio_dev(
	
		domain
		
	)

Summary

Read and write userio device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_vfio_dev(
	
		domain
		
	)

Summary

Read and write vfio devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_vhost(
	
		domain
		
	)

Summary

Allow read/write the vhost devices

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_vmware(
	
		domain
		
	)

Summary

Read and write VMWare devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_wireless(
	
		domain
		
	)

Summary

Read and write the the wireless device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_xen(
	
		domain
		
	)

Summary

Read and write Xen devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_xserver_misc(
	
		domain
		
	)

Summary

Read and write X server miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rw_zero(
	
		domain
		
	)

Summary

Read and write to the zero device (/dev/zero).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rwx_vmware(
	
		domain
		
	)

Summary

Read, write, and mmap VMWare devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rwx_zero(
	
		domain
		
	)

Summary

Read, write, and execute the zero device (/dev/zero).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_rx_raw_memory(
	
		domain
		
	)

Summary

Read and execute raw memory devices (e.g. /dev/mem). This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_search_sysfs(
	
		domain
		
	)

Summary

Search the sysfs directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_search_usbfs(
	
		domain
		
	)

Summary

Search the directory containing USB hardware information.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_acpi_bios_dev(
	
		domain
		
	)

Summary

Set the attributes of the apm bios device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_all_blk_files(
	
		domain
		
	)

Summary

Setattr on all block file device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_all_chr_files(
	
		domain
		
	)

Summary

Setattr on all character file device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_all_sysfs(
	
		domain
		
	)

Summary

Set the attributes of sysfs files, directories and symlinks.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_autofs_dev(
	
		domain
		
	)

Summary

Set the attributes of the autofs device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_cpu_dev(
	
		domain
		
	)

Summary

Set the attributes of the CPU microcode and id interfaces.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_dlm_control(
	
		domain
		
	)

Summary

Set the attributes of the dlm control devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_dri_dev(
	
		domain
		
	)

Summary

Setattr the dri devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_framebuffer_dev(
	
		domain
		
	)

Summary

Set the attributes of the framebuffer device node.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_generic_blk_files(
	
		domain
		
	)

Summary

Set the attributes on generic block devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_generic_chr_files(
	
		domain
		
	)

Summary

Set the attributes for generic character device files.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_generic_dirs(
	
		domain
		
	)

Summary

Set the attributes of /dev directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_generic_usb_dev(
	
		domain
		
	)

Summary

Setattr generic the USB devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_input_dev(
	
		domain
		
	)

Summary

Set the attributes of the event devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_ksm_dev(
	
		domain
		
	)

Summary

Set the attributes of the ksm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_kvm_dev(
	
		domain
		
	)

Summary

Set the attributes of the kvm devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_misc_dev(
	
		domain
		
	)

Summary

Set the attributes of miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_modem_dev(
	
		domain
		
	)

Summary

Set the attributes of the modem devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_mouse_dev(
	
		domain
		
	)

Summary

Set the attributes of the mouse devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_null_dev(
	
		domain
		
	)

Summary

Set the attributes of the null device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_power_mgmt_dev(
	
		domain
		
	)

Summary

Set the attributes of the the power management device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_printer_dev(
	
		domain
		
	)

Summary

Set the attributes of the printer device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_qemu_dev(
	
		domain
		
	)

Summary

Set the attributes of the QEMU microcode and id interfaces.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_scanner_dev(
	
		domain
		
	)

Summary

Set the attributes of the scanner device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_sound_dev(
	
		domain
		
	)

Summary

Set the attributes of the sound devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_usbfs_files(
	
		domain
		
	)

Summary

Set the attributes of usbfs filesystem.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_video_dev(
	
		domain
		
	)

Summary

Set the attributes of video4linux device nodes.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_setattr_xserver_misc_dev(
	
		domain
		
	)

Summary

Set the attributes of X server miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_tmpfs_filetrans_dev(
	
		domain
		
			,
		
		objectclass(es)
		
			,
		
		name
		
	)

Summary

Create, read, and write device nodes. The node will be transitioned to the type provided. This is a temporary interface until devtmpfs functionality fixed.

Parameters

Parameter:	Description:
domain	Domain allowed access.
objectclass(es)	Object class(es) (single or set including {}) for which this the transition will occur.
name	The name of the object being created.

dev_unconfined(
	
		domain
		
	)

Summary

Unconfined access to devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_unmount_sysfs(
	
		domain
		
	)

Summary

unmount a sysfs filesystem

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_watch_dev_dirs(
	
		domain
		
	)

Summary

Watch the directories in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_framebuffer(
	
		domain
		
	)

Summary

Write the framebuffer.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_generic_sock_files(
	
		domain
		
	)

Summary

Write generic sock files in /dev.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_generic_sockets(
	
		domain
		
	)

Summary

Write generic socket files in /dev.

Parameters

Parameter:	Description:
domain	Domain to not audit.

dev_write_kmsg(
	
		domain
		
	)

Summary

Write to the kernel messages device

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_misc(
	
		domain
		
	)

Summary

Write miscellaneous devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_rand(
	
		domain
		
	)

Summary

Write to the random device (e.g., /dev/random). This adds entropy used to generate the random data read from the random device.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_raw_memory(
	
		domain
		
	)

Summary

Write raw memory devices (e.g. /dev/mem). This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_raw_memory_cond(
	
		domain
		
			,
		
		tunable
		
	)

Summary

Write raw memory devices (e.g. /dev/mem) if a tunable is set. This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.
tunable	Tunable to depend on

dev_write_realtime_clock(
	
		domain
		
	)

Summary

Set the realtime clock (/dev/rtc).

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_sound(
	
		domain
		
	)

Summary

Write the sound devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_sound_mixer(
	
		domain
		
	)

Summary

Write the sound mixer devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_sysfs(
	
		domain
		
	)

Summary

Write to hardware state information.

Description

Allow the specified domain to write to the sysfs filesystem.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_sysfs_dirs(
	
		domain
		
	)

Summary

Write in a sysfs directories.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_urand(
	
		domain
		
	)

Summary

Write to the pseudo random device (e.g., /dev/urandom). This sets the random number generator seed.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_usbmon_dev(
	
		domain
		
	)

Summary

Write USB monitor devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_video_dev(
	
		domain
		
	)

Summary

Write the video4linux devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_write_watchdog(
	
		domain
		
	)

Summary

Write to watchdog devices.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_wx_raw_memory(
	
		domain
		
	)

Summary

Write and execute raw memory devices (e.g. /dev/mem). This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.

dev_wx_raw_memory_cond(
	
		domain
		
			,
		
		tunable
		
	)

Summary

Write and execute raw memory devices (e.g. /dev/mem) if a tunable is set. This is extremely dangerous as it can bypass the SELinux protections, and should only be used by trusted domains.

Parameters

Parameter:	Description:
domain	Domain allowed access.
tunable	Tunable to depend on

Return