From: sven.vermeulen@siphos.be (Sven Vermeulen)
Date: Wed, 4 Jan 2012 21:01:20 +0100
Subject: [refpolicy] [PATCH 1/5] Add read interface for udev rules
In-Reply-To: <20120104200014.GA6512@siphos.be>
References: <20120104200014.GA6512@siphos.be>
Message-ID: <20120104200119.GB6512@siphos.be>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com


Applications, such as dracut or other initramfs creators, need read access to udev rules to see if they need to pull in
additional requirements for the initramfs or not. This adds in the udev_read_rules_files() interface for this purpose.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/system/udev.if |   18 ++++++++++++++++++
 1 files changed, 18 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index 025348a..3d0f1f0 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -132,6 +132,24 @@ interface(`udev_dontaudit_rw_dgram_sockets',`
 
 ########################################
 ## <summary>
+##	Read udev rules files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`udev_read_rules_files',`
+	gen_require(`
+		type udev_rules_t;
+	')
+
+	read_files_pattern($1, udev_rules_t, udev_rules_t)
+')
+
+########################################
+## <summary>
 ##	Manage udev rules files
 ## </summary>
 ## <param name="domain">
-- 
1.7.3.4