3.4.3 参考策略源代码分析

policy_module(wine,1.1.3)
########################################
#
# Declarations
#
type wine_t;
domain_type(wine_t)                    #定义进程wine的域为wine_t

type wine_exec_t;                      #定义可执行文件的类型
domain_entry_file(wine_t,wine_exec_t)   #指定域wint_t由wine_exec_t类型文件转移生成

########################################
#
# Local policy
#
ifdef(`targeted_policy',`
allow wine_t self:process { execstack execmem execheap };
unconfined_domain_noaudit(wine_t) #使域wine_t成为unconfined域，即可做unconfined的操作
files_execmod_all_files(wine_t)    #可执行所有可执行文件

 optional_policy(`
 hal_dbus_chat(wine_t)
 ')
')

## 
Wine Is Not an Emulator.  Run Windows programs in Linux.

########################################
## 

##Execute the wine program in the wine domain.
## 
## 
##

##Domain allowed access.
##
## 
#
interface(`wine_domtrans',`
gen_require(`
type wine_t, wine_exec_t;
')

corecmd_search_bin($1)                     #$1域有搜索bin目录的权限
domain_auto_trans($1, wine_exec_t, wine_t) #$1执行wine_exec_t文件，新进程域为wine_t

allow $1 wine_t:fd use;
allow wine_t $1:fd use;
allow wine_t $1:fifo_file rw_file_perms;
allow wine_t $1:process sigchld;
')

/usr/bin/wine--gen_context(system_u:object_r:wine_exec_t,s0)
/opt/picasa/wine/bin/wine--gen_context(system_u:object_r:wine_exec_t,s0)

type wine_exec_t;
type wine_t;
##### begin domain_type(wine_t) depth: 1         #对应策略模块wine.te中语句

##### begin domain_base_type(wine_t) depth: 2
     typeattribute wine_t domain;                #定义域属性
##### end domain_base_type(wine_t) depth: 1

##### begin init_sigchld(wine_t) depth: 2
allow wine_t init_t:process sigchld;
##### end init_sigchld(wine_t) depth: 1

##### begin init_signull(wine_t) depth: 2
allow wine_t init_t:process signull;
##### end init_signull(wine_t) depth: 1

##### begin rpm_use_fds(wine_t) depth: 2
allow wine_t rpm_t:fd use;
##### end rpm_use_fds(wine_t) depth: 1

##### begin rpm_read_pipes(wine_t) depth: 2
allow wine_t rpm_t:fifo_file { read getattr lock ioctl };
##### end rpm_read_pipes(wine_t) depth: 1

##### begin selinux_dontaudit_read_fs(wine_t) depth: 2
dontaudit wine_t security_t:dir { getattr search };
dontaudit wine_t security_t:file { getattr read };
##### end selinux_dontaudit_read_fs(wine_t) depth: 1

##### begin seutil_dontaudit_read_config(wine_t) depth: 2
dontaudit wine_t selinux_config_t:dir search;
dontaudit wine_t selinux_config_t:file { getattr read };
##### end seutil_dontaudit_read_config(wine_t) depth: 1

##### end domain_type(wine_t) depth: 0


##### begin domain_entry_file(wine_t,wine_exec_t) depth: 1
allow wine_t wine_exec_t:file entrypoint;
allow wine_t wine_exec_t:file { read getattr lock execute ioctl };
typeattribute wine_exec_t entry_type;
##### end domain_entry_file(wine_t,wine_exec_t) depth: 0


##### begin domain_entry_file(wine_t,wine_exec_t) depth: 1
allow wine_t wine_exec_t:file entrypoint;
allow wine_t wine_exec_t:file { read getattr lock execute ioctl };
typeattribute wine_exec_t entry_type;

##### begin corecmd_executable_file(wine_exec_t) depth: 2
typeattribute wine_exec_t exec_type;

##### begin files_type(wine_exec_t) depth: 3
typeattribute wine_exec_t file_type;
##### end files_type(wine_exec_t) depth: 2

##### end corecmd_executable_file(wine_exec_t) depth: 1

##### end domain_entry_file(wine_t,wine_exec_t) depth: 0