sepolicy/policy/chromeos/kernel.te

# Life begins with the kernel.
type kernel, chromeos_domain, domain, mlstrustedobject;

permissive kernel;

r_dir_file(kernel, rootfs)
r_dir_file(kernel, sysfs)

allow kernel selinuxfs:dir r_dir_perms;
allow kernel selinuxfs:file rw_file_perms;
allow kernel self:security setcheckreqprot;

allow kernel unlabeled:dir search;
allow kernel cros_system_file:dir search;

# TODO: label device file in more detail.
allow kernel device:dir { search read write getattr };
allow kernel cros_dev_type:chr_file { create setattr getattr };
allow kernel cros_labeled_dev_type:chr_file write;
allow kernel device:dir add_name; # for dm-X device.
allow kernel device:blk_file { rw_file_perms create setattr };
allow kernel device:dir open;

allow kernel self:global_capability_class_set sys_nice;
allow kernel self:system { module_request };
allow kernel self:capability { mknod };

allow kernel sysfs:filesystem getattr;
allow kernel labeledfs:filesystem getattr;
allow kernel device:filesystem getattr;

allow kernel device:chr_file relabelfrom;
allow kernel cros_dev_type:chr_file relabelto;

allow kernel cros_modprobe_exec:{ file lnk_file } r_file_perms;

neverallow * kernel:process { transition dyntransition };

dontaudit kernel device:chr_file write;