SELinux Type Enforcement for multi-process QEMU

module mpqemu 1.0;


require {
	class process transition;
	class file { execute read };
	class file entrypoint;
	class dir search;
	class file { getattr open read };
	class file { getattr map open read };
	class file { execute map read };
	class lnk_file read;
	class chr_file { lock open read write };
	class file { getattr ioctl lock open read write };
	class process fork;
	class fd use;
	class unix_stream_socket { read write };
	class file open;
	class process { noatsecure rlimitinh siginh };
	class file write;
	class dir { getattr search };
	class file { open read };
	class process getattr;
	type qemu_t;
	type qemu_exec_t;
	type virtd_t;
	type ld_so_cache_t;
	type ld_so_t;
	type lib_t;
	type null_device_t;
	type virt_image_t;
	type shell_exec_t;
	type init_t;
	attribute domain;
	attribute entry_type;
	attribute exec_type;
	attribute application_exec_type;
	attribute file_type, non_security_file_type, non_auth_file_type;
	attribute virt_domain;
	attribute virt_image_type;

};


type qemu_lsi53c895a_exec_t;
type qemu_lsi53c895a_img_t;
type qemu_lsi53c895a_t;

typeattribute qemu_lsi53c895a_t virt_domain;

typeattribute qemu_lsi53c895a_exec_t file_type, non_security_file_type, non_auth_file_type;
typeattribute qemu_lsi53c895a_exec_t exec_type;
typeattribute qemu_lsi53c895a_exec_t application_exec_type;
typeattribute qemu_lsi53c895a_exec_t entry_type;
typeattribute qemu_lsi53c895a_img_t file_type, non_security_file_type, non_auth_file_type;
typeattribute qemu_lsi53c895a_img_t virt_image_type;
type_transition qemu_t qemu_lsi53c895a_exec_t : process qemu_lsi53c895a_t;
type_transition virtd_t qemu_exec_t : process qemu_t;

#============= init_t ==============
allow init_t qemu_lsi53c895a_t:dir search;
allow init_t qemu_lsi53c895a_t:file { getattr open read };

#============= qemu_lsi53c895a_t ==============
allow qemu_lsi53c895a_t ld_so_cache_t : file { getattr map open read };
allow qemu_lsi53c895a_t ld_so_t : file { execute map read };
allow qemu_lsi53c895a_t lib_t : lnk_file read;
allow qemu_lsi53c895a_t null_device_t : chr_file { lock open read write };
allow qemu_lsi53c895a_t qemu_lsi53c895a_exec_t : file { execute map read };
allow qemu_lsi53c895a_t qemu_lsi53c895a_img_t : file { getattr ioctl lock open read write };
allow qemu_lsi53c895a_t self : process fork;
allow qemu_lsi53c895a_t qemu_t : fd use;
allow qemu_lsi53c895a_t qemu_t : unix_stream_socket { read write };
allow qemu_lsi53c895a_t qemu_lsi53c895a_exec_t : file entrypoint;

#============= qemu_t ==============
allow qemu_t qemu_lsi53c895a_exec_t : file open;
allow qemu_t qemu_lsi53c895a_t : process { noatsecure rlimitinh siginh };
allow qemu_t virt_image_t : file write;
allow qemu_t qemu_lsi53c895a_t : process transition;
allow qemu_t qemu_lsi53c895a_exec_t : file { execute read };

#============= virtd_t ==============
allow virtd_t shell_exec_t : file entrypoint;