Phase 2: Initializing TOMOYO Linux.

Register pathnames with patterns using the "file_pattern" directive. When a file operation is performed and the requested pathname matches a patterned pathname registered with "file_pattern" directive, policy is generated using patterned pathnames.
The following is the guideline.

• Files under /proc/PID/ directory.
• Files under /sys/ directory. (Applicable to 2.6 kernels only)
• Some files under /dev/ directory.
• Policy files under /etc/ccs/ directory.
• Manual pages.
• Spool directories.
• Temporary files used for sending and receiving mails.
• Temporary files used by man command.
• Temporary files used by mount command.

TOMOYO Linux needs more patterned pathnames depending on the applications installed and their configurations. You can add missing patterned pathnames after running the system.

Register pathname groups using the "path_group" directive. This is a macro to reduce the amount of domain policy by grouping multiple pathnames using group names. An example usage is shown later.

Register number groups using the "number_group" directive. This is a macro to reduce the amount of domain policy by grouping multiple numbers using group names. An example usage is shown later.

Register IPv4 or IPv6 address groups using the "address_group" directive. This is a macro to reduce the amount of domain policy by grouping multiple addresses using group names. An example usage is shown later.

Register files that are allowed to be read by all programs using the "allow_read" directive. Patterns are allowed. When a file open request for reading is issued and the requested pathname matches a pathname registered with "allow_read" directive, the open request for read access is granted even if the pathname is not explicitly permitted by the domain policy.
The following is the guideline.

• Dynamically-linked library files that are registered with ldconfig.
• Some files under /proc/ directory.
• Some locale data under /usr/share/locale/ directory.

You may find more files depending on applications in your system or configurations. Add missing files after observing which files are used for read access.

Register environment variable names that are allowed to be passed to all programs using the "allow_env" directive. Patterns are allowed. When execve() request is issued and the passed environment variable name matches matches environment variable names registered with "allow_env" directive, the environment variable name is granted without checking domain policy.
The following is the guideline.

• Commonly used environment variable names such as PATH and HOME

You may find more environment variable names depending on applications in your system or configurations. Add missing environment variable names after observing which environment variable names are used.

Register files that you don't want to allow overwriting existing contents (like log files) using "deny_rewrite" directive. Patterns are allowed. Files registered with "deny_rewrite" directive are (as long as it is not explicitly given by "allow_rewrite" directive in domain policy) forbidden to "open for writing but not append mode" and "truncate".
The following is the guideline.

• Files under /var/log/ directory.

You may find more files depending on applications in your system or configurations. Add missing files after observing which files are used for append-only access.

To deal multiple programs as a single program, use aggregator directive followed by name of original program and aggregated program. Patterns are allowed for name of original program.
For example, /usr/bin/tac and /bin/cat are similar. By specifying "aggregator /usr/bin/tac /bin/cat", you can run /usr/bin/tac in the domain for /bin/cat .

Register programs that initializes the domain transition history using the "initialize_domain" directive. No patterns allowed. When a program that is registered with "initialize_domain" directive is executed, the program runs just under the <kernel> domain.
The following is the guideline.

• Scripts that start or terminate daemon programs located under /etc/init.d/ directory.
• Daemon programs that you want to make domain names shorter (for example, httpd and sshd).

You may find more programs depending on applications in your system or configurations. Add missing programs after observing which programs should be initialize their domain transition history. But be careful with the side effect of other domains. For example, when the domain policy already includes

and you add /bin/tcsh as initialize_domain, "<kernel> ... /bin/bash /bin/tcsh" will become unreachable domain because /bin/tcsh runs in "<kernel> /bin/tcsh" domain. In that case, you will need to replace "<kernel> ... /bin/bash /bin/tcsh" with "<kernel> /bin/tcsh" as shown below.

To deny the effect of "initialize_domain" directive under specific conditions, use "no_initialize_domain" directive.

To declare domain keepers, use "keep_domain" directive followed by domain definition.
For example, if "keep_domain <kernel> /usr/sbin/sshd /bin/tcsh" is given, any process that belongs to "<kernel> /usr/sbin/sshd /bin/tcsh" domain stays at that domain unless any program registered with "initialize_domain" directive is executed.

To deny the effect of "keep_domain" directive under specific conditions, use "no_keep_domain" directive.

To reserve local ports, use "deny_autobind" directive followed by port number.
Some programs require specific port numbers which might be assigned by automatic port number assignment functionality. If such port numbers are assigned by automatic port number assignment functionality, such programs can't work. This directive reserves such port numbers.