Policy specification

Contents

The /sys/kernel/security/tomoyo/ interface

• /sys/kernel/security/tomoyo/domain_policy
• /sys/kernel/security/tomoyo/exception_policy
• /sys/kernel/security/tomoyo/manager
• /sys/kernel/security/tomoyo/profile
• /sys/kernel/security/tomoyo/query
• /sys/kernel/security/tomoyo/self_domain
• /sys/kernel/security/tomoyo/meminfo
• /sys/kernel/security/tomoyo/version
• /sys/kernel/security/tomoyo/.domain_status
• /sys/kernel/security/tomoyo/.process_status

Domain transition procedure

Expression rules

• Word expression rules
• Wildcard expression rules

Exception policy syntax

• aggregator
• allow_read
• deny_rewrite
• file_pattern
• initialize_domain
• no_initialize_domain
• keep_domain
• no_keep_domain
• number_group
• path_group

Domain policy syntax

• allow_execute
• allow_read
• allow_write
• allow_read/write
• allow_create
• allow_unlink
• allow_chown
• allow_chgrp
• allow_chmod
• allow_mkdir
• allow_rmdir
• allow_mkfifo
• allow_mksock
• allow_mkblock
• allow_mkchar
• allow_truncate
• allow_symlink
• allow_link
• allow_rename
• allow_rewrite
• allow_ioctl
• allow_mount
• allow_unmount
• allow_chroot
• allow_pivot_root
• use_profile
• ignore_global_allow_read
• quota_exceeded
• transition_failed