Re: File access macros

[Ian Pilcher <arequipeno@gmail.com>]

On 9/14/25 12:29 AM, Dominick Grift wrote:
> I can give you an example of how the public content feature might be
> implemented with an example. the refpolicy ftp module:
> 
> There are two scenario's there:
> 
> 1. by default ftpd_t can read(only) public_content_t and public_content_rw_t
> dirs, files and symlinks:
> 
> https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/services/ftp.te#L251
> 
> This interface is defined here:
> 
> https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/system/miscfiles.if#L915
> 
> 2. write access to public_content_rw_t is conditional in this
> example (with a boolean):
> 
> https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/services/ftp.te#L16
> https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/services/ftp.te#L260
> 
> This interface is defined here:
> 
> https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/system/miscfiles.if#L937

I did finally find the miscfiles_read_public_files and
miscfiles_manage_public_files macros by looking at the Apache policy
module (apache.te), so I ended up with this simple module:

	policy_module(container-public-content, 0)

	require {
		type container_t;
	};

	bool container_read_public_content false;
	if container_read_public_content {
		miscfiles_read_public_files(container_t)
	}

	bool container_manage_public_content false;
	if container_manage_public_content {
		miscfiles_manage_public_files(container_t)
	}

Thanks!

-- 
========================================================================
If your user interface is intuitive in retrospect ... it isn't intuitive
========================================================================