policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 colord_read_lib_files($1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 dbus_system_bus_client($1_usertype)
 696
 697                 allow $1_usertype $1_usertype:dbus  send_msg;
 698
 699                 optional_policy(`
 700                         avahi_dbus_chat($1_usertype)
 701                 ')
 702
 703                 optional_policy(`
 704                         policykit_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         bluetooth_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         consolekit_dbus_chat($1_usertype)
 713                         consolekit_read_log($1_usertype)
 714                 ')
 715
 716                 optional_policy(`
 717                         devicekit_dbus_chat($1_usertype)
 718                         devicekit_dbus_chat_power($1_usertype)
 719                         devicekit_dbus_chat_disk($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         hal_dbus_chat($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         modemmanager_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         networkmanager_dbus_chat($1_usertype)
 732                         networkmanager_read_lib_files($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         vpn_dbus_chat($1_usertype)
 737                 ')
 738         ')
 739
 740         optional_policy(`
 741                 git_session_role($1_r, $1_usertype)
 742         ')
 743
 744         optional_policy(`
 745                 inetd_use_fds($1_usertype)
 746                 inetd_rw_tcp_sockets($1_usertype)
 747         ')
 748
 749         optional_policy(`
 750                 inn_read_config($1_usertype)
 751                 inn_read_news_lib($1_usertype)
 752                 inn_read_news_spool($1_usertype)
 753         ')
 754
 755         optional_policy(`
 756                 lircd_stream_connect($1_usertype)
 757         ')
 758
 759         optional_policy(`
 760                 locate_read_lib_files($1_usertype)
 761         ')
 762
 763         # for running depmod as part of the kernel packaging process
 764         optional_policy(`
 765                 modutils_read_module_config($1_usertype)
 766         ')
 767
 768         optional_policy(`
 769                 mta_rw_spool($1_usertype)
 770                 mta_manage_queue($1_usertype)
 771                 mta_filetrans_home_content($1_usertype)
 772         ')
 773
 774         optional_policy(`
 775                 tunable_policy(`allow_user_mysql_connect',`
 776                         mysql_stream_connect($1_t)
 777                 ')
 778         ')
 779
 780         optional_policy(`
 781                 oident_manage_user_content($1_t)
 782                 oident_relabel_user_content($1_t)
 783         ')
 784
 785         optional_policy(`
 786                 # to allow monitoring of pcmcia status
 787                 pcmcia_read_pid($1_usertype)
 788         ')
 789
 790         optional_policy(`
 791                 pcscd_read_pub_files($1_usertype)
 792                 pcscd_stream_connect($1_usertype)
 793         ')
 794
 795         optional_policy(`
 796                 tunable_policy(`allow_user_postgresql_connect',`
 797                         postgresql_stream_connect($1_usertype)
 798                         postgresql_tcp_connect($1_usertype)
 799                 ')
 800         ')
 801
 802         optional_policy(`
 803                 resmgr_stream_connect($1_usertype)
 804         ')
 805
 806         optional_policy(`
 807                 rpc_dontaudit_getattr_exports($1_usertype)
 808                 rpc_manage_nfs_rw_content($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 rpcbind_stream_connect($1_usertype)
 813         ')
 814
 815         optional_policy(`
 816                 samba_stream_connect_winbind($1_usertype)
 817         ')
 818
 819         optional_policy(`
 820                 sandbox_transition($1_usertype, $1_r)
 821         ')
 822
 823         optional_policy(`
 824                 seunshare_role_template($1, $1_r, $1_t)
 825         ')
 826
 827         optional_policy(`
 828                 slrnpull_search_spool($1_usertype)
 829         ')
 830 ')
 831
 832 #######################################
 833 ## <summary>
 834 ##      The template for creating a login user.
 835 ## </summary>
 836 ## <desc>
 837 ##      <p>
 838 ##      This template creates a user domain, types, and
 839 ##      rules for the user's tty, pty, home directories,
 840 ##      tmp, and tmpfs files.
 841 ##      </p>
 842 ## </desc>
 843 ## <param name="userdomain_prefix">
 844 ##      <summary>
 845 ##      The prefix of the user domain (e.g., user
 846 ##      is the prefix for user_t).
 847 ##      </summary>
 848 ## </param>
 849 #
 850 template(`userdom_login_user_template', `
 851         gen_require(`
 852                 class context contains;
 853         ')
 854
 855         userdom_base_user_template($1)
 856
 857         userdom_manage_home_role($1_r, $1_usertype)
 858
 859         userdom_manage_tmp_role($1_r, $1_usertype)
 860         userdom_manage_tmpfs_role($1_r, $1_usertype)
 861
 862         ifelse(`$1',`unconfined',`',`
 863                 gen_tunable(allow_$1_exec_content, true)
 864
 865                 tunable_policy(`allow_$1_exec_content',`
 866                         userdom_exec_user_tmp_files($1_usertype)
 867                         userdom_exec_user_home_content_files($1_usertype)
 868                 ')
 869                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 870                         fs_exec_nfs_files($1_usertype)
 871                 ')
 872
 873                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 874                         fs_exec_cifs_files($1_usertype)
 875                 ')
 876         ')
 877
 878         userdom_change_password_template($1)
 879
 880         ##############################
 881         #
 882         # User domain Local policy
 883         #
 884
 885         allow $1_t self:capability { setgid chown fowner };
 886         dontaudit $1_t self:capability { sys_nice fsetid };
 887
 888         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 889         dontaudit $1_t self:process setrlimit;
 890         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 891
 892         allow $1_t self:context contains;
 893
 894         kernel_dontaudit_read_system_state($1_usertype)
 895         kernel_dontaudit_list_all_proc($1_usertype)
 896
 897         dev_read_sysfs($1_usertype)
 898         dev_read_urand($1_usertype)
 899
 900         domain_use_interactive_fds($1_usertype)
 901         # Command completion can fire hundreds of denials
 902         domain_dontaudit_exec_all_entry_files($1_usertype)
 903
 904         files_dontaudit_list_default($1_usertype)
 905         files_dontaudit_read_default_files($1_usertype)
 906         # Stat lost+found.
 907         files_getattr_lost_found_dirs($1_usertype)
 908
 909         fs_get_all_fs_quotas($1_usertype)
 910         fs_getattr_all_fs($1_usertype)
 911         fs_search_all($1_usertype)
 912         fs_list_inotifyfs($1_usertype)
 913         fs_rw_anon_inodefs_files($1_usertype)
 914
 915         auth_dontaudit_write_login_records($1_t)
 916         auth_rw_cache($1_t)
 917
 918         application_exec_all($1_t)
 919         # The library functions always try to open read-write first,
 920         # then fall back to read-only if it fails.
 921         init_dontaudit_rw_utmp($1_t)
 922
 923         # Stop warnings about access to /dev/console
 924         init_dontaudit_use_fds($1_usertype)
 925         init_dontaudit_use_script_fds($1_usertype)
 926
 927         libs_exec_lib_files($1_usertype)
 928
 929         logging_dontaudit_getattr_all_logs($1_usertype)
 930
 931         # for running TeX programs
 932         miscfiles_read_tetex_data($1_usertype)
 933         miscfiles_exec_tetex_data($1_usertype)
 934
 935         seutil_read_config($1_usertype)
 936
 937         optional_policy(`
 938                 cups_read_config($1_usertype)
 939                 cups_stream_connect($1_usertype)
 940                 cups_stream_connect_ptal($1_usertype)
 941         ')
 942
 943         optional_policy(`
 944                 kerberos_use($1_usertype)
 945                 kerberos_filetrans_home_content($1_usertype)
 946         ')
 947
 948         optional_policy(`
 949                 mta_dontaudit_read_spool_symlinks($1_usertype)
 950         ')
 951
 952         optional_policy(`
 953                 quota_dontaudit_getattr_db($1_usertype)
 954         ')
 955
 956         optional_policy(`
 957                 rpm_read_db($1_usertype)
 958                 rpm_dontaudit_manage_db($1_usertype)
 959                 rpm_read_cache($1_usertype)
 960         ')
 961
 962         optional_policy(`
 963                 oddjob_run_mkhomedir($1_t, $1_r)
 964         ')
 965 ')
 966
 967 #######################################
 968 ## <summary>
 969 ##      The template for creating a unprivileged login user.
 970 ## </summary>
 971 ## <desc>
 972 ##      <p>
 973 ##      This template creates a user domain, types, and
 974 ##      rules for the user's tty, pty, home directories,
 975 ##      tmp, and tmpfs files.
 976 ##      </p>
 977 ## </desc>
 978 ## <param name="userdomain_prefix">
 979 ##      <summary>
 980 ##      The prefix of the user domain (e.g., user
 981 ##      is the prefix for user_t).
 982 ##      </summary>
 983 ## </param>
 984 #
 985 template(`userdom_restricted_user_template',`
 986         gen_require(`
 987                 attribute unpriv_userdomain;
 988         ')
 989
 990         userdom_login_user_template($1)
 991
 992         typeattribute $1_t unpriv_userdomain;
 993         domain_interactive_fd($1_t)
 994
 995         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 996         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 997
 998         ##############################
 999         #
1000         # Local policy
1001         #
1002
1003         optional_policy(`
1004                 loadkeys_run($1_t, $1_r)
1005         ')
1006 ')
1007
1008 #######################################
1009 ## <summary>
1010 ##      The template for creating a unprivileged xwindows login user.
1011 ## </summary>
1012 ## <desc>
1013 ##      <p>
1014 ##      The template for creating a unprivileged xwindows login user.
1015 ##      </p>
1016 ##      <p>
1017 ##      This template creates a user domain, types, and
1018 ##      rules for the user's tty, pty, home directories,
1019 ##      tmp, and tmpfs files.
1020 ##      </p>
1021 ## </desc>
1022 ## <param name="userdomain_prefix">
1023 ##      <summary>
1024 ##      The prefix of the user domain (e.g., user
1025 ##      is the prefix for user_t).
1026 ##      </summary>
1027 ## </param>
1028 #
1029 template(`userdom_restricted_xwindows_user_template',`
1030
1031         userdom_restricted_user_template($1)
1032
1033         ##############################
1034         #
1035         # Local policy
1036         #
1037
1038         auth_role($1_r, $1_t)
1039         auth_search_pam_console_data($1_usertype)
1040         auth_dontaudit_read_login_records($1_usertype)
1041
1042         dev_read_sound($1_usertype)
1043         dev_write_sound($1_usertype)
1044         # gnome keyring wants to read this.
1045         dev_dontaudit_read_rand($1_usertype)
1046         # temporarily allow since openoffice requires this
1047         dev_read_rand($1_usertype)
1048
1049         dev_read_video_dev($1_usertype)
1050         dev_write_video_dev($1_usertype)
1051         dev_rw_wireless($1_usertype)
1052
1053         libs_dontaudit_setattr_lib_files($1_usertype)
1054
1055         tunable_policy(`user_rw_noexattrfile',`
1056                 dev_rw_usbfs($1_t)
1057                 dev_rw_generic_usb_dev($1_usertype)
1058
1059                 fs_manage_noxattr_fs_files($1_usertype)
1060                 fs_manage_noxattr_fs_dirs($1_usertype)
1061                 fs_manage_dos_dirs($1_usertype)
1062                 fs_manage_dos_files($1_usertype)
1063                 storage_raw_read_removable_device($1_usertype)
1064                 storage_raw_write_removable_device($1_usertype)
1065         ')
1066
1067         logging_send_syslog_msg($1_usertype)
1068         logging_dontaudit_send_audit_msgs($1_t)
1069
1070         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1071         logging_send_audit_msgs($1_t)
1072         selinux_get_enforce_mode($1_t)
1073         seutil_exec_restorecond($1_t)
1074         seutil_read_file_contexts($1_t)
1075         seutil_read_default_contexts($1_t)
1076
1077         xserver_restricted_role($1_r, $1_t)
1078
1079         optional_policy(`
1080                 alsa_read_rw_config($1_usertype)
1081         ')
1082
1083         optional_policy(`
1084                 dbus_role_template($1, $1_r, $1_usertype)
1085                 dbus_system_bus_client($1_usertype)
1086                 allow $1_usertype $1_usertype:dbus send_msg;
1087
1088                 optional_policy(`
1089                         abrt_dbus_chat($1_usertype)
1090                         abrt_run_helper($1_usertype, $1_r)
1091                 ')
1092
1093                 optional_policy(`
1094                         consolekit_dontaudit_read_log($1_usertype)
1095                         consolekit_dbus_chat($1_usertype)
1096                 ')
1097
1098                 optional_policy(`
1099                         cups_dbus_chat($1_usertype)
1100                         cups_dbus_chat_config($1_usertype)
1101                 ')
1102
1103                 optional_policy(`
1104                         devicekit_dbus_chat($1_usertype)
1105                         devicekit_dbus_chat_disk($1_usertype)
1106                         devicekit_dbus_chat_power($1_usertype)
1107                 ')
1108
1109                 optional_policy(`
1110                         fprintd_dbus_chat($1_t)
1111                 ')
1112         ')
1113
1114         optional_policy(`
1115                 policykit_role($1_r, $1_usertype)
1116         ')
1117
1118         optional_policy(`
1119                 pulseaudio_role($1_r, $1_usertype)
1120                 pulseaudio_filetrans_admin_home_content($1_usertype)
1121                 pulseaudio_filetrans_home_content($1_usertype)
1122         ')
1123
1124         optional_policy(`
1125                 rtkit_scheduled($1_usertype)
1126         ')
1127
1128         optional_policy(`
1129                 setroubleshoot_dontaudit_stream_connect($1_t)
1130         ')
1131
1132         optional_policy(`
1133                 udev_read_db($1_usertype)
1134         ')
1135 ')
1136
1137 #######################################
1138 ## <summary>
1139 ##      The template for creating a unprivileged user roughly
1140 ##      equivalent to a regular linux user.
1141 ## </summary>
1142 ## <desc>
1143 ##      <p>
1144 ##      The template for creating a unprivileged user roughly
1145 ##      equivalent to a regular linux user.
1146 ##      </p>
1147 ##      <p>
1148 ##      This template creates a user domain, types, and
1149 ##      rules for the user's tty, pty, home directories,
1150 ##      tmp, and tmpfs files.
1151 ##      </p>
1152 ## </desc>
1153 ## <param name="userdomain_prefix">
1154 ##      <summary>
1155 ##      The prefix of the user domain (e.g., user
1156 ##      is the prefix for user_t).
1157 ##      </summary>
1158 ## </param>
1159 #
1160 template(`userdom_unpriv_user_template', `
1161
1162         ##############################
1163         #
1164         # Declarations
1165         #
1166
1167         # Inherit rules for ordinary users.
1168         userdom_restricted_xwindows_user_template($1)
1169         userdom_common_user_template($1)
1170
1171         ##############################
1172         #
1173         # Local policy
1174         #
1175
1176         # port access is audited even if dac would not have allowed it, so dontaudit it here
1177 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1178         # Need the following rule to allow users to run vpnc
1179         corenet_tcp_bind_xserver_port($1_t)
1180         corenet_tcp_bind_generic_node($1_usertype)
1181
1182         storage_rw_fuse($1_t)
1183
1184         files_exec_usr_files($1_t)
1185    # cjp: why?
1186         files_read_kernel_symbol_table($1_t)
1187
1188         ifndef(`enable_mls',`
1189                 fs_exec_noxattr($1_t)
1190
1191                 tunable_policy(`user_rw_noexattrfile',`
1192                         fs_manage_noxattr_fs_files($1_t)
1193                         fs_manage_noxattr_fs_dirs($1_t)
1194                         # Write floppies
1195                         storage_raw_read_removable_device($1_t)
1196                         storage_raw_write_removable_device($1_t)
1197                 ',`
1198                         storage_raw_read_removable_device($1_t)
1199                 ')
1200         ')
1201
1202         miscfiles_read_hwdata($1_usertype)
1203
1204         # Allow users to run TCP servers (bind to ports and accept connection from
1205         # the same domain and outside users) disabling this forces FTP passive mode
1206         # and may change other protocols
1207
1208         tunable_policy(`user_share_music',`
1209                 corenet_tcp_bind_daap_port($1_usertype)
1210         ')
1211
1212         tunable_policy(`user_tcp_server',`
1213                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1214         ')
1215
1216         tunable_policy(`user_setrlimit',`
1217                 allow $1_usertype self:process setrlimit;
1218         ')
1219
1220         optional_policy(`
1221                 cdrecord_role($1_r, $1_t)
1222         ')
1223
1224         optional_policy(`
1225                 cron_role($1_r, $1_t)
1226         ')
1227
1228         optional_policy(`
1229                 gpg_role($1_r, $1_usertype)
1230         ')
1231
1232         optional_policy(`
1233                 gpm_stream_connect($1_usertype)
1234         ')
1235
1236         optional_policy(`
1237                 mount_run_fusermount($1_t, $1_r)
1238                 mount_read_pid_files($1_t)
1239         ')
1240
1241         optional_policy(`
1242                 postfix_run_postdrop($1_t, $1_r)
1243                 postfix_search_spool($1_t)
1244         ')
1245
1246         # Run pppd in pppd_t by default for user
1247         optional_policy(`
1248                 ppp_run_cond($1_t, $1_r)
1249         ')
1250
1251         optional_policy(`
1252                 vdagent_getattr_log($1_t)
1253                 vdagent_getattr_exec($1_t)
1254                 vdagent_stream_connect($1_t)
1255         ')
1256 ')
1257
1258 #######################################
1259 ## <summary>
1260 ##      The template for creating an administrative user.
1261 ## </summary>
1262 ## <desc>
1263 ##      <p>
1264 ##      This template creates a user domain, types, and
1265 ##      rules for the user's tty, pty, home directories,
1266 ##      tmp, and tmpfs files.
1267 ##      </p>
1268 ##      <p>
1269 ##      The privileges given to administrative users are:
1270 ##      <ul>
1271 ##              <li>Raw disk access</li>
1272 ##              <li>Set all sysctls</li>
1273 ##              <li>All kernel ring buffer controls</li>
1274 ##              <li>Create, read, write, and delete all files but shadow</li>
1275 ##              <li>Manage source and binary format SELinux policy</li>
1276 ##              <li>Run insmod</li>
1277 ##      </ul>
1278 ##      </p>
1279 ## </desc>
1280 ## <param name="userdomain_prefix">
1281 ##      <summary>
1282 ##      The prefix of the user domain (e.g., sysadm
1283 ##      is the prefix for sysadm_t).
1284 ##      </summary>
1285 ## </param>
1286 #
1287 template(`userdom_admin_user_template',`
1288         gen_require(`
1289                 attribute admindomain;
1290                 class passwd { passwd chfn chsh rootok crontab };
1291         ')
1292
1293         ##############################
1294         #
1295         # Declarations
1296         #
1297
1298         # Inherit rules for ordinary users.
1299         userdom_login_user_template($1)
1300         userdom_common_user_template($1)
1301
1302         domain_obj_id_change_exemption($1_t)
1303         role system_r types $1_t;
1304
1305         typeattribute $1_t admindomain;
1306
1307         ifdef(`direct_sysadm_daemon',`
1308                 domain_system_change_exemption($1_t)
1309         ')
1310
1311         ##############################
1312         #
1313         # $1_t local policy
1314         #
1315
1316         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1317         tunable_policy(`deny_ptrace',`',`
1318                 allow $1_t self:capability sys_ptrace;
1319         ')
1320         allow $1_t self:capability2 syslog;
1321         allow $1_t self:process { setexec setfscreate };
1322         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1323         allow $1_t self:tun_socket create;
1324         # Set password information for other users.
1325         allow $1_t self:passwd { passwd chfn chsh };
1326         # Skip authentication when pam_rootok is specified.
1327         allow $1_t self:passwd rootok;
1328
1329         # Manipulate other users crontab.
1330         allow $1_t self:passwd crontab;
1331
1332         kernel_read_software_raid_state($1_t)
1333         kernel_getattr_core_if($1_t)
1334         kernel_getattr_message_if($1_t)
1335         kernel_change_ring_buffer_level($1_t)
1336         kernel_clear_ring_buffer($1_t)
1337         kernel_read_ring_buffer($1_t)
1338         kernel_get_sysvipc_info($1_t)
1339         kernel_rw_all_sysctls($1_t)
1340         # signal unlabeled processes:
1341         kernel_kill_unlabeled($1_t)
1342         kernel_signal_unlabeled($1_t)
1343         kernel_sigstop_unlabeled($1_t)
1344         kernel_signull_unlabeled($1_t)
1345         kernel_sigchld_unlabeled($1_t)
1346         kernel_signal($1_t)
1347
1348         corenet_tcp_bind_generic_port($1_t)
1349         # allow setting up tunnels
1350         corenet_rw_tun_tap_dev($1_t)
1351
1352         dev_getattr_generic_blk_files($1_t)
1353         dev_getattr_generic_chr_files($1_t)
1354         # for lsof
1355         dev_getattr_mtrr_dev($1_t)
1356         # Allow MAKEDEV to work
1357         dev_create_all_blk_files($1_t)
1358         dev_create_all_chr_files($1_t)
1359         dev_delete_all_blk_files($1_t)
1360         dev_delete_all_chr_files($1_t)
1361         dev_rename_all_blk_files($1_t)
1362         dev_rename_all_chr_files($1_t)
1363         dev_create_generic_symlinks($1_t)
1364         dev_rw_generic_usb_dev($1_t)
1365         dev_rw_usbfs($1_t)
1366
1367         domain_setpriority_all_domains($1_t)
1368         domain_read_all_domains_state($1_t)
1369         domain_getattr_all_domains($1_t)
1370         domain_getcap_all_domains($1_t)
1371         domain_dontaudit_ptrace_all_domains($1_t)
1372         # signal all domains:
1373         domain_kill_all_domains($1_t)
1374         domain_signal_all_domains($1_t)
1375         domain_signull_all_domains($1_t)
1376         domain_sigstop_all_domains($1_t)
1377         domain_sigstop_all_domains($1_t)
1378         domain_sigchld_all_domains($1_t)
1379         # for lsof
1380         domain_getattr_all_sockets($1_t)
1381         domain_dontaudit_getattr_all_sockets($1_t)
1382
1383         files_exec_usr_src_files($1_t)
1384
1385         fs_getattr_all_fs($1_t)
1386         fs_getattr_all_files($1_t)
1387         fs_list_all($1_t)
1388         fs_set_all_quotas($1_t)
1389         fs_exec_noxattr($1_t)
1390
1391         storage_raw_read_removable_device($1_t)
1392         storage_raw_write_removable_device($1_t)
1393         storage_dontaudit_read_fixed_disk($1_t)
1394
1395         term_use_all_inherited_terms($1_t)
1396         term_use_unallocated_ttys($1_t)
1397
1398         auth_getattr_shadow($1_t)
1399         # Manage almost all files
1400         files_manage_non_security_dirs($1_t)
1401         files_manage_non_security_files($1_t)
1402         # Relabel almost all files
1403         files_relabel_non_security_files($1_t)
1404
1405         init_telinit($1_t)
1406
1407         logging_send_syslog_msg($1_t)
1408
1409         optional_policy(`
1410                 modutils_domtrans_insmod($1_t)
1411                 modutils_domtrans_depmod($1_t)
1412         ')
1413
1414         # The following rule is temporary until such time that a complete
1415         # policy management infrastructure is in place so that an administrator
1416         # cannot directly manipulate policy files with arbitrary programs.
1417         seutil_manage_src_policy($1_t)
1418         # Violates the goal of limiting write access to checkpolicy.
1419         # But presently necessary for installing the file_contexts file.
1420         seutil_manage_bin_policy($1_t)
1421
1422         systemd_config_all_services($1_t)
1423
1424         userdom_manage_user_home_content_dirs($1_t)
1425         userdom_manage_user_home_content_files($1_t)
1426         userdom_manage_user_home_content_symlinks($1_t)
1427         userdom_manage_user_home_content_pipes($1_t)
1428         userdom_manage_user_home_content_sockets($1_t)
1429         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1430
1431         tunable_policy(`user_rw_noexattrfile',`
1432                 fs_manage_noxattr_fs_files($1_t)
1433                 fs_manage_noxattr_fs_dirs($1_t)
1434         ',`
1435                 fs_read_noxattr_fs_files($1_t)
1436         ')
1437
1438         optional_policy(`
1439                 postgresql_unconfined($1_t)
1440         ')
1441
1442         optional_policy(`
1443                 userhelper_exec($1_t)
1444         ')
1445 ')
1446
1447 ########################################
1448 ## <summary>
1449 ##      Allow user to run as a secadm
1450 ## </summary>
1451 ## <desc>
1452 ##      <p>
1453 ##      Create objects in a user home directory
1454 ##      with an automatic type transition to
1455 ##      a specified private type.
1456 ##      </p>
1457 ##      <p>
1458 ##      This is a templated interface, and should only
1459 ##      be called from a per-userdomain template.
1460 ##      </p>
1461 ## </desc>
1462 ## <param name="domain">
1463 ##      <summary>
1464 ##      Domain allowed access.
1465 ##      </summary>
1466 ## </param>
1467 ## <param name="role">
1468 ##      <summary>
1469 ##      The role  of the object to create.
1470 ##      </summary>
1471 ## </param>
1472 #
1473 template(`userdom_security_admin_template',`
1474         allow $1 self:capability { dac_read_search dac_override };
1475
1476         corecmd_exec_shell($1)
1477
1478         domain_obj_id_change_exemption($1)
1479
1480         dev_relabel_all_dev_nodes($1)
1481
1482         files_create_boot_flag($1)
1483         files_create_default_dir($1)
1484         files_root_filetrans_default($1, dir)
1485
1486         # Necessary for managing /boot/efi
1487         fs_manage_dos_files($1)
1488
1489         mls_process_read_up($1)
1490         mls_file_read_all_levels($1)
1491         mls_file_upgrade($1)
1492         mls_file_downgrade($1)
1493
1494         selinux_set_enforce_mode($1)
1495         selinux_set_all_booleans($1)
1496         selinux_set_parameters($1)
1497         selinux_read_policy($1)
1498
1499         files_relabel_all_files($1)
1500         auth_relabel_shadow($1)
1501
1502         init_exec($1)
1503
1504         logging_send_syslog_msg($1)
1505         logging_read_audit_log($1)
1506         logging_read_generic_logs($1)
1507         logging_read_audit_config($1)
1508
1509         seutil_manage_bin_policy($1)
1510         seutil_manage_default_contexts($1)
1511         seutil_manage_file_contexts($1)
1512         seutil_manage_module_store($1)
1513         seutil_manage_config($1)
1514         seutil_run_checkpolicy($1,$2)
1515         seutil_run_loadpolicy($1,$2)
1516         seutil_run_semanage($1,$2)
1517         seutil_run_setsebool($1,$2)
1518         seutil_run_setfiles($1, $2)
1519
1520         seutil_manage_bin_policy($1)
1521     seutil_manage_default_contexts($1)
1522     seutil_manage_file_contexts($1)
1523     seutil_manage_module_store($1)
1524     seutil_manage_config($1)
1525
1526         optional_policy(`
1527                 aide_run($1,$2)
1528         ')
1529
1530         optional_policy(`
1531                 consoletype_exec($1)
1532         ')
1533
1534         optional_policy(`
1535                 dmesg_exec($1)
1536         ')
1537
1538         optional_policy(`
1539                 ipsec_run_setkey($1,$2)
1540         ')
1541
1542         optional_policy(`
1543                 netlabel_run_mgmt($1,$2)
1544         ')
1545
1546         optional_policy(`
1547                 samhain_run($1, $2)
1548         ')
1549 ')
1550
1551 ########################################
1552 ## <summary>
1553 ##      Make the specified type usable in a
1554 ##      user home directory.
1555 ## </summary>
1556 ## <param name="type">
1557 ##      <summary>
1558 ##      Type to be used as a file in the
1559 ##      user home directory.
1560 ##      </summary>
1561 ## </param>
1562 #
1563 interface(`userdom_user_home_content',`
1564         gen_require(`
1565                 type user_home_t;
1566                 attribute user_home_type;
1567         ')
1568
1569         allow $1 user_home_t:filesystem associate;
1570         files_type($1)
1571         ubac_constrained($1)
1572
1573         files_poly_member($1)
1574         typeattribute $1  user_home_type;
1575 ')
1576
1577 ########################################
1578 ## <summary>
1579 ##      Make the specified type usable in a
1580 ##      generic temporary directory.
1581 ## </summary>
1582 ## <param name="type">
1583 ##      <summary>
1584 ##      Type to be used as a file in the
1585 ##      generic temporary directory.
1586 ##      </summary>
1587 ## </param>
1588 #
1589 interface(`userdom_user_tmp_content',`
1590         gen_require(`
1591                 attribute user_tmp_type;
1592         ')
1593
1594         typeattribute $1 user_tmp_type;
1595
1596         files_tmp_file($1)
1597         ubac_constrained($1)
1598 ')
1599
1600 ########################################
1601 ## <summary>
1602 ##      Make the specified type usable in a
1603 ##      generic tmpfs_t directory.
1604 ## </summary>
1605 ## <param name="type">
1606 ##      <summary>
1607 ##      Type to be used as a file in the
1608 ##      generic temporary directory.
1609 ##      </summary>
1610 ## </param>
1611 #
1612 interface(`userdom_user_tmpfs_content',`
1613         gen_require(`
1614                 attribute user_tmpfs_type;
1615         ')
1616
1617         typeattribute $1 user_tmpfs_type;
1618
1619         files_tmpfs_file($1)
1620         ubac_constrained($1)
1621 ')
1622
1623 ########################################
1624 ## <summary>
1625 ##      Allow domain to attach to TUN devices created by administrative users.
1626 ## </summary>
1627 ## <param name="domain">
1628 ##      <summary>
1629 ##      Domain allowed access.
1630 ##      </summary>
1631 ## </param>
1632 #
1633 interface(`userdom_attach_admin_tun_iface',`
1634         gen_require(`
1635                 attribute admindomain;
1636         ')
1637
1638         allow $1 admindomain:tun_socket relabelfrom;
1639         allow $1 self:tun_socket relabelto;
1640 ')
1641
1642 ########################################
1643 ## <summary>
1644 ##      Set the attributes of a user pty.
1645 ## </summary>
1646 ## <param name="domain">
1647 ##      <summary>
1648 ##      Domain allowed access.
1649 ##      </summary>
1650 ## </param>
1651 #
1652 interface(`userdom_setattr_user_ptys',`
1653         gen_require(`
1654                 type user_devpts_t;
1655         ')
1656
1657         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Create a user pty.
1663 ## </summary>
1664 ## <param name="domain">
1665 ##      <summary>
1666 ##      Domain allowed access.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_create_user_pty',`
1671         gen_require(`
1672                 type user_devpts_t;
1673         ')
1674
1675         term_create_pty($1, user_devpts_t)
1676 ')
1677
1678 ########################################
1679 ## <summary>
1680 ##      Get the attributes of user home directories.
1681 ## </summary>
1682 ## <param name="domain">
1683 ##      <summary>
1684 ##      Domain allowed access.
1685 ##      </summary>
1686 ## </param>
1687 #
1688 interface(`userdom_getattr_user_home_dirs',`
1689         gen_require(`
1690                 type user_home_dir_t;
1691         ')
1692
1693         allow $1 user_home_dir_t:dir getattr_dir_perms;
1694         files_search_home($1)
1695 ')
1696
1697 ########################################
1698 ## <summary>
1699 ##      Do not audit attempts to get the attributes of user home directories.
1700 ## </summary>
1701 ## <param name="domain">
1702 ##      <summary>
1703 ##      Domain to not audit.
1704 ##      </summary>
1705 ## </param>
1706 #
1707 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1708         gen_require(`
1709                 type user_home_dir_t;
1710         ')
1711
1712         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1713 ')
1714
1715 ########################################
1716 ## <summary>
1717 ##      Search user home directories.
1718 ## </summary>
1719 ## <param name="domain">
1720 ##      <summary>
1721 ##      Domain allowed access.
1722 ##      </summary>
1723 ## </param>
1724 #
1725 interface(`userdom_search_user_home_dirs',`
1726         gen_require(`
1727                 type user_home_dir_t;
1728         ')
1729
1730         allow $1 user_home_dir_t:dir search_dir_perms;
1731         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1732         files_search_home($1)
1733 ')
1734
1735 ########################################
1736 ## <summary>
1737 ##      Do not audit attempts to search user home directories.
1738 ## </summary>
1739 ## <desc>
1740 ##      <p>
1741 ##      Do not audit attempts to search user home directories.
1742 ##      This will supress SELinux denial messages when the specified
1743 ##      domain is denied the permission to search these directories.
1744 ##      </p>
1745 ## </desc>
1746 ## <param name="domain">
1747 ##      <summary>
1748 ##      Domain to not audit.
1749 ##      </summary>
1750 ## </param>
1751 ## <infoflow type="none"/>
1752 #
1753 interface(`userdom_dontaudit_search_user_home_dirs',`
1754         gen_require(`
1755                 type user_home_dir_t;
1756         ')
1757
1758         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1759 ')
1760
1761 ########################################
1762 ## <summary>
1763 ##      List user home directories.
1764 ## </summary>
1765 ## <param name="domain">
1766 ##      <summary>
1767 ##      Domain allowed access.
1768 ##      </summary>
1769 ## </param>
1770 #
1771 interface(`userdom_list_user_home_dirs',`
1772         gen_require(`
1773                 type user_home_dir_t;
1774         ')
1775
1776         allow $1 user_home_dir_t:dir list_dir_perms;
1777         files_search_home($1)
1778
1779         tunable_policy(`use_nfs_home_dirs',`
1780                 fs_list_nfs($1)
1781         ')
1782
1783         tunable_policy(`use_samba_home_dirs',`
1784                 fs_list_cifs($1)
1785         ')
1786 ')
1787
1788 ########################################
1789 ## <summary>
1790 ##      Do not audit attempts to list user home subdirectories.
1791 ## </summary>
1792 ## <param name="domain">
1793 ##      <summary>
1794 ##      Domain to not audit.
1795 ##      </summary>
1796 ## </param>
1797 #
1798 interface(`userdom_dontaudit_list_user_home_dirs',`
1799         gen_require(`
1800                 type user_home_dir_t;
1801                 type user_home_t;
1802         ')
1803
1804         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1805         dontaudit $1 user_home_t:dir list_dir_perms;
1806 ')
1807
1808 ########################################
1809 ## <summary>
1810 ##      Create user home directories.
1811 ## </summary>
1812 ## <param name="domain">
1813 ##      <summary>
1814 ##      Domain allowed access.
1815 ##      </summary>
1816 ## </param>
1817 #
1818 interface(`userdom_create_user_home_dirs',`
1819         gen_require(`
1820                 type user_home_dir_t;
1821         ')
1822
1823         allow $1 user_home_dir_t:dir create_dir_perms;
1824 ')
1825
1826 ########################################
1827 ## <summary>
1828 ##      Create user home directories.
1829 ## </summary>
1830 ## <param name="domain">
1831 ##      <summary>
1832 ##      Domain allowed access.
1833 ##      </summary>
1834 ## </param>
1835 #
1836 interface(`userdom_manage_user_home_dirs',`
1837         gen_require(`
1838                 type user_home_dir_t;
1839         ')
1840
1841         allow $1 user_home_dir_t:dir manage_dir_perms;
1842 ')
1843
1844 ########################################
1845 ## <summary>
1846 ##      Relabel to user home directories.
1847 ## </summary>
1848 ## <param name="domain">
1849 ##      <summary>
1850 ##      Domain allowed access.
1851 ##      </summary>
1852 ## </param>
1853 #
1854 interface(`userdom_relabelto_user_home_dirs',`
1855         gen_require(`
1856                 type user_home_dir_t;
1857         ')
1858
1859         allow $1 user_home_dir_t:dir relabelto;
1860 ')
1861
1862
1863 ########################################
1864 ## <summary>
1865 ##      Relabel to user home files.
1866 ## </summary>
1867 ## <param name="domain">
1868 ##      <summary>
1869 ##      Domain allowed access.
1870 ##      </summary>
1871 ## </param>
1872 #
1873 interface(`userdom_relabelto_user_home_files',`
1874         gen_require(`
1875                 type user_home_t;
1876         ')
1877
1878         allow $1 user_home_t:file relabelto;
1879 ')
1880 ########################################
1881 ## <summary>
1882 ##      Relabel user home files.
1883 ## </summary>
1884 ## <param name="domain">
1885 ##      <summary>
1886 ##      Domain allowed access.
1887 ##      </summary>
1888 ## </param>
1889 #
1890 interface(`userdom_relabel_user_home_files',`
1891         gen_require(`
1892                 type user_home_t;
1893         ')
1894
1895         allow $1 user_home_t:file relabel_file_perms;
1896 ')
1897
1898 ########################################
1899 ## <summary>
1900 ##      Create directories in the home dir root with
1901 ##      the user home directory type.
1902 ## </summary>
1903 ## <param name="domain">
1904 ##      <summary>
1905 ##      Domain allowed access.
1906 ##      </summary>
1907 ## </param>
1908 #
1909 interface(`userdom_home_filetrans_user_home_dir',`
1910         gen_require(`
1911                 type user_home_dir_t;
1912         ')
1913
1914         files_home_filetrans($1, user_home_dir_t, dir)
1915 ')
1916
1917 ########################################
1918 ## <summary>
1919 ##      Do a domain transition to the specified
1920 ##      domain when executing a program in the
1921 ##      user home directory.
1922 ## </summary>
1923 ## <desc>
1924 ##      <p>
1925 ##      Do a domain transition to the specified
1926 ##      domain when executing a program in the
1927 ##      user home directory.
1928 ##      </p>
1929 ##      <p>
1930 ##      No interprocess communication (signals, pipes,
1931 ##      etc.) is provided by this interface since
1932 ##      the domains are not owned by this module.
1933 ##      </p>
1934 ## </desc>
1935 ## <param name="source_domain">
1936 ##      <summary>
1937 ##      Domain allowed to transition.
1938 ##      </summary>
1939 ## </param>
1940 ## <param name="target_domain">
1941 ##      <summary>
1942 ##      Domain to transition to.
1943 ##      </summary>
1944 ## </param>
1945 #
1946 interface(`userdom_user_home_domtrans',`
1947         gen_require(`
1948                 type user_home_dir_t, user_home_t;
1949         ')
1950
1951         domain_auto_trans($1, user_home_t, $2)
1952         allow $1 user_home_dir_t:dir search_dir_perms;
1953         files_search_home($1)
1954 ')
1955
1956 ########################################
1957 ## <summary>
1958 ##      Do not audit attempts to search user home content directories.
1959 ## </summary>
1960 ## <param name="domain">
1961 ##      <summary>
1962 ##      Domain to not audit.
1963 ##      </summary>
1964 ## </param>
1965 #
1966 interface(`userdom_dontaudit_search_user_home_content',`
1967         gen_require(`
1968                 type user_home_t;
1969         ')
1970
1971         dontaudit $1 user_home_t:dir search_dir_perms;
1972         fs_dontaudit_list_nfs($1)
1973         fs_dontaudit_list_cifs($1)
1974 ')
1975
1976 ########################################
1977 ## <summary>
1978 ##      List contents of users home directory.
1979 ## </summary>
1980 ## <param name="domain">
1981 ##      <summary>
1982 ##      Domain allowed access.
1983 ##      </summary>
1984 ## </param>
1985 #
1986 interface(`userdom_list_user_home_content',`
1987         gen_require(`
1988                 type user_home_dir_t;
1989                 attribute user_home_type;
1990         ')
1991
1992         files_list_home($1)
1993         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1994 ')
1995
1996 ########################################
1997 ## <summary>
1998 ##      Create, read, write, and delete directories
1999 ##      in a user home subdirectory.
2000 ## </summary>
2001 ## <param name="domain">
2002 ##      <summary>
2003 ##      Domain allowed access.
2004 ##      </summary>
2005 ## </param>
2006 #
2007 interface(`userdom_manage_user_home_content_dirs',`
2008         gen_require(`
2009                 type user_home_dir_t, user_home_t;
2010         ')
2011
2012         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2013         files_search_home($1)
2014 ')
2015
2016 ########################################
2017 ## <summary>
2018 ##      Delete directories in a user home subdirectory.
2019 ## </summary>
2020 ## <param name="domain">
2021 ##      <summary>
2022 ##      Domain allowed access.
2023 ##      </summary>
2024 ## </param>
2025 #
2026 interface(`userdom_delete_user_home_content_dirs',`
2027         gen_require(`
2028                 type user_home_t;
2029         ')
2030
2031         allow $1 user_home_t:dir delete_dir_perms;
2032 ')
2033
2034 ########################################
2035 ## <summary>
2036 ##      Delete all directories in a user home subdirectory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`userdom_delete_all_user_home_content_dirs',`
2045         gen_require(`
2046                 attribute user_home_type;
2047         ')
2048
2049         allow $1 user_home_type:dir delete_dir_perms;
2050 ')
2051
2052 ########################################
2053 ## <summary>
2054 ##      Set the attributes of user home files.
2055 ## </summary>
2056 ## <param name="domain">
2057 ##      <summary>
2058 ##      Domain allowed access.
2059 ##      </summary>
2060 ## </param>
2061 ## <rolecap/>
2062 #
2063 interface(`userdom_setattr_user_home_content_files',`
2064         gen_require(`
2065                 type user_home_t;
2066         ')
2067
2068         allow $1 user_home_t:file setattr;
2069 ')
2070
2071 ########################################
2072 ## <summary>
2073 ##      Do not audit attempts to set the
2074 ##      attributes of user home files.
2075 ## </summary>
2076 ## <param name="domain">
2077 ##      <summary>
2078 ##      Domain to not audit.
2079 ##      </summary>
2080 ## </param>
2081 #
2082 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2083         gen_require(`
2084                 type user_home_t;
2085         ')
2086
2087         dontaudit $1 user_home_t:file setattr_file_perms;
2088 ')
2089
2090 ########################################
2091 ## <summary>
2092 ##      Set the attributes of all user home directories.
2093 ## </summary>
2094 ## <param name="domain">
2095 ##      <summary>
2096 ##      Domain allowed access.
2097 ##      </summary>
2098 ## </param>
2099 ## <rolecap/>
2100 #
2101 interface(`userdom_setattr_all_user_home_content_dirs',`
2102         gen_require(`
2103                 attribute user_home_type;
2104         ')
2105
2106         allow $1 user_home_type:dir setattr_dir_perms;
2107 ')
2108
2109 ########################################
2110 ## <summary>
2111 ##      Mmap user home files.
2112 ## </summary>
2113 ## <param name="domain">
2114 ##      <summary>
2115 ##      Domain allowed access.
2116 ##      </summary>
2117 ## </param>
2118 #
2119 interface(`userdom_mmap_user_home_content_files',`
2120         gen_require(`
2121                 type user_home_dir_t, user_home_t;
2122         ')
2123
2124         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2125         files_search_home($1)
2126 ')
2127
2128 ########################################
2129 ## <summary>
2130 ##      Read user home files.
2131 ## </summary>
2132 ## <param name="domain">
2133 ##      <summary>
2134 ##      Domain allowed access.
2135 ##      </summary>
2136 ## </param>
2137 #
2138 interface(`userdom_read_user_home_content_files',`
2139         gen_require(`
2140                 type user_home_dir_t, user_home_t;
2141         ')
2142
2143         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2144         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2145         files_search_home($1)
2146 ')
2147
2148 ########################################
2149 ## <summary>
2150 ##      Do not audit attempts to getattr user home files.
2151 ## </summary>
2152 ## <param name="domain">
2153 ##      <summary>
2154 ##      Domain to not audit.
2155 ##      </summary>
2156 ## </param>
2157 #
2158 interface(`userdom_dontaudit_getattr_user_home_content',`
2159         gen_require(`
2160                 attribute user_home_type;
2161         ')
2162
2163         dontaudit $1 user_home_type:dir getattr;
2164         dontaudit $1 user_home_type:file getattr;
2165 ')
2166
2167 ########################################
2168 ## <summary>
2169 ##      Do not audit attempts to read user home files.
2170 ## </summary>
2171 ## <param name="domain">
2172 ##      <summary>
2173 ##      Domain to not audit.
2174 ##      </summary>
2175 ## </param>
2176 #
2177 interface(`userdom_dontaudit_read_user_home_content_files',`
2178         gen_require(`
2179                 attribute user_home_type;
2180                 type user_home_dir_t;
2181         ')
2182
2183         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2184         dontaudit $1 user_home_type:dir list_dir_perms;
2185         dontaudit $1 user_home_type:file read_file_perms;
2186         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2187 ')
2188
2189 ########################################
2190 ## <summary>
2191 ##      Do not audit attempts to append user home files.
2192 ## </summary>
2193 ## <param name="domain">
2194 ##      <summary>
2195 ##      Domain to not audit.
2196 ##      </summary>
2197 ## </param>
2198 #
2199 interface(`userdom_dontaudit_append_user_home_content_files',`
2200         gen_require(`
2201                 type user_home_t;
2202         ')
2203
2204         dontaudit $1 user_home_t:file append_file_perms;
2205 ')
2206
2207 ########################################
2208 ## <summary>
2209 ##      Do not audit attempts to write user home files.
2210 ## </summary>
2211 ## <param name="domain">
2212 ##      <summary>
2213 ##      Domain to not audit.
2214 ##      </summary>
2215 ## </param>
2216 #
2217 interface(`userdom_dontaudit_write_user_home_content_files',`
2218         gen_require(`
2219                 type user_home_t;
2220         ')
2221
2222         dontaudit $1 user_home_t:file write_file_perms;
2223 ')
2224
2225 ########################################
2226 ## <summary>
2227 ##      Delete files in a user home subdirectory.
2228 ## </summary>
2229 ## <param name="domain">
2230 ##      <summary>
2231 ##      Domain allowed access.
2232 ##      </summary>
2233 ## </param>
2234 #
2235 interface(`userdom_delete_user_home_content_files',`
2236         gen_require(`
2237                 type user_home_t;
2238         ')
2239
2240         allow $1 user_home_t:file delete_file_perms;
2241 ')
2242
2243 ########################################
2244 ## <summary>
2245 ##      Delete all files in a user home subdirectory.
2246 ## </summary>
2247 ## <param name="domain">
2248 ##      <summary>
2249 ##      Domain allowed access.
2250 ##      </summary>
2251 ## </param>
2252 #
2253 interface(`userdom_delete_all_user_home_content_files',`
2254         gen_require(`
2255                 attribute user_home_type;
2256         ')
2257
2258         allow $1 user_home_type:file delete_file_perms;
2259 ')
2260
2261 ########################################
2262 ## <summary>
2263 ##      Delete sock files in a user home subdirectory.
2264 ## </summary>
2265 ## <param name="domain">
2266 ##      <summary>
2267 ##      Domain allowed access.
2268 ##      </summary>
2269 ## </param>
2270 #
2271 interface(`userdom_delete_user_home_content_sock_files',`
2272         gen_require(`
2273                 type user_home_t;
2274         ')
2275
2276         allow $1 user_home_t:sock_file delete_file_perms;
2277 ')
2278
2279 ########################################
2280 ## <summary>
2281 ##      Delete all sock files in a user home subdirectory.
2282 ## </summary>
2283 ## <param name="domain">
2284 ##      <summary>
2285 ##      Domain allowed access.
2286 ##      </summary>
2287 ## </param>
2288 #
2289 interface(`userdom_delete_all_user_home_content_sock_files',`
2290         gen_require(`
2291                 attribute user_home_type;
2292         ')
2293
2294         allow $1 user_home_type:sock_file delete_file_perms;
2295 ')
2296
2297 ########################################
2298 ## <summary>
2299 ##      Do not audit attempts to write user home files.
2300 ## </summary>
2301 ## <param name="domain">
2302 ##      <summary>
2303 ##      Domain to not audit.
2304 ##      </summary>
2305 ## </param>
2306 #
2307 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2308         gen_require(`
2309                 type user_home_t;
2310         ')
2311
2312         dontaudit $1 user_home_t:file relabel_file_perms;
2313 ')
2314
2315 ########################################
2316 ## <summary>
2317 ##      Read user home subdirectory symbolic links.
2318 ## </summary>
2319 ## <param name="domain">
2320 ##      <summary>
2321 ##      Domain allowed access.
2322 ##      </summary>
2323 ## </param>
2324 #
2325 interface(`userdom_read_user_home_content_symlinks',`
2326         gen_require(`
2327                 type user_home_dir_t, user_home_t;
2328         ')
2329
2330         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2331 ')
2332
2333 ########################################
2334 ## <summary>
2335 ##      Execute user home files.
2336 ## </summary>
2337 ## <param name="domain">
2338 ##      <summary>
2339 ##      Domain allowed access.
2340 ##      </summary>
2341 ## </param>
2342 ## <rolecap/>
2343 #
2344 interface(`userdom_exec_user_home_content_files',`
2345         gen_require(`
2346                 type user_home_dir_t;
2347                 attribute user_home_type;
2348         ')
2349
2350         files_search_home($1)
2351         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2352         dontaudit $1 user_home_type:sock_file execute;
2353         ')
2354
2355 ########################################
2356 ## <summary>
2357 ##      Do not audit attempts to execute user home files.
2358 ## </summary>
2359 ## <param name="domain">
2360 ##      <summary>
2361 ##      Domain to not audit.
2362 ##      </summary>
2363 ## </param>
2364 #
2365 interface(`userdom_dontaudit_exec_user_home_content_files',`
2366         gen_require(`
2367                 type user_home_t;
2368         ')
2369
2370         dontaudit $1 user_home_t:file exec_file_perms;
2371 ')
2372
2373 ########################################
2374 ## <summary>
2375 ##      Create, read, write, and delete files
2376 ##      in a user home subdirectory.
2377 ## </summary>
2378 ## <param name="domain">
2379 ##      <summary>
2380 ##      Domain allowed access.
2381 ##      </summary>
2382 ## </param>
2383 #
2384 interface(`userdom_manage_user_home_content_files',`
2385         gen_require(`
2386                 type user_home_dir_t, user_home_t;
2387         ')
2388
2389         manage_files_pattern($1, user_home_t, user_home_t)
2390         allow $1 user_home_dir_t:dir search_dir_perms;
2391         files_search_home($1)
2392 ')
2393
2394 ########################################
2395 ## <summary>
2396 ##      Do not audit attempts to create, read, write, and delete directories
2397 ##      in a user home subdirectory.
2398 ## </summary>
2399 ## <param name="domain">
2400 ##      <summary>
2401 ##      Domain to not audit.
2402 ##      </summary>
2403 ## </param>
2404 #
2405 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2406         gen_require(`
2407                 type user_home_dir_t, user_home_t;
2408         ')
2409
2410         dontaudit $1 user_home_t:dir manage_dir_perms;
2411 ')
2412
2413 ########################################
2414 ## <summary>
2415 ##      Create, read, write, and delete symbolic links
2416 ##      in a user home subdirectory.
2417 ## </summary>
2418 ## <param name="domain">
2419 ##      <summary>
2420 ##      Domain allowed access.
2421 ##      </summary>
2422 ## </param>
2423 #
2424 interface(`userdom_manage_user_home_content_symlinks',`
2425         gen_require(`
2426                 type user_home_dir_t, user_home_t;
2427         ')
2428
2429         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2430         allow $1 user_home_dir_t:dir search_dir_perms;
2431         files_search_home($1)
2432 ')
2433
2434 ########################################
2435 ## <summary>
2436 ##      Delete symbolic links in a user home directory.
2437 ## </summary>
2438 ## <param name="domain">
2439 ##      <summary>
2440 ##      Domain allowed access.
2441 ##      </summary>
2442 ## </param>
2443 #
2444 interface(`userdom_delete_user_home_content_symlinks',`
2445         gen_require(`
2446                 type user_home_t;
2447         ')
2448
2449         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2450 ')
2451
2452 ########################################
2453 ## <summary>
2454 ##      Delete all symbolic links in a user home directory.
2455 ## </summary>
2456 ## <param name="domain">
2457 ##      <summary>
2458 ##      Domain allowed access.
2459 ##      </summary>
2460 ## </param>
2461 #
2462 interface(`userdom_delete_all_user_home_content_symlinks',`
2463         gen_require(`
2464                 attribute user_home_type;
2465         ')
2466
2467         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2468 ')
2469
2470 ########################################
2471 ## <summary>
2472 ##      Create, read, write, and delete named pipes
2473 ##      in a user home subdirectory.
2474 ## </summary>
2475 ## <param name="domain">
2476 ##      <summary>
2477 ##      Domain allowed access.
2478 ##      </summary>
2479 ## </param>
2480 #
2481 interface(`userdom_manage_user_home_content_pipes',`
2482         gen_require(`
2483                 type user_home_dir_t, user_home_t;
2484         ')
2485
2486         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2487         allow $1 user_home_dir_t:dir search_dir_perms;
2488         files_search_home($1)
2489 ')
2490
2491 ########################################
2492 ## <summary>
2493 ##      Create, read, write, and delete named sockets
2494 ##      in a user home subdirectory.
2495 ## </summary>
2496 ## <param name="domain">
2497 ##      <summary>
2498 ##      Domain allowed access.
2499 ##      </summary>
2500 ## </param>
2501 #
2502 interface(`userdom_manage_user_home_content_sockets',`
2503         gen_require(`
2504                 type user_home_dir_t, user_home_t;
2505         ')
2506
2507         allow $1 user_home_dir_t:dir search_dir_perms;
2508         manage_sock_files_pattern($1, user_home_t, user_home_t)
2509         files_search_home($1)
2510 ')
2511
2512 ########################################
2513 ## <summary>
2514 ##      Create objects in a user home directory
2515 ##      with an automatic type transition to
2516 ##      a specified private type.
2517 ## </summary>
2518 ## <param name="domain">
2519 ##      <summary>
2520 ##      Domain allowed access.
2521 ##      </summary>
2522 ## </param>
2523 ## <param name="private_type">
2524 ##      <summary>
2525 ##      The type of the object to create.
2526 ##      </summary>
2527 ## </param>
2528 ## <param name="object_class">
2529 ##      <summary>
2530 ##      The class of the object to be created.
2531 ##      </summary>
2532 ## </param>
2533 #
2534 interface(`userdom_user_home_dir_filetrans',`
2535         gen_require(`
2536                 type user_home_dir_t;
2537         ')
2538
2539         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2540         files_search_home($1)
2541 ')
2542
2543 ########################################
2544 ## <summary>
2545 ##      Create objects in a user home directory
2546 ##      with an automatic type transition to
2547 ##      a specified private type.
2548 ## </summary>
2549 ## <param name="domain">
2550 ##      <summary>
2551 ##      Domain allowed access.
2552 ##      </summary>
2553 ## </param>
2554 ## <param name="private_type">
2555 ##      <summary>
2556 ##      The type of the object to create.
2557 ##      </summary>
2558 ## </param>
2559 ## <param name="object_class">
2560 ##      <summary>
2561 ##      The class of the object to be created.
2562 ##      </summary>
2563 ## </param>
2564 #
2565 interface(`userdom_user_home_content_filetrans',`
2566         gen_require(`
2567                 type user_home_dir_t, user_home_t;
2568         ')
2569
2570         filetrans_pattern($1, user_home_t, $2, $3, $4)
2571         allow $1 user_home_dir_t:dir search_dir_perms;
2572         files_search_home($1)
2573 ')
2574
2575 ########################################
2576 ## <summary>
2577 ##      Create objects in a user home directory
2578 ##      with an automatic type transition to
2579 ##      the user home file type.
2580 ## </summary>
2581 ## <param name="domain">
2582 ##      <summary>
2583 ##      Domain allowed access.
2584 ##      </summary>
2585 ## </param>
2586 ## <param name="object_class">
2587 ##      <summary>
2588 ##      The class of the object to be created.
2589 ##      </summary>
2590 ## </param>
2591 #
2592 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2593         gen_require(`
2594                 type user_home_dir_t, user_home_t;
2595         ')
2596
2597         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2598         files_search_home($1)
2599 ')
2600
2601 ########################################
2602 ## <summary>
2603 ##      Write to user temporary named sockets.
2604 ## </summary>
2605 ## <param name="domain">
2606 ##      <summary>
2607 ##      Domain allowed access.
2608 ##      </summary>
2609 ## </param>
2610 #
2611 interface(`userdom_write_user_tmp_sockets',`
2612         gen_require(`
2613                 type user_tmp_t;
2614         ')
2615
2616         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2617         files_search_tmp($1)
2618 ')
2619
2620 ########################################
2621 ## <summary>
2622 ##      List user temporary directories.
2623 ## </summary>
2624 ## <param name="domain">
2625 ##      <summary>
2626 ##      Domain allowed access.
2627 ##      </summary>
2628 ## </param>
2629 #
2630 interface(`userdom_list_user_tmp',`
2631         gen_require(`
2632                 type user_tmp_t;
2633         ')
2634
2635         allow $1 user_tmp_t:dir list_dir_perms;
2636         files_search_tmp($1)
2637 ')
2638
2639 ########################################
2640 ## <summary>
2641 ##      Do not audit attempts to list user
2642 ##      temporary directories.
2643 ## </summary>
2644 ## <param name="domain">
2645 ##      <summary>
2646 ##      Domain to not audit.
2647 ##      </summary>
2648 ## </param>
2649 #
2650 interface(`userdom_dontaudit_list_user_tmp',`
2651         gen_require(`
2652                 type user_tmp_t;
2653         ')
2654
2655         dontaudit $1 user_tmp_t:dir list_dir_perms;
2656 ')
2657
2658 ########################################
2659 ## <summary>
2660 ##      Do not audit attempts to manage users
2661 ##      temporary directories.
2662 ## </summary>
2663 ## <param name="domain">
2664 ##      <summary>
2665 ##      Domain to not audit.
2666 ##      </summary>
2667 ## </param>
2668 #
2669 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2670         gen_require(`
2671                 type user_tmp_t;
2672         ')
2673
2674         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2675 ')
2676
2677 ########################################
2678 ## <summary>
2679 ##      Read user temporary files.
2680 ## </summary>
2681 ## <param name="domain">
2682 ##      <summary>
2683 ##      Domain allowed access.
2684 ##      </summary>
2685 ## </param>
2686 #
2687 interface(`userdom_read_user_tmp_files',`
2688         gen_require(`
2689                 type user_tmp_t;
2690         ')
2691
2692         read_files_pattern($1, user_tmp_t, user_tmp_t)
2693         allow $1 user_tmp_t:dir list_dir_perms;
2694         files_search_tmp($1)
2695 ')
2696
2697 ########################################
2698 ## <summary>
2699 ##      Do not audit attempts to read users
2700 ##      temporary files.
2701 ## </summary>
2702 ## <param name="domain">
2703 ##      <summary>
2704 ##      Domain to not audit.
2705 ##      </summary>
2706 ## </param>
2707 #
2708 interface(`userdom_dontaudit_read_user_tmp_files',`
2709         gen_require(`
2710                 type user_tmp_t;
2711         ')
2712
2713         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2714 ')
2715
2716 ########################################
2717 ## <summary>
2718 ##      Do not audit attempts to append users
2719 ##      temporary files.
2720 ## </summary>
2721 ## <param name="domain">
2722 ##      <summary>
2723 ##      Domain to not audit.
2724 ##      </summary>
2725 ## </param>
2726 #
2727 interface(`userdom_dontaudit_append_user_tmp_files',`
2728         gen_require(`
2729                 type user_tmp_t;
2730         ')
2731
2732         dontaudit $1 user_tmp_t:file append_file_perms;
2733 ')
2734
2735 ########################################
2736 ## <summary>
2737 ##      Read and write user temporary files.
2738 ## </summary>
2739 ## <param name="domain">
2740 ##      <summary>
2741 ##      Domain allowed access.
2742 ##      </summary>
2743 ## </param>
2744 #
2745 interface(`userdom_rw_user_tmp_files',`
2746         gen_require(`
2747                 type user_tmp_t;
2748         ')
2749
2750         allow $1 user_tmp_t:dir list_dir_perms;
2751         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2752         files_search_tmp($1)
2753 ')
2754
2755 ########################################
2756 ## <summary>
2757 ##      Do not audit attempts to manage users
2758 ##      temporary files.
2759 ## </summary>
2760 ## <param name="domain">
2761 ##      <summary>
2762 ##      Domain to not audit.
2763 ##      </summary>
2764 ## </param>
2765 #
2766 interface(`userdom_dontaudit_manage_user_tmp_files',`
2767         gen_require(`
2768                 type user_tmp_t;
2769         ')
2770
2771         dontaudit $1 user_tmp_t:file manage_file_perms;
2772 ')
2773
2774 ########################################
2775 ## <summary>
2776 ##      Read user temporary symbolic links.
2777 ## </summary>
2778 ## <param name="domain">
2779 ##      <summary>
2780 ##      Domain allowed access.
2781 ##      </summary>
2782 ## </param>
2783 #
2784 interface(`userdom_read_user_tmp_symlinks',`
2785         gen_require(`
2786                 type user_tmp_t;
2787         ')
2788
2789         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2790         allow $1 user_tmp_t:dir list_dir_perms;
2791         files_search_tmp($1)
2792 ')
2793
2794 ########################################
2795 ## <summary>
2796 ##      Create, read, write, and delete user
2797 ##      temporary directories.
2798 ## </summary>
2799 ## <param name="domain">
2800 ##      <summary>
2801 ##      Domain allowed access.
2802 ##      </summary>
2803 ## </param>
2804 #
2805 interface(`userdom_manage_user_tmp_dirs',`
2806         gen_require(`
2807                 type user_tmp_t;
2808         ')
2809
2810         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2811         files_search_tmp($1)
2812 ')
2813
2814 ########################################
2815 ## <summary>
2816 ##      Create, read, write, and delete user
2817 ##      temporary files.
2818 ## </summary>
2819 ## <param name="domain">
2820 ##      <summary>
2821 ##      Domain allowed access.
2822 ##      </summary>
2823 ## </param>
2824 #
2825 interface(`userdom_manage_user_tmp_files',`
2826         gen_require(`
2827                 type user_tmp_t;
2828         ')
2829
2830         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2831         files_search_tmp($1)
2832 ')
2833
2834 ########################################
2835 ## <summary>
2836 ##      Create, read, write, and delete user
2837 ##      temporary symbolic links.
2838 ## </summary>
2839 ## <param name="domain">
2840 ##      <summary>
2841 ##      Domain allowed access.
2842 ##      </summary>
2843 ## </param>
2844 #
2845 interface(`userdom_manage_user_tmp_symlinks',`
2846         gen_require(`
2847                 type user_tmp_t;
2848         ')
2849
2850         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2851         files_search_tmp($1)
2852 ')
2853
2854 ########################################
2855 ## <summary>
2856 ##      Create, read, write, and delete user
2857 ##      temporary named pipes.
2858 ## </summary>
2859 ## <param name="domain">
2860 ##      <summary>
2861 ##      Domain allowed access.
2862 ##      </summary>
2863 ## </param>
2864 #
2865 interface(`userdom_manage_user_tmp_pipes',`
2866         gen_require(`
2867                 type user_tmp_t;
2868         ')
2869
2870         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2871         files_search_tmp($1)
2872 ')
2873
2874 ########################################
2875 ## <summary>
2876 ##      Create, read, write, and delete user
2877 ##      temporary named sockets.
2878 ## </summary>
2879 ## <param name="domain">
2880 ##      <summary>
2881 ##      Domain allowed access.
2882 ##      </summary>
2883 ## </param>
2884 #
2885 interface(`userdom_manage_user_tmp_sockets',`
2886         gen_require(`
2887                 type user_tmp_t;
2888         ')
2889
2890         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2891         files_search_tmp($1)
2892 ')
2893
2894 ########################################
2895 ## <summary>
2896 ##      Create objects in a user temporary directory
2897 ##      with an automatic type transition to
2898 ##      a specified private type.
2899 ## </summary>
2900 ## <param name="domain">
2901 ##      <summary>
2902 ##      Domain allowed access.
2903 ##      </summary>
2904 ## </param>
2905 ## <param name="private_type">
2906 ##      <summary>
2907 ##      The type of the object to create.
2908 ##      </summary>
2909 ## </param>
2910 ## <param name="object_class">
2911 ##      <summary>
2912 ##      The class of the object to be created.
2913 ##      </summary>
2914 ## </param>
2915 #
2916 interface(`userdom_user_tmp_filetrans',`
2917         gen_require(`
2918                 type user_tmp_t;
2919         ')
2920
2921         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2922         files_search_tmp($1)
2923 ')
2924
2925 ########################################
2926 ## <summary>
2927 ##      Create objects in the temporary directory
2928 ##      with an automatic type transition to
2929 ##      the user temporary type.
2930 ## </summary>
2931 ## <param name="domain">
2932 ##      <summary>
2933 ##      Domain allowed access.
2934 ##      </summary>
2935 ## </param>
2936 ## <param name="object_class">
2937 ##      <summary>
2938 ##      The class of the object to be created.
2939 ##      </summary>
2940 ## </param>
2941 #
2942 interface(`userdom_tmp_filetrans_user_tmp',`
2943         gen_require(`
2944                 type user_tmp_t;
2945         ')
2946
2947         files_tmp_filetrans($1, user_tmp_t, $2)
2948 ')
2949
2950 #######################################
2951 ## <summary>
2952 ##  Getattr user tmpfs files.
2953 ## </summary>
2954 ## <param name="domain">
2955 ##  <summary>
2956 ##  Domain allowed access.
2957 ##  </summary>
2958 ## </param>
2959 #
2960 interface(`userdom_getattr_user_tmpfs_files',`
2961     gen_require(`
2962         type user_tmpfs_t;
2963     ')
2964
2965     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2966     fs_search_tmpfs($1)
2967 ')
2968
2969 ########################################
2970 ## <summary>
2971 ##      Read user tmpfs files.
2972 ## </summary>
2973 ## <param name="domain">
2974 ##      <summary>
2975 ##      Domain allowed access.
2976 ##      </summary>
2977 ## </param>
2978 #
2979 interface(`userdom_read_user_tmpfs_files',`
2980         gen_require(`
2981                 type user_tmpfs_t;
2982         ')
2983
2984         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2985         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2986         allow $1 user_tmpfs_t:dir list_dir_perms;
2987         fs_search_tmpfs($1)
2988 ')
2989
2990 ########################################
2991 ## <summary>
2992 ##      Read/Write user tmpfs files.
2993 ## </summary>
2994 ## <param name="domain">
2995 ##      <summary>
2996 ##      Domain allowed access.
2997 ##      </summary>
2998 ## </param>
2999 #
3000 interface(`userdom_rw_user_tmpfs_files',`
3001         gen_require(`
3002                 type user_tmpfs_t;
3003         ')
3004
3005         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3006         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3007         allow $1 user_tmpfs_t:dir list_dir_perms;
3008         fs_search_tmpfs($1)
3009 ')
3010
3011 ########################################
3012 ## <summary>
3013 ##      Read/Write inherited user tmpfs files.
3014 ## </summary>
3015 ## <param name="domain">
3016 ##      <summary>
3017 ##      Domain allowed access.
3018 ##      </summary>
3019 ## </param>
3020 #
3021 interface(`userdom_rw_inherited_user_tmpfs_files',`
3022         gen_require(`
3023                 type user_tmpfs_t;
3024         ')
3025
3026         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3027 ')
3028
3029 ########################################
3030 ## <summary>
3031 ##      Execute user tmpfs files.
3032 ## </summary>
3033 ## <param name="domain">
3034 ##      <summary>
3035 ##      Domain allowed access.
3036 ##      </summary>
3037 ## </param>
3038 #
3039 interface(`userdom_execute_user_tmpfs_files',`
3040         gen_require(`
3041                 type user_tmpfs_t;
3042         ')
3043
3044         allow $1 user_tmpfs_t:file execute;
3045 ')
3046
3047 ########################################
3048 ## <summary>
3049 ##      Get the attributes of a user domain tty.
3050 ## </summary>
3051 ## <param name="domain">
3052 ##      <summary>
3053 ##      Domain allowed access.
3054 ##      </summary>
3055 ## </param>
3056 #
3057 interface(`userdom_getattr_user_ttys',`
3058         gen_require(`
3059                 type user_tty_device_t;
3060         ')
3061
3062         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3063 ')
3064
3065 ########################################
3066 ## <summary>
3067 ##      Do not audit attempts to get the attributes of a user domain tty.
3068 ## </summary>
3069 ## <param name="domain">
3070 ##      <summary>
3071 ##      Domain to not audit.
3072 ##      </summary>
3073 ## </param>
3074 #
3075 interface(`userdom_dontaudit_getattr_user_ttys',`
3076         gen_require(`
3077                 type user_tty_device_t;
3078         ')
3079
3080         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3081 ')
3082
3083 ########################################
3084 ## <summary>
3085 ##      Set the attributes of a user domain tty.
3086 ## </summary>
3087 ## <param name="domain">
3088 ##      <summary>
3089 ##      Domain allowed access.
3090 ##      </summary>
3091 ## </param>
3092 #
3093 interface(`userdom_setattr_user_ttys',`
3094         gen_require(`
3095                 type user_tty_device_t;
3096         ')
3097
3098         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3099 ')
3100
3101 ########################################
3102 ## <summary>
3103 ##      Do not audit attempts to set the attributes of a user domain tty.
3104 ## </summary>
3105 ## <param name="domain">
3106 ##      <summary>
3107 ##      Domain to not audit.
3108 ##      </summary>
3109 ## </param>
3110 #
3111 interface(`userdom_dontaudit_setattr_user_ttys',`
3112         gen_require(`
3113                 type user_tty_device_t;
3114         ')
3115
3116         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3117 ')
3118
3119 ########################################
3120 ## <summary>
3121 ##      Read and write a user domain tty.
3122 ## </summary>
3123 ## <param name="domain">
3124 ##      <summary>
3125 ##      Domain allowed access.
3126 ##      </summary>
3127 ## </param>
3128 #
3129 interface(`userdom_use_user_ttys',`
3130         gen_require(`
3131                 type user_tty_device_t;
3132         ')
3133
3134         allow $1 user_tty_device_t:chr_file rw_term_perms;
3135 ')
3136
3137 ########################################
3138 ## <summary>
3139 ##      Read and write a inherited user domain tty.
3140 ## </summary>
3141 ## <param name="domain">
3142 ##      <summary>
3143 ##      Domain allowed access.
3144 ##      </summary>
3145 ## </param>
3146 #
3147 interface(`userdom_use_inherited_user_ttys',`
3148         gen_require(`
3149                 type user_tty_device_t;
3150         ')
3151
3152         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3153 ')
3154
3155 ########################################
3156 ## <summary>
3157 ##      Read and write a user domain pty.
3158 ## </summary>
3159 ## <param name="domain">
3160 ##      <summary>
3161 ##      Domain allowed access.
3162 ##      </summary>
3163 ## </param>
3164 #
3165 interface(`userdom_use_user_ptys',`
3166         gen_require(`
3167                 type user_devpts_t;
3168         ')
3169
3170         allow $1 user_devpts_t:chr_file rw_term_perms;
3171 ')
3172
3173 ########################################
3174 ## <summary>
3175 ##      Read and write a inherited user domain pty.
3176 ## </summary>
3177 ## <param name="domain">
3178 ##      <summary>
3179 ##      Domain allowed access.
3180 ##      </summary>
3181 ## </param>
3182 #
3183 interface(`userdom_use_inherited_user_ptys',`
3184         gen_require(`
3185                 type user_devpts_t;
3186         ')
3187
3188         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3189 ')
3190
3191 ########################################
3192 ## <summary>
3193 ##      Read and write a inherited user TTYs and PTYs.
3194 ## </summary>
3195 ## <desc>
3196 ##      <p>
3197 ##      Allow the specified domain to read and write inherited user
3198 ##      TTYs and PTYs. This will allow the domain to
3199 ##      interact with the user via the terminal. Typically
3200 ##      all interactive applications will require this
3201 ##      access.
3202 ##      </p>
3203 ## </desc>
3204 ## <param name="domain">
3205 ##      <summary>
3206 ##      Domain allowed access.
3207 ##      </summary>
3208 ## </param>
3209 ## <infoflow type="both" weight="10"/>
3210 #
3211 interface(`userdom_use_inherited_user_terminals',`
3212         gen_require(`
3213                 type user_tty_device_t, user_devpts_t;
3214         ')
3215
3216         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3217         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3218 ')
3219
3220 #######################################
3221 ## <summary>
3222 ##  Allow attempts to read and write
3223 ##  a user domain tty and pty.
3224 ## </summary>
3225 ## <param name="domain">
3226 ##  <summary>
3227 ##  Domain to not audit.
3228 ##  </summary>
3229 ## </param>
3230 #
3231 interface(`userdom_use_user_terminals',`
3232     gen_require(`
3233         type user_tty_device_t, user_devpts_t;
3234     ')
3235
3236     allow $1 user_tty_device_t:chr_file rw_term_perms;
3237     allow $1 user_devpts_t:chr_file rw_term_perms;
3238 ')
3239
3240 ########################################
3241 ## <summary>
3242 ##      Do not audit attempts to read and write
3243 ##      a user domain tty and pty.
3244 ## </summary>
3245 ## <param name="domain">
3246 ##      <summary>
3247 ##      Domain to not audit.
3248 ##      </summary>
3249 ## </param>
3250 #
3251 interface(`userdom_dontaudit_use_user_terminals',`
3252         gen_require(`
3253                 type user_tty_device_t, user_devpts_t;
3254         ')
3255
3256         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3257         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3258 ')
3259
3260
3261 ########################################
3262 ## <summary>
3263 ##      Get attributes of user domain tty and pty.
3264 ## </summary>
3265 ## <param name="domain">
3266 ##      <summary>
3267 ##      Domain allowed access.
3268 ##      </summary>
3269 ## </param>
3270 #
3271 interface(`userdom_getattr_user_terminals',`
3272         gen_require(`
3273                 type user_tty_device_t, user_devpts_t;
3274         ')
3275
3276         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3277 ')
3278
3279 ########################################
3280 ## <summary>
3281 ##      Execute a shell in all user domains.  This
3282 ##      is an explicit transition, requiring the
3283 ##      caller to use setexeccon().
3284 ## </summary>
3285 ## <param name="domain">
3286 ##      <summary>
3287 ##      Domain allowed to transition.
3288 ##      </summary>
3289 ## </param>
3290 #
3291 interface(`userdom_spec_domtrans_all_users',`
3292         gen_require(`
3293                 attribute userdomain;
3294         ')
3295
3296         corecmd_shell_spec_domtrans($1, userdomain)
3297         allow userdomain $1:fd use;
3298         allow userdomain $1:fifo_file rw_file_perms;
3299         allow userdomain $1:process sigchld;
3300 ')
3301
3302 ########################################
3303 ## <summary>
3304 ##      Execute an Xserver session in all unprivileged user domains.  This
3305 ##      is an explicit transition, requiring the
3306 ##      caller to use setexeccon().
3307 ## </summary>
3308 ## <param name="domain">
3309 ##      <summary>
3310 ##      Domain allowed to transition.
3311 ##      </summary>
3312 ## </param>
3313 #
3314 interface(`userdom_xsession_spec_domtrans_all_users',`
3315         gen_require(`
3316                 attribute userdomain;
3317         ')
3318
3319         xserver_xsession_spec_domtrans($1, userdomain)
3320         allow userdomain $1:fd use;
3321         allow userdomain $1:fifo_file rw_file_perms;
3322         allow userdomain $1:process sigchld;
3323 ')
3324
3325 ########################################
3326 ## <summary>
3327 ##      Execute a shell in all unprivileged user domains.  This
3328 ##      is an explicit transition, requiring the
3329 ##      caller to use setexeccon().
3330 ## </summary>
3331 ## <param name="domain">
3332 ##      <summary>
3333 ##      Domain allowed to transition.
3334 ##      </summary>
3335 ## </param>
3336 #
3337 interface(`userdom_spec_domtrans_unpriv_users',`
3338         gen_require(`
3339                 attribute unpriv_userdomain;
3340         ')
3341
3342         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3343         allow unpriv_userdomain $1:fd use;
3344         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3345         allow unpriv_userdomain $1:process sigchld;
3346 ')
3347
3348 #####################################
3349 ## <summary>
3350 ##  Allow domain dyntrans to unpriv userdomain.
3351 ## </summary>
3352 ## <param name="domain">
3353 ##  <summary>
3354 ##  Domain allowed access.
3355 ##  </summary>
3356 ## </param>
3357 #
3358 interface(`userdom_dyntransition_unpriv_users',`
3359     gen_require(`
3360         attribute unpriv_userdomain;
3361     ')
3362
3363     allow $1 unpriv_userdomain:process dyntransition;
3364 ')
3365
3366 ########################################
3367 ## <summary>
3368 ##      Execute an Xserver session in all unprivileged user domains.  This
3369 ##      is an explicit transition, requiring the
3370 ##      caller to use setexeccon().
3371 ## </summary>
3372 ## <param name="domain">
3373 ##      <summary>
3374 ##      Domain allowed to transition.
3375 ##      </summary>
3376 ## </param>
3377 #
3378 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3379         gen_require(`
3380                 attribute unpriv_userdomain;
3381         ')
3382
3383         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3384         allow unpriv_userdomain $1:fd use;
3385         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3386         allow unpriv_userdomain $1:process sigchld;
3387 ')
3388
3389 ########################################
3390 ## <summary>
3391 ##      Manage unpriviledged user SysV sempaphores.
3392 ## </summary>
3393 ## <param name="domain">
3394 ##      <summary>
3395 ##      Domain allowed access.
3396 ##      </summary>
3397 ## </param>
3398 #
3399 interface(`userdom_manage_unpriv_user_semaphores',`
3400         gen_require(`
3401                 attribute unpriv_userdomain;
3402         ')
3403
3404         allow $1 unpriv_userdomain:sem create_sem_perms;
3405 ')
3406
3407 ########################################
3408 ## <summary>
3409 ##      Manage unpriviledged user SysV shared
3410 ##      memory segments.
3411 ## </summary>
3412 ## <param name="domain">
3413 ##      <summary>
3414 ##      Domain allowed access.
3415 ##      </summary>
3416 ## </param>
3417 #
3418 interface(`userdom_manage_unpriv_user_shared_mem',`
3419         gen_require(`
3420                 attribute unpriv_userdomain;
3421         ')
3422
3423         allow $1 unpriv_userdomain:shm create_shm_perms;
3424 ')
3425
3426 ########################################
3427 ## <summary>
3428 ##      Execute bin_t in the unprivileged user domains. This
3429 ##      is an explicit transition, requiring the
3430 ##      caller to use setexeccon().
3431 ## </summary>
3432 ## <param name="domain">
3433 ##      <summary>
3434 ##      Domain allowed to transition.
3435 ##      </summary>
3436 ## </param>
3437 #
3438 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3439         gen_require(`
3440                 attribute unpriv_userdomain;
3441         ')
3442
3443         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3444         allow unpriv_userdomain $1:fd use;
3445         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3446         allow unpriv_userdomain $1:process sigchld;
3447 ')
3448
3449 ########################################
3450 ## <summary>
3451 ##      Execute all entrypoint files in unprivileged user
3452 ##      domains. This is an explicit transition, requiring the
3453 ##      caller to use setexeccon().
3454 ## </summary>
3455 ## <param name="domain">
3456 ##      <summary>
3457 ##      Domain allowed access.
3458 ##      </summary>
3459 ## </param>
3460 #
3461 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3462         gen_require(`
3463                 attribute unpriv_userdomain;
3464         ')
3465
3466         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3467         allow unpriv_userdomain $1:fd use;
3468         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3469         allow unpriv_userdomain $1:process sigchld;
3470 ')
3471
3472 ########################################
3473 ## <summary>
3474 ##      Search users home directories.
3475 ## </summary>
3476 ## <param name="domain">
3477 ##      <summary>
3478 ##      Domain allowed access.
3479 ##      </summary>
3480 ## </param>
3481 #
3482 interface(`userdom_search_user_home_content',`
3483         gen_require(`
3484                 type user_home_dir_t;
3485                 attribute user_home_type;
3486         ')
3487
3488         files_list_home($1)
3489         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3490         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3491 ')
3492
3493 ########################################
3494 ## <summary>
3495 ##      Send general signals to unprivileged user domains.
3496 ## </summary>
3497 ## <param name="domain">
3498 ##      <summary>
3499 ##      Domain allowed access.
3500 ##      </summary>
3501 ## </param>
3502 #
3503 interface(`userdom_signal_unpriv_users',`
3504         gen_require(`
3505                 attribute unpriv_userdomain;
3506         ')
3507
3508         allow $1 unpriv_userdomain:process signal;
3509 ')
3510
3511 ########################################
3512 ## <summary>
3513 ##      Inherit the file descriptors from unprivileged user domains.
3514 ## </summary>
3515 ## <param name="domain">
3516 ##      <summary>
3517 ##      Domain allowed access.
3518 ##      </summary>
3519 ## </param>
3520 #
3521 interface(`userdom_use_unpriv_users_fds',`
3522         gen_require(`
3523                 attribute unpriv_userdomain;
3524         ')
3525
3526         allow $1 unpriv_userdomain:fd use;
3527 ')
3528
3529 ########################################
3530 ## <summary>
3531 ##      Do not audit attempts to inherit the file descriptors
3532 ##      from unprivileged user domains.
3533 ## </summary>
3534 ## <desc>
3535 ##      <p>
3536 ##      Do not audit attempts to inherit the file descriptors
3537 ##      from unprivileged user domains. This will supress
3538 ##      SELinux denial messages when the specified domain is denied
3539 ##      the permission to inherit these file descriptors.
3540 ##      </p>
3541 ## </desc>
3542 ## <param name="domain">
3543 ##      <summary>
3544 ##      Domain to not audit.
3545 ##      </summary>
3546 ## </param>
3547 ## <infoflow type="none"/>
3548 #
3549 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3550         gen_require(`
3551                 attribute unpriv_userdomain;
3552         ')
3553
3554         dontaudit $1 unpriv_userdomain:fd use;
3555 ')
3556
3557 ########################################
3558 ## <summary>
3559 ##      Do not audit attempts to use user ptys.
3560 ## </summary>
3561 ## <param name="domain">
3562 ##      <summary>
3563 ##      Domain to not audit.
3564 ##      </summary>
3565 ## </param>
3566 #
3567 interface(`userdom_dontaudit_use_user_ptys',`
3568         gen_require(`
3569                 type user_devpts_t;
3570         ')
3571
3572         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3573 ')
3574
3575 ########################################
3576 ## <summary>
3577 ##      Relabel files to unprivileged user pty types.
3578 ## </summary>
3579 ## <param name="domain">
3580 ##      <summary>
3581 ##      Domain allowed access.
3582 ##      </summary>
3583 ## </param>
3584 #
3585 interface(`userdom_relabelto_user_ptys',`
3586         gen_require(`
3587                 type user_devpts_t;
3588         ')
3589
3590         allow $1 user_devpts_t:chr_file relabelto;
3591 ')
3592
3593 ########################################
3594 ## <summary>
3595 ##      Do not audit attempts to relabel files from
3596 ##      user pty types.
3597 ## </summary>
3598 ## <param name="domain">
3599 ##      <summary>
3600 ##      Domain to not audit.
3601 ##      </summary>
3602 ## </param>
3603 #
3604 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3605         gen_require(`
3606                 type user_devpts_t;
3607         ')
3608
3609         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3610 ')
3611
3612 ########################################
3613 ## <summary>
3614 ##      Write all users files in /tmp
3615 ## </summary>
3616 ## <param name="domain">
3617 ##      <summary>
3618 ##      Domain allowed access.
3619 ##      </summary>
3620 ## </param>
3621 #
3622 interface(`userdom_write_user_tmp_files',`
3623         gen_require(`
3624                 type user_tmp_t;
3625         ')
3626
3627         write_files_pattern($1, user_tmp_t, user_tmp_t)
3628 ')
3629
3630 ########################################
3631 ## <summary>
3632 ##      Do not audit attempts to write users
3633 ##      temporary files.
3634 ## </summary>
3635 ## <param name="domain">
3636 ##      <summary>
3637 ##      Domain to not audit.
3638 ##      </summary>
3639 ## </param>
3640 #
3641 interface(`userdom_dontaudit_write_user_tmp_files',`
3642         gen_require(`
3643                 type user_tmp_t;
3644         ')
3645
3646         dontaudit $1 user_tmp_t:file write;
3647 ')
3648
3649 ########################################
3650 ## <summary>
3651 ##      Do not audit attempts to read/write users
3652 ##      temporary fifo files.
3653 ## </summary>
3654 ## <param name="domain">
3655 ##      <summary>
3656 ##      Domain to not audit.
3657 ##      </summary>
3658 ## </param>
3659 #
3660 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3661         gen_require(`
3662                 type user_tmp_t;
3663         ')
3664
3665         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3666 ')
3667
3668 ########################################
3669 ## <summary>
3670 ##      Do not audit attempts to use user ttys.
3671 ## </summary>
3672 ## <param name="domain">
3673 ##      <summary>
3674 ##      Domain to not audit.
3675 ##      </summary>
3676 ## </param>
3677 #
3678 interface(`userdom_dontaudit_use_user_ttys',`
3679         gen_require(`
3680                 type user_tty_device_t;
3681         ')
3682
3683         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3684 ')
3685
3686 ########################################
3687 ## <summary>
3688 ##      Read the process state of all user domains.
3689 ## </summary>
3690 ## <param name="domain">
3691 ##      <summary>
3692 ##      Domain allowed access.
3693 ##      </summary>
3694 ## </param>
3695 #
3696 interface(`userdom_read_all_users_state',`
3697         gen_require(`
3698                 attribute userdomain;
3699         ')
3700
3701         read_files_pattern($1, userdomain, userdomain)
3702         read_lnk_files_pattern($1,userdomain,userdomain)
3703         kernel_search_proc($1)
3704 ')
3705
3706 ########################################
3707 ## <summary>
3708 ##      Get the attributes of all user domains.
3709 ## </summary>
3710 ## <param name="domain">
3711 ##      <summary>
3712 ##      Domain allowed access.
3713 ##      </summary>
3714 ## </param>
3715 #
3716 interface(`userdom_getattr_all_users',`
3717         gen_require(`
3718                 attribute userdomain;
3719         ')
3720
3721         allow $1 userdomain:process getattr;
3722 ')
3723
3724 ########################################
3725 ## <summary>
3726 ##      Inherit the file descriptors from all user domains
3727 ## </summary>
3728 ## <param name="domain">
3729 ##      <summary>
3730 ##      Domain allowed access.
3731 ##      </summary>
3732 ## </param>
3733 #
3734 interface(`userdom_use_all_users_fds',`
3735         gen_require(`
3736                 attribute userdomain;
3737         ')
3738
3739         allow $1 userdomain:fd use;
3740 ')
3741
3742 ########################################
3743 ## <summary>
3744 ##      Do not audit attempts to inherit the file
3745 ##      descriptors from any user domains.
3746 ## </summary>
3747 ## <param name="domain">
3748 ##      <summary>
3749 ##      Domain to not audit.
3750 ##      </summary>
3751 ## </param>
3752 #
3753 interface(`userdom_dontaudit_use_all_users_fds',`
3754         gen_require(`
3755                 attribute userdomain;
3756         ')
3757
3758         dontaudit $1 userdomain:fd use;
3759 ')
3760
3761 ########################################
3762 ## <summary>
3763 ##      Send general signals to all user domains.
3764 ## </summary>
3765 ## <param name="domain">
3766 ##      <summary>
3767 ##      Domain allowed access.
3768 ##      </summary>
3769 ## </param>
3770 #
3771 interface(`userdom_signal_all_users',`
3772         gen_require(`
3773                 attribute userdomain;
3774         ')
3775
3776         allow $1 userdomain:process signal;
3777 ')
3778
3779 ########################################
3780 ## <summary>
3781 ##      Send kill signals to all user domains.
3782 ## </summary>
3783 ## <param name="domain">
3784 ##      <summary>
3785 ##      Domain allowed access.
3786 ##      </summary>
3787 ## </param>
3788 #
3789 interface(`userdom_kill_all_users',`
3790         gen_require(`
3791                 attribute userdomain;
3792         ')
3793
3794         allow $1 userdomain:process sigkill;
3795 ')
3796
3797 ########################################
3798 ## <summary>
3799 ##      Send a SIGCHLD signal to all user domains.
3800 ## </summary>
3801 ## <param name="domain">
3802 ##      <summary>
3803 ##      Domain allowed access.
3804 ##      </summary>
3805 ## </param>
3806 #
3807 interface(`userdom_sigchld_all_users',`
3808         gen_require(`
3809                 attribute userdomain;
3810         ')
3811
3812         allow $1 userdomain:process sigchld;
3813 ')
3814
3815 ########################################
3816 ## <summary>
3817 ##      Read keys for all user domains.
3818 ## </summary>
3819 ## <param name="domain">
3820 ##      <summary>
3821 ##      Domain allowed access.
3822 ##      </summary>
3823 ## </param>
3824 #
3825 interface(`userdom_read_all_users_keys',`
3826         gen_require(`
3827                 attribute userdomain;
3828         ')
3829
3830         allow $1 userdomain:key read;
3831 ')
3832
3833 ########################################
3834 ## <summary>
3835 ##      Create keys for all user domains.
3836 ## </summary>
3837 ## <param name="domain">
3838 ##      <summary>
3839 ##      Domain allowed access.
3840 ##      </summary>
3841 ## </param>
3842 #
3843 interface(`userdom_create_all_users_keys',`
3844         gen_require(`
3845                 attribute userdomain;
3846         ')
3847
3848         allow $1 userdomain:key create;
3849 ')
3850
3851 ########################################
3852 ## <summary>
3853 ##      Send a dbus message to all user domains.
3854 ## </summary>
3855 ## <param name="domain">
3856 ##      <summary>
3857 ##      Domain allowed access.
3858 ##      </summary>
3859 ## </param>
3860 #
3861 interface(`userdom_dbus_send_all_users',`
3862         gen_require(`
3863                 attribute userdomain;
3864                 class dbus send_msg;
3865         ')
3866
3867         allow $1 userdomain:dbus send_msg;
3868 ')
3869
3870 ########################################
3871 ## <summary>
3872 ##      Allow apps to set rlimits on userdomain
3873 ## </summary>
3874 ## <param name="domain">
3875 ##      <summary>
3876 ##      Domain allowed access.
3877 ##      </summary>
3878 ## </param>
3879 #
3880 interface(`userdom_set_rlimitnh',`
3881         gen_require(`
3882                 attribute userdomain;
3883         ')
3884
3885         allow $1 userdomain:process rlimitinh;
3886 ')
3887
3888 ########################################
3889 ## <summary>
3890 ##      Define this type as a Allow apps to set rlimits on userdomain
3891 ## </summary>
3892 ## <param name="domain">
3893 ##      <summary>
3894 ##      Domain allowed access.
3895 ##      </summary>
3896 ## </param>
3897 ## <param name="userdomain_prefix">
3898 ##      <summary>
3899 ##      The prefix of the user domain (e.g., user
3900 ##      is the prefix for user_t).
3901 ## </summary>
3902 ## </param>
3903 ## <param name="domain">
3904 ##      <summary>
3905 ##      Domain allowed access.
3906 ##      </summary>
3907 ## </param>
3908 #
3909 template(`userdom_unpriv_usertype',`
3910         gen_require(`
3911                 attribute unpriv_userdomain, userdomain;
3912                 attribute $1_usertype;
3913         ')
3914         typeattribute $2  $1_usertype;
3915         typeattribute $2  unpriv_userdomain;
3916         typeattribute $2  userdomain;
3917
3918         auth_use_nsswitch($2)
3919         ubac_constrained($2)
3920 ')
3921
3922 #######################################
3923 ## <summary>
3924 ##  Define this type as a Allow apps to set rlimits on userdomain
3925 ## </summary>
3926 ## <param name="domain">
3927 ##  <summary>
3928 ##  Domain allowed access.
3929 ##  </summary>
3930 ## </param>
3931 ## <param name="userdomain_prefix">
3932 ##  <summary>
3933 ##  The prefix of the user domain (e.g., user
3934 ##  is the prefix for user_t).
3935 ## </summary>
3936 ## </param>
3937 ## <param name="domain">
3938 ##  <summary>
3939 ##  Domain allowed access.
3940 ##  </summary>
3941 ## </param>
3942 #
3943 template(`userdom_unpriv_type',`
3944     gen_require(`
3945         attribute unpriv_userdomain, userdomain;
3946     ')
3947     typeattribute $2  unpriv_userdomain;
3948     typeattribute $2  userdomain;
3949
3950     auth_use_nsswitch($2)
3951     ubac_constrained($2)
3952 ')
3953
3954 ########################################
3955 ## <summary>
3956 ##      Connect to users over an unix stream socket.
3957 ## </summary>
3958 ## <param name="domain">
3959 ##      <summary>
3960 ##      Domain allowed access.
3961 ##      </summary>
3962 ## </param>
3963 #
3964 interface(`userdom_stream_connect',`
3965         gen_require(`
3966                 type user_tmp_t;
3967                 attribute userdomain;
3968         ')
3969
3970         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3971 ')
3972
3973 ########################################
3974 ## <summary>
3975 ##      Ptrace user domains.
3976 ## </summary>
3977 ## <param name="domain">
3978 ##      <summary>
3979 ##      Domain allowed access.
3980 ##      </summary>
3981 ## </param>
3982 #
3983 interface(`userdom_ptrace_all_users',`
3984         gen_require(`
3985                 attribute userdomain;
3986         ')
3987
3988         tunable_policy(`deny_ptrace',`',`
3989                 allow $1 userdomain:process ptrace;
3990         ')
3991 ')
3992
3993 ########################################
3994 ## <summary>
3995 ##      dontaudit Search /root
3996 ## </summary>
3997 ## <param name="domain">
3998 ##      <summary>
3999 ##      Domain to not audit.
4000 ##      </summary>
4001 ## </param>
4002 #
4003 interface(`userdom_dontaudit_search_admin_dir',`
4004         gen_require(`
4005                 type admin_home_t;
4006         ')
4007
4008         dontaudit $1 admin_home_t:dir search_dir_perms;
4009 ')
4010
4011 ########################################
4012 ## <summary>
4013 ##      dontaudit list /root
4014 ## </summary>
4015 ## <param name="domain">
4016 ##      <summary>
4017 ##      Domain to not audit.
4018 ##      </summary>
4019 ## </param>
4020 #
4021 interface(`userdom_dontaudit_list_admin_dir',`
4022         gen_require(`
4023                 type admin_home_t;
4024         ')
4025
4026         dontaudit $1 admin_home_t:dir list_dir_perms;
4027 ')
4028
4029 ########################################
4030 ## <summary>
4031 ##      Allow domain to  list /root
4032 ## </summary>
4033 ## <param name="domain">
4034 ##      <summary>
4035 ##      Domain allowed access.
4036 ##      </summary>
4037 ## </param>
4038 #
4039 interface(`userdom_list_admin_dir',`
4040         gen_require(`
4041                 type admin_home_t;
4042         ')
4043
4044         allow $1 admin_home_t:dir list_dir_perms;
4045 ')
4046
4047 ########################################
4048 ## <summary>
4049 ##      Allow Search /root
4050 ## </summary>
4051 ## <param name="domain">
4052 ##      <summary>
4053 ##      Domain allowed access.
4054 ##      </summary>
4055 ## </param>
4056 #
4057 interface(`userdom_search_admin_dir',`
4058         gen_require(`
4059                 type admin_home_t;
4060         ')
4061
4062         allow $1 admin_home_t:dir search_dir_perms;
4063 ')
4064
4065 ########################################
4066 ## <summary>
4067 ##      RW unpriviledged user SysV sempaphores.
4068 ## </summary>
4069 ## <param name="domain">
4070 ##      <summary>
4071 ##      Domain allowed access.
4072 ##      </summary>
4073 ## </param>
4074 #
4075 interface(`userdom_rw_semaphores',`
4076         gen_require(`
4077                 attribute unpriv_userdomain;
4078         ')
4079
4080         allow $1 unpriv_userdomain:sem rw_sem_perms;
4081 ')
4082
4083 ########################################
4084 ## <summary>
4085 ##      Send a message to unpriv users over a unix domain
4086 ##      datagram socket.
4087 ## </summary>
4088 ## <param name="domain">
4089 ##      <summary>
4090 ##      Domain allowed access.
4091 ##      </summary>
4092 ## </param>
4093 #
4094 interface(`userdom_dgram_send',`
4095         gen_require(`
4096                 attribute unpriv_userdomain;
4097         ')
4098
4099         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4100 ')
4101
4102 ######################################
4103 ## <summary>
4104 ##      Send a message to users over a unix domain
4105 ##      datagram socket.
4106 ## </summary>
4107 ## <param name="domain">
4108 ##      <summary>
4109 ##      Domain allowed access.
4110 ##      </summary>
4111 ## </param>
4112 #
4113 interface(`userdom_users_dgram_send',`
4114         gen_require(`
4115                  attribute userdomain;
4116       ')
4117
4118        allow $1 userdomain:unix_dgram_socket sendto;
4119 ')
4120
4121 #######################################
4122 ## <summary>
4123 ##      Allow execmod on files in homedirectory
4124 ## </summary>
4125 ## <param name="domain">
4126 ##      <summary>
4127 ##      Domain allowed access.
4128 ##      </summary>
4129 ## </param>
4130 ## <rolebase/>
4131 #
4132 interface(`userdom_execmod_user_home_files',`
4133         gen_require(`
4134                 type user_home_type;
4135         ')
4136
4137         allow $1 user_home_type:file execmod;
4138 ')
4139
4140 ########################################
4141 ## <summary>
4142 ##      Read admin home files.
4143 ## </summary>
4144 ## <param name="domain">
4145 ##      <summary>
4146 ##      Domain allowed access.
4147 ##      </summary>
4148 ## </param>
4149 ## <rolecap/>
4150 #
4151 interface(`userdom_read_admin_home_files',`
4152         gen_require(`
4153                 type admin_home_t;
4154         ')
4155
4156         read_files_pattern($1, admin_home_t, admin_home_t)
4157 ')
4158
4159 ########################################
4160 ## <summary>
4161 ##      Delete admin home files.
4162 ## </summary>
4163 ## <param name="domain">
4164 ##      <summary>
4165 ##      Domain allowed access.
4166 ##      </summary>
4167 ## </param>
4168 ## <rolecap/>
4169 #
4170 interface(`userdom_delete_admin_home_files',`
4171         gen_require(`
4172                 type admin_home_t;
4173         ')
4174
4175         allow $1 admin_home_t:file delete_file_perms;
4176 ')
4177
4178 ########################################
4179 ## <summary>
4180 ##      Execute admin home files.
4181 ## </summary>
4182 ## <param name="domain">
4183 ##      <summary>
4184 ##      Domain allowed access.
4185 ##      </summary>
4186 ## </param>
4187 ## <rolecap/>
4188 #
4189 interface(`userdom_exec_admin_home_files',`
4190         gen_require(`
4191                 type admin_home_t;
4192         ')
4193
4194         exec_files_pattern($1, admin_home_t, admin_home_t)
4195 ')
4196
4197 ########################################
4198 ## <summary>
4199 ##      Append files inherited
4200 ##      in the /root directory.
4201 ## </summary>
4202 ## <param name="domain">
4203 ##      <summary>
4204 ##      Domain allowed access.
4205 ##      </summary>
4206 ## </param>
4207 #
4208 interface(`userdom_inherit_append_admin_home_files',`
4209         gen_require(`
4210                 type admin_home_t;
4211         ')
4212
4213         allow $1 admin_home_t:file { getattr append };
4214 ')
4215
4216
4217 #######################################
4218 ## <summary>
4219 ##      Manage all files/directories in the homedir
4220 ## </summary>
4221 ## <param name="userdomain">
4222 ##      <summary>
4223 ##      The user domain
4224 ##      </summary>
4225 ## </param>
4226 ## <rolebase/>
4227 #
4228 interface(`userdom_manage_user_home_content',`
4229         gen_require(`
4230                 type user_home_dir_t, user_home_t;
4231                 attribute user_home_type;
4232         ')
4233
4234         files_list_home($1)
4235         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4236         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4237         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4238         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4239         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4240         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4241
4242 ')
4243
4244
4245 ########################################
4246 ## <summary>
4247 ##      Create objects in a user home directory
4248 ##      with an automatic type transition to
4249 ##      the user home file type.
4250 ## </summary>
4251 ## <param name="domain">
4252 ##      <summary>
4253 ##      Domain allowed access.
4254 ##      </summary>
4255 ## </param>
4256 ## <param name="object_class">
4257 ##      <summary>
4258 ##      The class of the object to be created.
4259 ##      </summary>
4260 ## </param>
4261 #
4262 interface(`userdom_user_home_dir_filetrans_pattern',`
4263         gen_require(`
4264                 type user_home_dir_t, user_home_t;
4265         ')
4266
4267         type_transition $1 user_home_dir_t:$2 user_home_t;
4268 ')
4269
4270 ########################################
4271 ## <summary>
4272 ##      Create objects in the /root directory
4273 ##      with an automatic type transition to
4274 ##      a specified private type.
4275 ## </summary>
4276 ## <param name="domain">
4277 ##      <summary>
4278 ##      Domain allowed access.
4279 ##      </summary>
4280 ## </param>
4281 ## <param name="private_type">
4282 ##      <summary>
4283 ##      The type of the object to create.
4284 ##      </summary>
4285 ## </param>
4286 ## <param name="object_class">
4287 ##      <summary>
4288 ##      The class of the object to be created.
4289 ##      </summary>
4290 ## </param>
4291 #
4292 interface(`userdom_admin_home_dir_filetrans',`
4293         gen_require(`
4294                 type admin_home_t;
4295         ')
4296
4297         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4298 ')
4299
4300 ########################################
4301 ## <summary>
4302 ##      Send signull to unprivileged user domains.
4303 ## </summary>
4304 ## <param name="domain">
4305 ##      <summary>
4306 ##      Domain allowed access.
4307 ##      </summary>
4308 ## </param>
4309 #
4310 interface(`userdom_signull_unpriv_users',`
4311         gen_require(`
4312                 attribute unpriv_userdomain;
4313         ')
4314
4315         allow $1 unpriv_userdomain:process signull;
4316 ')
4317
4318 ########################################
4319 ## <summary>
4320 ##      Write all users files in /tmp
4321 ## </summary>
4322 ## <param name="domain">
4323 ##      <summary>
4324 ##      Domain allowed access.
4325 ##      </summary>
4326 ## </param>
4327 #
4328 interface(`userdom_write_user_tmp_dirs',`
4329         gen_require(`
4330                 type user_tmp_t;
4331         ')
4332
4333         write_files_pattern($1, user_tmp_t, user_tmp_t)
4334 ')
4335
4336 ########################################
4337 ## <summary>
4338 ##      Manage keys for all user domains.
4339 ## </summary>
4340 ## <param name="domain">
4341 ##      <summary>
4342 ##      Domain allowed access.
4343 ##      </summary>
4344 ## </param>
4345 #
4346 interface(`userdom_manage_all_users_keys',`
4347         gen_require(`
4348                 attribute userdomain;
4349         ')
4350
4351         allow $1 userdomain:key manage_key_perms;
4352 ')
4353
4354
4355 ########################################
4356 ## <summary>
4357 ##      Do not audit attempts to read and write
4358 ##      unserdomain stream.
4359 ## </summary>
4360 ## <param name="domain">
4361 ##      <summary>
4362 ##      Domain to not audit.
4363 ##      </summary>
4364 ## </param>
4365 #
4366 interface(`userdom_dontaudit_rw_stream',`
4367         gen_require(`
4368                 attribute userdomain;
4369         ')
4370
4371         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4372 ')
4373
4374 ########################################
4375 ## <summary>
4376 ##      Do not audit attempts to read and write
4377 ##      unserdomain datagram socket.
4378 ## </summary>
4379 ## <param name="domain">
4380 ##      <summary>
4381 ##      Domain to not audit.
4382 ##      </summary>
4383 ## </param>
4384 #
4385 interface(`userdom_dontaudit_rw_dgram_socket',`
4386         gen_require(`
4387                 attribute userdomain;
4388         ')
4389
4390         dontaudit $1 userdomain:unix_dgram_socket { read write };
4391 ')
4392
4393 ########################################
4394 ## <summary>
4395 ##      Append files
4396 ##      in a user home subdirectory.
4397 ## </summary>
4398 ## <param name="domain">
4399 ##      <summary>
4400 ##      Domain allowed access.
4401 ##      </summary>
4402 ## </param>
4403 #
4404 interface(`userdom_append_user_home_content_files',`
4405         gen_require(`
4406                 type user_home_dir_t, user_home_t;
4407         ')
4408
4409         append_files_pattern($1, user_home_t, user_home_t)
4410         allow $1 user_home_dir_t:dir search_dir_perms;
4411         files_search_home($1)
4412 ')
4413
4414 ########################################
4415 ## <summary>
4416 ##      Read files inherited
4417 ##      in a user home subdirectory.
4418 ## </summary>
4419 ## <param name="domain">
4420 ##      <summary>
4421 ##      Domain allowed access.
4422 ##      </summary>
4423 ## </param>
4424 #
4425 interface(`userdom_read_inherited_user_home_content_files',`
4426         gen_require(`
4427                 attribute user_home_type;
4428         ')
4429
4430         allow $1 user_home_type:file { getattr read };
4431 ')
4432
4433 ########################################
4434 ## <summary>
4435 ##      Append files inherited
4436 ##      in a user home subdirectory.
4437 ## </summary>
4438 ## <param name="domain">
4439 ##      <summary>
4440 ##      Domain allowed access.
4441 ##      </summary>
4442 ## </param>
4443 #
4444 interface(`userdom_inherit_append_user_home_content_files',`
4445         gen_require(`
4446                 type user_home_t;
4447         ')
4448
4449         allow $1 user_home_t:file { getattr append };
4450 ')
4451
4452 ########################################
4453 ## <summary>
4454 ##      Append files inherited
4455 ##      in a user tmp files.
4456 ## </summary>
4457 ## <param name="domain">
4458 ##      <summary>
4459 ##      Domain allowed access.
4460 ##      </summary>
4461 ## </param>
4462 #
4463 interface(`userdom_inherit_append_user_tmp_files',`
4464         gen_require(`
4465                 type user_tmp_t;
4466         ')
4467
4468         allow $1 user_tmp_t:file { getattr append };
4469 ')
4470
4471 ######################################
4472 ## <summary>
4473 ##      Read audio files in the users homedir.
4474 ## </summary>
4475 ## <param name="domain">
4476 ##      <summary>
4477 ##      Domain allowed access.
4478 ##      </summary>
4479 ## </param>
4480 ## <rolecap/>
4481 #
4482 interface(`userdom_read_home_audio_files',`
4483         gen_require(`
4484                 type audio_home_t;
4485         ')
4486
4487         userdom_search_user_home_dirs($1)
4488         allow $1 audio_home_t:dir list_dir_perms;
4489         read_files_pattern($1, audio_home_t, audio_home_t)
4490         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4491 ')
4492
4493 ########################################
4494 ## <summary>
4495 ##      Do not audit attempts to write all user home content files.
4496 ## </summary>
4497 ## <param name="domain">
4498 ##      <summary>
4499 ##      Domain to not audit.
4500 ##      </summary>
4501 ## </param>
4502 #
4503 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4504         gen_require(`
4505                 attribute user_home_type;
4506         ')
4507
4508         dontaudit $1 user_home_type:file write_file_perms;
4509 ')
4510
4511 ########################################
4512 ## <summary>
4513 ##      Do not audit attempts to write all user tmp content files.
4514 ## </summary>
4515 ## <param name="domain">
4516 ##      <summary>
4517 ##      Domain to not audit.
4518 ##      </summary>
4519 ## </param>
4520 #
4521 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4522         gen_require(`
4523                 attribute user_tmp_type;
4524         ')
4525
4526         dontaudit $1 user_tmp_type:file write_file_perms;
4527 ')
4528
4529 ########################################
4530 ## <summary>
4531 ##      Manage all user temporary content.
4532 ## </summary>
4533 ## <param name="domain">
4534 ##      <summary>
4535 ##      Domain allowed access.
4536 ##      </summary>
4537 ## </param>
4538 #
4539 interface(`userdom_manage_all_user_tmp_content',`
4540         gen_require(`
4541                 attribute user_tmp_type;
4542         ')
4543
4544         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4545         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4546         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4547         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4548         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4549         files_search_tmp($1)
4550 ')
4551
4552 ########################################
4553 ## <summary>
4554 ##      List all user temporary content.
4555 ## </summary>
4556 ## <param name="domain">
4557 ##      <summary>
4558 ##      Domain allowed access.
4559 ##      </summary>
4560 ## </param>
4561 #
4562 interface(`userdom_list_all_user_tmp_content',`
4563         gen_require(`
4564                 attribute user_tmp_type;
4565         ')
4566
4567         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4568         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4569         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4570         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4571         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4572         files_search_var($1)
4573         files_search_tmp($1)
4574 ')
4575
4576 ########################################
4577 ## <summary>
4578 ##      Manage all user tmpfs content.
4579 ## </summary>
4580 ## <param name="domain">
4581 ##      <summary>
4582 ##      Domain allowed access.
4583 ##      </summary>
4584 ## </param>
4585 #
4586 interface(`userdom_manage_all_user_tmpfs_content',`
4587         gen_require(`
4588                 attribute user_tmpfs_type;
4589         ')
4590
4591         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4592         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4593         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4594         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4595         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4596         fs_search_tmpfs($1)
4597 ')
4598
4599 ########################################
4600 ## <summary>
4601 ##      Delete all user temporary content.
4602 ## </summary>
4603 ## <param name="domain">
4604 ##      <summary>
4605 ##      Domain allowed access.
4606 ##      </summary>
4607 ## </param>
4608 #
4609 interface(`userdom_delete_all_user_tmp_content',`
4610         gen_require(`
4611                 attribute user_tmp_type;
4612         ')
4613
4614         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4615         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4616         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4617         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4618         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4619         # /var/tmp
4620         files_search_var($1)
4621         files_delete_tmp_dir_entry($1)
4622 ')
4623
4624 ########################################
4625 ## <summary>
4626 ##      Read system SSL certificates in the users homedir.
4627 ## </summary>
4628 ## <param name="domain">
4629 ##      <summary>
4630 ##      Domain allowed access.
4631 ##      </summary>
4632 ## </param>
4633 #
4634 interface(`userdom_read_home_certs',`
4635         gen_require(`
4636                 type home_cert_t;
4637         ')
4638
4639         userdom_search_user_home_content($1)
4640         allow $1 home_cert_t:dir list_dir_perms;
4641         read_files_pattern($1, home_cert_t, home_cert_t)
4642         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4643 ')
4644
4645 ########################################
4646 ## <summary>
4647 ##      Manage system SSL certificates in the users homedir.
4648 ## </summary>
4649 ## <param name="domain">
4650 ##      <summary>
4651 ##      Domain allowed access.
4652 ##      </summary>
4653 ## </param>
4654 #
4655 interface(`userdom_manage_home_certs',`
4656         gen_require(`
4657                 type home_cert_t;
4658         ')
4659
4660         allow $1 home_cert_t:dir list_dir_perms;
4661         manage_files_pattern($1, home_cert_t, home_cert_t)
4662         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4663
4664         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4665         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4666 ')
4667
4668 #######################################
4669 ## <summary>
4670 ##  Dontaudit Write system SSL certificates in the users homedir.
4671 ## </summary>
4672 ## <param name="domain">
4673 ##  <summary>
4674 ##      Domain to not audit.
4675 ##  </summary>
4676 ## </param>
4677 #
4678 interface(`userdom_dontaudit_write_home_certs',`
4679     gen_require(`
4680         type home_cert_t;
4681     ')
4682
4683     dontaudit $1 home_cert_t:file write;
4684 ')
4685
4686 ########################################
4687 ## <summary>
4688 ##      dontaudit Search getatrr /root files
4689 ## </summary>
4690 ## <param name="domain">
4691 ##      <summary>
4692 ##      Domain to not audit.
4693 ##      </summary>
4694 ## </param>
4695 #
4696 interface(`userdom_dontaudit_getattr_admin_home_files',`
4697         gen_require(`
4698                 type admin_home_t;
4699         ')
4700
4701         dontaudit $1 admin_home_t:file getattr;
4702 ')
4703
4704 ########################################
4705 ## <summary>
4706 ##      dontaudit read /root lnk files
4707 ## </summary>
4708 ## <param name="domain">
4709 ##      <summary>
4710 ##      Domain to not audit.
4711 ##      </summary>
4712 ## </param>
4713 #
4714 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4715         gen_require(`
4716                 type admin_home_t;
4717         ')
4718
4719         dontaudit $1 admin_home_t:lnk_file read;
4720 ')
4721
4722 ########################################
4723 ## <summary>
4724 ##      dontaudit read /root files
4725 ## </summary>
4726 ## <param name="domain">
4727 ##      <summary>
4728 ##      Domain to not audit.
4729 ##      </summary>
4730 ## </param>
4731 #
4732 interface(`userdom_dontaudit_read_admin_home_files',`
4733         gen_require(`
4734                 type admin_home_t;
4735         ')
4736
4737         dontaudit $1 admin_home_t:file read_file_perms;
4738 ')
4739
4740 ########################################
4741 ## <summary>
4742 ##      Create, read, write, and delete user
4743 ##      temporary chr files.
4744 ## </summary>
4745 ## <param name="domain">
4746 ##      <summary>
4747 ##      Domain allowed access.
4748 ##      </summary>
4749 ## </param>
4750 #
4751 interface(`userdom_manage_user_tmp_chr_files',`
4752         gen_require(`
4753                 type user_tmp_t;
4754         ')
4755
4756         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4757         files_search_tmp($1)
4758 ')
4759
4760 ########################################
4761 ## <summary>
4762 ##      Create, read, write, and delete user
4763 ##      temporary blk files.
4764 ## </summary>
4765 ## <param name="domain">
4766 ##      <summary>
4767 ##      Domain allowed access.
4768 ##      </summary>
4769 ## </param>
4770 #
4771 interface(`userdom_manage_user_tmp_blk_files',`
4772         gen_require(`
4773                 type user_tmp_t;
4774         ')
4775
4776         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4777         files_search_tmp($1)
4778 ')
4779
4780 ########################################
4781 ## <summary>
4782 ##      Dontaudit attempt to set attributes on  user temporary directories.
4783 ## </summary>
4784 ## <param name="domain">
4785 ##      <summary>
4786 ##      Domain to not audit.
4787 ##      </summary>
4788 ## </param>
4789 #
4790 interface(`userdom_dontaudit_setattr_user_tmp',`
4791         gen_require(`
4792                 type user_tmp_t;
4793         ')
4794
4795         dontaudit $1 user_tmp_t:dir setattr;
4796 ')
4797
4798 ########################################
4799 ## <summary>
4800 ##      Read all inherited users files in /tmp
4801 ## </summary>
4802 ## <param name="domain">
4803 ##      <summary>
4804 ##      Domain allowed access.
4805 ##      </summary>
4806 ## </param>
4807 #
4808 interface(`userdom_read_inherited_user_tmp_files',`
4809         gen_require(`
4810                 type user_tmp_t;
4811         ')
4812
4813         allow $1 user_tmp_t:file read_inherited_file_perms;
4814 ')
4815
4816 ########################################
4817 ## <summary>
4818 ##      Write all inherited users files in /tmp
4819 ## </summary>
4820 ## <param name="domain">
4821 ##      <summary>
4822 ##      Domain allowed access.
4823 ##      </summary>
4824 ## </param>
4825 #
4826 interface(`userdom_write_inherited_user_tmp_files',`
4827         gen_require(`
4828                 type user_tmp_t;
4829         ')
4830
4831         allow $1 user_tmp_t:file write;
4832 ')
4833
4834 ########################################
4835 ## <summary>
4836 ##      Delete all users files in /tmp
4837 ## </summary>
4838 ## <param name="domain">
4839 ##      <summary>
4840 ##      Domain allowed access.
4841 ##      </summary>
4842 ## </param>
4843 #
4844 interface(`userdom_delete_user_tmp_files',`
4845         gen_require(`
4846                 type user_tmp_t;
4847         ')
4848
4849         allow $1 user_tmp_t:file delete_file_perms;
4850 ')
4851
4852 ########################################
4853 ## <summary>
4854 ##      Delete user tmpfs files.
4855 ## </summary>
4856 ## <param name="domain">
4857 ##      <summary>
4858 ##      Domain allowed access.
4859 ##      </summary>
4860 ## </param>
4861 #
4862 interface(`userdom_delete_user_tmpfs_files',`
4863         gen_require(`
4864                 type user_tmpfs_t;
4865         ')
4866
4867         allow $1 user_tmpfs_t:file delete_file_perms;
4868 ')
4869
4870 ########################################
4871 ## <summary>
4872 ##      Read/Write unpriviledged user SysV shared
4873 ##      memory segments.
4874 ## </summary>
4875 ## <param name="domain">
4876 ##      <summary>
4877 ##      Domain allowed access.
4878 ##      </summary>
4879 ## </param>
4880 #
4881 interface(`userdom_rw_unpriv_user_shared_mem',`
4882         gen_require(`
4883                 attribute unpriv_userdomain;
4884         ')
4885
4886         allow $1 unpriv_userdomain:shm rw_shm_perms;
4887 ')
4888
4889 ########################################
4890 ## <summary>
4891 ##      Do not audit attempts to search user
4892 ##      temporary directories.
4893 ## </summary>
4894 ## <param name="domain">
4895 ##      <summary>
4896 ##      Domain to not audit.
4897 ##      </summary>
4898 ## </param>
4899 #
4900 interface(`userdom_dontaudit_search_user_tmp',`
4901         gen_require(`
4902                 type user_tmp_t;
4903         ')
4904
4905         dontaudit $1 user_tmp_t:dir search_dir_perms;
4906 ')
4907
4908 ########################################
4909 ## <summary>
4910 ##      Execute a file in a user home directory
4911 ##      in the specified domain.
4912 ## </summary>
4913 ## <desc>
4914 ##      <p>
4915 ##      Execute a file in a user home directory
4916 ##      in the specified domain.
4917 ##      </p>
4918 ##      <p>
4919 ##      No interprocess communication (signals, pipes,
4920 ##      etc.) is provided by this interface since
4921 ##      the domains are not owned by this module.
4922 ##      </p>
4923 ## </desc>
4924 ## <param name="domain">
4925 ##      <summary>
4926 ##      Domain allowed access.
4927 ##      </summary>
4928 ## </param>
4929 ## <param name="target_domain">
4930 ##      <summary>
4931 ##      The type of the new process.
4932 ##      </summary>
4933 ## </param>
4934 #
4935 interface(`userdom_domtrans_user_home',`
4936         gen_require(`
4937                 type user_home_t;
4938         ')
4939
4940         read_lnk_files_pattern($1, user_home_t, user_home_t)
4941         domain_transition_pattern($1, user_home_t, $2)
4942         type_transition $1 user_home_t:process $2;
4943 ')
4944
4945 ########################################
4946 ## <summary>
4947 ##      Execute a file in a user tmp directory
4948 ##      in the specified domain.
4949 ## </summary>
4950 ## <desc>
4951 ##      <p>
4952 ##      Execute a file in a user tmp directory
4953 ##      in the specified domain.
4954 ##      </p>
4955 ##      <p>
4956 ##      No interprocess communication (signals, pipes,
4957 ##      etc.) is provided by this interface since
4958 ##      the domains are not owned by this module.
4959 ##      </p>
4960 ## </desc>
4961 ## <param name="domain">
4962 ##      <summary>
4963 ##      Domain allowed access.
4964 ##      </summary>
4965 ## </param>
4966 ## <param name="target_domain">
4967 ##      <summary>
4968 ##      The type of the new process.
4969 ##      </summary>
4970 ## </param>
4971 #
4972 interface(`userdom_domtrans_user_tmp',`
4973         gen_require(`
4974                 type user_tmp_t;
4975         ')
4976
4977         files_search_tmp($1)
4978         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4979         domain_transition_pattern($1, user_tmp_t, $2)
4980         type_transition $1 user_tmp_t:process $2;
4981 ')
4982
4983 ########################################
4984 ## <summary>
4985 ##      Do not audit attempts to read all user home content files.
4986 ## </summary>
4987 ## <param name="domain">
4988 ##      <summary>
4989 ##      Domain to not audit.
4990 ##      </summary>
4991 ## </param>
4992 #
4993 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4994         gen_require(`
4995                 attribute user_home_type;
4996         ')
4997
4998         dontaudit $1 user_home_type:file read_file_perms;
4999 ')
5000
5001 ########################################
5002 ## <summary>
5003 ##      Do not audit attempts to read all user tmp content files.
5004 ## </summary>
5005 ## <param name="domain">
5006 ##      <summary>
5007 ##      Domain to not audit.
5008 ##      </summary>
5009 ## </param>
5010 #
5011 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5012         gen_require(`
5013                 attribute user_tmp_type;
5014         ')
5015
5016         dontaudit $1 user_tmp_type:file read_file_perms;
5017 ')
5018
5019 #######################################
5020 ## <summary>
5021 ## Read and write unpriviledged user SysV sempaphores.
5022 ## </summary>
5023 ## <param name="domain">
5024 ## <summary>
5025 ## Domain allowed access.
5026 ## </summary>
5027 ## </param>
5028 #
5029 interface(`userdom_rw_unpriv_user_semaphores',`
5030    gen_require(`
5031        attribute unpriv_userdomain;
5032    ')
5033
5034    allow $1 unpriv_userdomain:sem rw_sem_perms;
5035 ')
5036
5037 ########################################
5038 ## <summary>
5039 ##      Transition to userdom named content
5040 ## </summary>
5041 ## <param name="domain">
5042 ##      <summary>
5043 ##      Domain allowed access.
5044 ##      </summary>
5045 ## </param>
5046 #
5047 interface(`userdom_filetrans_home_content',`
5048         gen_require(`
5049                 type home_bin_t, home_cert_t;
5050                 type audio_home_t;
5051         ')
5052
5053         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5054         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5055         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5056         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5057         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5058         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5059 ')
5060
5061 ########################################
5062 ## <summary>
5063 ##      Make the specified type able to read content in user home dirs
5064 ## </summary>
5065 ## <param name="type">
5066 ##      <summary>
5067 ##      Domain allowed access.
5068 ##      </summary>
5069 ## </param>
5070 #
5071 interface(`userdom_home_reader',`
5072         gen_require(`
5073                 attribute userdom_home_reader_type;
5074         ')
5075
5076         typeattribute $1 userdom_home_reader_type;
5077 ')
5078
5079
5080 ########################################
5081 ## <summary>
5082 ##      Make the specified type able to manage content in user home dirs
5083 ## </summary>
5084 ## <param name="type">
5085 ##      <summary>
5086 ##      Domain allowed access.
5087 ##      </summary>
5088 ## </param>
5089 #
5090 interface(`userdom_home_manager',`
5091         gen_require(`
5092                 attribute userdom_home_manager_type;
5093         ')
5094
5095         typeattribute $1 userdom_home_manager_type;
5096 ')