policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94
  95         files_read_etc_files($1_usertype)
  96         files_list_mnt($1_usertype)
  97         files_read_mnt_files($1_usertype)
  98         files_read_etc_runtime_files($1_usertype)
  99         files_read_usr_files($1_usertype)
 100         files_read_usr_src_files($1_usertype)
 101         # Read directories and files with the readable_t type.
 102         # This type is a general type for "world"-readable files.
 103         files_list_world_readable($1_usertype)
 104         files_read_world_readable_files($1_usertype)
 105         files_read_world_readable_symlinks($1_usertype)
 106         files_read_world_readable_pipes($1_usertype)
 107         files_read_world_readable_sockets($1_usertype)
 108         # old broswer_domain():
 109         files_dontaudit_getattr_all_dirs($1_usertype)
 110         files_dontaudit_list_non_security($1_usertype)
 111         files_dontaudit_getattr_all_files($1_usertype)
 112         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 113         files_dontaudit_getattr_non_security_pipes($1_usertype)
 114         files_dontaudit_getattr_non_security_sockets($1_usertype)
 115
 116         files_exec_usr_files($1_t)
 117
 118         fs_list_cgroup_dirs($1_usertype)
 119         fs_dontaudit_rw_cgroup_files($1_usertype)
 120
 121         storage_rw_fuse($1_usertype)
 122
 123         auth_use_nsswitch($1_usertype)
 124
 125         init_stream_connect($1_usertype)
 126         # The library functions always try to open read-write first,
 127         # then fall back to read-only if it fails.
 128         init_dontaudit_rw_utmp($1_usertype)
 129
 130         libs_exec_ld_so($1_usertype)
 131
 132         miscfiles_read_localization($1_t)
 133         miscfiles_read_generic_certs($1_t)
 134
 135         miscfiles_read_all_certs($1_usertype)
 136         miscfiles_read_localization($1_usertype)
 137         miscfiles_read_man_pages($1_usertype)
 138         miscfiles_read_public_files($1_usertype)
 139
 140         tunable_policy(`allow_execmem',`
 141                 # Allow loading DSOs that require executable stack.
 142                 allow $1_t self:process execmem;
 143         ')
 144
 145         tunable_policy(`allow_execmem && allow_execstack',`
 146                 # Allow making the stack executable via mprotect.
 147                 allow $1_t self:process execstack;
 148         ')
 149
 150         optional_policy(`
 151                 fs_list_cgroup_dirs($1_usertype)
 152         ')
 153
 154         optional_policy(`
 155                 ssh_rw_stream_sockets($1_usertype)
 156                 ssh_delete_tmp($1_t)
 157                 ssh_signal($1_t)
 158         ')
 159 ')
 160
 161 #######################################
 162 ## <summary>
 163 ##      Allow a home directory for which the
 164 ##      role has read-only access.
 165 ## </summary>
 166 ## <desc>
 167 ##      <p>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ##      </p>
 171 ##      <p>
 172 ##      This does not allow execute access.
 173 ##      </p>
 174 ## </desc>
 175 ## <param name="role">
 176 ##      <summary>
 177 ##      The user role
 178 ##      </summary>
 179 ## </param>
 180 ## <param name="userdomain">
 181 ##      <summary>
 182 ##      The user domain
 183 ##      </summary>
 184 ## </param>
 185 ## <rolebase/>
 186 #
 187 interface(`userdom_ro_home_role',`
 188         gen_require(`
 189                 type user_home_t, user_home_dir_t;
 190         ')
 191
 192         role $1 types { user_home_t user_home_dir_t };
 193
 194         ##############################
 195         #
 196         # Domain access to home dir
 197         #
 198
 199         type_member $2 user_home_dir_t:dir user_home_dir_t;
 200
 201         # read-only home directory
 202         allow $2 user_home_dir_t:dir list_dir_perms;
 203         allow $2 user_home_t:dir list_dir_perms;
 204         allow $2 user_home_t:file entrypoint;
 205         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 206         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 207         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 208         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 209         files_list_home($2)
 210
 211 ')
 212
 213 #######################################
 214 ## <summary>
 215 ##      Allow a home directory for which the
 216 ##      role has full access.
 217 ## </summary>
 218 ## <desc>
 219 ##      <p>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ##      </p>
 223 ##      <p>
 224 ##      This does not allow execute access.
 225 ##      </p>
 226 ## </desc>
 227 ## <param name="role">
 228 ##      <summary>
 229 ##      The user role
 230 ##      </summary>
 231 ## </param>
 232 ## <param name="userdomain">
 233 ##      <summary>
 234 ##      The user domain
 235 ##      </summary>
 236 ## </param>
 237 ## <rolebase/>
 238 #
 239 interface(`userdom_manage_home_role',`
 240         gen_require(`
 241                 type user_home_t, user_home_dir_t;
 242                 attribute user_home_type;
 243         ')
 244
 245         role $1 types { user_home_type user_home_dir_t };
 246
 247         ##############################
 248         #
 249         # Domain access to home dir
 250         #
 251
 252         type_member $2 user_home_dir_t:dir user_home_dir_t;
 253
 254         # full control of the home directory
 255         allow $2 user_home_t:dir mounton;
 256         allow $2 user_home_t:file entrypoint;
 257
 258         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 259         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 260         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 261         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 262         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 263         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 264         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 265         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 271         files_list_home($2)
 272
 273         # cjp: this should probably be removed:
 274         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 275
 276         tunable_policy(`use_nfs_home_dirs',`
 277                 fs_mount_nfs($2)
 278                 fs_mounton_nfs($2)
 279                 fs_manage_nfs_dirs($2)
 280                 fs_manage_nfs_files($2)
 281                 fs_manage_nfs_symlinks($2)
 282                 fs_manage_nfs_named_sockets($2)
 283                 fs_manage_nfs_named_pipes($2)
 284         ')
 285
 286         tunable_policy(`use_samba_home_dirs',`
 287                 fs_mount_cifs($2)
 288                 fs_mounton_cifs($2)
 289                 fs_manage_cifs_dirs($2)
 290                 fs_manage_cifs_files($2)
 291                 fs_manage_cifs_symlinks($2)
 292                 fs_manage_cifs_named_sockets($2)
 293                 fs_manage_cifs_named_pipes($2)
 294         ')
 295 ')
 296
 297 #######################################
 298 ## <summary>
 299 ##      Manage user temporary files
 300 ## </summary>
 301 ## <param name="role">
 302 ##      <summary>
 303 ##      Role allowed access.
 304 ##      </summary>
 305 ## </param>
 306 ## <param name="domain">
 307 ##      <summary>
 308 ##      Domain allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <rolebase/>
 312 #
 313 interface(`userdom_manage_tmp_role',`
 314         gen_require(`
 315                 type user_tmp_t;
 316         ')
 317
 318         role $1 types user_tmp_t;
 319
 320         files_poly_member_tmp($2, user_tmp_t)
 321
 322         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 323         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 324         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 325         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 326         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 327         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 328         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 329 ')
 330
 331 #######################################
 332 ## <summary>
 333 ##      Dontaudit search of user bin dirs.
 334 ## </summary>
 335 ## <param name="domain">
 336 ##      <summary>
 337 ##      Domain allowed access.
 338 ##      </summary>
 339 ## </param>
 340 #
 341 interface(`userdom_dontaudit_search_user_bin_dirs',`
 342         gen_require(`
 343                 type home_bin_t;
 344         ')
 345
 346         dontaudit $1 home_bin_t:dir search_dir_perms;
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Execute user bin files.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain allowed access.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_exec_user_bin_files',`
 360         gen_require(`
 361                 attribute user_home_type;
 362                 type home_bin_t, user_home_dir_t;
 363         ')
 364
 365         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 366         files_search_home($1)
 367 ')
 368
 369 #######################################
 370 ## <summary>
 371 ##      The execute access user temporary files.
 372 ## </summary>
 373 ## <param name="domain">
 374 ##      <summary>
 375 ##      Domain allowed access.
 376 ##      </summary>
 377 ## </param>
 378 ## <rolebase/>
 379 #
 380 interface(`userdom_exec_user_tmp_files',`
 381         gen_require(`
 382                 type user_tmp_t;
 383         ')
 384
 385         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 386         dontaudit $1 user_tmp_t:sock_file execute;
 387         files_search_tmp($1)
 388 ')
 389
 390 #######################################
 391 ## <summary>
 392 ##      Role access for the user tmpfs type
 393 ##      that the user has full access.
 394 ## </summary>
 395 ## <desc>
 396 ##      <p>
 397 ##      Role access for the user tmpfs type
 398 ##      that the user has full access.
 399 ##      </p>
 400 ##      <p>
 401 ##      This does not allow execute access.
 402 ##      </p>
 403 ## </desc>
 404 ## <param name="role">
 405 ##      <summary>
 406 ##      Role allowed access.
 407 ##      </summary>
 408 ## </param>
 409 ## <param name="domain">
 410 ##      <summary>
 411 ##      Domain allowed access.
 412 ##      </summary>
 413 ## </param>
 414 ## <rolecap/>
 415 #
 416 interface(`userdom_manage_tmpfs_role',`
 417         gen_require(`
 418                 type user_tmpfs_t;
 419         ')
 420
 421         role $1 types user_tmpfs_t;
 422
 423         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 424         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 425         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 426         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 427         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 428         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 429 ')
 430
 431 #######################################
 432 ## <summary>
 433 ##      The interface allowing the user basic
 434 ##      network permissions
 435 ## </summary>
 436 ## <param name="userdomain">
 437 ##      <summary>
 438 ##      The user domain
 439 ##      </summary>
 440 ## </param>
 441 ## <rolebase/>
 442 #
 443 interface(`userdom_basic_networking',`
 444
 445         allow $1 self:tcp_socket create_stream_socket_perms;
 446         allow $1 self:udp_socket create_socket_perms;
 447
 448         corenet_all_recvfrom_unlabeled($1)
 449         corenet_all_recvfrom_netlabel($1)
 450         corenet_tcp_sendrecv_generic_if($1)
 451         corenet_udp_sendrecv_generic_if($1)
 452         corenet_tcp_sendrecv_generic_node($1)
 453         corenet_udp_sendrecv_generic_node($1)
 454         corenet_tcp_sendrecv_all_ports($1)
 455         corenet_udp_sendrecv_all_ports($1)
 456         corenet_tcp_connect_all_ports($1)
 457         corenet_sendrecv_all_client_packets($1)
 458
 459         optional_policy(`
 460                 init_tcp_recvfrom_all_daemons($1)
 461                 init_udp_recvfrom_all_daemons($1)
 462         ')
 463
 464         optional_policy(`
 465                 ipsec_match_default_spd($1)
 466         ')
 467
 468 ')
 469
 470 #######################################
 471 ## <summary>
 472 ##      The template for creating a user xwindows client.  (Deprecated)
 473 ## </summary>
 474 ## <param name="userdomain_prefix">
 475 ##      <summary>
 476 ##      The prefix of the user domain (e.g., user
 477 ##      is the prefix for user_t).
 478 ##      </summary>
 479 ## </param>
 480 ## <rolebase/>
 481 #
 482 template(`userdom_xwindows_client_template',`
 483         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 484         gen_require(`
 485                 type $1_t, user_tmpfs_t;
 486         ')
 487
 488         dev_rw_xserver_misc($1_t)
 489         dev_rw_power_management($1_t)
 490         dev_read_input($1_t)
 491         dev_read_misc($1_t)
 492         dev_write_misc($1_t)
 493         # open office is looking for the following
 494         dev_getattr_agp_dev($1_t)
 495         dev_dontaudit_rw_dri($1_t)
 496         # GNOME checks for usb and other devices:
 497         dev_rw_usbfs($1_t)
 498         dev_rw_generic_usb_dev($1_t)
 499
 500         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 501         xserver_xsession_entry_type($1_t)
 502         xserver_dontaudit_write_log($1_t)
 503         xserver_stream_connect_xdm($1_t)
 504         # certain apps want to read xdm.pid file
 505         xserver_read_xdm_pid($1_t)
 506         # gnome-session creates socket under /tmp/.ICE-unix/
 507         xserver_create_xdm_tmp_sockets($1_t)
 508         # Needed for escd, remove if we get escd policy
 509         xserver_manage_xdm_tmp_files($1_t)
 510 ')
 511
 512 #######################################
 513 ## <summary>
 514 ##      The template for allowing the user to change passwords.
 515 ## </summary>
 516 ## <param name="userdomain_prefix">
 517 ##      <summary>
 518 ##      The prefix of the user domain (e.g., user
 519 ##      is the prefix for user_t).
 520 ##      </summary>
 521 ## </param>
 522 ## <rolebase/>
 523 #
 524 template(`userdom_change_password_template',`
 525         gen_require(`
 526                 type $1_t;
 527                 role $1_r;
 528         ')
 529
 530         optional_policy(`
 531                 usermanage_run_chfn($1_t,$1_r)
 532                 usermanage_run_passwd($1_t,$1_r)
 533         ')
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template containing rules common to unprivileged
 539 ##      users and administrative users.
 540 ## </summary>
 541 ## <desc>
 542 ##      <p>
 543 ##      This template creates a user domain, types, and
 544 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 545 ##      </p>
 546 ## </desc>
 547 ## <param name="userdomain_prefix">
 548 ##      <summary>
 549 ##      The prefix of the user domain (e.g., user
 550 ##      is the prefix for user_t).
 551 ##      </summary>
 552 ## </param>
 553 #
 554 template(`userdom_common_user_template',`
 555         gen_require(`
 556                 attribute unpriv_userdomain;
 557         ')
 558
 559         userdom_basic_networking($1_usertype)
 560
 561         ##############################
 562         #
 563         # User domain Local policy
 564         #
 565
 566         # evolution and gnome-session try to create a netlink socket
 567         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 568         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 569         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 570         allow $1_t self:socket create_socket_perms;
 571
 572         allow $1_usertype unpriv_userdomain:fd use;
 573
 574         kernel_read_system_state($1_usertype)
 575         kernel_read_network_state($1_usertype)
 576         kernel_read_net_sysctls($1_usertype)
 577         # Very permissive allowing every domain to see every type:
 578         kernel_get_sysvipc_info($1_usertype)
 579         # Find CDROM devices:
 580         kernel_read_device_sysctls($1_usertype)
 581         kernel_request_load_module($1_usertype)
 582
 583         corenet_udp_bind_generic_node($1_usertype)
 584         corenet_udp_bind_generic_port($1_usertype)
 585
 586         dev_read_rand($1_usertype)
 587         dev_write_sound($1_usertype)
 588         dev_read_sound($1_usertype)
 589         dev_read_sound_mixer($1_usertype)
 590         dev_write_sound_mixer($1_usertype)
 591
 592         files_exec_etc_files($1_usertype)
 593         files_search_locks($1_usertype)
 594         # Check to see if cdrom is mounted
 595         files_search_mnt($1_usertype)
 596         # cjp: perhaps should cut back on file reads:
 597         files_read_var_files($1_usertype)
 598         files_read_var_symlinks($1_usertype)
 599         files_read_generic_spool($1_usertype)
 600         files_read_var_lib_files($1_usertype)
 601         # Stat lost+found.
 602         files_getattr_lost_found_dirs($1_usertype)
 603         files_read_config_files($1_usertype)
 604         fs_read_noxattr_fs_files($1_usertype)
 605         fs_read_noxattr_fs_symlinks($1_usertype)
 606         fs_rw_cgroup_files($1_usertype)
 607
 608         logging_send_syslog_msg($1_usertype)
 609         logging_send_audit_msgs($1_usertype)
 610         selinux_get_enforce_mode($1_usertype)
 611
 612         # cjp: some of this probably can be removed
 613         selinux_get_fs_mount($1_usertype)
 614         selinux_validate_context($1_usertype)
 615         selinux_compute_access_vector($1_usertype)
 616         selinux_compute_create_context($1_usertype)
 617         selinux_compute_relabel_context($1_usertype)
 618         selinux_compute_user_contexts($1_usertype)
 619
 620         # for eject
 621         storage_getattr_fixed_disk_dev($1_usertype)
 622
 623         auth_read_login_records($1_usertype)
 624         auth_run_pam($1_t,$1_r)
 625         auth_run_utempter($1_t,$1_r)
 626
 627         init_read_utmp($1_usertype)
 628
 629         seutil_read_file_contexts($1_usertype)
 630         seutil_read_default_contexts($1_usertype)
 631         seutil_run_newrole($1_t,$1_r)
 632         seutil_exec_checkpolicy($1_t)
 633         seutil_exec_setfiles($1_usertype)
 634         # for when the network connection is killed
 635         # this is needed when a login role can change
 636         # to this one.
 637         seutil_dontaudit_signal_newrole($1_t)
 638
 639         tunable_policy(`user_direct_mouse',`
 640                 dev_read_mouse($1_usertype)
 641         ')
 642
 643         tunable_policy(`user_ttyfile_stat',`
 644                 term_getattr_all_ttys($1_t)
 645         ')
 646
 647         optional_policy(`
 648                 alsa_read_rw_config($1_usertype)
 649         ')
 650
 651         optional_policy(`
 652                 # Allow graphical boot to check battery lifespan
 653                 apm_stream_connect($1_usertype)
 654         ')
 655
 656         optional_policy(`
 657                 canna_stream_connect($1_usertype)
 658         ')
 659
 660         optional_policy(`
 661                 chrome_role($1_r, $1_usertype)
 662         ')
 663
 664         optional_policy(`
 665                 dbus_system_bus_client($1_usertype)
 666
 667                 allow $1_usertype $1_usertype:dbus  send_msg;
 668
 669                 optional_policy(`
 670                         avahi_dbus_chat($1_usertype)
 671                 ')
 672
 673                 optional_policy(`
 674                         policykit_dbus_chat($1_usertype)
 675                 ')
 676
 677                 optional_policy(`
 678                         bluetooth_dbus_chat($1_usertype)
 679                 ')
 680
 681                 optional_policy(`
 682                         consolekit_dbus_chat($1_usertype)
 683                         consolekit_read_log($1_usertype)
 684                 ')
 685
 686                 optional_policy(`
 687                         devicekit_dbus_chat($1_usertype)
 688                         devicekit_dbus_chat_power($1_usertype)
 689                         devicekit_dbus_chat_disk($1_usertype)
 690                 ')
 691
 692                 optional_policy(`
 693                         evolution_dbus_chat($1_usertype)
 694                         evolution_alarm_dbus_chat($1_usertype)
 695                 ')
 696
 697                 optional_policy(`
 698                         gnome_dbus_chat_gconfdefault($1_usertype)
 699                 ')
 700
 701                 optional_policy(`
 702                         hal_dbus_chat($1_usertype)
 703                 ')
 704
 705                 optional_policy(`
 706                         modemmanager_dbus_chat($1_usertype)
 707                 ')
 708
 709                 optional_policy(`
 710                         networkmanager_dbus_chat($1_usertype)
 711                         networkmanager_read_lib_files($1_usertype)
 712                 ')
 713
 714                 optional_policy(`
 715                         vpn_dbus_chat($1_usertype)
 716                 ')
 717         ')
 718
 719         optional_policy(`
 720                 git_session_role($1_r, $1_usertype)
 721         ')
 722
 723         optional_policy(`
 724                 inetd_use_fds($1_usertype)
 725                 inetd_rw_tcp_sockets($1_usertype)
 726         ')
 727
 728         optional_policy(`
 729                 inn_read_config($1_usertype)
 730                 inn_read_news_lib($1_usertype)
 731                 inn_read_news_spool($1_usertype)
 732         ')
 733
 734         optional_policy(`
 735                 locate_read_lib_files($1_usertype)
 736         ')
 737
 738         # for running depmod as part of the kernel packaging process
 739         optional_policy(`
 740                 modutils_read_module_config($1_usertype)
 741         ')
 742
 743         optional_policy(`
 744                 mta_rw_spool($1_usertype)
 745                 mta_manage_queue($1_usertype)
 746         ')
 747
 748         optional_policy(`
 749                 nsplugin_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 tunable_policy(`allow_user_mysql_connect',`
 754                         mysql_stream_connect($1_t)
 755                 ')
 756         ')
 757
 758         optional_policy(`
 759                 # to allow monitoring of pcmcia status
 760                 pcmcia_read_pid($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 pcscd_read_pub_files($1_usertype)
 765                 pcscd_stream_connect($1_usertype)
 766         ')
 767
 768         optional_policy(`
 769                 tunable_policy(`allow_user_postgresql_connect',`
 770                         postgresql_stream_connect($1_usertype)
 771                         postgresql_tcp_connect($1_usertype)
 772                 ')
 773         ')
 774
 775         optional_policy(`
 776                 resmgr_stream_connect($1_usertype)
 777         ')
 778
 779         optional_policy(`
 780                 rpc_dontaudit_getattr_exports($1_usertype)
 781                 rpc_manage_nfs_rw_content($1_usertype)
 782         ')
 783
 784         optional_policy(`
 785                 rpcbind_stream_connect($1_usertype)
 786         ')
 787
 788         optional_policy(`
 789                 samba_stream_connect_winbind($1_usertype)
 790         ')
 791
 792         optional_policy(`
 793                 sandbox_transition($1_usertype, $1_r)
 794         ')
 795
 796         optional_policy(`
 797                 seunshare_role_template($1, $1_r, $1_t)
 798         ')
 799
 800         optional_policy(`
 801                 slrnpull_search_spool($1_usertype)
 802         ')
 803
 804 ')
 805
 806 #######################################
 807 ## <summary>
 808 ##      The template for creating a login user.
 809 ## </summary>
 810 ## <desc>
 811 ##      <p>
 812 ##      This template creates a user domain, types, and
 813 ##      rules for the user's tty, pty, home directories,
 814 ##      tmp, and tmpfs files.
 815 ##      </p>
 816 ## </desc>
 817 ## <param name="userdomain_prefix">
 818 ##      <summary>
 819 ##      The prefix of the user domain (e.g., user
 820 ##      is the prefix for user_t).
 821 ##      </summary>
 822 ## </param>
 823 #
 824 template(`userdom_login_user_template', `
 825         gen_require(`
 826                 class context contains;
 827         ')
 828
 829         userdom_base_user_template($1)
 830
 831         userdom_manage_home_role($1_r, $1_usertype)
 832
 833         userdom_manage_tmp_role($1_r, $1_usertype)
 834         userdom_manage_tmpfs_role($1_r, $1_usertype)
 835
 836         ifelse(`$1',`unconfined',`',`
 837                 gen_tunable(allow_$1_exec_content, true)
 838
 839                 tunable_policy(`allow_$1_exec_content',`
 840                         userdom_exec_user_tmp_files($1_usertype)
 841                         userdom_exec_user_home_content_files($1_usertype)
 842                 ')
 843                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 844                         fs_exec_nfs_files($1_usertype)
 845                 ')
 846
 847                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 848                         fs_exec_cifs_files($1_usertype)
 849                 ')
 850         ')
 851
 852         userdom_change_password_template($1)
 853
 854         ##############################
 855         #
 856         # User domain Local policy
 857         #
 858
 859         allow $1_t self:capability { setgid chown fowner };
 860         dontaudit $1_t self:capability { sys_nice fsetid };
 861
 862         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 863         dontaudit $1_t self:process setrlimit;
 864         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 865
 866         allow $1_t self:context contains;
 867
 868         kernel_dontaudit_read_system_state($1_usertype)
 869         kernel_dontaudit_list_all_proc($1_usertype)
 870
 871         dev_read_sysfs($1_usertype)
 872         dev_read_urand($1_usertype)
 873
 874         domain_use_interactive_fds($1_usertype)
 875         # Command completion can fire hundreds of denials
 876         domain_dontaudit_exec_all_entry_files($1_usertype)
 877
 878         files_dontaudit_list_default($1_usertype)
 879         files_dontaudit_read_default_files($1_usertype)
 880         # Stat lost+found.
 881         files_getattr_lost_found_dirs($1_usertype)
 882
 883         fs_get_all_fs_quotas($1_usertype)
 884         fs_getattr_all_fs($1_usertype)
 885         fs_search_all($1_usertype)
 886         fs_list_inotifyfs($1_usertype)
 887         fs_rw_anon_inodefs_files($1_usertype)
 888
 889         auth_dontaudit_write_login_records($1_t)
 890         auth_rw_cache($1_t)
 891
 892         # Stop warnings about access to /dev/console
 893         init_dontaudit_use_fds($1_usertype)
 894         init_dontaudit_use_script_fds($1_usertype)
 895
 896         libs_exec_lib_files($1_usertype)
 897
 898         logging_dontaudit_getattr_all_logs($1_usertype)
 899
 900         # for running TeX programs
 901         miscfiles_read_tetex_data($1_usertype)
 902         miscfiles_exec_tetex_data($1_usertype)
 903
 904         seutil_read_config($1_usertype)
 905
 906         optional_policy(`
 907                 cups_read_config($1_usertype)
 908                 cups_stream_connect($1_usertype)
 909                 cups_stream_connect_ptal($1_usertype)
 910         ')
 911
 912         optional_policy(`
 913                 kerberos_use($1_usertype)
 914                 kerberos_connect_524($1_usertype)
 915         ')
 916
 917         optional_policy(`
 918                 mta_dontaudit_read_spool_symlinks($1_usertype)
 919         ')
 920
 921         optional_policy(`
 922                 quota_dontaudit_getattr_db($1_usertype)
 923         ')
 924
 925         optional_policy(`
 926                 rpm_read_db($1_usertype)
 927                 rpm_dontaudit_manage_db($1_usertype)
 928                 rpm_read_cache($1_usertype)
 929         ')
 930
 931         optional_policy(`
 932                 oddjob_run_mkhomedir($1_t, $1_r)
 933         ')
 934 ')
 935
 936 #######################################
 937 ## <summary>
 938 ##      The template for creating a unprivileged login user.
 939 ## </summary>
 940 ## <desc>
 941 ##      <p>
 942 ##      This template creates a user domain, types, and
 943 ##      rules for the user's tty, pty, home directories,
 944 ##      tmp, and tmpfs files.
 945 ##      </p>
 946 ## </desc>
 947 ## <param name="userdomain_prefix">
 948 ##      <summary>
 949 ##      The prefix of the user domain (e.g., user
 950 ##      is the prefix for user_t).
 951 ##      </summary>
 952 ## </param>
 953 #
 954 template(`userdom_restricted_user_template',`
 955         gen_require(`
 956                 attribute unpriv_userdomain;
 957         ')
 958
 959         userdom_login_user_template($1)
 960
 961         typeattribute $1_t unpriv_userdomain;
 962         domain_interactive_fd($1_t)
 963
 964         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 965         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 966
 967         ##############################
 968         #
 969         # Local policy
 970         #
 971
 972         optional_policy(`
 973                 loadkeys_run($1_t,$1_r)
 974         ')
 975 ')
 976
 977 #######################################
 978 ## <summary>
 979 ##      The template for creating a unprivileged xwindows login user.
 980 ## </summary>
 981 ## <desc>
 982 ##      <p>
 983 ##      The template for creating a unprivileged xwindows login user.
 984 ##      </p>
 985 ##      <p>
 986 ##      This template creates a user domain, types, and
 987 ##      rules for the user's tty, pty, home directories,
 988 ##      tmp, and tmpfs files.
 989 ##      </p>
 990 ## </desc>
 991 ## <param name="userdomain_prefix">
 992 ##      <summary>
 993 ##      The prefix of the user domain (e.g., user
 994 ##      is the prefix for user_t).
 995 ##      </summary>
 996 ## </param>
 997 #
 998 template(`userdom_restricted_xwindows_user_template',`
 999
1000         userdom_restricted_user_template($1)
1001
1002         ##############################
1003         #
1004         # Local policy
1005         #
1006
1007         auth_role($1_r, $1_t)
1008         auth_search_pam_console_data($1_usertype)
1009
1010         dev_read_sound($1_usertype)
1011         dev_write_sound($1_usertype)
1012         # gnome keyring wants to read this.
1013         dev_dontaudit_read_rand($1_usertype)
1014         # temporarily allow since openoffice requires this
1015         dev_read_rand($1_usertype)
1016
1017         dev_read_video_dev($1_usertype)
1018         dev_write_video_dev($1_usertype)
1019         dev_rw_wireless($1_usertype)
1020
1021         tunable_policy(`user_rw_noexattrfile',`
1022                 dev_rw_usbfs($1_t)
1023                 dev_rw_generic_usb_dev($1_usertype)
1024
1025                 fs_manage_noxattr_fs_files($1_usertype)
1026                 fs_manage_noxattr_fs_dirs($1_usertype)
1027                 fs_manage_dos_dirs($1_usertype)
1028                 fs_manage_dos_files($1_usertype)
1029                 storage_raw_read_removable_device($1_usertype)
1030                 storage_raw_write_removable_device($1_usertype)
1031         ')
1032
1033         logging_send_syslog_msg($1_usertype)
1034         logging_dontaudit_send_audit_msgs($1_t)
1035
1036         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1037         logging_send_audit_msgs($1_t)
1038         selinux_get_enforce_mode($1_t)
1039         seutil_exec_restorecond($1_t)
1040         seutil_read_file_contexts($1_t)
1041         seutil_read_default_contexts($1_t)
1042
1043         xserver_restricted_role($1_r, $1_t)
1044
1045         optional_policy(`
1046                 alsa_read_rw_config($1_usertype)
1047         ')
1048
1049         optional_policy(`
1050                 dbus_role_template($1, $1_r, $1_usertype)
1051                 dbus_system_bus_client($1_usertype)
1052                 allow $1_usertype $1_usertype:dbus send_msg;
1053
1054                 optional_policy(`
1055                         abrt_dbus_chat($1_usertype)
1056                         abrt_run_helper($1_usertype, $1_r)
1057                 ')
1058
1059                 optional_policy(`
1060                         consolekit_dbus_chat($1_usertype)
1061                 ')
1062
1063                 optional_policy(`
1064                         cups_dbus_chat($1_usertype)
1065                         cups_dbus_chat_config($1_usertype)
1066                 ')
1067
1068                 optional_policy(`
1069                         devicekit_dbus_chat($1_usertype)
1070                         devicekit_dbus_chat_disk($1_usertype)
1071                         devicekit_dbus_chat_power($1_usertype)
1072                 ')
1073
1074                 optional_policy(`
1075                         fprintd_dbus_chat($1_t)
1076                 ')
1077         ')
1078
1079         optional_policy(`
1080                 openoffice_role_template($1, $1_r, $1_usertype)
1081         ')
1082
1083         optional_policy(`
1084                 policykit_role($1_r, $1_usertype)
1085         ')
1086
1087         optional_policy(`
1088                 pulseaudio_role($1_r, $1_usertype)
1089         ')
1090
1091         optional_policy(`
1092                 rtkit_scheduled($1_usertype)
1093         ')
1094
1095         optional_policy(`
1096                 setroubleshoot_dontaudit_stream_connect($1_t)
1097         ')
1098
1099         optional_policy(`
1100                 udev_read_db($1_usertype)
1101         ')
1102
1103         optional_policy(`
1104                 wm_role_template($1, $1_r, $1_t)
1105         ')
1106 ')
1107
1108 #######################################
1109 ## <summary>
1110 ##      The template for creating a unprivileged user roughly
1111 ##      equivalent to a regular linux user.
1112 ## </summary>
1113 ## <desc>
1114 ##      <p>
1115 ##      The template for creating a unprivileged user roughly
1116 ##      equivalent to a regular linux user.
1117 ##      </p>
1118 ##      <p>
1119 ##      This template creates a user domain, types, and
1120 ##      rules for the user's tty, pty, home directories,
1121 ##      tmp, and tmpfs files.
1122 ##      </p>
1123 ## </desc>
1124 ## <param name="userdomain_prefix">
1125 ##      <summary>
1126 ##      The prefix of the user domain (e.g., user
1127 ##      is the prefix for user_t).
1128 ##      </summary>
1129 ## </param>
1130 #
1131 template(`userdom_unpriv_user_template', `
1132
1133         ##############################
1134         #
1135         # Declarations
1136         #
1137
1138         # Inherit rules for ordinary users.
1139         userdom_restricted_xwindows_user_template($1)
1140         userdom_common_user_template($1)
1141
1142         ##############################
1143         #
1144         # Local policy
1145         #
1146
1147         # port access is audited even if dac would not have allowed it, so dontaudit it here
1148 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1149         # Need the following rule to allow users to run vpnc
1150         corenet_tcp_bind_xserver_port($1_t)
1151         corenet_tcp_bind_all_nodes($1_usertype)
1152
1153         storage_rw_fuse($1_t)
1154
1155         miscfiles_read_hwdata($1_usertype)
1156
1157         # Allow users to run TCP servers (bind to ports and accept connection from
1158         # the same domain and outside users) disabling this forces FTP passive mode
1159         # and may change other protocols
1160         tunable_policy(`user_tcp_server',`
1161                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1162         ')
1163
1164         tunable_policy(`user_setrlimit',`
1165                 allow $1_usertype self:process setrlimit;
1166         ')
1167
1168         optional_policy(`
1169                 cdrecord_role($1_r, $1_t)
1170         ')
1171
1172         optional_policy(`
1173                 cron_role($1_r, $1_t)
1174         ')
1175
1176         optional_policy(`
1177                 games_rw_data($1_usertype)
1178         ')
1179
1180         optional_policy(`
1181                 gpg_role($1_r, $1_usertype)
1182         ')
1183
1184         optional_policy(`
1185                 gnomeclock_dbus_chat($1_t)
1186         ')
1187
1188         optional_policy(`
1189                 gpm_stream_connect($1_usertype)
1190         ')
1191
1192         optional_policy(`
1193                 execmem_role_template($1, $1_r, $1_t)
1194         ')
1195
1196         optional_policy(`
1197                 java_role_template($1, $1_r, $1_t)
1198         ')
1199
1200         optional_policy(`
1201                 mono_role_template($1, $1_r, $1_t)
1202         ')
1203
1204         optional_policy(`
1205                 mount_run_fusermount($1_t, $1_r)
1206         ')
1207
1208         optional_policy(`
1209                 wine_role_template($1, $1_r, $1_t)
1210         ')
1211
1212         optional_policy(`
1213                 postfix_run_postdrop($1_t, $1_r)
1214         ')
1215
1216         # Run pppd in pppd_t by default for user
1217         optional_policy(`
1218                 ppp_run_cond($1_t, $1_r)
1219         ')
1220 ')
1221
1222 #######################################
1223 ## <summary>
1224 ##      The template for creating an administrative user.
1225 ## </summary>
1226 ## <desc>
1227 ##      <p>
1228 ##      This template creates a user domain, types, and
1229 ##      rules for the user's tty, pty, home directories,
1230 ##      tmp, and tmpfs files.
1231 ##      </p>
1232 ##      <p>
1233 ##      The privileges given to administrative users are:
1234 ##      <ul>
1235 ##              <li>Raw disk access</li>
1236 ##              <li>Set all sysctls</li>
1237 ##              <li>All kernel ring buffer controls</li>
1238 ##              <li>Create, read, write, and delete all files but shadow</li>
1239 ##              <li>Manage source and binary format SELinux policy</li>
1240 ##              <li>Run insmod</li>
1241 ##      </ul>
1242 ##      </p>
1243 ## </desc>
1244 ## <param name="userdomain_prefix">
1245 ##      <summary>
1246 ##      The prefix of the user domain (e.g., sysadm
1247 ##      is the prefix for sysadm_t).
1248 ##      </summary>
1249 ## </param>
1250 #
1251 template(`userdom_admin_user_template',`
1252         gen_require(`
1253                 attribute admindomain;
1254                 class passwd { passwd chfn chsh rootok crontab };
1255         ')
1256
1257         ##############################
1258         #
1259         # Declarations
1260         #
1261
1262         # Inherit rules for ordinary users.
1263         userdom_login_user_template($1)
1264         userdom_common_user_template($1)
1265
1266         domain_obj_id_change_exemption($1_t)
1267         role system_r types $1_t;
1268
1269         typeattribute $1_t admindomain;
1270
1271         ifdef(`direct_sysadm_daemon',`
1272                 domain_system_change_exemption($1_t)
1273         ')
1274
1275         ##############################
1276         #
1277         # $1_t local policy
1278         #
1279
1280         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1281         allow $1_t self:process { setexec setfscreate };
1282         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1283         allow $1_t self:tun_socket create;
1284         # Set password information for other users.
1285         allow $1_t self:passwd { passwd chfn chsh };
1286         # Skip authentication when pam_rootok is specified.
1287         allow $1_t self:passwd rootok;
1288
1289         # Manipulate other users crontab.
1290         allow $1_t self:passwd crontab;
1291
1292         kernel_read_software_raid_state($1_t)
1293         kernel_getattr_core_if($1_t)
1294         kernel_getattr_message_if($1_t)
1295         kernel_change_ring_buffer_level($1_t)
1296         kernel_clear_ring_buffer($1_t)
1297         kernel_read_ring_buffer($1_t)
1298         kernel_get_sysvipc_info($1_t)
1299         kernel_rw_all_sysctls($1_t)
1300         # signal unlabeled processes:
1301         kernel_kill_unlabeled($1_t)
1302         kernel_signal_unlabeled($1_t)
1303         kernel_sigstop_unlabeled($1_t)
1304         kernel_signull_unlabeled($1_t)
1305         kernel_sigchld_unlabeled($1_t)
1306         kernel_signal($1_t)
1307
1308         corenet_tcp_bind_generic_port($1_t)
1309         # allow setting up tunnels
1310         corenet_rw_tun_tap_dev($1_t)
1311
1312         dev_getattr_generic_blk_files($1_t)
1313         dev_getattr_generic_chr_files($1_t)
1314         # for lsof
1315         dev_getattr_mtrr_dev($1_t)
1316         # Allow MAKEDEV to work
1317         dev_create_all_blk_files($1_t)
1318         dev_create_all_chr_files($1_t)
1319         dev_delete_all_blk_files($1_t)
1320         dev_delete_all_chr_files($1_t)
1321         dev_rename_all_blk_files($1_t)
1322         dev_rename_all_chr_files($1_t)
1323         dev_create_generic_symlinks($1_t)
1324
1325         domain_setpriority_all_domains($1_t)
1326         domain_read_all_domains_state($1_t)
1327         domain_getattr_all_domains($1_t)
1328         domain_dontaudit_ptrace_all_domains($1_t)
1329         # signal all domains:
1330         domain_kill_all_domains($1_t)
1331         domain_signal_all_domains($1_t)
1332         domain_signull_all_domains($1_t)
1333         domain_sigstop_all_domains($1_t)
1334         domain_sigstop_all_domains($1_t)
1335         domain_sigchld_all_domains($1_t)
1336         # for lsof
1337         domain_getattr_all_sockets($1_t)
1338         domain_dontaudit_getattr_all_sockets($1_t)
1339
1340         files_exec_usr_src_files($1_t)
1341
1342         fs_getattr_all_fs($1_t)
1343         fs_getattr_all_files($1_t)
1344         fs_list_all($1_t)
1345         fs_set_all_quotas($1_t)
1346         fs_exec_noxattr($1_t)
1347
1348         storage_raw_read_removable_device($1_t)
1349         storage_raw_write_removable_device($1_t)
1350
1351         term_use_all_terms($1_t)
1352
1353         auth_getattr_shadow($1_t)
1354         # Manage almost all files
1355         auth_manage_all_files_except_shadow($1_t)
1356         # Relabel almost all files
1357         auth_relabel_all_files_except_shadow($1_t)
1358
1359         init_telinit($1_t)
1360
1361         logging_send_syslog_msg($1_t)
1362
1363         modutils_domtrans_insmod($1_t)
1364         modutils_domtrans_depmod($1_t)
1365
1366         # The following rule is temporary until such time that a complete
1367         # policy management infrastructure is in place so that an administrator
1368         # cannot directly manipulate policy files with arbitrary programs.
1369         seutil_manage_src_policy($1_t)
1370         # Violates the goal of limiting write access to checkpolicy.
1371         # But presently necessary for installing the file_contexts file.
1372         seutil_manage_bin_policy($1_t)
1373
1374         userdom_manage_user_home_content_dirs($1_t)
1375         userdom_manage_user_home_content_files($1_t)
1376         userdom_manage_user_home_content_symlinks($1_t)
1377         userdom_manage_user_home_content_pipes($1_t)
1378         userdom_manage_user_home_content_sockets($1_t)
1379         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1380
1381         tunable_policy(`user_rw_noexattrfile',`
1382                 fs_manage_noxattr_fs_files($1_t)
1383                 fs_manage_noxattr_fs_dirs($1_t)
1384         ',`
1385                 fs_read_noxattr_fs_files($1_t)
1386         ')
1387
1388         optional_policy(`
1389                 postgresql_unconfined($1_t)
1390         ')
1391
1392         optional_policy(`
1393                 userhelper_exec($1_t)
1394         ')
1395 ')
1396
1397 ########################################
1398 ## <summary>
1399 ##      Allow user to run as a secadm
1400 ## </summary>
1401 ## <desc>
1402 ##      <p>
1403 ##      Create objects in a user home directory
1404 ##      with an automatic type transition to
1405 ##      a specified private type.
1406 ##      </p>
1407 ##      <p>
1408 ##      This is a templated interface, and should only
1409 ##      be called from a per-userdomain template.
1410 ##      </p>
1411 ## </desc>
1412 ## <param name="domain">
1413 ##      <summary>
1414 ##      Domain allowed access.
1415 ##      </summary>
1416 ## </param>
1417 ## <param name="role">
1418 ##      <summary>
1419 ##      The role  of the object to create.
1420 ##      </summary>
1421 ## </param>
1422 #
1423 template(`userdom_security_admin_template',`
1424         allow $1 self:capability { dac_read_search dac_override };
1425
1426         corecmd_exec_shell($1)
1427
1428         domain_obj_id_change_exemption($1)
1429
1430         dev_relabel_all_dev_nodes($1)
1431
1432         files_create_boot_flag($1)
1433         files_create_default_dir($1)
1434         files_root_filetrans_default($1, dir)
1435
1436         # Necessary for managing /boot/efi
1437         fs_manage_dos_files($1)
1438
1439         mls_process_read_up($1)
1440         mls_file_read_all_levels($1)
1441         mls_file_upgrade($1)
1442         mls_file_downgrade($1)
1443
1444         selinux_set_enforce_mode($1)
1445         selinux_set_all_booleans($1)
1446         selinux_set_parameters($1)
1447
1448         auth_relabel_all_files_except_shadow($1)
1449         auth_relabel_shadow($1)
1450
1451         init_exec($1)
1452
1453         logging_send_syslog_msg($1)
1454         logging_read_audit_log($1)
1455         logging_read_generic_logs($1)
1456         logging_read_audit_config($1)
1457
1458         seutil_manage_bin_policy($1)
1459         seutil_run_checkpolicy($1,$2)
1460         seutil_run_loadpolicy($1,$2)
1461         seutil_run_semanage($1,$2)
1462         seutil_run_setsebool($1,$2)
1463         seutil_run_setfiles($1, $2)
1464
1465         optional_policy(`
1466                 aide_run($1,$2)
1467         ')
1468
1469         optional_policy(`
1470                 consoletype_exec($1)
1471         ')
1472
1473         optional_policy(`
1474                 dmesg_exec($1)
1475         ')
1476
1477         optional_policy(`
1478                 ipsec_run_setkey($1,$2)
1479         ')
1480
1481         optional_policy(`
1482                 netlabel_run_mgmt($1,$2)
1483         ')
1484 ')
1485
1486 ########################################
1487 ## <summary>
1488 ##      Make the specified type usable in a
1489 ##      user home directory.
1490 ## </summary>
1491 ## <param name="type">
1492 ##      <summary>
1493 ##      Type to be used as a file in the
1494 ##      user home directory.
1495 ##      </summary>
1496 ## </param>
1497 #
1498 interface(`userdom_user_home_content',`
1499         gen_require(`
1500                 type user_home_t;
1501                 attribute user_home_type;
1502         ')
1503
1504         allow $1 user_home_t:filesystem associate;
1505         files_type($1)
1506         ubac_constrained($1)
1507
1508         files_poly_member($1)
1509         typeattribute $1  user_home_type;
1510 ')
1511
1512 ########################################
1513 ## <summary>
1514 ##      Allow domain to attach to TUN devices created by administrative users.
1515 ## </summary>
1516 ## <param name="domain">
1517 ##      <summary>
1518 ##      Domain allowed access.
1519 ##      </summary>
1520 ## </param>
1521 #
1522 interface(`userdom_attach_admin_tun_iface',`
1523         gen_require(`
1524                 attribute admindomain;
1525         ')
1526
1527         allow $1 admindomain:tun_socket relabelfrom;
1528         allow $1 self:tun_socket relabelto;
1529 ')
1530
1531 ########################################
1532 ## <summary>
1533 ##      Set the attributes of a user pty.
1534 ## </summary>
1535 ## <param name="domain">
1536 ##      <summary>
1537 ##      Domain allowed access.
1538 ##      </summary>
1539 ## </param>
1540 #
1541 interface(`userdom_setattr_user_ptys',`
1542         gen_require(`
1543                 type user_devpts_t;
1544         ')
1545
1546         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1547 ')
1548
1549 ########################################
1550 ## <summary>
1551 ##      Create a user pty.
1552 ## </summary>
1553 ## <param name="domain">
1554 ##      <summary>
1555 ##      Domain allowed access.
1556 ##      </summary>
1557 ## </param>
1558 #
1559 interface(`userdom_create_user_pty',`
1560         gen_require(`
1561                 type user_devpts_t;
1562         ')
1563
1564         term_create_pty($1, user_devpts_t)
1565 ')
1566
1567 ########################################
1568 ## <summary>
1569 ##      Get the attributes of user home directories.
1570 ## </summary>
1571 ## <param name="domain">
1572 ##      <summary>
1573 ##      Domain allowed access.
1574 ##      </summary>
1575 ## </param>
1576 #
1577 interface(`userdom_getattr_user_home_dirs',`
1578         gen_require(`
1579                 type user_home_dir_t;
1580         ')
1581
1582         allow $1 user_home_dir_t:dir getattr_dir_perms;
1583         files_search_home($1)
1584 ')
1585
1586 ########################################
1587 ## <summary>
1588 ##      Do not audit attempts to get the attributes of user home directories.
1589 ## </summary>
1590 ## <param name="domain">
1591 ##      <summary>
1592 ##      Domain to not audit.
1593 ##      </summary>
1594 ## </param>
1595 #
1596 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1597         gen_require(`
1598                 type user_home_dir_t;
1599         ')
1600
1601         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1602 ')
1603
1604 ########################################
1605 ## <summary>
1606 ##      Search user home directories.
1607 ## </summary>
1608 ## <param name="domain">
1609 ##      <summary>
1610 ##      Domain allowed access.
1611 ##      </summary>
1612 ## </param>
1613 #
1614 interface(`userdom_search_user_home_dirs',`
1615         gen_require(`
1616                 type user_home_dir_t;
1617         ')
1618
1619         allow $1 user_home_dir_t:dir search_dir_perms;
1620         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1621         files_search_home($1)
1622 ')
1623
1624 ########################################
1625 ## <summary>
1626 ##      Do not audit attempts to search user home directories.
1627 ## </summary>
1628 ## <desc>
1629 ##      <p>
1630 ##      Do not audit attempts to search user home directories.
1631 ##      This will supress SELinux denial messages when the specified
1632 ##      domain is denied the permission to search these directories.
1633 ##      </p>
1634 ## </desc>
1635 ## <param name="domain">
1636 ##      <summary>
1637 ##      Domain to not audit.
1638 ##      </summary>
1639 ## </param>
1640 ## <infoflow type="none"/>
1641 #
1642 interface(`userdom_dontaudit_search_user_home_dirs',`
1643         gen_require(`
1644                 type user_home_dir_t;
1645         ')
1646
1647         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1648 ')
1649
1650 ########################################
1651 ## <summary>
1652 ##      List user home directories.
1653 ## </summary>
1654 ## <param name="domain">
1655 ##      <summary>
1656 ##      Domain allowed access.
1657 ##      </summary>
1658 ## </param>
1659 #
1660 interface(`userdom_list_user_home_dirs',`
1661         gen_require(`
1662                 type user_home_dir_t;
1663         ')
1664
1665         allow $1 user_home_dir_t:dir list_dir_perms;
1666         files_search_home($1)
1667
1668         tunable_policy(`use_nfs_home_dirs',`
1669                 fs_list_nfs($1)
1670         ')
1671
1672         tunable_policy(`use_samba_home_dirs',`
1673                 fs_list_cifs($1)
1674         ')
1675 ')
1676
1677 ########################################
1678 ## <summary>
1679 ##      Do not audit attempts to list user home subdirectories.
1680 ## </summary>
1681 ## <param name="domain">
1682 ##      <summary>
1683 ##      Domain to not audit.
1684 ##      </summary>
1685 ## </param>
1686 #
1687 interface(`userdom_dontaudit_list_user_home_dirs',`
1688         gen_require(`
1689                 type user_home_dir_t;
1690                 type user_home_t;
1691         ')
1692
1693         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1694         dontaudit $1 user_home_t:dir list_dir_perms;
1695 ')
1696
1697 ########################################
1698 ## <summary>
1699 ##      Create user home directories.
1700 ## </summary>
1701 ## <param name="domain">
1702 ##      <summary>
1703 ##      Domain allowed access.
1704 ##      </summary>
1705 ## </param>
1706 #
1707 interface(`userdom_create_user_home_dirs',`
1708         gen_require(`
1709                 type user_home_dir_t;
1710         ')
1711
1712         allow $1 user_home_dir_t:dir create_dir_perms;
1713 ')
1714
1715 ########################################
1716 ## <summary>
1717 ##      Create user home directories.
1718 ## </summary>
1719 ## <param name="domain">
1720 ##      <summary>
1721 ##      Domain allowed access.
1722 ##      </summary>
1723 ## </param>
1724 #
1725 interface(`userdom_manage_user_home_dirs',`
1726         gen_require(`
1727                 type user_home_dir_t;
1728         ')
1729
1730         allow $1 user_home_dir_t:dir manage_dir_perms;
1731 ')
1732
1733 ########################################
1734 ## <summary>
1735 ##      Relabel to user home directories.
1736 ## </summary>
1737 ## <param name="domain">
1738 ##      <summary>
1739 ##      Domain allowed access.
1740 ##      </summary>
1741 ## </param>
1742 #
1743 interface(`userdom_relabelto_user_home_dirs',`
1744         gen_require(`
1745                 type user_home_dir_t;
1746         ')
1747
1748         allow $1 user_home_dir_t:dir relabelto;
1749 ')
1750
1751
1752 ########################################
1753 ## <summary>
1754 ##      Relabel to user home files.
1755 ## </summary>
1756 ## <param name="domain">
1757 ##      <summary>
1758 ##      Domain allowed access.
1759 ##      </summary>
1760 ## </param>
1761 #
1762 interface(`userdom_relabelto_user_home_files',`
1763         gen_require(`
1764                 type user_home_t;
1765         ')
1766
1767         allow $1 user_home_t:file relabelto;
1768 ')
1769 ########################################
1770 ## <summary>
1771 ##      Relabel user home files.
1772 ## </summary>
1773 ## <param name="domain">
1774 ##      <summary>
1775 ##      Domain allowed access.
1776 ##      </summary>
1777 ## </param>
1778 #
1779 interface(`userdom_relabel_user_home_files',`
1780         gen_require(`
1781                 type user_home_t;
1782         ')
1783
1784         allow $1 user_home_t:file relabel_file_perms;
1785 ')
1786
1787 ########################################
1788 ## <summary>
1789 ##      Create directories in the home dir root with
1790 ##      the user home directory type.
1791 ## </summary>
1792 ## <param name="domain">
1793 ##      <summary>
1794 ##      Domain allowed access.
1795 ##      </summary>
1796 ## </param>
1797 #
1798 interface(`userdom_home_filetrans_user_home_dir',`
1799         gen_require(`
1800                 type user_home_dir_t;
1801         ')
1802
1803         files_home_filetrans($1, user_home_dir_t, dir)
1804 ')
1805
1806 ########################################
1807 ## <summary>
1808 ##      Do a domain transition to the specified
1809 ##      domain when executing a program in the
1810 ##      user home directory.
1811 ## </summary>
1812 ## <desc>
1813 ##      <p>
1814 ##      Do a domain transition to the specified
1815 ##      domain when executing a program in the
1816 ##      user home directory.
1817 ##      </p>
1818 ##      <p>
1819 ##      No interprocess communication (signals, pipes,
1820 ##      etc.) is provided by this interface since
1821 ##      the domains are not owned by this module.
1822 ##      </p>
1823 ## </desc>
1824 ## <param name="source_domain">
1825 ##      <summary>
1826 ##      Domain allowed to transition.
1827 ##      </summary>
1828 ## </param>
1829 ## <param name="target_domain">
1830 ##      <summary>
1831 ##      Domain to transition to.
1832 ##      </summary>
1833 ## </param>
1834 #
1835 interface(`userdom_user_home_domtrans',`
1836         gen_require(`
1837                 type user_home_dir_t, user_home_t;
1838         ')
1839
1840         domain_auto_trans($1, user_home_t, $2)
1841         allow $1 user_home_dir_t:dir search_dir_perms;
1842         files_search_home($1)
1843 ')
1844
1845 ########################################
1846 ## <summary>
1847 ##      Do not audit attempts to search user home content directories.
1848 ## </summary>
1849 ## <param name="domain">
1850 ##      <summary>
1851 ##      Domain to not audit.
1852 ##      </summary>
1853 ## </param>
1854 #
1855 interface(`userdom_dontaudit_search_user_home_content',`
1856         gen_require(`
1857                 type user_home_t;
1858         ')
1859
1860         dontaudit $1 user_home_t:dir search_dir_perms;
1861         fs_dontaudit_list_nfs($1)
1862         fs_dontaudit_list_cifs($1)
1863 ')
1864
1865 ########################################
1866 ## <summary>
1867 ##      List contents of users home directory.
1868 ## </summary>
1869 ## <param name="domain">
1870 ##      <summary>
1871 ##      Domain allowed access.
1872 ##      </summary>
1873 ## </param>
1874 #
1875 interface(`userdom_list_user_home_content',`
1876         gen_require(`
1877                 type user_home_dir_t;
1878                 attribute user_home_type;
1879         ')
1880
1881         files_list_home($1)
1882         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1883 ')
1884
1885 ########################################
1886 ## <summary>
1887 ##      Create, read, write, and delete directories
1888 ##      in a user home subdirectory.
1889 ## </summary>
1890 ## <param name="domain">
1891 ##      <summary>
1892 ##      Domain allowed access.
1893 ##      </summary>
1894 ## </param>
1895 #
1896 interface(`userdom_manage_user_home_content_dirs',`
1897         gen_require(`
1898                 type user_home_dir_t, user_home_t;
1899         ')
1900
1901         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1902         files_search_home($1)
1903 ')
1904
1905 ########################################
1906 ## <summary>
1907 ##      Delete directories in a user home subdirectory.
1908 ## </summary>
1909 ## <param name="domain">
1910 ##      <summary>
1911 ##      Domain allowed access.
1912 ##      </summary>
1913 ## </param>
1914 #
1915 interface(`userdom_delete_user_home_content_dirs',`
1916         gen_require(`
1917                 type user_home_t;
1918         ')
1919
1920         allow $1 user_home_t:dir delete_dir_perms;
1921 ')
1922
1923 ########################################
1924 ## <summary>
1925 ##      Set the attributes of user home files.
1926 ## </summary>
1927 ## <param name="domain">
1928 ##      <summary>
1929 ##      Domain allowed access.
1930 ##      </summary>
1931 ## </param>
1932 ## <rolecap/>
1933 #
1934 interface(`userdom_setattr_user_home_content_files',`
1935         gen_require(`
1936                 type user_home_t;
1937         ')
1938
1939         allow $1 user_home_t:file setattr;
1940 ')
1941
1942 ########################################
1943 ## <summary>
1944 ##      Do not audit attempts to set the
1945 ##      attributes of user home files.
1946 ## </summary>
1947 ## <param name="domain">
1948 ##      <summary>
1949 ##      Domain to not audit.
1950 ##      </summary>
1951 ## </param>
1952 #
1953 interface(`userdom_dontaudit_setattr_user_home_content_files',`
1954         gen_require(`
1955                 type user_home_t;
1956         ')
1957
1958         dontaudit $1 user_home_t:file setattr_file_perms;
1959 ')
1960
1961 ########################################
1962 ## <summary>
1963 ##      Mmap user home files.
1964 ## </summary>
1965 ## <param name="domain">
1966 ##      <summary>
1967 ##      Domain allowed access.
1968 ##      </summary>
1969 ## </param>
1970 #
1971 interface(`userdom_mmap_user_home_content_files',`
1972         gen_require(`
1973                 type user_home_dir_t, user_home_t;
1974         ')
1975
1976         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1977         files_search_home($1)
1978 ')
1979
1980 ########################################
1981 ## <summary>
1982 ##      Read user home files.
1983 ## </summary>
1984 ## <param name="domain">
1985 ##      <summary>
1986 ##      Domain allowed access.
1987 ##      </summary>
1988 ## </param>
1989 #
1990 interface(`userdom_read_user_home_content_files',`
1991         gen_require(`
1992                 type user_home_dir_t, user_home_t;
1993         ')
1994
1995         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
1996         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1997         files_search_home($1)
1998 ')
1999
2000 ########################################
2001 ## <summary>
2002 ##      Do not audit attempts to getattr user home files.
2003 ## </summary>
2004 ## <param name="domain">
2005 ##      <summary>
2006 ##      Domain to not audit.
2007 ##      </summary>
2008 ## </param>
2009 #
2010 interface(`userdom_dontaudit_getattr_user_home_content',`
2011         gen_require(`
2012                 attribute user_home_type;
2013         ')
2014
2015         dontaudit $1 user_home_type:dir getattr;
2016         dontaudit $1 user_home_type:file getattr;
2017 ')
2018
2019 ########################################
2020 ## <summary>
2021 ##      Do not audit attempts to read user home files.
2022 ## </summary>
2023 ## <param name="domain">
2024 ##      <summary>
2025 ##      Domain to not audit.
2026 ##      </summary>
2027 ## </param>
2028 #
2029 interface(`userdom_dontaudit_read_user_home_content_files',`
2030         gen_require(`
2031                 attribute user_home_type;
2032                 type user_home_dir_t;
2033         ')
2034
2035         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2036         dontaudit $1 user_home_type:dir list_dir_perms;
2037         dontaudit $1 user_home_type:file read_file_perms;
2038         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2039 ')
2040
2041 ########################################
2042 ## <summary>
2043 ##      Do not audit attempts to append user home files.
2044 ## </summary>
2045 ## <param name="domain">
2046 ##      <summary>
2047 ##      Domain to not audit.
2048 ##      </summary>
2049 ## </param>
2050 #
2051 interface(`userdom_dontaudit_append_user_home_content_files',`
2052         gen_require(`
2053                 type user_home_t;
2054         ')
2055
2056         dontaudit $1 user_home_t:file append_file_perms;
2057 ')
2058
2059 ########################################
2060 ## <summary>
2061 ##      Do not audit attempts to write user home files.
2062 ## </summary>
2063 ## <param name="domain">
2064 ##      <summary>
2065 ##      Domain to not audit.
2066 ##      </summary>
2067 ## </param>
2068 #
2069 interface(`userdom_dontaudit_write_user_home_content_files',`
2070         gen_require(`
2071                 type user_home_t;
2072         ')
2073
2074         dontaudit $1 user_home_t:file write_file_perms;
2075 ')
2076
2077 ########################################
2078 ## <summary>
2079 ##      Delete files in a user home subdirectory.
2080 ## </summary>
2081 ## <param name="domain">
2082 ##      <summary>
2083 ##      Domain allowed access.
2084 ##      </summary>
2085 ## </param>
2086 #
2087 interface(`userdom_delete_user_home_content_files',`
2088         gen_require(`
2089                 type user_home_t;
2090         ')
2091
2092         allow $1 user_home_t:file delete_file_perms;
2093 ')
2094
2095 ########################################
2096 ## <summary>
2097 ##      Do not audit attempts to write user home files.
2098 ## </summary>
2099 ## <param name="domain">
2100 ##      <summary>
2101 ##      Domain to not audit.
2102 ##      </summary>
2103 ## </param>
2104 #
2105 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2106         gen_require(`
2107                 type user_home_t;
2108         ')
2109
2110         dontaudit $1 user_home_t:file relabel_file_perms;
2111 ')
2112
2113 ########################################
2114 ## <summary>
2115 ##      Read user home subdirectory symbolic links.
2116 ## </summary>
2117 ## <param name="domain">
2118 ##      <summary>
2119 ##      Domain allowed access.
2120 ##      </summary>
2121 ## </param>
2122 #
2123 interface(`userdom_read_user_home_content_symlinks',`
2124         gen_require(`
2125                 type user_home_dir_t, user_home_t;
2126         ')
2127
2128         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2129 ')
2130
2131 ########################################
2132 ## <summary>
2133 ##      Execute user home files.
2134 ## </summary>
2135 ## <param name="domain">
2136 ##      <summary>
2137 ##      Domain allowed access.
2138 ##      </summary>
2139 ## </param>
2140 ## <rolecap/>
2141 #
2142 interface(`userdom_exec_user_home_content_files',`
2143         gen_require(`
2144                 type user_home_dir_t;
2145                 attribute user_home_type;
2146         ')
2147
2148         files_search_home($1)
2149         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2150         dontaudit $1 user_home_type:sock_file execute;
2151         ')
2152
2153 ########################################
2154 ## <summary>
2155 ##      Do not audit attempts to execute user home files.
2156 ## </summary>
2157 ## <param name="domain">
2158 ##      <summary>
2159 ##      Domain to not audit.
2160 ##      </summary>
2161 ## </param>
2162 #
2163 interface(`userdom_dontaudit_exec_user_home_content_files',`
2164         gen_require(`
2165                 type user_home_t;
2166         ')
2167
2168         dontaudit $1 user_home_t:file exec_file_perms;
2169 ')
2170
2171 ########################################
2172 ## <summary>
2173 ##      Create, read, write, and delete files
2174 ##      in a user home subdirectory.
2175 ## </summary>
2176 ## <param name="domain">
2177 ##      <summary>
2178 ##      Domain allowed access.
2179 ##      </summary>
2180 ## </param>
2181 #
2182 interface(`userdom_manage_user_home_content_files',`
2183         gen_require(`
2184                 type user_home_dir_t, user_home_t;
2185         ')
2186
2187         manage_files_pattern($1, user_home_t, user_home_t)
2188         allow $1 user_home_dir_t:dir search_dir_perms;
2189         files_search_home($1)
2190 ')
2191
2192 ########################################
2193 ## <summary>
2194 ##      Do not audit attempts to create, read, write, and delete directories
2195 ##      in a user home subdirectory.
2196 ## </summary>
2197 ## <param name="domain">
2198 ##      <summary>
2199 ##      Domain to not audit.
2200 ##      </summary>
2201 ## </param>
2202 #
2203 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2204         gen_require(`
2205                 type user_home_dir_t, user_home_t;
2206         ')
2207
2208         dontaudit $1 user_home_t:dir manage_dir_perms;
2209 ')
2210
2211 ########################################
2212 ## <summary>
2213 ##      Create, read, write, and delete symbolic links
2214 ##      in a user home subdirectory.
2215 ## </summary>
2216 ## <param name="domain">
2217 ##      <summary>
2218 ##      Domain allowed access.
2219 ##      </summary>
2220 ## </param>
2221 #
2222 interface(`userdom_manage_user_home_content_symlinks',`
2223         gen_require(`
2224                 type user_home_dir_t, user_home_t;
2225         ')
2226
2227         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2228         allow $1 user_home_dir_t:dir search_dir_perms;
2229         files_search_home($1)
2230 ')
2231
2232 ########################################
2233 ## <summary>
2234 ##      Delete symbolic links in a user home directory.
2235 ## </summary>
2236 ## <param name="domain">
2237 ##      <summary>
2238 ##      Domain allowed access.
2239 ##      </summary>
2240 ## </param>
2241 #
2242 interface(`userdom_delete_user_home_content_symlinks',`
2243         gen_require(`
2244                 type user_home_t;
2245         ')
2246
2247         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2248 ')
2249
2250 ########################################
2251 ## <summary>
2252 ##      Create, read, write, and delete named pipes
2253 ##      in a user home subdirectory.
2254 ## </summary>
2255 ## <param name="domain">
2256 ##      <summary>
2257 ##      Domain allowed access.
2258 ##      </summary>
2259 ## </param>
2260 #
2261 interface(`userdom_manage_user_home_content_pipes',`
2262         gen_require(`
2263                 type user_home_dir_t, user_home_t;
2264         ')
2265
2266         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2267         allow $1 user_home_dir_t:dir search_dir_perms;
2268         files_search_home($1)
2269 ')
2270
2271 ########################################
2272 ## <summary>
2273 ##      Create, read, write, and delete named sockets
2274 ##      in a user home subdirectory.
2275 ## </summary>
2276 ## <param name="domain">
2277 ##      <summary>
2278 ##      Domain allowed access.
2279 ##      </summary>
2280 ## </param>
2281 #
2282 interface(`userdom_manage_user_home_content_sockets',`
2283         gen_require(`
2284                 type user_home_dir_t, user_home_t;
2285         ')
2286
2287         allow $1 user_home_dir_t:dir search_dir_perms;
2288         manage_sock_files_pattern($1, user_home_t, user_home_t)
2289         files_search_home($1)
2290 ')
2291
2292 ########################################
2293 ## <summary>
2294 ##      Create objects in a user home directory
2295 ##      with an automatic type transition to
2296 ##      a specified private type.
2297 ## </summary>
2298 ## <param name="domain">
2299 ##      <summary>
2300 ##      Domain allowed access.
2301 ##      </summary>
2302 ## </param>
2303 ## <param name="private_type">
2304 ##      <summary>
2305 ##      The type of the object to create.
2306 ##      </summary>
2307 ## </param>
2308 ## <param name="object_class">
2309 ##      <summary>
2310 ##      The class of the object to be created.
2311 ##      </summary>
2312 ## </param>
2313 #
2314 interface(`userdom_user_home_dir_filetrans',`
2315         gen_require(`
2316                 type user_home_dir_t;
2317         ')
2318
2319         filetrans_pattern($1, user_home_dir_t, $2, $3)
2320         files_search_home($1)
2321 ')
2322
2323 ########################################
2324 ## <summary>
2325 ##      Create objects in a user home directory
2326 ##      with an automatic type transition to
2327 ##      a specified private type.
2328 ## </summary>
2329 ## <param name="domain">
2330 ##      <summary>
2331 ##      Domain allowed access.
2332 ##      </summary>
2333 ## </param>
2334 ## <param name="private_type">
2335 ##      <summary>
2336 ##      The type of the object to create.
2337 ##      </summary>
2338 ## </param>
2339 ## <param name="object_class">
2340 ##      <summary>
2341 ##      The class of the object to be created.
2342 ##      </summary>
2343 ## </param>
2344 #
2345 interface(`userdom_user_home_content_filetrans',`
2346         gen_require(`
2347                 type user_home_dir_t, user_home_t;
2348         ')
2349
2350         filetrans_pattern($1, user_home_t, $2, $3)
2351         allow $1 user_home_dir_t:dir search_dir_perms;
2352         files_search_home($1)
2353 ')
2354
2355 ########################################
2356 ## <summary>
2357 ##      Create objects in a user home directory
2358 ##      with an automatic type transition to
2359 ##      the user home file type.
2360 ## </summary>
2361 ## <param name="domain">
2362 ##      <summary>
2363 ##      Domain allowed access.
2364 ##      </summary>
2365 ## </param>
2366 ## <param name="object_class">
2367 ##      <summary>
2368 ##      The class of the object to be created.
2369 ##      </summary>
2370 ## </param>
2371 #
2372 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2373         gen_require(`
2374                 type user_home_dir_t, user_home_t;
2375         ')
2376
2377         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2378         files_search_home($1)
2379 ')
2380
2381 ########################################
2382 ## <summary>
2383 ##      Write to user temporary named sockets.
2384 ## </summary>
2385 ## <param name="domain">
2386 ##      <summary>
2387 ##      Domain allowed access.
2388 ##      </summary>
2389 ## </param>
2390 #
2391 interface(`userdom_write_user_tmp_sockets',`
2392         gen_require(`
2393                 type user_tmp_t;
2394         ')
2395
2396         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2397         files_search_tmp($1)
2398 ')
2399
2400 ########################################
2401 ## <summary>
2402 ##      List user temporary directories.
2403 ## </summary>
2404 ## <param name="domain">
2405 ##      <summary>
2406 ##      Domain allowed access.
2407 ##      </summary>
2408 ## </param>
2409 #
2410 interface(`userdom_list_user_tmp',`
2411         gen_require(`
2412                 type user_tmp_t;
2413         ')
2414
2415         allow $1 user_tmp_t:dir list_dir_perms;
2416         files_search_tmp($1)
2417 ')
2418
2419 ########################################
2420 ## <summary>
2421 ##      Do not audit attempts to list user
2422 ##      temporary directories.
2423 ## </summary>
2424 ## <param name="domain">
2425 ##      <summary>
2426 ##      Domain to not audit.
2427 ##      </summary>
2428 ## </param>
2429 #
2430 interface(`userdom_dontaudit_list_user_tmp',`
2431         gen_require(`
2432                 type user_tmp_t;
2433         ')
2434
2435         dontaudit $1 user_tmp_t:dir list_dir_perms;
2436 ')
2437
2438 ########################################
2439 ## <summary>
2440 ##      Do not audit attempts to manage users
2441 ##      temporary directories.
2442 ## </summary>
2443 ## <param name="domain">
2444 ##      <summary>
2445 ##      Domain to not audit.
2446 ##      </summary>
2447 ## </param>
2448 #
2449 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2450         gen_require(`
2451                 type user_tmp_t;
2452         ')
2453
2454         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2455 ')
2456
2457 ########################################
2458 ## <summary>
2459 ##      Read user temporary files.
2460 ## </summary>
2461 ## <param name="domain">
2462 ##      <summary>
2463 ##      Domain allowed access.
2464 ##      </summary>
2465 ## </param>
2466 #
2467 interface(`userdom_read_user_tmp_files',`
2468         gen_require(`
2469                 type user_tmp_t;
2470         ')
2471
2472         read_files_pattern($1, user_tmp_t, user_tmp_t)
2473         allow $1 user_tmp_t:dir list_dir_perms;
2474         files_search_tmp($1)
2475 ')
2476
2477 ########################################
2478 ## <summary>
2479 ##      Do not audit attempts to read users
2480 ##      temporary files.
2481 ## </summary>
2482 ## <param name="domain">
2483 ##      <summary>
2484 ##      Domain to not audit.
2485 ##      </summary>
2486 ## </param>
2487 #
2488 interface(`userdom_dontaudit_read_user_tmp_files',`
2489         gen_require(`
2490                 type user_tmp_t;
2491         ')
2492
2493         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2494 ')
2495
2496 ########################################
2497 ## <summary>
2498 ##      Do not audit attempts to append users
2499 ##      temporary files.
2500 ## </summary>
2501 ## <param name="domain">
2502 ##      <summary>
2503 ##      Domain to not audit.
2504 ##      </summary>
2505 ## </param>
2506 #
2507 interface(`userdom_dontaudit_append_user_tmp_files',`
2508         gen_require(`
2509                 type user_tmp_t;
2510         ')
2511
2512         dontaudit $1 user_tmp_t:file append_file_perms;
2513 ')
2514
2515 ########################################
2516 ## <summary>
2517 ##      Read and write user temporary files.
2518 ## </summary>
2519 ## <param name="domain">
2520 ##      <summary>
2521 ##      Domain allowed access.
2522 ##      </summary>
2523 ## </param>
2524 #
2525 interface(`userdom_rw_user_tmp_files',`
2526         gen_require(`
2527                 type user_tmp_t;
2528         ')
2529
2530         allow $1 user_tmp_t:dir list_dir_perms;
2531         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2532         files_search_tmp($1)
2533 ')
2534
2535 ########################################
2536 ## <summary>
2537 ##      Do not audit attempts to manage users
2538 ##      temporary files.
2539 ## </summary>
2540 ## <param name="domain">
2541 ##      <summary>
2542 ##      Domain to not audit.
2543 ##      </summary>
2544 ## </param>
2545 #
2546 interface(`userdom_dontaudit_manage_user_tmp_files',`
2547         gen_require(`
2548                 type user_tmp_t;
2549         ')
2550
2551         dontaudit $1 user_tmp_t:file manage_file_perms;
2552 ')
2553
2554 ########################################
2555 ## <summary>
2556 ##      Read user temporary symbolic links.
2557 ## </summary>
2558 ## <param name="domain">
2559 ##      <summary>
2560 ##      Domain allowed access.
2561 ##      </summary>
2562 ## </param>
2563 #
2564 interface(`userdom_read_user_tmp_symlinks',`
2565         gen_require(`
2566                 type user_tmp_t;
2567         ')
2568
2569         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2570         allow $1 user_tmp_t:dir list_dir_perms;
2571         files_search_tmp($1)
2572 ')
2573
2574 ########################################
2575 ## <summary>
2576 ##      Create, read, write, and delete user
2577 ##      temporary directories.
2578 ## </summary>
2579 ## <param name="domain">
2580 ##      <summary>
2581 ##      Domain allowed access.
2582 ##      </summary>
2583 ## </param>
2584 #
2585 interface(`userdom_manage_user_tmp_dirs',`
2586         gen_require(`
2587                 type user_tmp_t;
2588         ')
2589
2590         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2591         files_search_tmp($1)
2592 ')
2593
2594 ########################################
2595 ## <summary>
2596 ##      Create, read, write, and delete user
2597 ##      temporary files.
2598 ## </summary>
2599 ## <param name="domain">
2600 ##      <summary>
2601 ##      Domain allowed access.
2602 ##      </summary>
2603 ## </param>
2604 #
2605 interface(`userdom_manage_user_tmp_files',`
2606         gen_require(`
2607                 type user_tmp_t;
2608         ')
2609
2610         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2611         files_search_tmp($1)
2612 ')
2613
2614 ########################################
2615 ## <summary>
2616 ##      Create, read, write, and delete user
2617 ##      temporary symbolic links.
2618 ## </summary>
2619 ## <param name="domain">
2620 ##      <summary>
2621 ##      Domain allowed access.
2622 ##      </summary>
2623 ## </param>
2624 #
2625 interface(`userdom_manage_user_tmp_symlinks',`
2626         gen_require(`
2627                 type user_tmp_t;
2628         ')
2629
2630         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2631         files_search_tmp($1)
2632 ')
2633
2634 ########################################
2635 ## <summary>
2636 ##      Create, read, write, and delete user
2637 ##      temporary named pipes.
2638 ## </summary>
2639 ## <param name="domain">
2640 ##      <summary>
2641 ##      Domain allowed access.
2642 ##      </summary>
2643 ## </param>
2644 #
2645 interface(`userdom_manage_user_tmp_pipes',`
2646         gen_require(`
2647                 type user_tmp_t;
2648         ')
2649
2650         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2651         files_search_tmp($1)
2652 ')
2653
2654 ########################################
2655 ## <summary>
2656 ##      Create, read, write, and delete user
2657 ##      temporary named sockets.
2658 ## </summary>
2659 ## <param name="domain">
2660 ##      <summary>
2661 ##      Domain allowed access.
2662 ##      </summary>
2663 ## </param>
2664 #
2665 interface(`userdom_manage_user_tmp_sockets',`
2666         gen_require(`
2667                 type user_tmp_t;
2668         ')
2669
2670         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2671         files_search_tmp($1)
2672 ')
2673
2674 ########################################
2675 ## <summary>
2676 ##      Create objects in a user temporary directory
2677 ##      with an automatic type transition to
2678 ##      a specified private type.
2679 ## </summary>
2680 ## <param name="domain">
2681 ##      <summary>
2682 ##      Domain allowed access.
2683 ##      </summary>
2684 ## </param>
2685 ## <param name="private_type">
2686 ##      <summary>
2687 ##      The type of the object to create.
2688 ##      </summary>
2689 ## </param>
2690 ## <param name="object_class">
2691 ##      <summary>
2692 ##      The class of the object to be created.
2693 ##      </summary>
2694 ## </param>
2695 #
2696 interface(`userdom_user_tmp_filetrans',`
2697         gen_require(`
2698                 type user_tmp_t;
2699         ')
2700
2701         filetrans_pattern($1, user_tmp_t, $2, $3)
2702         files_search_tmp($1)
2703 ')
2704
2705 ########################################
2706 ## <summary>
2707 ##      Create objects in the temporary directory
2708 ##      with an automatic type transition to
2709 ##      the user temporary type.
2710 ## </summary>
2711 ## <param name="domain">
2712 ##      <summary>
2713 ##      Domain allowed access.
2714 ##      </summary>
2715 ## </param>
2716 ## <param name="object_class">
2717 ##      <summary>
2718 ##      The class of the object to be created.
2719 ##      </summary>
2720 ## </param>
2721 #
2722 interface(`userdom_tmp_filetrans_user_tmp',`
2723         gen_require(`
2724                 type user_tmp_t;
2725         ')
2726
2727         files_tmp_filetrans($1, user_tmp_t, $2)
2728 ')
2729
2730 ########################################
2731 ## <summary>
2732 ##      Read user tmpfs files.
2733 ## </summary>
2734 ## <param name="domain">
2735 ##      <summary>
2736 ##      Domain allowed access.
2737 ##      </summary>
2738 ## </param>
2739 #
2740 interface(`userdom_read_user_tmpfs_files',`
2741         gen_require(`
2742                 type user_tmpfs_t;
2743         ')
2744
2745         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2746         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2747         allow $1 user_tmpfs_t:dir list_dir_perms;
2748         fs_search_tmpfs($1)
2749 ')
2750
2751 ########################################
2752 ## <summary>
2753 ##      Read/Write user tmpfs files.
2754 ## </summary>
2755 ## <param name="domain">
2756 ##      <summary>
2757 ##      Domain allowed access.
2758 ##      </summary>
2759 ## </param>
2760 #
2761 interface(`userdom_rw_user_tmpfs_files',`
2762         gen_require(`
2763                 type user_tmpfs_t;
2764         ')
2765
2766         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2767         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2768         allow $1 user_tmpfs_t:dir list_dir_perms;
2769         fs_search_tmpfs($1)
2770 ')
2771
2772 ########################################
2773 ## <summary>
2774 ##      Get the attributes of a user domain tty.
2775 ## </summary>
2776 ## <param name="domain">
2777 ##      <summary>
2778 ##      Domain allowed access.
2779 ##      </summary>
2780 ## </param>
2781 #
2782 interface(`userdom_getattr_user_ttys',`
2783         gen_require(`
2784                 type user_tty_device_t;
2785         ')
2786
2787         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2788 ')
2789
2790 ########################################
2791 ## <summary>
2792 ##      Do not audit attempts to get the attributes of a user domain tty.
2793 ## </summary>
2794 ## <param name="domain">
2795 ##      <summary>
2796 ##      Domain to not audit.
2797 ##      </summary>
2798 ## </param>
2799 #
2800 interface(`userdom_dontaudit_getattr_user_ttys',`
2801         gen_require(`
2802                 type user_tty_device_t;
2803         ')
2804
2805         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2806 ')
2807
2808 ########################################
2809 ## <summary>
2810 ##      Set the attributes of a user domain tty.
2811 ## </summary>
2812 ## <param name="domain">
2813 ##      <summary>
2814 ##      Domain allowed access.
2815 ##      </summary>
2816 ## </param>
2817 #
2818 interface(`userdom_setattr_user_ttys',`
2819         gen_require(`
2820                 type user_tty_device_t;
2821         ')
2822
2823         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2824 ')
2825
2826 ########################################
2827 ## <summary>
2828 ##      Do not audit attempts to set the attributes of a user domain tty.
2829 ## </summary>
2830 ## <param name="domain">
2831 ##      <summary>
2832 ##      Domain to not audit.
2833 ##      </summary>
2834 ## </param>
2835 #
2836 interface(`userdom_dontaudit_setattr_user_ttys',`
2837         gen_require(`
2838                 type user_tty_device_t;
2839         ')
2840
2841         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2842 ')
2843
2844 ########################################
2845 ## <summary>
2846 ##      Read and write a user domain tty.
2847 ## </summary>
2848 ## <param name="domain">
2849 ##      <summary>
2850 ##      Domain allowed access.
2851 ##      </summary>
2852 ## </param>
2853 #
2854 interface(`userdom_use_user_ttys',`
2855         gen_require(`
2856                 type user_tty_device_t;
2857         ')
2858
2859         allow $1 user_tty_device_t:chr_file rw_term_perms;
2860 ')
2861
2862 ########################################
2863 ## <summary>
2864 ##      Read and write a user domain pty.
2865 ## </summary>
2866 ## <param name="domain">
2867 ##      <summary>
2868 ##      Domain allowed access.
2869 ##      </summary>
2870 ## </param>
2871 #
2872 interface(`userdom_use_user_ptys',`
2873         gen_require(`
2874                 type user_devpts_t;
2875         ')
2876
2877         allow $1 user_devpts_t:chr_file rw_term_perms;
2878 ')
2879
2880 ########################################
2881 ## <summary>
2882 ##      Read and write a user TTYs and PTYs.
2883 ## </summary>
2884 ## <desc>
2885 ##      <p>
2886 ##      Allow the specified domain to read and write user
2887 ##      TTYs and PTYs. This will allow the domain to
2888 ##      interact with the user via the terminal. Typically
2889 ##      all interactive applications will require this
2890 ##      access.
2891 ##      </p>
2892 ##      <p>
2893 ##      However, this also allows the applications to spy
2894 ##      on user sessions or inject information into the
2895 ##      user session.  Thus, this access should likely
2896 ##      not be allowed for non-interactive domains.
2897 ##      </p>
2898 ## </desc>
2899 ## <param name="domain">
2900 ##      <summary>
2901 ##      Domain allowed access.
2902 ##      </summary>
2903 ## </param>
2904 ## <infoflow type="both" weight="10"/>
2905 #
2906 interface(`userdom_use_user_terminals',`
2907         gen_require(`
2908                 type user_tty_device_t, user_devpts_t;
2909         ')
2910
2911         allow $1 user_tty_device_t:chr_file rw_term_perms;
2912         allow $1 user_devpts_t:chr_file rw_term_perms;
2913         term_list_ptys($1)
2914 ')
2915
2916 ########################################
2917 ## <summary>
2918 ##      Do not audit attempts to read and write
2919 ##      a user domain tty and pty.
2920 ## </summary>
2921 ## <param name="domain">
2922 ##      <summary>
2923 ##      Domain to not audit.
2924 ##      </summary>
2925 ## </param>
2926 #
2927 interface(`userdom_dontaudit_use_user_terminals',`
2928         gen_require(`
2929                 type user_tty_device_t, user_devpts_t;
2930         ')
2931
2932         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
2933         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
2934 ')
2935
2936 ########################################
2937 ## <summary>
2938 ##      Execute a shell in all user domains.  This
2939 ##      is an explicit transition, requiring the
2940 ##      caller to use setexeccon().
2941 ## </summary>
2942 ## <param name="domain">
2943 ##      <summary>
2944 ##      Domain allowed to transition.
2945 ##      </summary>
2946 ## </param>
2947 #
2948 interface(`userdom_spec_domtrans_all_users',`
2949         gen_require(`
2950                 attribute userdomain;
2951         ')
2952
2953         corecmd_shell_spec_domtrans($1, userdomain)
2954         allow userdomain $1:fd use;
2955         allow userdomain $1:fifo_file rw_file_perms;
2956         allow userdomain $1:process sigchld;
2957 ')
2958
2959 ########################################
2960 ## <summary>
2961 ##      Execute an Xserver session in all unprivileged user domains.  This
2962 ##      is an explicit transition, requiring the
2963 ##      caller to use setexeccon().
2964 ## </summary>
2965 ## <param name="domain">
2966 ##      <summary>
2967 ##      Domain allowed to transition.
2968 ##      </summary>
2969 ## </param>
2970 #
2971 interface(`userdom_xsession_spec_domtrans_all_users',`
2972         gen_require(`
2973                 attribute userdomain;
2974         ')
2975
2976         xserver_xsession_spec_domtrans($1, userdomain)
2977         allow userdomain $1:fd use;
2978         allow userdomain $1:fifo_file rw_file_perms;
2979         allow userdomain $1:process sigchld;
2980 ')
2981
2982 ########################################
2983 ## <summary>
2984 ##      Execute a shell in all unprivileged user domains.  This
2985 ##      is an explicit transition, requiring the
2986 ##      caller to use setexeccon().
2987 ## </summary>
2988 ## <param name="domain">
2989 ##      <summary>
2990 ##      Domain allowed to transition.
2991 ##      </summary>
2992 ## </param>
2993 #
2994 interface(`userdom_spec_domtrans_unpriv_users',`
2995         gen_require(`
2996                 attribute unpriv_userdomain;
2997         ')
2998
2999         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3000         allow unpriv_userdomain $1:fd use;
3001         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3002         allow unpriv_userdomain $1:process sigchld;
3003 ')
3004
3005 ########################################
3006 ## <summary>
3007 ##      Execute an Xserver session in all unprivileged user domains.  This
3008 ##      is an explicit transition, requiring the
3009 ##      caller to use setexeccon().
3010 ## </summary>
3011 ## <param name="domain">
3012 ##      <summary>
3013 ##      Domain allowed to transition.
3014 ##      </summary>
3015 ## </param>
3016 #
3017 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3018         gen_require(`
3019                 attribute unpriv_userdomain;
3020         ')
3021
3022         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3023         allow unpriv_userdomain $1:fd use;
3024         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3025         allow unpriv_userdomain $1:process sigchld;
3026 ')
3027
3028 ########################################
3029 ## <summary>
3030 ##      Manage unpriviledged user SysV sempaphores.
3031 ## </summary>
3032 ## <param name="domain">
3033 ##      <summary>
3034 ##      Domain allowed access.
3035 ##      </summary>
3036 ## </param>
3037 #
3038 interface(`userdom_manage_unpriv_user_semaphores',`
3039         gen_require(`
3040                 attribute unpriv_userdomain;
3041         ')
3042
3043         allow $1 unpriv_userdomain:sem create_sem_perms;
3044 ')
3045
3046 ########################################
3047 ## <summary>
3048 ##      Manage unpriviledged user SysV shared
3049 ##      memory segments.
3050 ## </summary>
3051 ## <param name="domain">
3052 ##      <summary>
3053 ##      Domain allowed access.
3054 ##      </summary>
3055 ## </param>
3056 #
3057 interface(`userdom_manage_unpriv_user_shared_mem',`
3058         gen_require(`
3059                 attribute unpriv_userdomain;
3060         ')
3061
3062         allow $1 unpriv_userdomain:shm create_shm_perms;
3063 ')
3064
3065 ########################################
3066 ## <summary>
3067 ##      Execute bin_t in the unprivileged user domains. This
3068 ##      is an explicit transition, requiring the
3069 ##      caller to use setexeccon().
3070 ## </summary>
3071 ## <param name="domain">
3072 ##      <summary>
3073 ##      Domain allowed to transition.
3074 ##      </summary>
3075 ## </param>
3076 #
3077 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3078         gen_require(`
3079                 attribute unpriv_userdomain;
3080         ')
3081
3082         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3083         allow unpriv_userdomain $1:fd use;
3084         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3085         allow unpriv_userdomain $1:process sigchld;
3086 ')
3087
3088 ########################################
3089 ## <summary>
3090 ##      Execute all entrypoint files in unprivileged user
3091 ##      domains. This is an explicit transition, requiring the
3092 ##      caller to use setexeccon().
3093 ## </summary>
3094 ## <param name="domain">
3095 ##      <summary>
3096 ##      Domain allowed access.
3097 ##      </summary>
3098 ## </param>
3099 #
3100 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3101         gen_require(`
3102                 attribute unpriv_userdomain;
3103         ')
3104
3105         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3106         allow unpriv_userdomain $1:fd use;
3107         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3108         allow unpriv_userdomain $1:process sigchld;
3109 ')
3110
3111 ########################################
3112 ## <summary>
3113 ##      Search users home directories.
3114 ## </summary>
3115 ## <param name="domain">
3116 ##      <summary>
3117 ##      Domain allowed access.
3118 ##      </summary>
3119 ## </param>
3120 #
3121 interface(`userdom_search_user_home_content',`
3122         gen_require(`
3123                 type user_home_dir_t;
3124                 attribute user_home_type;
3125         ')
3126
3127         files_list_home($1)
3128         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3129         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3130 ')
3131
3132 ########################################
3133 ## <summary>
3134 ##      Send general signals to unprivileged user domains.
3135 ## </summary>
3136 ## <param name="domain">
3137 ##      <summary>
3138 ##      Domain allowed access.
3139 ##      </summary>
3140 ## </param>
3141 #
3142 interface(`userdom_signal_unpriv_users',`
3143         gen_require(`
3144                 attribute unpriv_userdomain;
3145         ')
3146
3147         allow $1 unpriv_userdomain:process signal;
3148 ')
3149
3150 ########################################
3151 ## <summary>
3152 ##      Inherit the file descriptors from unprivileged user domains.
3153 ## </summary>
3154 ## <param name="domain">
3155 ##      <summary>
3156 ##      Domain allowed access.
3157 ##      </summary>
3158 ## </param>
3159 #
3160 interface(`userdom_use_unpriv_users_fds',`
3161         gen_require(`
3162                 attribute unpriv_userdomain;
3163         ')
3164
3165         allow $1 unpriv_userdomain:fd use;
3166 ')
3167
3168 ########################################
3169 ## <summary>
3170 ##      Do not audit attempts to inherit the file descriptors
3171 ##      from unprivileged user domains.
3172 ## </summary>
3173 ## <desc>
3174 ##      <p>
3175 ##      Do not audit attempts to inherit the file descriptors
3176 ##      from unprivileged user domains. This will supress
3177 ##      SELinux denial messages when the specified domain is denied
3178 ##      the permission to inherit these file descriptors.
3179 ##      </p>
3180 ## </desc>
3181 ## <param name="domain">
3182 ##      <summary>
3183 ##      Domain to not audit.
3184 ##      </summary>
3185 ## </param>
3186 ## <infoflow type="none"/>
3187 #
3188 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3189         gen_require(`
3190                 attribute unpriv_userdomain;
3191         ')
3192
3193         dontaudit $1 unpriv_userdomain:fd use;
3194 ')
3195
3196 ########################################
3197 ## <summary>
3198 ##      Do not audit attempts to use user ptys.
3199 ## </summary>
3200 ## <param name="domain">
3201 ##      <summary>
3202 ##      Domain to not audit.
3203 ##      </summary>
3204 ## </param>
3205 #
3206 interface(`userdom_dontaudit_use_user_ptys',`
3207         gen_require(`
3208                 type user_devpts_t;
3209         ')
3210
3211         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3212 ')
3213
3214 ########################################
3215 ## <summary>
3216 ##      Relabel files to unprivileged user pty types.
3217 ## </summary>
3218 ## <param name="domain">
3219 ##      <summary>
3220 ##      Domain allowed access.
3221 ##      </summary>
3222 ## </param>
3223 #
3224 interface(`userdom_relabelto_user_ptys',`
3225         gen_require(`
3226                 type user_devpts_t;
3227         ')
3228
3229         allow $1 user_devpts_t:chr_file relabelto;
3230 ')
3231
3232 ########################################
3233 ## <summary>
3234 ##      Do not audit attempts to relabel files from
3235 ##      user pty types.
3236 ## </summary>
3237 ## <param name="domain">
3238 ##      <summary>
3239 ##      Domain to not audit.
3240 ##      </summary>
3241 ## </param>
3242 #
3243 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3244         gen_require(`
3245                 type user_devpts_t;
3246         ')
3247
3248         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3249 ')
3250
3251 ########################################
3252 ## <summary>
3253 ##      Write all users files in /tmp
3254 ## </summary>
3255 ## <param name="domain">
3256 ##      <summary>
3257 ##      Domain allowed access.
3258 ##      </summary>
3259 ## </param>
3260 #
3261 interface(`userdom_write_user_tmp_files',`
3262         gen_require(`
3263                 type user_tmp_t;
3264         ')
3265
3266         write_files_pattern($1, user_tmp_t, user_tmp_t)
3267 ')
3268
3269 ########################################
3270 ## <summary>
3271 ##      Do not audit attempts to write users
3272 ##      temporary files.
3273 ## </summary>
3274 ## <param name="domain">
3275 ##      <summary>
3276 ##      Domain to not audit.
3277 ##      </summary>
3278 ## </param>
3279 #
3280 interface(`userdom_dontaudit_write_user_tmp_files',`
3281         gen_require(`
3282                 type user_tmp_t;
3283         ')
3284
3285         dontaudit $1 user_tmp_t:file write;
3286 ')
3287
3288 ########################################
3289 ## <summary>
3290 ##      Do not audit attempts to read/write users
3291 ##      temporary fifo files.
3292 ## </summary>
3293 ## <param name="domain">
3294 ##      <summary>
3295 ##      Domain to not audit.
3296 ##      </summary>
3297 ## </param>
3298 #
3299 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3300         gen_require(`
3301                 type user_tmp_t;
3302         ')
3303
3304         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3305 ')
3306
3307 ########################################
3308 ## <summary>
3309 ##      Do not audit attempts to use user ttys.
3310 ## </summary>
3311 ## <param name="domain">
3312 ##      <summary>
3313 ##      Domain to not audit.
3314 ##      </summary>
3315 ## </param>
3316 #
3317 interface(`userdom_dontaudit_use_user_ttys',`
3318         gen_require(`
3319                 type user_tty_device_t;
3320         ')
3321
3322         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3323 ')
3324
3325 ########################################
3326 ## <summary>
3327 ##      Read the process state of all user domains.
3328 ## </summary>
3329 ## <param name="domain">
3330 ##      <summary>
3331 ##      Domain allowed access.
3332 ##      </summary>
3333 ## </param>
3334 #
3335 interface(`userdom_read_all_users_state',`
3336         gen_require(`
3337                 attribute userdomain;
3338         ')
3339
3340         read_files_pattern($1, userdomain, userdomain)
3341         read_lnk_files_pattern($1,userdomain,userdomain)
3342         kernel_search_proc($1)
3343 ')
3344
3345 ########################################
3346 ## <summary>
3347 ##      Get the attributes of all user domains.
3348 ## </summary>
3349 ## <param name="domain">
3350 ##      <summary>
3351 ##      Domain allowed access.
3352 ##      </summary>
3353 ## </param>
3354 #
3355 interface(`userdom_getattr_all_users',`
3356         gen_require(`
3357                 attribute userdomain;
3358         ')
3359
3360         allow $1 userdomain:process getattr;
3361 ')
3362
3363 ########################################
3364 ## <summary>
3365 ##      Inherit the file descriptors from all user domains
3366 ## </summary>
3367 ## <param name="domain">
3368 ##      <summary>
3369 ##      Domain allowed access.
3370 ##      </summary>
3371 ## </param>
3372 #
3373 interface(`userdom_use_all_users_fds',`
3374         gen_require(`
3375                 attribute userdomain;
3376         ')
3377
3378         allow $1 userdomain:fd use;
3379 ')
3380
3381 ########################################
3382 ## <summary>
3383 ##      Do not audit attempts to inherit the file
3384 ##      descriptors from any user domains.
3385 ## </summary>
3386 ## <param name="domain">
3387 ##      <summary>
3388 ##      Domain to not audit.
3389 ##      </summary>
3390 ## </param>
3391 #
3392 interface(`userdom_dontaudit_use_all_users_fds',`
3393         gen_require(`
3394                 attribute userdomain;
3395         ')
3396
3397         dontaudit $1 userdomain:fd use;
3398 ')
3399
3400 ########################################
3401 ## <summary>
3402 ##      Send general signals to all user domains.
3403 ## </summary>
3404 ## <param name="domain">
3405 ##      <summary>
3406 ##      Domain allowed access.
3407 ##      </summary>
3408 ## </param>
3409 #
3410 interface(`userdom_signal_all_users',`
3411         gen_require(`
3412                 attribute userdomain;
3413         ')
3414
3415         allow $1 userdomain:process signal;
3416 ')
3417
3418 ########################################
3419 ## <summary>
3420 ##      Send a SIGCHLD signal to all user domains.
3421 ## </summary>
3422 ## <param name="domain">
3423 ##      <summary>
3424 ##      Domain allowed access.
3425 ##      </summary>
3426 ## </param>
3427 #
3428 interface(`userdom_sigchld_all_users',`
3429         gen_require(`
3430                 attribute userdomain;
3431         ')
3432
3433         allow $1 userdomain:process sigchld;
3434 ')
3435
3436 ########################################
3437 ## <summary>
3438 ##      Create keys for all user domains.
3439 ## </summary>
3440 ## <param name="domain">
3441 ##      <summary>
3442 ##      Domain allowed access.
3443 ##      </summary>
3444 ## </param>
3445 #
3446 interface(`userdom_create_all_users_keys',`
3447         gen_require(`
3448                 attribute userdomain;
3449         ')
3450
3451         allow $1 userdomain:key create;
3452 ')
3453
3454 ########################################
3455 ## <summary>
3456 ##      Send a dbus message to all user domains.
3457 ## </summary>
3458 ## <param name="domain">
3459 ##      <summary>
3460 ##      Domain allowed access.
3461 ##      </summary>
3462 ## </param>
3463 #
3464 interface(`userdom_dbus_send_all_users',`
3465         gen_require(`
3466                 attribute userdomain;
3467                 class dbus send_msg;
3468         ')
3469
3470         allow $1 userdomain:dbus send_msg;
3471 ')
3472
3473 ########################################
3474 ## <summary>
3475 ##      Allow apps to set rlimits on userdomain
3476 ## </summary>
3477 ## <param name="domain">
3478 ##      <summary>
3479 ##      Domain allowed access.
3480 ##      </summary>
3481 ## </param>
3482 #
3483 interface(`userdom_set_rlimitnh',`
3484         gen_require(`
3485                 attribute userdomain;
3486         ')
3487
3488         allow $1 userdomain:process rlimitinh;
3489 ')
3490
3491 ########################################
3492 ## <summary>
3493 ##      Define this type as a Allow apps to set rlimits on userdomain
3494 ## </summary>
3495 ## <param name="domain">
3496 ##      <summary>
3497 ##      Domain allowed access.
3498 ##      </summary>
3499 ## </param>
3500 ## <param name="userdomain_prefix">
3501 ##      <summary>
3502 ##      The prefix of the user domain (e.g., user
3503 ##      is the prefix for user_t).
3504 ## </summary>
3505 ## </param>
3506 ## <param name="domain">
3507 ##      <summary>
3508 ##      Domain allowed access.
3509 ##      </summary>
3510 ## </param>
3511 #
3512 template(`userdom_unpriv_usertype',`
3513         gen_require(`
3514                 attribute unpriv_userdomain, userdomain;
3515                 attribute $1_usertype;
3516         ')
3517         typeattribute $2  $1_usertype;
3518         typeattribute $2  unpriv_userdomain;
3519         typeattribute $2  userdomain;
3520
3521         ubac_constrained($2)
3522 ')
3523
3524 ########################################
3525 ## <summary>
3526 ##      Connect to users over an unix stream socket.
3527 ## </summary>
3528 ## <param name="domain">
3529 ##      <summary>
3530 ##      Domain allowed access.
3531 ##      </summary>
3532 ## </param>
3533 #
3534 interface(`userdom_stream_connect',`
3535         gen_require(`
3536                 type user_tmp_t;
3537                 attribute userdomain;
3538         ')
3539
3540         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3541 ')
3542
3543 ########################################
3544 ## <summary>
3545 ##      Ptrace user domains.
3546 ## </summary>
3547 ## <param name="domain">
3548 ##      <summary>
3549 ##      Domain allowed access.
3550 ##      </summary>
3551 ## </param>
3552 #
3553 interface(`userdom_ptrace_all_users',`
3554         gen_require(`
3555                 attribute userdomain;
3556         ')
3557
3558         allow $1 userdomain:process ptrace;
3559 ')
3560
3561 ########################################
3562 ## <summary>
3563 ##      dontaudit Search /root
3564 ## </summary>
3565 ## <param name="domain">
3566 ##      <summary>
3567 ##      Domain allowed access.
3568 ##      </summary>
3569 ## </param>
3570 #
3571 interface(`userdom_dontaudit_search_admin_dir',`
3572         gen_require(`
3573                 type admin_home_t;
3574         ')
3575
3576         dontaudit $1 admin_home_t:dir search_dir_perms;
3577 ')
3578
3579 ########################################
3580 ## <summary>
3581 ##      dontaudit list /root
3582 ## </summary>
3583 ## <param name="domain">
3584 ##      <summary>
3585 ##      Domain allowed access.
3586 ##      </summary>
3587 ## </param>
3588 #
3589 interface(`userdom_dontaudit_list_admin_dir',`
3590         gen_require(`
3591                 type admin_home_t;
3592         ')
3593
3594         dontaudit $1 admin_home_t:dir list_dir_perms;
3595 ')
3596
3597 ########################################
3598 ## <summary>
3599 ##      Allow domain to  list /root
3600 ## </summary>
3601 ## <param name="domain">
3602 ##      <summary>
3603 ##      Domain allowed access.
3604 ##      </summary>
3605 ## </param>
3606 #
3607 interface(`userdom_list_admin_dir',`
3608         gen_require(`
3609                 type admin_home_t;
3610         ')
3611
3612         allow $1 admin_home_t:dir list_dir_perms;
3613 ')
3614
3615 ########################################
3616 ## <summary>
3617 ##      Allow Search /root
3618 ## </summary>
3619 ## <param name="domain">
3620 ##      <summary>
3621 ##      Domain allowed access.
3622 ##      </summary>
3623 ## </param>
3624 #
3625 interface(`userdom_search_admin_dir',`
3626         gen_require(`
3627                 type admin_home_t;
3628         ')
3629
3630         allow $1 admin_home_t:dir search_dir_perms;
3631 ')
3632
3633 ########################################
3634 ## <summary>
3635 ##      RW unpriviledged user SysV sempaphores.
3636 ## </summary>
3637 ## <param name="domain">
3638 ##      <summary>
3639 ##      Domain allowed access.
3640 ##      </summary>
3641 ## </param>
3642 #
3643 interface(`userdom_rw_semaphores',`
3644         gen_require(`
3645                 attribute unpriv_userdomain;
3646         ')
3647
3648         allow $1 unpriv_userdomain:sem rw_sem_perms;
3649 ')
3650
3651 ########################################
3652 ## <summary>
3653 ##      Send a message to unpriv users over a unix domain
3654 ##      datagram socket.
3655 ## </summary>
3656 ## <param name="domain">
3657 ##      <summary>
3658 ##      Domain allowed access.
3659 ##      </summary>
3660 ## </param>
3661 #
3662 interface(`userdom_dgram_send',`
3663         gen_require(`
3664                 attribute unpriv_userdomain;
3665         ')
3666
3667         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3668 ')
3669
3670 ######################################
3671 ## <summary>
3672 ##      Send a message to users over a unix domain
3673 ##      datagram socket.
3674 ## </summary>
3675 ## <param name="domain">
3676 ##      <summary>
3677 ##      Domain allowed access.
3678 ##      </summary>
3679 ## </param>
3680 #
3681 interface(`userdom_users_dgram_send',`
3682         gen_require(`
3683                  attribute userdomain;
3684       ')
3685
3686        allow $1 userdomain:unix_dgram_socket sendto;
3687 ')
3688
3689 #######################################
3690 ## <summary>
3691 ##      Allow execmod on files in homedirectory
3692 ## </summary>
3693 ## <param name="domain">
3694 ##      <summary>
3695 ##      Domain allowed access.
3696 ##      </summary>
3697 ## </param>
3698 ## <rolebase/>
3699 #
3700 interface(`userdom_execmod_user_home_files',`
3701         gen_require(`
3702                 type user_home_type;
3703         ')
3704
3705         allow $1 user_home_type:file execmod;
3706 ')
3707
3708 ########################################
3709 ## <summary>
3710 ##      Read admin home files.
3711 ## </summary>
3712 ## <param name="domain">
3713 ##      <summary>
3714 ##      Domain allowed access.
3715 ##      </summary>
3716 ## </param>
3717 ## <rolecap/>
3718 #
3719 interface(`userdom_read_admin_home_files',`
3720         gen_require(`
3721                 type admin_home_t;
3722         ')
3723
3724         read_files_pattern($1, admin_home_t, admin_home_t)
3725 ')
3726
3727 ########################################
3728 ## <summary>
3729 ##      Execute admin home files.
3730 ## </summary>
3731 ## <param name="domain">
3732 ##      <summary>
3733 ##      Domain allowed access.
3734 ##      </summary>
3735 ## </param>
3736 ## <rolecap/>
3737 #
3738 interface(`userdom_exec_admin_home_files',`
3739         gen_require(`
3740                 type admin_home_t;
3741         ')
3742
3743         exec_files_pattern($1, admin_home_t, admin_home_t)
3744 ')
3745
3746 ########################################
3747 ## <summary>
3748 ##      Append files inherited
3749 ##      in the /root directory.
3750 ## </summary>
3751 ## <param name="domain">
3752 ##      <summary>
3753 ##      Domain allowed access.
3754 ##      </summary>
3755 ## </param>
3756 #
3757 interface(`userdom_inherit_append_admin_home_files',`
3758         gen_require(`
3759                 type admin_home_t;
3760         ')
3761
3762         allow $1 admin_home_t:file { getattr append };
3763 ')
3764
3765
3766 #######################################
3767 ## <summary>
3768 ##      Manage all files/directories in the homedir
3769 ## </summary>
3770 ## <param name="userdomain">
3771 ##      <summary>
3772 ##      The user domain
3773 ##      </summary>
3774 ## </param>
3775 ## <rolebase/>
3776 #
3777 interface(`userdom_manage_user_home_content',`
3778         gen_require(`
3779                 type user_home_dir_t, user_home_t;
3780                 attribute user_home_type;
3781         ')
3782
3783         files_list_home($1)
3784         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3785         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3786         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3787         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3788         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3789         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3790
3791 ')
3792
3793
3794 ########################################
3795 ## <summary>
3796 ##      Create objects in a user home directory
3797 ##      with an automatic type transition to
3798 ##      the user home file type.
3799 ## </summary>
3800 ## <param name="domain">
3801 ##      <summary>
3802 ##      Domain allowed access.
3803 ##      </summary>
3804 ## </param>
3805 ## <param name="object_class">
3806 ##      <summary>
3807 ##      The class of the object to be created.
3808 ##      </summary>
3809 ## </param>
3810 #
3811 interface(`userdom_user_home_dir_filetrans_pattern',`
3812         gen_require(`
3813                 type user_home_dir_t, user_home_t;
3814         ')
3815
3816         type_transition $1 user_home_dir_t:$2 user_home_t;
3817 ')
3818
3819 ########################################
3820 ## <summary>
3821 ##      Create objects in the /root directory
3822 ##      with an automatic type transition to
3823 ##      a specified private type.
3824 ## </summary>
3825 ## <param name="domain">
3826 ##      <summary>
3827 ##      Domain allowed access.
3828 ##      </summary>
3829 ## </param>
3830 ## <param name="private_type">
3831 ##      <summary>
3832 ##      The type of the object to create.
3833 ##      </summary>
3834 ## </param>
3835 ## <param name="object_class">
3836 ##      <summary>
3837 ##      The class of the object to be created.
3838 ##      </summary>
3839 ## </param>
3840 #
3841 interface(`userdom_admin_home_dir_filetrans',`
3842         gen_require(`
3843                 type admin_home_t;
3844         ')
3845
3846         filetrans_pattern($1, admin_home_t, $2, $3)
3847 ')
3848
3849 ########################################
3850 ## <summary>
3851 ##      Send signull to unprivileged user domains.
3852 ## </summary>
3853 ## <param name="domain">
3854 ##      <summary>
3855 ##      Domain allowed access.
3856 ##      </summary>
3857 ## </param>
3858 #
3859 interface(`userdom_signull_unpriv_users',`
3860         gen_require(`
3861                 attribute unpriv_userdomain;
3862         ')
3863
3864         allow $1 unpriv_userdomain:process signull;
3865 ')
3866
3867 ########################################
3868 ## <summary>
3869 ##      Write all users files in /tmp
3870 ## </summary>
3871 ## <param name="domain">
3872 ##      <summary>
3873 ##      Domain allowed access.
3874 ##      </summary>
3875 ## </param>
3876 #
3877 interface(`userdom_write_user_tmp_dirs',`
3878         gen_require(`
3879                 type user_tmp_t;
3880         ')
3881
3882         write_files_pattern($1, user_tmp_t, user_tmp_t)
3883 ')
3884
3885 ########################################
3886 ## <summary>
3887 ##      Manage keys for all user domains.
3888 ## </summary>
3889 ## <param name="domain">
3890 ##      <summary>
3891 ##      Domain allowed access.
3892 ##      </summary>
3893 ## </param>
3894 #
3895 interface(`userdom_manage_all_users_keys',`
3896         gen_require(`
3897                 attribute userdomain;
3898         ')
3899
3900         allow $1 userdomain:key manage_key_perms;
3901 ')
3902
3903
3904 ########################################
3905 ## <summary>
3906 ##      Do not audit attempts to read and write
3907 ##      unserdomain stream.
3908 ## </summary>
3909 ## <param name="domain">
3910 ##      <summary>
3911 ##      Domain to not audit.
3912 ##      </summary>
3913 ## </param>
3914 #
3915 interface(`userdom_dontaudit_rw_stream',`
3916         gen_require(`
3917                 attribute userdomain;
3918         ')
3919
3920         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
3921 ')
3922
3923 ########################################
3924 ## <summary>
3925 ##      Append files
3926 ##      in a user home subdirectory.
3927 ## </summary>
3928 ## <param name="domain">
3929 ##      <summary>
3930 ##      Domain allowed access.
3931 ##      </summary>
3932 ## </param>
3933 #
3934 interface(`userdom_append_user_home_content_files',`
3935         gen_require(`
3936                 type user_home_dir_t, user_home_t;
3937         ')
3938
3939         append_files_pattern($1, user_home_t, user_home_t)
3940         allow $1 user_home_dir_t:dir search_dir_perms;
3941         files_search_home($1)
3942 ')
3943
3944 ########################################
3945 ## <summary>
3946 ##      Read files inherited
3947 ##      in a user home subdirectory.
3948 ## </summary>
3949 ## <param name="domain">
3950 ##      <summary>
3951 ##      Domain allowed access.
3952 ##      </summary>
3953 ## </param>
3954 #
3955 interface(`userdom_read_inherited_user_home_content_files',`
3956         gen_require(`
3957                 attribute user_home_type;
3958         ')
3959
3960         allow $1 user_home_type:file { getattr read };
3961 ')
3962
3963 ########################################
3964 ## <summary>
3965 ##      Append files inherited
3966 ##      in a user home subdirectory.
3967 ## </summary>
3968 ## <param name="domain">
3969 ##      <summary>
3970 ##      Domain allowed access.
3971 ##      </summary>
3972 ## </param>
3973 #
3974 interface(`userdom_inherit_append_user_home_content_files',`
3975         gen_require(`
3976                 type user_home_t;
3977         ')
3978
3979         allow $1 user_home_t:file { getattr append };
3980 ')
3981
3982 ########################################
3983 ## <summary>
3984 ##      Append files inherited
3985 ##      in a user tmp files.
3986 ## </summary>
3987 ## <param name="domain">
3988 ##      <summary>
3989 ##      Domain allowed access.
3990 ##      </summary>
3991 ## </param>
3992 #
3993 interface(`userdom_inherit_append_user_tmp_files',`
3994         gen_require(`
3995                 type user_tmp_t;
3996         ')
3997
3998         allow $1 user_tmp_t:file { getattr append };
3999 ')
4000
4001 ######################################
4002 ## <summary>
4003 ##      Read audio files in the users homedir.
4004 ## </summary>
4005 ## <param name="domain">
4006 ##      <summary>
4007 ##      Domain allowed access.
4008 ##      </summary>
4009 ## </param>
4010 ## <rolecap/>
4011 #
4012 interface(`userdom_read_home_audio_files',`
4013         gen_require(`
4014                 type audio_home_t;
4015         ')
4016
4017         userdom_search_user_home_dirs($1)
4018         allow $1 audio_home_t:dir list_dir_perms;
4019         read_files_pattern($1, audio_home_t, audio_home_t)
4020         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4021 ')
4022
4023 ########################################
4024 ## <summary>
4025 ##      Read system SSL certificates in the users homedir.
4026 ## </summary>
4027 ## <param name="domain">
4028 ##      <summary>
4029 ##      Domain allowed access.
4030 ##      </summary>
4031 ## </param>
4032 ## <rolecap/>
4033 #
4034 interface(`userdom_read_home_certs',`
4035         gen_require(`
4036                 type home_cert_t;
4037         ')
4038
4039         userdom_search_user_home_dirs($1)
4040         allow $1 home_cert_t:dir list_dir_perms;
4041         read_files_pattern($1, home_cert_t, home_cert_t)
4042         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4043 ')
4044
4045 ########################################
4046 ## <summary>
4047 ##      dontaudit Search getatrr /root files
4048 ## </summary>
4049 ## <param name="domain">
4050 ##      <summary>
4051 ##      Domain allowed access.
4052 ##      </summary>
4053 ## </param>
4054 #
4055 interface(`userdom_dontaudit_getattr_admin_home_files',`
4056         gen_require(`
4057                 type admin_home_t;
4058         ')
4059
4060         dontaudit $1 admin_home_t:file getattr;
4061 ')
4062
4063 ########################################
4064 ## <summary>
4065 ##      dontaudit read /root lnk files
4066 ## </summary>
4067 ## <param name="domain">
4068 ##      <summary>
4069 ##      Domain allowed access.
4070 ##      </summary>
4071 ## </param>
4072 #
4073 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4074         gen_require(`
4075                 type admin_home_t;
4076         ')
4077
4078         dontaudit $1 admin_home_t:lnk_file read;
4079 ')
4080
4081 ########################################
4082 ## <summary>
4083 ##      dontaudit read /root files
4084 ## </summary>
4085 ## <param name="domain">
4086 ##      <summary>
4087 ##      Domain allowed access.
4088 ##      </summary>
4089 ## </param>
4090 #
4091 interface(`userdom_dontaudit_read_admin_home_files',`
4092         gen_require(`
4093                 type admin_home_t;
4094         ')
4095
4096         dontaudit $1 admin_home_t:file read_file_perms;
4097 ')
4098
4099 ########################################
4100 ## <summary>
4101 ##      Create, read, write, and delete user
4102 ##      temporary chr files.
4103 ## </summary>
4104 ## <param name="domain">
4105 ##      <summary>
4106 ##      Domain allowed access.
4107 ##      </summary>
4108 ## </param>
4109 #
4110 interface(`userdom_manage_user_tmp_chr_files',`
4111         gen_require(`
4112                 type user_tmp_t;
4113         ')
4114
4115         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4116         files_search_tmp($1)
4117 ')
4118
4119 ########################################
4120 ## <summary>
4121 ##      Create, read, write, and delete user
4122 ##      temporary blk files.
4123 ## </summary>
4124 ## <param name="domain">
4125 ##      <summary>
4126 ##      Domain allowed access.
4127 ##      </summary>
4128 ## </param>
4129 #
4130 interface(`userdom_manage_user_tmp_blk_files',`
4131         gen_require(`
4132                 type user_tmp_t;
4133         ')
4134
4135         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4136         files_search_tmp($1)
4137 ')
4138
4139 ########################################
4140 ## <summary>
4141 ##      Dontaudit attempt to set attributes on  user temporary directories.
4142 ## </summary>
4143 ## <param name="domain">
4144 ##      <summary>
4145 ##      Domain allowed access.
4146 ##      </summary>
4147 ## </param>
4148 #
4149 interface(`userdom_dontaudit_setattr_user_tmp',`
4150         gen_require(`
4151                 type user_tmp_t;
4152         ')
4153
4154         dontaudit $1 user_tmp_t:dir setattr;
4155 ')
4156
4157 ########################################
4158 ## <summary>
4159 ##      Write all inherited users files in /tmp
4160 ## </summary>
4161 ## <param name="domain">
4162 ##      <summary>
4163 ##      Domain allowed access.
4164 ##      </summary>
4165 ## </param>
4166 #
4167 interface(`userdom_write_inherited_user_tmp_files',`
4168         gen_require(`
4169                 type user_tmp_t;
4170         ')
4171
4172         allow $1 user_tmp_t:file write;
4173 ')
4174
4175 ########################################
4176 ## <summary>
4177 ##      Delete all users files in /tmp
4178 ## </summary>
4179 ## <param name="domain">
4180 ##      <summary>
4181 ##      Domain allowed access.
4182 ##      </summary>
4183 ## </param>
4184 #
4185 interface(`userdom_delete_user_tmp_files',`
4186         gen_require(`
4187                 type user_tmp_t;
4188         ')
4189
4190         allow $1 user_tmp_t:file delete_file_perms;
4191 ')
4192
4193 ########################################
4194 ## <summary>
4195 ##      Delete user tmpfs files.
4196 ## </summary>
4197 ## <param name="domain">
4198 ##      <summary>
4199 ##      Domain allowed access.
4200 ##      </summary>
4201 ## </param>
4202 #
4203 interface(`userdom_delete_user_tmpfs_files',`
4204         gen_require(`
4205                 type user_tmpfs_t;
4206         ')
4207
4208         allow $1 user_tmpfs_t:file delete_file_perms;
4209 ')
4210
4211 ########################################
4212 ## <summary>
4213 ##      Read/Write unpriviledged user SysV shared
4214 ##      memory segments.
4215 ## </summary>
4216 ## <param name="domain">
4217 ##      <summary>
4218 ##      Domain allowed access.
4219 ##      </summary>
4220 ## </param>
4221 #
4222 interface(`userdom_rw_unpriv_user_shared_mem',`
4223         gen_require(`
4224                 attribute unpriv_userdomain;
4225         ')
4226
4227         allow $1 unpriv_userdomain:shm rw_shm_perms;
4228 ')
4229
4230 ########################################
4231 ## <summary>
4232 ##      Do not audit attempts to search user
4233 ##      temporary directories.
4234 ## </summary>
4235 ## <param name="domain">
4236 ##      <summary>
4237 ##      Domain to not audit.
4238 ##      </summary>
4239 ## </param>
4240 #
4241 interface(`userdom_dontaudit_search_user_tmp',`
4242         gen_require(`
4243                 type user_tmp_t;
4244         ')
4245
4246         dontaudit $1 user_tmp_t:dir search_dir_perms;
4247 ')
4248
4249 ########################################
4250 ## <summary>
4251 ##      Execute a file in a user home directory
4252 ##      in the specified domain.
4253 ## </summary>
4254 ## <desc>
4255 ##      <p>
4256 ##      Execute a file in a user home directory
4257 ##      in the specified domain.
4258 ##      </p>
4259 ##      <p>
4260 ##      No interprocess communication (signals, pipes,
4261 ##      etc.) is provided by this interface since
4262 ##      the domains are not owned by this module.
4263 ##      </p>
4264 ## </desc>
4265 ## <param name="domain">
4266 ##      <summary>
4267 ##      Domain allowed access.
4268 ##      </summary>
4269 ## </param>
4270 ## <param name="target_domain">
4271 ##      <summary>
4272 ##      The type of the new process.
4273 ##      </summary>
4274 ## </param>
4275 #
4276 interface(`userdom_domtrans_user_home',`
4277         gen_require(`
4278                 type user_home_t;
4279         ')
4280
4281         read_lnk_files_pattern($1, user_home_t, user_home_t)
4282         domain_transition_pattern($1, user_home_t, $2)
4283         type_transition $1 user_home_t:process $2;
4284 ')
4285
4286 ########################################
4287 ## <summary>
4288 ##      Execute a file in a user tmp directory
4289 ##      in the specified domain.
4290 ## </summary>
4291 ## <desc>
4292 ##      <p>
4293 ##      Execute a file in a user tmp directory
4294 ##      in the specified domain.
4295 ##      </p>
4296 ##      <p>
4297 ##      No interprocess communication (signals, pipes,
4298 ##      etc.) is provided by this interface since
4299 ##      the domains are not owned by this module.
4300 ##      </p>
4301 ## </desc>
4302 ## <param name="domain">
4303 ##      <summary>
4304 ##      Domain allowed access.
4305 ##      </summary>
4306 ## </param>
4307 ## <param name="target_domain">
4308 ##      <summary>
4309 ##      The type of the new process.
4310 ##      </summary>
4311 ## </param>
4312 #
4313 interface(`userdom_domtrans_user_tmp',`
4314         gen_require(`
4315                 type user_tmp_t;
4316         ')
4317
4318         files_search_tmp($1)
4319         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4320         domain_transition_pattern($1, user_tmp_t, $2)
4321         type_transition $1 user_tmp_t:process $2;
4322 ')