policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 colord_read_lib_files($1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 dbus_system_bus_client($1_usertype)
 696
 697                 allow $1_usertype $1_usertype:dbus  send_msg;
 698
 699                 optional_policy(`
 700                         avahi_dbus_chat($1_usertype)
 701                 ')
 702
 703                 optional_policy(`
 704                         policykit_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         bluetooth_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         consolekit_dbus_chat($1_usertype)
 713                         consolekit_read_log($1_usertype)
 714                 ')
 715
 716                 optional_policy(`
 717                         devicekit_dbus_chat($1_usertype)
 718                         devicekit_dbus_chat_power($1_usertype)
 719                         devicekit_dbus_chat_disk($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         evolution_dbus_chat($1_usertype)
 724                         evolution_alarm_dbus_chat($1_usertype)
 725                 ')
 726
 727                 optional_policy(`
 728                         gnome_dbus_chat_gconfdefault($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         hal_dbus_chat($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         kde_dbus_chat_backlighthelper($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         modemmanager_dbus_chat($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         networkmanager_dbus_chat($1_usertype)
 745                         networkmanager_read_lib_files($1_usertype)
 746                 ')
 747
 748                 optional_policy(`
 749                         vpn_dbus_chat($1_usertype)
 750                 ')
 751         ')
 752
 753         optional_policy(`
 754                 git_session_role($1_r, $1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inetd_use_fds($1_usertype)
 759                 inetd_rw_tcp_sockets($1_usertype)
 760         ')
 761
 762         optional_policy(`
 763                 inn_read_config($1_usertype)
 764                 inn_read_news_lib($1_usertype)
 765                 inn_read_news_spool($1_usertype)
 766         ')
 767
 768         optional_policy(`
 769                 lircd_stream_connect($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 locate_read_lib_files($1_usertype)
 774         ')
 775
 776         # for running depmod as part of the kernel packaging process
 777         optional_policy(`
 778                 modutils_read_module_config($1_usertype)
 779         ')
 780
 781         optional_policy(`
 782                 mta_rw_spool($1_usertype)
 783                 mta_manage_queue($1_usertype)
 784                 mta_filetrans_home_content($1_usertype)
 785         ')
 786
 787         optional_policy(`
 788                 tunable_policy(`allow_user_mysql_connect',`
 789                         mysql_stream_connect($1_t)
 790                 ')
 791         ')
 792
 793         optional_policy(`
 794                 oident_manage_user_content($1_t)
 795                 oident_relabel_user_content($1_t)
 796         ')
 797
 798         optional_policy(`
 799                 # to allow monitoring of pcmcia status
 800                 pcmcia_read_pid($1_usertype)
 801         ')
 802
 803         optional_policy(`
 804                 pcscd_read_pub_files($1_usertype)
 805                 pcscd_stream_connect($1_usertype)
 806         ')
 807
 808         optional_policy(`
 809                 tunable_policy(`allow_user_postgresql_connect',`
 810                         postgresql_stream_connect($1_usertype)
 811                         postgresql_tcp_connect($1_usertype)
 812                 ')
 813         ')
 814
 815         optional_policy(`
 816                 resmgr_stream_connect($1_usertype)
 817         ')
 818
 819         optional_policy(`
 820                 rpc_dontaudit_getattr_exports($1_usertype)
 821                 rpc_manage_nfs_rw_content($1_usertype)
 822         ')
 823
 824         optional_policy(`
 825                 rpcbind_stream_connect($1_usertype)
 826         ')
 827
 828         optional_policy(`
 829                 samba_stream_connect_winbind($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 sandbox_transition($1_usertype, $1_r)
 834         ')
 835
 836         optional_policy(`
 837                 seunshare_role_template($1, $1_r, $1_t)
 838         ')
 839
 840         optional_policy(`
 841                 slrnpull_search_spool($1_usertype)
 842         ')
 843
 844         optional_policy(`
 845                 thumb_role($1_r, $1_usertype)
 846         ')
 847 ')
 848
 849 #######################################
 850 ## <summary>
 851 ##      The template for creating a login user.
 852 ## </summary>
 853 ## <desc>
 854 ##      <p>
 855 ##      This template creates a user domain, types, and
 856 ##      rules for the user's tty, pty, home directories,
 857 ##      tmp, and tmpfs files.
 858 ##      </p>
 859 ## </desc>
 860 ## <param name="userdomain_prefix">
 861 ##      <summary>
 862 ##      The prefix of the user domain (e.g., user
 863 ##      is the prefix for user_t).
 864 ##      </summary>
 865 ## </param>
 866 #
 867 template(`userdom_login_user_template', `
 868         gen_require(`
 869                 class context contains;
 870         ')
 871
 872         userdom_base_user_template($1)
 873
 874         userdom_manage_home_role($1_r, $1_usertype)
 875
 876         userdom_manage_tmp_role($1_r, $1_usertype)
 877         userdom_manage_tmpfs_role($1_r, $1_usertype)
 878
 879         ifelse(`$1',`unconfined',`',`
 880                 gen_tunable(allow_$1_exec_content, true)
 881
 882                 tunable_policy(`allow_$1_exec_content',`
 883                         userdom_exec_user_tmp_files($1_usertype)
 884                         userdom_exec_user_home_content_files($1_usertype)
 885                 ')
 886                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 887                         fs_exec_nfs_files($1_usertype)
 888                 ')
 889
 890                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 891                         fs_exec_cifs_files($1_usertype)
 892                 ')
 893         ')
 894
 895         userdom_change_password_template($1)
 896
 897         ##############################
 898         #
 899         # User domain Local policy
 900         #
 901
 902         allow $1_t self:capability { setgid chown fowner };
 903         dontaudit $1_t self:capability { sys_nice fsetid };
 904
 905         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 906         dontaudit $1_t self:process setrlimit;
 907         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 908
 909         allow $1_t self:context contains;
 910
 911         kernel_dontaudit_read_system_state($1_usertype)
 912         kernel_dontaudit_list_all_proc($1_usertype)
 913
 914         dev_read_sysfs($1_usertype)
 915         dev_read_urand($1_usertype)
 916
 917         domain_use_interactive_fds($1_usertype)
 918         # Command completion can fire hundreds of denials
 919         domain_dontaudit_exec_all_entry_files($1_usertype)
 920
 921         files_dontaudit_list_default($1_usertype)
 922         files_dontaudit_read_default_files($1_usertype)
 923         # Stat lost+found.
 924         files_getattr_lost_found_dirs($1_usertype)
 925
 926         fs_get_all_fs_quotas($1_usertype)
 927         fs_getattr_all_fs($1_usertype)
 928         fs_search_all($1_usertype)
 929         fs_list_inotifyfs($1_usertype)
 930         fs_rw_anon_inodefs_files($1_usertype)
 931
 932         auth_dontaudit_write_login_records($1_t)
 933         auth_rw_cache($1_t)
 934
 935         application_exec_all($1_t)
 936         # The library functions always try to open read-write first,
 937         # then fall back to read-only if it fails.
 938         init_dontaudit_rw_utmp($1_t)
 939
 940         # Stop warnings about access to /dev/console
 941         init_dontaudit_use_fds($1_usertype)
 942         init_dontaudit_use_script_fds($1_usertype)
 943
 944         libs_exec_lib_files($1_usertype)
 945
 946         logging_dontaudit_getattr_all_logs($1_usertype)
 947
 948         # for running TeX programs
 949         miscfiles_read_tetex_data($1_usertype)
 950         miscfiles_exec_tetex_data($1_usertype)
 951
 952         seutil_read_config($1_usertype)
 953
 954         optional_policy(`
 955                 cups_read_config($1_usertype)
 956                 cups_stream_connect($1_usertype)
 957                 cups_stream_connect_ptal($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 kerberos_use($1_usertype)
 962                 kerberos_filetrans_home_content($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 mta_dontaudit_read_spool_symlinks($1_usertype)
 967         ')
 968
 969         optional_policy(`
 970                 quota_dontaudit_getattr_db($1_usertype)
 971         ')
 972
 973         optional_policy(`
 974                 rpm_read_db($1_usertype)
 975                 rpm_dontaudit_manage_db($1_usertype)
 976                 rpm_read_cache($1_usertype)
 977         ')
 978
 979         optional_policy(`
 980                 oddjob_run_mkhomedir($1_t, $1_r)
 981         ')
 982 ')
 983
 984 #######################################
 985 ## <summary>
 986 ##      The template for creating a unprivileged login user.
 987 ## </summary>
 988 ## <desc>
 989 ##      <p>
 990 ##      This template creates a user domain, types, and
 991 ##      rules for the user's tty, pty, home directories,
 992 ##      tmp, and tmpfs files.
 993 ##      </p>
 994 ## </desc>
 995 ## <param name="userdomain_prefix">
 996 ##      <summary>
 997 ##      The prefix of the user domain (e.g., user
 998 ##      is the prefix for user_t).
 999 ##      </summary>
1000 ## </param>
1001 #
1002 template(`userdom_restricted_user_template',`
1003         gen_require(`
1004                 attribute unpriv_userdomain;
1005         ')
1006
1007         userdom_login_user_template($1)
1008
1009         typeattribute $1_t unpriv_userdomain;
1010         domain_interactive_fd($1_t)
1011
1012         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1013         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1014
1015         ##############################
1016         #
1017         # Local policy
1018         #
1019
1020         optional_policy(`
1021                 loadkeys_run($1_t, $1_r)
1022         ')
1023 ')
1024
1025 #######################################
1026 ## <summary>
1027 ##      The template for creating a unprivileged xwindows login user.
1028 ## </summary>
1029 ## <desc>
1030 ##      <p>
1031 ##      The template for creating a unprivileged xwindows login user.
1032 ##      </p>
1033 ##      <p>
1034 ##      This template creates a user domain, types, and
1035 ##      rules for the user's tty, pty, home directories,
1036 ##      tmp, and tmpfs files.
1037 ##      </p>
1038 ## </desc>
1039 ## <param name="userdomain_prefix">
1040 ##      <summary>
1041 ##      The prefix of the user domain (e.g., user
1042 ##      is the prefix for user_t).
1043 ##      </summary>
1044 ## </param>
1045 #
1046 template(`userdom_restricted_xwindows_user_template',`
1047
1048         userdom_restricted_user_template($1)
1049
1050         ##############################
1051         #
1052         # Local policy
1053         #
1054
1055         auth_role($1_r, $1_t)
1056         auth_search_pam_console_data($1_usertype)
1057         auth_dontaudit_read_login_records($1_usertype)
1058
1059         dev_read_sound($1_usertype)
1060         dev_write_sound($1_usertype)
1061         # gnome keyring wants to read this.
1062         dev_dontaudit_read_rand($1_usertype)
1063         # temporarily allow since openoffice requires this
1064         dev_read_rand($1_usertype)
1065
1066         dev_read_video_dev($1_usertype)
1067         dev_write_video_dev($1_usertype)
1068         dev_rw_wireless($1_usertype)
1069
1070         libs_dontaudit_setattr_lib_files($1_usertype)
1071
1072         tunable_policy(`user_rw_noexattrfile',`
1073                 dev_rw_usbfs($1_t)
1074                 dev_rw_generic_usb_dev($1_usertype)
1075
1076                 fs_manage_noxattr_fs_files($1_usertype)
1077                 fs_manage_noxattr_fs_dirs($1_usertype)
1078                 fs_manage_dos_dirs($1_usertype)
1079                 fs_manage_dos_files($1_usertype)
1080                 storage_raw_read_removable_device($1_usertype)
1081                 storage_raw_write_removable_device($1_usertype)
1082         ')
1083
1084         logging_send_syslog_msg($1_usertype)
1085         logging_dontaudit_send_audit_msgs($1_t)
1086
1087         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1088         logging_send_audit_msgs($1_t)
1089         selinux_get_enforce_mode($1_t)
1090         seutil_exec_restorecond($1_t)
1091         seutil_read_file_contexts($1_t)
1092         seutil_read_default_contexts($1_t)
1093
1094         xserver_restricted_role($1_r, $1_t)
1095
1096         optional_policy(`
1097                 alsa_read_rw_config($1_usertype)
1098         ')
1099
1100          # cjp: needed by KDE apps
1101          # bug: #682499
1102          optional_policy(`
1103                 gnome_read_usr_config($1_usertype)
1104                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1105                 # cjp: telepathy F15 bugs
1106                 telepathy_role($1_r, $1_t, $1)
1107         ')
1108
1109         optional_policy(`
1110                 dbus_role_template($1, $1_r, $1_usertype)
1111                 dbus_system_bus_client($1_usertype)
1112                 allow $1_usertype $1_usertype:dbus send_msg;
1113
1114                 optional_policy(`
1115                         abrt_dbus_chat($1_usertype)
1116                         abrt_run_helper($1_usertype, $1_r)
1117                 ')
1118
1119                 optional_policy(`
1120                         consolekit_dontaudit_read_log($1_usertype)
1121                         consolekit_dbus_chat($1_usertype)
1122                 ')
1123
1124                 optional_policy(`
1125                         cups_dbus_chat($1_usertype)
1126                         cups_dbus_chat_config($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         devicekit_dbus_chat($1_usertype)
1131                         devicekit_dbus_chat_disk($1_usertype)
1132                         devicekit_dbus_chat_power($1_usertype)
1133                 ')
1134
1135                 optional_policy(`
1136                         fprintd_dbus_chat($1_t)
1137                 ')
1138         ')
1139
1140         optional_policy(`
1141                 policykit_role($1_r, $1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 pulseaudio_role($1_r, $1_usertype)
1146                 pulseaudio_filetrans_admin_home_content($1_usertype)
1147                 pulseaudio_filetrans_home_content($1_usertype)
1148         ')
1149
1150         optional_policy(`
1151                 rtkit_scheduled($1_usertype)
1152         ')
1153
1154         optional_policy(`
1155                 setroubleshoot_dontaudit_stream_connect($1_t)
1156         ')
1157
1158         optional_policy(`
1159                 udev_read_db($1_usertype)
1160         ')
1161
1162         optional_policy(`
1163                 wm_role_template($1, $1_r, $1_t)
1164         ')
1165 ')
1166
1167 #######################################
1168 ## <summary>
1169 ##      The template for creating a unprivileged user roughly
1170 ##      equivalent to a regular linux user.
1171 ## </summary>
1172 ## <desc>
1173 ##      <p>
1174 ##      The template for creating a unprivileged user roughly
1175 ##      equivalent to a regular linux user.
1176 ##      </p>
1177 ##      <p>
1178 ##      This template creates a user domain, types, and
1179 ##      rules for the user's tty, pty, home directories,
1180 ##      tmp, and tmpfs files.
1181 ##      </p>
1182 ## </desc>
1183 ## <param name="userdomain_prefix">
1184 ##      <summary>
1185 ##      The prefix of the user domain (e.g., user
1186 ##      is the prefix for user_t).
1187 ##      </summary>
1188 ## </param>
1189 #
1190 template(`userdom_unpriv_user_template', `
1191
1192         ##############################
1193         #
1194         # Declarations
1195         #
1196
1197         # Inherit rules for ordinary users.
1198         userdom_restricted_xwindows_user_template($1)
1199         userdom_common_user_template($1)
1200
1201         ##############################
1202         #
1203         # Local policy
1204         #
1205
1206         # port access is audited even if dac would not have allowed it, so dontaudit it here
1207 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1208         # Need the following rule to allow users to run vpnc
1209         corenet_tcp_bind_xserver_port($1_t)
1210         corenet_tcp_bind_generic_node($1_usertype)
1211
1212         storage_rw_fuse($1_t)
1213
1214         files_exec_usr_files($1_t)
1215    # cjp: why?
1216         files_read_kernel_symbol_table($1_t)
1217
1218         ifndef(`enable_mls',`
1219                 fs_exec_noxattr($1_t)
1220
1221                 tunable_policy(`user_rw_noexattrfile',`
1222                         fs_manage_noxattr_fs_files($1_t)
1223                         fs_manage_noxattr_fs_dirs($1_t)
1224                         # Write floppies
1225                         storage_raw_read_removable_device($1_t)
1226                         storage_raw_write_removable_device($1_t)
1227                 ',`
1228                         storage_raw_read_removable_device($1_t)
1229                 ')
1230         ')
1231
1232         miscfiles_read_hwdata($1_usertype)
1233
1234         # Allow users to run TCP servers (bind to ports and accept connection from
1235         # the same domain and outside users) disabling this forces FTP passive mode
1236         # and may change other protocols
1237
1238         tunable_policy(`user_share_music',`
1239                 corenet_tcp_bind_daap_port($1_usertype)
1240         ')
1241
1242         tunable_policy(`user_tcp_server',`
1243                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1244         ')
1245
1246         tunable_policy(`user_setrlimit',`
1247                 allow $1_usertype self:process setrlimit;
1248         ')
1249
1250         optional_policy(`
1251                 cdrecord_role($1_r, $1_t)
1252         ')
1253
1254         optional_policy(`
1255                 cron_role($1_r, $1_t)
1256         ')
1257
1258         optional_policy(`
1259                 games_rw_data($1_usertype)
1260         ')
1261
1262         optional_policy(`
1263                 gpg_role($1_r, $1_usertype)
1264         ')
1265
1266         optional_policy(`
1267                 gnomeclock_dbus_chat($1_t)
1268         ')
1269
1270         optional_policy(`
1271                 gpm_stream_connect($1_usertype)
1272         ')
1273
1274         optional_policy(`
1275                 mount_run_fusermount($1_t, $1_r)
1276                 mount_read_pid_files($1_t)
1277         ')
1278
1279         optional_policy(`
1280                 wine_role_template($1, $1_r, $1_t)
1281         ')
1282
1283         optional_policy(`
1284                 postfix_run_postdrop($1_t, $1_r)
1285                 postfix_search_spool($1_t)
1286         ')
1287
1288         # Run pppd in pppd_t by default for user
1289         optional_policy(`
1290                 ppp_run_cond($1_t, $1_r)
1291         ')
1292
1293         optional_policy(`
1294                 vdagent_getattr_log($1_t)
1295                 vdagent_getattr_exec($1_t)
1296                 vdagent_stream_connect($1_t)
1297         ')
1298 ')
1299
1300 #######################################
1301 ## <summary>
1302 ##      The template for creating an administrative user.
1303 ## </summary>
1304 ## <desc>
1305 ##      <p>
1306 ##      This template creates a user domain, types, and
1307 ##      rules for the user's tty, pty, home directories,
1308 ##      tmp, and tmpfs files.
1309 ##      </p>
1310 ##      <p>
1311 ##      The privileges given to administrative users are:
1312 ##      <ul>
1313 ##              <li>Raw disk access</li>
1314 ##              <li>Set all sysctls</li>
1315 ##              <li>All kernel ring buffer controls</li>
1316 ##              <li>Create, read, write, and delete all files but shadow</li>
1317 ##              <li>Manage source and binary format SELinux policy</li>
1318 ##              <li>Run insmod</li>
1319 ##      </ul>
1320 ##      </p>
1321 ## </desc>
1322 ## <param name="userdomain_prefix">
1323 ##      <summary>
1324 ##      The prefix of the user domain (e.g., sysadm
1325 ##      is the prefix for sysadm_t).
1326 ##      </summary>
1327 ## </param>
1328 #
1329 template(`userdom_admin_user_template',`
1330         gen_require(`
1331                 attribute admindomain;
1332                 class passwd { passwd chfn chsh rootok crontab };
1333         ')
1334
1335         ##############################
1336         #
1337         # Declarations
1338         #
1339
1340         # Inherit rules for ordinary users.
1341         userdom_login_user_template($1)
1342         userdom_common_user_template($1)
1343
1344         domain_obj_id_change_exemption($1_t)
1345         role system_r types $1_t;
1346
1347         typeattribute $1_t admindomain;
1348
1349         ifdef(`direct_sysadm_daemon',`
1350                 domain_system_change_exemption($1_t)
1351         ')
1352
1353         ##############################
1354         #
1355         # $1_t local policy
1356         #
1357
1358         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1359         tunable_policy(`deny_ptrace',`',`
1360                 allow $1_t self:capability sys_ptrace;
1361         ')
1362         allow $1_t self:capability2 syslog;
1363         allow $1_t self:process { setexec setfscreate };
1364         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1365         allow $1_t self:tun_socket create;
1366         # Set password information for other users.
1367         allow $1_t self:passwd { passwd chfn chsh };
1368         # Skip authentication when pam_rootok is specified.
1369         allow $1_t self:passwd rootok;
1370
1371         # Manipulate other users crontab.
1372         allow $1_t self:passwd crontab;
1373
1374         kernel_read_software_raid_state($1_t)
1375         kernel_getattr_core_if($1_t)
1376         kernel_getattr_message_if($1_t)
1377         kernel_change_ring_buffer_level($1_t)
1378         kernel_clear_ring_buffer($1_t)
1379         kernel_read_ring_buffer($1_t)
1380         kernel_get_sysvipc_info($1_t)
1381         kernel_rw_all_sysctls($1_t)
1382         # signal unlabeled processes:
1383         kernel_kill_unlabeled($1_t)
1384         kernel_signal_unlabeled($1_t)
1385         kernel_sigstop_unlabeled($1_t)
1386         kernel_signull_unlabeled($1_t)
1387         kernel_sigchld_unlabeled($1_t)
1388         kernel_signal($1_t)
1389
1390         corenet_tcp_bind_generic_port($1_t)
1391         # allow setting up tunnels
1392         corenet_rw_tun_tap_dev($1_t)
1393
1394         dev_getattr_generic_blk_files($1_t)
1395         dev_getattr_generic_chr_files($1_t)
1396         # for lsof
1397         dev_getattr_mtrr_dev($1_t)
1398         # Allow MAKEDEV to work
1399         dev_create_all_blk_files($1_t)
1400         dev_create_all_chr_files($1_t)
1401         dev_delete_all_blk_files($1_t)
1402         dev_delete_all_chr_files($1_t)
1403         dev_rename_all_blk_files($1_t)
1404         dev_rename_all_chr_files($1_t)
1405         dev_create_generic_symlinks($1_t)
1406         dev_rw_generic_usb_dev($1_t)
1407         dev_rw_usbfs($1_t)
1408
1409         domain_setpriority_all_domains($1_t)
1410         domain_read_all_domains_state($1_t)
1411         domain_getattr_all_domains($1_t)
1412         domain_getcap_all_domains($1_t)
1413         domain_dontaudit_ptrace_all_domains($1_t)
1414         # signal all domains:
1415         domain_kill_all_domains($1_t)
1416         domain_signal_all_domains($1_t)
1417         domain_signull_all_domains($1_t)
1418         domain_sigstop_all_domains($1_t)
1419         domain_sigstop_all_domains($1_t)
1420         domain_sigchld_all_domains($1_t)
1421         # for lsof
1422         domain_getattr_all_sockets($1_t)
1423         domain_dontaudit_getattr_all_sockets($1_t)
1424
1425         files_exec_usr_src_files($1_t)
1426
1427         fs_getattr_all_fs($1_t)
1428         fs_getattr_all_files($1_t)
1429         fs_list_all($1_t)
1430         fs_set_all_quotas($1_t)
1431         fs_exec_noxattr($1_t)
1432
1433         storage_raw_read_removable_device($1_t)
1434         storage_raw_write_removable_device($1_t)
1435         storage_dontaudit_read_fixed_disk($1_t)
1436
1437         term_use_all_inherited_terms($1_t)
1438         term_use_unallocated_ttys($1_t)
1439
1440         auth_getattr_shadow($1_t)
1441         # Manage almost all files
1442         files_manage_non_security_dirs($1_t)
1443         files_manage_non_security_files($1_t)
1444         # Relabel almost all files
1445         files_relabel_non_security_files($1_t)
1446
1447         init_telinit($1_t)
1448
1449         logging_send_syslog_msg($1_t)
1450
1451         optional_policy(`
1452                 modutils_domtrans_insmod($1_t)
1453                 modutils_domtrans_depmod($1_t)
1454         ')
1455
1456         # The following rule is temporary until such time that a complete
1457         # policy management infrastructure is in place so that an administrator
1458         # cannot directly manipulate policy files with arbitrary programs.
1459         seutil_manage_src_policy($1_t)
1460         # Violates the goal of limiting write access to checkpolicy.
1461         # But presently necessary for installing the file_contexts file.
1462         seutil_manage_bin_policy($1_t)
1463
1464         systemd_config_all_services($1_t)
1465
1466         userdom_manage_user_home_content_dirs($1_t)
1467         userdom_manage_user_home_content_files($1_t)
1468         userdom_manage_user_home_content_symlinks($1_t)
1469         userdom_manage_user_home_content_pipes($1_t)
1470         userdom_manage_user_home_content_sockets($1_t)
1471         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1472
1473         tunable_policy(`user_rw_noexattrfile',`
1474                 fs_manage_noxattr_fs_files($1_t)
1475                 fs_manage_noxattr_fs_dirs($1_t)
1476         ',`
1477                 fs_read_noxattr_fs_files($1_t)
1478         ')
1479
1480         optional_policy(`
1481                 postgresql_unconfined($1_t)
1482         ')
1483
1484         optional_policy(`
1485                 userhelper_exec($1_t)
1486         ')
1487 ')
1488
1489 ########################################
1490 ## <summary>
1491 ##      Allow user to run as a secadm
1492 ## </summary>
1493 ## <desc>
1494 ##      <p>
1495 ##      Create objects in a user home directory
1496 ##      with an automatic type transition to
1497 ##      a specified private type.
1498 ##      </p>
1499 ##      <p>
1500 ##      This is a templated interface, and should only
1501 ##      be called from a per-userdomain template.
1502 ##      </p>
1503 ## </desc>
1504 ## <param name="domain">
1505 ##      <summary>
1506 ##      Domain allowed access.
1507 ##      </summary>
1508 ## </param>
1509 ## <param name="role">
1510 ##      <summary>
1511 ##      The role  of the object to create.
1512 ##      </summary>
1513 ## </param>
1514 #
1515 template(`userdom_security_admin_template',`
1516         allow $1 self:capability { dac_read_search dac_override };
1517
1518         corecmd_exec_shell($1)
1519
1520         domain_obj_id_change_exemption($1)
1521
1522         dev_relabel_all_dev_nodes($1)
1523
1524         files_create_boot_flag($1)
1525         files_create_default_dir($1)
1526         files_root_filetrans_default($1, dir)
1527
1528         # Necessary for managing /boot/efi
1529         fs_manage_dos_files($1)
1530
1531         mls_process_read_up($1)
1532         mls_file_read_all_levels($1)
1533         mls_file_upgrade($1)
1534         mls_file_downgrade($1)
1535
1536         selinux_set_enforce_mode($1)
1537         selinux_set_all_booleans($1)
1538         selinux_set_parameters($1)
1539         selinux_read_policy($1)
1540
1541         files_relabel_all_files($1)
1542         auth_relabel_shadow($1)
1543
1544         init_exec($1)
1545
1546         logging_send_syslog_msg($1)
1547         logging_read_audit_log($1)
1548         logging_read_generic_logs($1)
1549         logging_read_audit_config($1)
1550
1551         seutil_manage_bin_policy($1)
1552         seutil_manage_default_contexts($1)
1553         seutil_manage_file_contexts($1)
1554         seutil_manage_module_store($1)
1555         seutil_manage_config($1)
1556         seutil_run_checkpolicy($1,$2)
1557         seutil_run_loadpolicy($1,$2)
1558         seutil_run_semanage($1,$2)
1559         seutil_run_setsebool($1,$2)
1560         seutil_run_setfiles($1, $2)
1561
1562         seutil_manage_bin_policy($1)
1563     seutil_manage_default_contexts($1)
1564     seutil_manage_file_contexts($1)
1565     seutil_manage_module_store($1)
1566     seutil_manage_config($1)
1567
1568         optional_policy(`
1569                 aide_run($1,$2)
1570         ')
1571
1572         optional_policy(`
1573                 consoletype_exec($1)
1574         ')
1575
1576         optional_policy(`
1577                 dmesg_exec($1)
1578         ')
1579
1580         optional_policy(`
1581                 ipsec_run_setkey($1,$2)
1582         ')
1583
1584         optional_policy(`
1585                 netlabel_run_mgmt($1,$2)
1586         ')
1587
1588         optional_policy(`
1589                 samhain_run($1, $2)
1590         ')
1591 ')
1592
1593 ########################################
1594 ## <summary>
1595 ##      Make the specified type usable in a
1596 ##      user home directory.
1597 ## </summary>
1598 ## <param name="type">
1599 ##      <summary>
1600 ##      Type to be used as a file in the
1601 ##      user home directory.
1602 ##      </summary>
1603 ## </param>
1604 #
1605 interface(`userdom_user_home_content',`
1606         gen_require(`
1607                 type user_home_t;
1608                 attribute user_home_type;
1609         ')
1610
1611         allow $1 user_home_t:filesystem associate;
1612         files_type($1)
1613         ubac_constrained($1)
1614
1615         files_poly_member($1)
1616         typeattribute $1  user_home_type;
1617 ')
1618
1619 ########################################
1620 ## <summary>
1621 ##      Make the specified type usable in a
1622 ##      generic temporary directory.
1623 ## </summary>
1624 ## <param name="type">
1625 ##      <summary>
1626 ##      Type to be used as a file in the
1627 ##      generic temporary directory.
1628 ##      </summary>
1629 ## </param>
1630 #
1631 interface(`userdom_user_tmp_content',`
1632         gen_require(`
1633                 attribute user_tmp_type;
1634         ')
1635
1636         typeattribute $1 user_tmp_type;
1637
1638         files_tmp_file($1)
1639         ubac_constrained($1)
1640 ')
1641
1642 ########################################
1643 ## <summary>
1644 ##      Make the specified type usable in a
1645 ##      generic tmpfs_t directory.
1646 ## </summary>
1647 ## <param name="type">
1648 ##      <summary>
1649 ##      Type to be used as a file in the
1650 ##      generic temporary directory.
1651 ##      </summary>
1652 ## </param>
1653 #
1654 interface(`userdom_user_tmpfs_content',`
1655         gen_require(`
1656                 attribute user_tmpfs_type;
1657         ')
1658
1659         typeattribute $1 user_tmpfs_type;
1660
1661         files_tmpfs_file($1)
1662         ubac_constrained($1)
1663 ')
1664
1665 ########################################
1666 ## <summary>
1667 ##      Allow domain to attach to TUN devices created by administrative users.
1668 ## </summary>
1669 ## <param name="domain">
1670 ##      <summary>
1671 ##      Domain allowed access.
1672 ##      </summary>
1673 ## </param>
1674 #
1675 interface(`userdom_attach_admin_tun_iface',`
1676         gen_require(`
1677                 attribute admindomain;
1678         ')
1679
1680         allow $1 admindomain:tun_socket relabelfrom;
1681         allow $1 self:tun_socket relabelto;
1682 ')
1683
1684 ########################################
1685 ## <summary>
1686 ##      Set the attributes of a user pty.
1687 ## </summary>
1688 ## <param name="domain">
1689 ##      <summary>
1690 ##      Domain allowed access.
1691 ##      </summary>
1692 ## </param>
1693 #
1694 interface(`userdom_setattr_user_ptys',`
1695         gen_require(`
1696                 type user_devpts_t;
1697         ')
1698
1699         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1700 ')
1701
1702 ########################################
1703 ## <summary>
1704 ##      Create a user pty.
1705 ## </summary>
1706 ## <param name="domain">
1707 ##      <summary>
1708 ##      Domain allowed access.
1709 ##      </summary>
1710 ## </param>
1711 #
1712 interface(`userdom_create_user_pty',`
1713         gen_require(`
1714                 type user_devpts_t;
1715         ')
1716
1717         term_create_pty($1, user_devpts_t)
1718 ')
1719
1720 ########################################
1721 ## <summary>
1722 ##      Get the attributes of user home directories.
1723 ## </summary>
1724 ## <param name="domain">
1725 ##      <summary>
1726 ##      Domain allowed access.
1727 ##      </summary>
1728 ## </param>
1729 #
1730 interface(`userdom_getattr_user_home_dirs',`
1731         gen_require(`
1732                 type user_home_dir_t;
1733         ')
1734
1735         allow $1 user_home_dir_t:dir getattr_dir_perms;
1736         files_search_home($1)
1737 ')
1738
1739 ########################################
1740 ## <summary>
1741 ##      Do not audit attempts to get the attributes of user home directories.
1742 ## </summary>
1743 ## <param name="domain">
1744 ##      <summary>
1745 ##      Domain to not audit.
1746 ##      </summary>
1747 ## </param>
1748 #
1749 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1750         gen_require(`
1751                 type user_home_dir_t;
1752         ')
1753
1754         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1755 ')
1756
1757 ########################################
1758 ## <summary>
1759 ##      Search user home directories.
1760 ## </summary>
1761 ## <param name="domain">
1762 ##      <summary>
1763 ##      Domain allowed access.
1764 ##      </summary>
1765 ## </param>
1766 #
1767 interface(`userdom_search_user_home_dirs',`
1768         gen_require(`
1769                 type user_home_dir_t;
1770         ')
1771
1772         allow $1 user_home_dir_t:dir search_dir_perms;
1773         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1774         files_search_home($1)
1775 ')
1776
1777 ########################################
1778 ## <summary>
1779 ##      Do not audit attempts to search user home directories.
1780 ## </summary>
1781 ## <desc>
1782 ##      <p>
1783 ##      Do not audit attempts to search user home directories.
1784 ##      This will supress SELinux denial messages when the specified
1785 ##      domain is denied the permission to search these directories.
1786 ##      </p>
1787 ## </desc>
1788 ## <param name="domain">
1789 ##      <summary>
1790 ##      Domain to not audit.
1791 ##      </summary>
1792 ## </param>
1793 ## <infoflow type="none"/>
1794 #
1795 interface(`userdom_dontaudit_search_user_home_dirs',`
1796         gen_require(`
1797                 type user_home_dir_t;
1798         ')
1799
1800         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1801 ')
1802
1803 ########################################
1804 ## <summary>
1805 ##      List user home directories.
1806 ## </summary>
1807 ## <param name="domain">
1808 ##      <summary>
1809 ##      Domain allowed access.
1810 ##      </summary>
1811 ## </param>
1812 #
1813 interface(`userdom_list_user_home_dirs',`
1814         gen_require(`
1815                 type user_home_dir_t;
1816         ')
1817
1818         allow $1 user_home_dir_t:dir list_dir_perms;
1819         files_search_home($1)
1820
1821         tunable_policy(`use_nfs_home_dirs',`
1822                 fs_list_nfs($1)
1823         ')
1824
1825         tunable_policy(`use_samba_home_dirs',`
1826                 fs_list_cifs($1)
1827         ')
1828 ')
1829
1830 ########################################
1831 ## <summary>
1832 ##      Do not audit attempts to list user home subdirectories.
1833 ## </summary>
1834 ## <param name="domain">
1835 ##      <summary>
1836 ##      Domain to not audit.
1837 ##      </summary>
1838 ## </param>
1839 #
1840 interface(`userdom_dontaudit_list_user_home_dirs',`
1841         gen_require(`
1842                 type user_home_dir_t;
1843                 type user_home_t;
1844         ')
1845
1846         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1847         dontaudit $1 user_home_t:dir list_dir_perms;
1848 ')
1849
1850 ########################################
1851 ## <summary>
1852 ##      Create user home directories.
1853 ## </summary>
1854 ## <param name="domain">
1855 ##      <summary>
1856 ##      Domain allowed access.
1857 ##      </summary>
1858 ## </param>
1859 #
1860 interface(`userdom_create_user_home_dirs',`
1861         gen_require(`
1862                 type user_home_dir_t;
1863         ')
1864
1865         allow $1 user_home_dir_t:dir create_dir_perms;
1866 ')
1867
1868 ########################################
1869 ## <summary>
1870 ##      Create user home directories.
1871 ## </summary>
1872 ## <param name="domain">
1873 ##      <summary>
1874 ##      Domain allowed access.
1875 ##      </summary>
1876 ## </param>
1877 #
1878 interface(`userdom_manage_user_home_dirs',`
1879         gen_require(`
1880                 type user_home_dir_t;
1881         ')
1882
1883         allow $1 user_home_dir_t:dir manage_dir_perms;
1884 ')
1885
1886 ########################################
1887 ## <summary>
1888 ##      Relabel to user home directories.
1889 ## </summary>
1890 ## <param name="domain">
1891 ##      <summary>
1892 ##      Domain allowed access.
1893 ##      </summary>
1894 ## </param>
1895 #
1896 interface(`userdom_relabelto_user_home_dirs',`
1897         gen_require(`
1898                 type user_home_dir_t;
1899         ')
1900
1901         allow $1 user_home_dir_t:dir relabelto;
1902 ')
1903
1904
1905 ########################################
1906 ## <summary>
1907 ##      Relabel to user home files.
1908 ## </summary>
1909 ## <param name="domain">
1910 ##      <summary>
1911 ##      Domain allowed access.
1912 ##      </summary>
1913 ## </param>
1914 #
1915 interface(`userdom_relabelto_user_home_files',`
1916         gen_require(`
1917                 type user_home_t;
1918         ')
1919
1920         allow $1 user_home_t:file relabelto;
1921 ')
1922 ########################################
1923 ## <summary>
1924 ##      Relabel user home files.
1925 ## </summary>
1926 ## <param name="domain">
1927 ##      <summary>
1928 ##      Domain allowed access.
1929 ##      </summary>
1930 ## </param>
1931 #
1932 interface(`userdom_relabel_user_home_files',`
1933         gen_require(`
1934                 type user_home_t;
1935         ')
1936
1937         allow $1 user_home_t:file relabel_file_perms;
1938 ')
1939
1940 ########################################
1941 ## <summary>
1942 ##      Create directories in the home dir root with
1943 ##      the user home directory type.
1944 ## </summary>
1945 ## <param name="domain">
1946 ##      <summary>
1947 ##      Domain allowed access.
1948 ##      </summary>
1949 ## </param>
1950 #
1951 interface(`userdom_home_filetrans_user_home_dir',`
1952         gen_require(`
1953                 type user_home_dir_t;
1954         ')
1955
1956         files_home_filetrans($1, user_home_dir_t, dir)
1957 ')
1958
1959 ########################################
1960 ## <summary>
1961 ##      Do a domain transition to the specified
1962 ##      domain when executing a program in the
1963 ##      user home directory.
1964 ## </summary>
1965 ## <desc>
1966 ##      <p>
1967 ##      Do a domain transition to the specified
1968 ##      domain when executing a program in the
1969 ##      user home directory.
1970 ##      </p>
1971 ##      <p>
1972 ##      No interprocess communication (signals, pipes,
1973 ##      etc.) is provided by this interface since
1974 ##      the domains are not owned by this module.
1975 ##      </p>
1976 ## </desc>
1977 ## <param name="source_domain">
1978 ##      <summary>
1979 ##      Domain allowed to transition.
1980 ##      </summary>
1981 ## </param>
1982 ## <param name="target_domain">
1983 ##      <summary>
1984 ##      Domain to transition to.
1985 ##      </summary>
1986 ## </param>
1987 #
1988 interface(`userdom_user_home_domtrans',`
1989         gen_require(`
1990                 type user_home_dir_t, user_home_t;
1991         ')
1992
1993         domain_auto_trans($1, user_home_t, $2)
1994         allow $1 user_home_dir_t:dir search_dir_perms;
1995         files_search_home($1)
1996 ')
1997
1998 ########################################
1999 ## <summary>
2000 ##      Do not audit attempts to search user home content directories.
2001 ## </summary>
2002 ## <param name="domain">
2003 ##      <summary>
2004 ##      Domain to not audit.
2005 ##      </summary>
2006 ## </param>
2007 #
2008 interface(`userdom_dontaudit_search_user_home_content',`
2009         gen_require(`
2010                 type user_home_t;
2011         ')
2012
2013         dontaudit $1 user_home_t:dir search_dir_perms;
2014         fs_dontaudit_list_nfs($1)
2015         fs_dontaudit_list_cifs($1)
2016 ')
2017
2018 ########################################
2019 ## <summary>
2020 ##      List contents of users home directory.
2021 ## </summary>
2022 ## <param name="domain">
2023 ##      <summary>
2024 ##      Domain allowed access.
2025 ##      </summary>
2026 ## </param>
2027 #
2028 interface(`userdom_list_user_home_content',`
2029         gen_require(`
2030                 type user_home_dir_t;
2031                 attribute user_home_type;
2032         ')
2033
2034         files_list_home($1)
2035         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2036 ')
2037
2038 ########################################
2039 ## <summary>
2040 ##      Create, read, write, and delete directories
2041 ##      in a user home subdirectory.
2042 ## </summary>
2043 ## <param name="domain">
2044 ##      <summary>
2045 ##      Domain allowed access.
2046 ##      </summary>
2047 ## </param>
2048 #
2049 interface(`userdom_manage_user_home_content_dirs',`
2050         gen_require(`
2051                 type user_home_dir_t, user_home_t;
2052         ')
2053
2054         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2055         files_search_home($1)
2056 ')
2057
2058 ########################################
2059 ## <summary>
2060 ##      Delete directories in a user home subdirectory.
2061 ## </summary>
2062 ## <param name="domain">
2063 ##      <summary>
2064 ##      Domain allowed access.
2065 ##      </summary>
2066 ## </param>
2067 #
2068 interface(`userdom_delete_user_home_content_dirs',`
2069         gen_require(`
2070                 type user_home_t;
2071         ')
2072
2073         allow $1 user_home_t:dir delete_dir_perms;
2074 ')
2075
2076 ########################################
2077 ## <summary>
2078 ##      Delete all directories in a user home subdirectory.
2079 ## </summary>
2080 ## <param name="domain">
2081 ##      <summary>
2082 ##      Domain allowed access.
2083 ##      </summary>
2084 ## </param>
2085 #
2086 interface(`userdom_delete_all_user_home_content_dirs',`
2087         gen_require(`
2088                 attribute user_home_type;
2089         ')
2090
2091         allow $1 user_home_type:dir delete_dir_perms;
2092 ')
2093
2094 ########################################
2095 ## <summary>
2096 ##      Set the attributes of user home files.
2097 ## </summary>
2098 ## <param name="domain">
2099 ##      <summary>
2100 ##      Domain allowed access.
2101 ##      </summary>
2102 ## </param>
2103 ## <rolecap/>
2104 #
2105 interface(`userdom_setattr_user_home_content_files',`
2106         gen_require(`
2107                 type user_home_t;
2108         ')
2109
2110         allow $1 user_home_t:file setattr;
2111 ')
2112
2113 ########################################
2114 ## <summary>
2115 ##      Do not audit attempts to set the
2116 ##      attributes of user home files.
2117 ## </summary>
2118 ## <param name="domain">
2119 ##      <summary>
2120 ##      Domain to not audit.
2121 ##      </summary>
2122 ## </param>
2123 #
2124 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2125         gen_require(`
2126                 type user_home_t;
2127         ')
2128
2129         dontaudit $1 user_home_t:file setattr_file_perms;
2130 ')
2131
2132 ########################################
2133 ## <summary>
2134 ##      Set the attributes of all user home directories.
2135 ## </summary>
2136 ## <param name="domain">
2137 ##      <summary>
2138 ##      Domain allowed access.
2139 ##      </summary>
2140 ## </param>
2141 ## <rolecap/>
2142 #
2143 interface(`userdom_setattr_all_user_home_content_dirs',`
2144         gen_require(`
2145                 attribute user_home_type;
2146         ')
2147
2148         allow $1 user_home_type:dir setattr_dir_perms;
2149 ')
2150
2151 ########################################
2152 ## <summary>
2153 ##      Mmap user home files.
2154 ## </summary>
2155 ## <param name="domain">
2156 ##      <summary>
2157 ##      Domain allowed access.
2158 ##      </summary>
2159 ## </param>
2160 #
2161 interface(`userdom_mmap_user_home_content_files',`
2162         gen_require(`
2163                 type user_home_dir_t, user_home_t;
2164         ')
2165
2166         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2167         files_search_home($1)
2168 ')
2169
2170 ########################################
2171 ## <summary>
2172 ##      Read user home files.
2173 ## </summary>
2174 ## <param name="domain">
2175 ##      <summary>
2176 ##      Domain allowed access.
2177 ##      </summary>
2178 ## </param>
2179 #
2180 interface(`userdom_read_user_home_content_files',`
2181         gen_require(`
2182                 type user_home_dir_t, user_home_t;
2183         ')
2184
2185         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2186         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2187         files_search_home($1)
2188 ')
2189
2190 ########################################
2191 ## <summary>
2192 ##      Do not audit attempts to getattr user home files.
2193 ## </summary>
2194 ## <param name="domain">
2195 ##      <summary>
2196 ##      Domain to not audit.
2197 ##      </summary>
2198 ## </param>
2199 #
2200 interface(`userdom_dontaudit_getattr_user_home_content',`
2201         gen_require(`
2202                 attribute user_home_type;
2203         ')
2204
2205         dontaudit $1 user_home_type:dir getattr;
2206         dontaudit $1 user_home_type:file getattr;
2207 ')
2208
2209 ########################################
2210 ## <summary>
2211 ##      Do not audit attempts to read user home files.
2212 ## </summary>
2213 ## <param name="domain">
2214 ##      <summary>
2215 ##      Domain to not audit.
2216 ##      </summary>
2217 ## </param>
2218 #
2219 interface(`userdom_dontaudit_read_user_home_content_files',`
2220         gen_require(`
2221                 attribute user_home_type;
2222                 type user_home_dir_t;
2223         ')
2224
2225         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2226         dontaudit $1 user_home_type:dir list_dir_perms;
2227         dontaudit $1 user_home_type:file read_file_perms;
2228         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2229 ')
2230
2231 ########################################
2232 ## <summary>
2233 ##      Do not audit attempts to append user home files.
2234 ## </summary>
2235 ## <param name="domain">
2236 ##      <summary>
2237 ##      Domain to not audit.
2238 ##      </summary>
2239 ## </param>
2240 #
2241 interface(`userdom_dontaudit_append_user_home_content_files',`
2242         gen_require(`
2243                 type user_home_t;
2244         ')
2245
2246         dontaudit $1 user_home_t:file append_file_perms;
2247 ')
2248
2249 ########################################
2250 ## <summary>
2251 ##      Do not audit attempts to write user home files.
2252 ## </summary>
2253 ## <param name="domain">
2254 ##      <summary>
2255 ##      Domain to not audit.
2256 ##      </summary>
2257 ## </param>
2258 #
2259 interface(`userdom_dontaudit_write_user_home_content_files',`
2260         gen_require(`
2261                 type user_home_t;
2262         ')
2263
2264         dontaudit $1 user_home_t:file write_file_perms;
2265 ')
2266
2267 ########################################
2268 ## <summary>
2269 ##      Delete files in a user home subdirectory.
2270 ## </summary>
2271 ## <param name="domain">
2272 ##      <summary>
2273 ##      Domain allowed access.
2274 ##      </summary>
2275 ## </param>
2276 #
2277 interface(`userdom_delete_user_home_content_files',`
2278         gen_require(`
2279                 type user_home_t;
2280         ')
2281
2282         allow $1 user_home_t:file delete_file_perms;
2283 ')
2284
2285 ########################################
2286 ## <summary>
2287 ##      Delete all files in a user home subdirectory.
2288 ## </summary>
2289 ## <param name="domain">
2290 ##      <summary>
2291 ##      Domain allowed access.
2292 ##      </summary>
2293 ## </param>
2294 #
2295 interface(`userdom_delete_all_user_home_content_files',`
2296         gen_require(`
2297                 attribute user_home_type;
2298         ')
2299
2300         allow $1 user_home_type:file delete_file_perms;
2301 ')
2302
2303 ########################################
2304 ## <summary>
2305 ##      Delete sock files in a user home subdirectory.
2306 ## </summary>
2307 ## <param name="domain">
2308 ##      <summary>
2309 ##      Domain allowed access.
2310 ##      </summary>
2311 ## </param>
2312 #
2313 interface(`userdom_delete_user_home_content_sock_files',`
2314         gen_require(`
2315                 type user_home_t;
2316         ')
2317
2318         allow $1 user_home_t:sock_file delete_file_perms;
2319 ')
2320
2321 ########################################
2322 ## <summary>
2323 ##      Delete all sock files in a user home subdirectory.
2324 ## </summary>
2325 ## <param name="domain">
2326 ##      <summary>
2327 ##      Domain allowed access.
2328 ##      </summary>
2329 ## </param>
2330 #
2331 interface(`userdom_delete_all_user_home_content_sock_files',`
2332         gen_require(`
2333                 attribute user_home_type;
2334         ')
2335
2336         allow $1 user_home_type:sock_file delete_file_perms;
2337 ')
2338
2339 ########################################
2340 ## <summary>
2341 ##      Do not audit attempts to write user home files.
2342 ## </summary>
2343 ## <param name="domain">
2344 ##      <summary>
2345 ##      Domain to not audit.
2346 ##      </summary>
2347 ## </param>
2348 #
2349 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2350         gen_require(`
2351                 type user_home_t;
2352         ')
2353
2354         dontaudit $1 user_home_t:file relabel_file_perms;
2355 ')
2356
2357 ########################################
2358 ## <summary>
2359 ##      Read user home subdirectory symbolic links.
2360 ## </summary>
2361 ## <param name="domain">
2362 ##      <summary>
2363 ##      Domain allowed access.
2364 ##      </summary>
2365 ## </param>
2366 #
2367 interface(`userdom_read_user_home_content_symlinks',`
2368         gen_require(`
2369                 type user_home_dir_t, user_home_t;
2370         ')
2371
2372         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2373 ')
2374
2375 ########################################
2376 ## <summary>
2377 ##      Execute user home files.
2378 ## </summary>
2379 ## <param name="domain">
2380 ##      <summary>
2381 ##      Domain allowed access.
2382 ##      </summary>
2383 ## </param>
2384 ## <rolecap/>
2385 #
2386 interface(`userdom_exec_user_home_content_files',`
2387         gen_require(`
2388                 type user_home_dir_t;
2389                 attribute user_home_type;
2390         ')
2391
2392         files_search_home($1)
2393         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2394         dontaudit $1 user_home_type:sock_file execute;
2395         ')
2396
2397 ########################################
2398 ## <summary>
2399 ##      Do not audit attempts to execute user home files.
2400 ## </summary>
2401 ## <param name="domain">
2402 ##      <summary>
2403 ##      Domain to not audit.
2404 ##      </summary>
2405 ## </param>
2406 #
2407 interface(`userdom_dontaudit_exec_user_home_content_files',`
2408         gen_require(`
2409                 type user_home_t;
2410         ')
2411
2412         dontaudit $1 user_home_t:file exec_file_perms;
2413 ')
2414
2415 ########################################
2416 ## <summary>
2417 ##      Create, read, write, and delete files
2418 ##      in a user home subdirectory.
2419 ## </summary>
2420 ## <param name="domain">
2421 ##      <summary>
2422 ##      Domain allowed access.
2423 ##      </summary>
2424 ## </param>
2425 #
2426 interface(`userdom_manage_user_home_content_files',`
2427         gen_require(`
2428                 type user_home_dir_t, user_home_t;
2429         ')
2430
2431         manage_files_pattern($1, user_home_t, user_home_t)
2432         allow $1 user_home_dir_t:dir search_dir_perms;
2433         files_search_home($1)
2434 ')
2435
2436 ########################################
2437 ## <summary>
2438 ##      Do not audit attempts to create, read, write, and delete directories
2439 ##      in a user home subdirectory.
2440 ## </summary>
2441 ## <param name="domain">
2442 ##      <summary>
2443 ##      Domain to not audit.
2444 ##      </summary>
2445 ## </param>
2446 #
2447 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2448         gen_require(`
2449                 type user_home_dir_t, user_home_t;
2450         ')
2451
2452         dontaudit $1 user_home_t:dir manage_dir_perms;
2453 ')
2454
2455 ########################################
2456 ## <summary>
2457 ##      Create, read, write, and delete symbolic links
2458 ##      in a user home subdirectory.
2459 ## </summary>
2460 ## <param name="domain">
2461 ##      <summary>
2462 ##      Domain allowed access.
2463 ##      </summary>
2464 ## </param>
2465 #
2466 interface(`userdom_manage_user_home_content_symlinks',`
2467         gen_require(`
2468                 type user_home_dir_t, user_home_t;
2469         ')
2470
2471         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2472         allow $1 user_home_dir_t:dir search_dir_perms;
2473         files_search_home($1)
2474 ')
2475
2476 ########################################
2477 ## <summary>
2478 ##      Delete symbolic links in a user home directory.
2479 ## </summary>
2480 ## <param name="domain">
2481 ##      <summary>
2482 ##      Domain allowed access.
2483 ##      </summary>
2484 ## </param>
2485 #
2486 interface(`userdom_delete_user_home_content_symlinks',`
2487         gen_require(`
2488                 type user_home_t;
2489         ')
2490
2491         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2492 ')
2493
2494 ########################################
2495 ## <summary>
2496 ##      Delete all symbolic links in a user home directory.
2497 ## </summary>
2498 ## <param name="domain">
2499 ##      <summary>
2500 ##      Domain allowed access.
2501 ##      </summary>
2502 ## </param>
2503 #
2504 interface(`userdom_delete_all_user_home_content_symlinks',`
2505         gen_require(`
2506                 attribute user_home_type;
2507         ')
2508
2509         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2510 ')
2511
2512 ########################################
2513 ## <summary>
2514 ##      Create, read, write, and delete named pipes
2515 ##      in a user home subdirectory.
2516 ## </summary>
2517 ## <param name="domain">
2518 ##      <summary>
2519 ##      Domain allowed access.
2520 ##      </summary>
2521 ## </param>
2522 #
2523 interface(`userdom_manage_user_home_content_pipes',`
2524         gen_require(`
2525                 type user_home_dir_t, user_home_t;
2526         ')
2527
2528         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2529         allow $1 user_home_dir_t:dir search_dir_perms;
2530         files_search_home($1)
2531 ')
2532
2533 ########################################
2534 ## <summary>
2535 ##      Create, read, write, and delete named sockets
2536 ##      in a user home subdirectory.
2537 ## </summary>
2538 ## <param name="domain">
2539 ##      <summary>
2540 ##      Domain allowed access.
2541 ##      </summary>
2542 ## </param>
2543 #
2544 interface(`userdom_manage_user_home_content_sockets',`
2545         gen_require(`
2546                 type user_home_dir_t, user_home_t;
2547         ')
2548
2549         allow $1 user_home_dir_t:dir search_dir_perms;
2550         manage_sock_files_pattern($1, user_home_t, user_home_t)
2551         files_search_home($1)
2552 ')
2553
2554 ########################################
2555 ## <summary>
2556 ##      Create objects in a user home directory
2557 ##      with an automatic type transition to
2558 ##      a specified private type.
2559 ## </summary>
2560 ## <param name="domain">
2561 ##      <summary>
2562 ##      Domain allowed access.
2563 ##      </summary>
2564 ## </param>
2565 ## <param name="private_type">
2566 ##      <summary>
2567 ##      The type of the object to create.
2568 ##      </summary>
2569 ## </param>
2570 ## <param name="object_class">
2571 ##      <summary>
2572 ##      The class of the object to be created.
2573 ##      </summary>
2574 ## </param>
2575 #
2576 interface(`userdom_user_home_dir_filetrans',`
2577         gen_require(`
2578                 type user_home_dir_t;
2579         ')
2580
2581         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2582         files_search_home($1)
2583 ')
2584
2585 ########################################
2586 ## <summary>
2587 ##      Create objects in a user home directory
2588 ##      with an automatic type transition to
2589 ##      a specified private type.
2590 ## </summary>
2591 ## <param name="domain">
2592 ##      <summary>
2593 ##      Domain allowed access.
2594 ##      </summary>
2595 ## </param>
2596 ## <param name="private_type">
2597 ##      <summary>
2598 ##      The type of the object to create.
2599 ##      </summary>
2600 ## </param>
2601 ## <param name="object_class">
2602 ##      <summary>
2603 ##      The class of the object to be created.
2604 ##      </summary>
2605 ## </param>
2606 #
2607 interface(`userdom_user_home_content_filetrans',`
2608         gen_require(`
2609                 type user_home_dir_t, user_home_t;
2610         ')
2611
2612         filetrans_pattern($1, user_home_t, $2, $3, $4)
2613         allow $1 user_home_dir_t:dir search_dir_perms;
2614         files_search_home($1)
2615 ')
2616
2617 ########################################
2618 ## <summary>
2619 ##      Create objects in a user home directory
2620 ##      with an automatic type transition to
2621 ##      the user home file type.
2622 ## </summary>
2623 ## <param name="domain">
2624 ##      <summary>
2625 ##      Domain allowed access.
2626 ##      </summary>
2627 ## </param>
2628 ## <param name="object_class">
2629 ##      <summary>
2630 ##      The class of the object to be created.
2631 ##      </summary>
2632 ## </param>
2633 #
2634 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2635         gen_require(`
2636                 type user_home_dir_t, user_home_t;
2637         ')
2638
2639         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2640         files_search_home($1)
2641 ')
2642
2643 ########################################
2644 ## <summary>
2645 ##      Write to user temporary named sockets.
2646 ## </summary>
2647 ## <param name="domain">
2648 ##      <summary>
2649 ##      Domain allowed access.
2650 ##      </summary>
2651 ## </param>
2652 #
2653 interface(`userdom_write_user_tmp_sockets',`
2654         gen_require(`
2655                 type user_tmp_t;
2656         ')
2657
2658         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2659         files_search_tmp($1)
2660 ')
2661
2662 ########################################
2663 ## <summary>
2664 ##      List user temporary directories.
2665 ## </summary>
2666 ## <param name="domain">
2667 ##      <summary>
2668 ##      Domain allowed access.
2669 ##      </summary>
2670 ## </param>
2671 #
2672 interface(`userdom_list_user_tmp',`
2673         gen_require(`
2674                 type user_tmp_t;
2675         ')
2676
2677         allow $1 user_tmp_t:dir list_dir_perms;
2678         files_search_tmp($1)
2679 ')
2680
2681 ########################################
2682 ## <summary>
2683 ##      Do not audit attempts to list user
2684 ##      temporary directories.
2685 ## </summary>
2686 ## <param name="domain">
2687 ##      <summary>
2688 ##      Domain to not audit.
2689 ##      </summary>
2690 ## </param>
2691 #
2692 interface(`userdom_dontaudit_list_user_tmp',`
2693         gen_require(`
2694                 type user_tmp_t;
2695         ')
2696
2697         dontaudit $1 user_tmp_t:dir list_dir_perms;
2698 ')
2699
2700 ########################################
2701 ## <summary>
2702 ##      Do not audit attempts to manage users
2703 ##      temporary directories.
2704 ## </summary>
2705 ## <param name="domain">
2706 ##      <summary>
2707 ##      Domain to not audit.
2708 ##      </summary>
2709 ## </param>
2710 #
2711 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2712         gen_require(`
2713                 type user_tmp_t;
2714         ')
2715
2716         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2717 ')
2718
2719 ########################################
2720 ## <summary>
2721 ##      Read user temporary files.
2722 ## </summary>
2723 ## <param name="domain">
2724 ##      <summary>
2725 ##      Domain allowed access.
2726 ##      </summary>
2727 ## </param>
2728 #
2729 interface(`userdom_read_user_tmp_files',`
2730         gen_require(`
2731                 type user_tmp_t;
2732         ')
2733
2734         read_files_pattern($1, user_tmp_t, user_tmp_t)
2735         allow $1 user_tmp_t:dir list_dir_perms;
2736         files_search_tmp($1)
2737 ')
2738
2739 ########################################
2740 ## <summary>
2741 ##      Do not audit attempts to read users
2742 ##      temporary files.
2743 ## </summary>
2744 ## <param name="domain">
2745 ##      <summary>
2746 ##      Domain to not audit.
2747 ##      </summary>
2748 ## </param>
2749 #
2750 interface(`userdom_dontaudit_read_user_tmp_files',`
2751         gen_require(`
2752                 type user_tmp_t;
2753         ')
2754
2755         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2756 ')
2757
2758 ########################################
2759 ## <summary>
2760 ##      Do not audit attempts to append users
2761 ##      temporary files.
2762 ## </summary>
2763 ## <param name="domain">
2764 ##      <summary>
2765 ##      Domain to not audit.
2766 ##      </summary>
2767 ## </param>
2768 #
2769 interface(`userdom_dontaudit_append_user_tmp_files',`
2770         gen_require(`
2771                 type user_tmp_t;
2772         ')
2773
2774         dontaudit $1 user_tmp_t:file append_file_perms;
2775 ')
2776
2777 ########################################
2778 ## <summary>
2779 ##      Read and write user temporary files.
2780 ## </summary>
2781 ## <param name="domain">
2782 ##      <summary>
2783 ##      Domain allowed access.
2784 ##      </summary>
2785 ## </param>
2786 #
2787 interface(`userdom_rw_user_tmp_files',`
2788         gen_require(`
2789                 type user_tmp_t;
2790         ')
2791
2792         allow $1 user_tmp_t:dir list_dir_perms;
2793         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2794         files_search_tmp($1)
2795 ')
2796
2797 ########################################
2798 ## <summary>
2799 ##      Do not audit attempts to manage users
2800 ##      temporary files.
2801 ## </summary>
2802 ## <param name="domain">
2803 ##      <summary>
2804 ##      Domain to not audit.
2805 ##      </summary>
2806 ## </param>
2807 #
2808 interface(`userdom_dontaudit_manage_user_tmp_files',`
2809         gen_require(`
2810                 type user_tmp_t;
2811         ')
2812
2813         dontaudit $1 user_tmp_t:file manage_file_perms;
2814 ')
2815
2816 ########################################
2817 ## <summary>
2818 ##      Read user temporary symbolic links.
2819 ## </summary>
2820 ## <param name="domain">
2821 ##      <summary>
2822 ##      Domain allowed access.
2823 ##      </summary>
2824 ## </param>
2825 #
2826 interface(`userdom_read_user_tmp_symlinks',`
2827         gen_require(`
2828                 type user_tmp_t;
2829         ')
2830
2831         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2832         allow $1 user_tmp_t:dir list_dir_perms;
2833         files_search_tmp($1)
2834 ')
2835
2836 ########################################
2837 ## <summary>
2838 ##      Create, read, write, and delete user
2839 ##      temporary directories.
2840 ## </summary>
2841 ## <param name="domain">
2842 ##      <summary>
2843 ##      Domain allowed access.
2844 ##      </summary>
2845 ## </param>
2846 #
2847 interface(`userdom_manage_user_tmp_dirs',`
2848         gen_require(`
2849                 type user_tmp_t;
2850         ')
2851
2852         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2853         files_search_tmp($1)
2854 ')
2855
2856 ########################################
2857 ## <summary>
2858 ##      Create, read, write, and delete user
2859 ##      temporary files.
2860 ## </summary>
2861 ## <param name="domain">
2862 ##      <summary>
2863 ##      Domain allowed access.
2864 ##      </summary>
2865 ## </param>
2866 #
2867 interface(`userdom_manage_user_tmp_files',`
2868         gen_require(`
2869                 type user_tmp_t;
2870         ')
2871
2872         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2873         files_search_tmp($1)
2874 ')
2875
2876 ########################################
2877 ## <summary>
2878 ##      Create, read, write, and delete user
2879 ##      temporary symbolic links.
2880 ## </summary>
2881 ## <param name="domain">
2882 ##      <summary>
2883 ##      Domain allowed access.
2884 ##      </summary>
2885 ## </param>
2886 #
2887 interface(`userdom_manage_user_tmp_symlinks',`
2888         gen_require(`
2889                 type user_tmp_t;
2890         ')
2891
2892         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2893         files_search_tmp($1)
2894 ')
2895
2896 ########################################
2897 ## <summary>
2898 ##      Create, read, write, and delete user
2899 ##      temporary named pipes.
2900 ## </summary>
2901 ## <param name="domain">
2902 ##      <summary>
2903 ##      Domain allowed access.
2904 ##      </summary>
2905 ## </param>
2906 #
2907 interface(`userdom_manage_user_tmp_pipes',`
2908         gen_require(`
2909                 type user_tmp_t;
2910         ')
2911
2912         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2913         files_search_tmp($1)
2914 ')
2915
2916 ########################################
2917 ## <summary>
2918 ##      Create, read, write, and delete user
2919 ##      temporary named sockets.
2920 ## </summary>
2921 ## <param name="domain">
2922 ##      <summary>
2923 ##      Domain allowed access.
2924 ##      </summary>
2925 ## </param>
2926 #
2927 interface(`userdom_manage_user_tmp_sockets',`
2928         gen_require(`
2929                 type user_tmp_t;
2930         ')
2931
2932         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2933         files_search_tmp($1)
2934 ')
2935
2936 ########################################
2937 ## <summary>
2938 ##      Create objects in a user temporary directory
2939 ##      with an automatic type transition to
2940 ##      a specified private type.
2941 ## </summary>
2942 ## <param name="domain">
2943 ##      <summary>
2944 ##      Domain allowed access.
2945 ##      </summary>
2946 ## </param>
2947 ## <param name="private_type">
2948 ##      <summary>
2949 ##      The type of the object to create.
2950 ##      </summary>
2951 ## </param>
2952 ## <param name="object_class">
2953 ##      <summary>
2954 ##      The class of the object to be created.
2955 ##      </summary>
2956 ## </param>
2957 #
2958 interface(`userdom_user_tmp_filetrans',`
2959         gen_require(`
2960                 type user_tmp_t;
2961         ')
2962
2963         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2964         files_search_tmp($1)
2965 ')
2966
2967 ########################################
2968 ## <summary>
2969 ##      Create objects in the temporary directory
2970 ##      with an automatic type transition to
2971 ##      the user temporary type.
2972 ## </summary>
2973 ## <param name="domain">
2974 ##      <summary>
2975 ##      Domain allowed access.
2976 ##      </summary>
2977 ## </param>
2978 ## <param name="object_class">
2979 ##      <summary>
2980 ##      The class of the object to be created.
2981 ##      </summary>
2982 ## </param>
2983 #
2984 interface(`userdom_tmp_filetrans_user_tmp',`
2985         gen_require(`
2986                 type user_tmp_t;
2987         ')
2988
2989         files_tmp_filetrans($1, user_tmp_t, $2)
2990 ')
2991
2992 #######################################
2993 ## <summary>
2994 ##  Getattr user tmpfs files.
2995 ## </summary>
2996 ## <param name="domain">
2997 ##  <summary>
2998 ##  Domain allowed access.
2999 ##  </summary>
3000 ## </param>
3001 #
3002 interface(`userdom_getattr_user_tmpfs_files',`
3003     gen_require(`
3004         type user_tmpfs_t;
3005     ')
3006
3007     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3008     fs_search_tmpfs($1)
3009 ')
3010
3011 ########################################
3012 ## <summary>
3013 ##      Read user tmpfs files.
3014 ## </summary>
3015 ## <param name="domain">
3016 ##      <summary>
3017 ##      Domain allowed access.
3018 ##      </summary>
3019 ## </param>
3020 #
3021 interface(`userdom_read_user_tmpfs_files',`
3022         gen_require(`
3023                 type user_tmpfs_t;
3024         ')
3025
3026         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3027         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3028         allow $1 user_tmpfs_t:dir list_dir_perms;
3029         fs_search_tmpfs($1)
3030 ')
3031
3032 ########################################
3033 ## <summary>
3034 ##      Read/Write user tmpfs files.
3035 ## </summary>
3036 ## <param name="domain">
3037 ##      <summary>
3038 ##      Domain allowed access.
3039 ##      </summary>
3040 ## </param>
3041 #
3042 interface(`userdom_rw_user_tmpfs_files',`
3043         gen_require(`
3044                 type user_tmpfs_t;
3045         ')
3046
3047         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3048         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3049         allow $1 user_tmpfs_t:dir list_dir_perms;
3050         fs_search_tmpfs($1)
3051 ')
3052
3053 ########################################
3054 ## <summary>
3055 ##      Read/Write inherited user tmpfs files.
3056 ## </summary>
3057 ## <param name="domain">
3058 ##      <summary>
3059 ##      Domain allowed access.
3060 ##      </summary>
3061 ## </param>
3062 #
3063 interface(`userdom_rw_inherited_user_tmpfs_files',`
3064         gen_require(`
3065                 type user_tmpfs_t;
3066         ')
3067
3068         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3069 ')
3070
3071 ########################################
3072 ## <summary>
3073 ##      Execute user tmpfs files.
3074 ## </summary>
3075 ## <param name="domain">
3076 ##      <summary>
3077 ##      Domain allowed access.
3078 ##      </summary>
3079 ## </param>
3080 #
3081 interface(`userdom_execute_user_tmpfs_files',`
3082         gen_require(`
3083                 type user_tmpfs_t;
3084         ')
3085
3086         allow $1 user_tmpfs_t:file execute;
3087 ')
3088
3089 ########################################
3090 ## <summary>
3091 ##      Get the attributes of a user domain tty.
3092 ## </summary>
3093 ## <param name="domain">
3094 ##      <summary>
3095 ##      Domain allowed access.
3096 ##      </summary>
3097 ## </param>
3098 #
3099 interface(`userdom_getattr_user_ttys',`
3100         gen_require(`
3101                 type user_tty_device_t;
3102         ')
3103
3104         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3105 ')
3106
3107 ########################################
3108 ## <summary>
3109 ##      Do not audit attempts to get the attributes of a user domain tty.
3110 ## </summary>
3111 ## <param name="domain">
3112 ##      <summary>
3113 ##      Domain to not audit.
3114 ##      </summary>
3115 ## </param>
3116 #
3117 interface(`userdom_dontaudit_getattr_user_ttys',`
3118         gen_require(`
3119                 type user_tty_device_t;
3120         ')
3121
3122         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3123 ')
3124
3125 ########################################
3126 ## <summary>
3127 ##      Set the attributes of a user domain tty.
3128 ## </summary>
3129 ## <param name="domain">
3130 ##      <summary>
3131 ##      Domain allowed access.
3132 ##      </summary>
3133 ## </param>
3134 #
3135 interface(`userdom_setattr_user_ttys',`
3136         gen_require(`
3137                 type user_tty_device_t;
3138         ')
3139
3140         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3141 ')
3142
3143 ########################################
3144 ## <summary>
3145 ##      Do not audit attempts to set the attributes of a user domain tty.
3146 ## </summary>
3147 ## <param name="domain">
3148 ##      <summary>
3149 ##      Domain to not audit.
3150 ##      </summary>
3151 ## </param>
3152 #
3153 interface(`userdom_dontaudit_setattr_user_ttys',`
3154         gen_require(`
3155                 type user_tty_device_t;
3156         ')
3157
3158         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3159 ')
3160
3161 ########################################
3162 ## <summary>
3163 ##      Read and write a user domain tty.
3164 ## </summary>
3165 ## <param name="domain">
3166 ##      <summary>
3167 ##      Domain allowed access.
3168 ##      </summary>
3169 ## </param>
3170 #
3171 interface(`userdom_use_user_ttys',`
3172         gen_require(`
3173                 type user_tty_device_t;
3174         ')
3175
3176         allow $1 user_tty_device_t:chr_file rw_term_perms;
3177 ')
3178
3179 ########################################
3180 ## <summary>
3181 ##      Read and write a inherited user domain tty.
3182 ## </summary>
3183 ## <param name="domain">
3184 ##      <summary>
3185 ##      Domain allowed access.
3186 ##      </summary>
3187 ## </param>
3188 #
3189 interface(`userdom_use_inherited_user_ttys',`
3190         gen_require(`
3191                 type user_tty_device_t;
3192         ')
3193
3194         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3195 ')
3196
3197 ########################################
3198 ## <summary>
3199 ##      Read and write a user domain pty.
3200 ## </summary>
3201 ## <param name="domain">
3202 ##      <summary>
3203 ##      Domain allowed access.
3204 ##      </summary>
3205 ## </param>
3206 #
3207 interface(`userdom_use_user_ptys',`
3208         gen_require(`
3209                 type user_devpts_t;
3210         ')
3211
3212         allow $1 user_devpts_t:chr_file rw_term_perms;
3213 ')
3214
3215 ########################################
3216 ## <summary>
3217 ##      Read and write a inherited user domain pty.
3218 ## </summary>
3219 ## <param name="domain">
3220 ##      <summary>
3221 ##      Domain allowed access.
3222 ##      </summary>
3223 ## </param>
3224 #
3225 interface(`userdom_use_inherited_user_ptys',`
3226         gen_require(`
3227                 type user_devpts_t;
3228         ')
3229
3230         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3231 ')
3232
3233 ########################################
3234 ## <summary>
3235 ##      Read and write a inherited user TTYs and PTYs.
3236 ## </summary>
3237 ## <desc>
3238 ##      <p>
3239 ##      Allow the specified domain to read and write inherited user
3240 ##      TTYs and PTYs. This will allow the domain to
3241 ##      interact with the user via the terminal. Typically
3242 ##      all interactive applications will require this
3243 ##      access.
3244 ##      </p>
3245 ## </desc>
3246 ## <param name="domain">
3247 ##      <summary>
3248 ##      Domain allowed access.
3249 ##      </summary>
3250 ## </param>
3251 ## <infoflow type="both" weight="10"/>
3252 #
3253 interface(`userdom_use_inherited_user_terminals',`
3254         gen_require(`
3255                 type user_tty_device_t, user_devpts_t;
3256         ')
3257
3258         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3259         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3260 ')
3261
3262 #######################################
3263 ## <summary>
3264 ##  Allow attempts to read and write
3265 ##  a user domain tty and pty.
3266 ## </summary>
3267 ## <param name="domain">
3268 ##  <summary>
3269 ##  Domain to not audit.
3270 ##  </summary>
3271 ## </param>
3272 #
3273 interface(`userdom_use_user_terminals',`
3274     gen_require(`
3275         type user_tty_device_t, user_devpts_t;
3276     ')
3277
3278     allow $1 user_tty_device_t:chr_file rw_term_perms;
3279     allow $1 user_devpts_t:chr_file rw_term_perms;
3280 ')
3281
3282 ########################################
3283 ## <summary>
3284 ##      Do not audit attempts to read and write
3285 ##      a user domain tty and pty.
3286 ## </summary>
3287 ## <param name="domain">
3288 ##      <summary>
3289 ##      Domain to not audit.
3290 ##      </summary>
3291 ## </param>
3292 #
3293 interface(`userdom_dontaudit_use_user_terminals',`
3294         gen_require(`
3295                 type user_tty_device_t, user_devpts_t;
3296         ')
3297
3298         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3299         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3300 ')
3301
3302
3303 ########################################
3304 ## <summary>
3305 ##      Get attributes of user domain tty and pty.
3306 ## </summary>
3307 ## <param name="domain">
3308 ##      <summary>
3309 ##      Domain allowed access.
3310 ##      </summary>
3311 ## </param>
3312 #
3313 interface(`userdom_getattr_user_terminals',`
3314         gen_require(`
3315                 type user_tty_device_t, user_devpts_t;
3316         ')
3317
3318         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3319 ')
3320
3321 ########################################
3322 ## <summary>
3323 ##      Execute a shell in all user domains.  This
3324 ##      is an explicit transition, requiring the
3325 ##      caller to use setexeccon().
3326 ## </summary>
3327 ## <param name="domain">
3328 ##      <summary>
3329 ##      Domain allowed to transition.
3330 ##      </summary>
3331 ## </param>
3332 #
3333 interface(`userdom_spec_domtrans_all_users',`
3334         gen_require(`
3335                 attribute userdomain;
3336         ')
3337
3338         corecmd_shell_spec_domtrans($1, userdomain)
3339         allow userdomain $1:fd use;
3340         allow userdomain $1:fifo_file rw_file_perms;
3341         allow userdomain $1:process sigchld;
3342 ')
3343
3344 ########################################
3345 ## <summary>
3346 ##      Execute an Xserver session in all unprivileged user domains.  This
3347 ##      is an explicit transition, requiring the
3348 ##      caller to use setexeccon().
3349 ## </summary>
3350 ## <param name="domain">
3351 ##      <summary>
3352 ##      Domain allowed to transition.
3353 ##      </summary>
3354 ## </param>
3355 #
3356 interface(`userdom_xsession_spec_domtrans_all_users',`
3357         gen_require(`
3358                 attribute userdomain;
3359         ')
3360
3361         xserver_xsession_spec_domtrans($1, userdomain)
3362         allow userdomain $1:fd use;
3363         allow userdomain $1:fifo_file rw_file_perms;
3364         allow userdomain $1:process sigchld;
3365 ')
3366
3367 ########################################
3368 ## <summary>
3369 ##      Execute a shell in all unprivileged user domains.  This
3370 ##      is an explicit transition, requiring the
3371 ##      caller to use setexeccon().
3372 ## </summary>
3373 ## <param name="domain">
3374 ##      <summary>
3375 ##      Domain allowed to transition.
3376 ##      </summary>
3377 ## </param>
3378 #
3379 interface(`userdom_spec_domtrans_unpriv_users',`
3380         gen_require(`
3381                 attribute unpriv_userdomain;
3382         ')
3383
3384         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3385         allow unpriv_userdomain $1:fd use;
3386         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3387         allow unpriv_userdomain $1:process sigchld;
3388 ')
3389
3390 #####################################
3391 ## <summary>
3392 ##  Allow domain dyntrans to unpriv userdomain.
3393 ## </summary>
3394 ## <param name="domain">
3395 ##  <summary>
3396 ##  Domain allowed access.
3397 ##  </summary>
3398 ## </param>
3399 #
3400 interface(`userdom_dyntransition_unpriv_users',`
3401     gen_require(`
3402         attribute unpriv_userdomain;
3403     ')
3404
3405     allow $1 unpriv_userdomain:process dyntransition;
3406 ')
3407
3408 ########################################
3409 ## <summary>
3410 ##      Execute an Xserver session in all unprivileged user domains.  This
3411 ##      is an explicit transition, requiring the
3412 ##      caller to use setexeccon().
3413 ## </summary>
3414 ## <param name="domain">
3415 ##      <summary>
3416 ##      Domain allowed to transition.
3417 ##      </summary>
3418 ## </param>
3419 #
3420 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3421         gen_require(`
3422                 attribute unpriv_userdomain;
3423         ')
3424
3425         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3426         allow unpriv_userdomain $1:fd use;
3427         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3428         allow unpriv_userdomain $1:process sigchld;
3429 ')
3430
3431 ########################################
3432 ## <summary>
3433 ##      Manage unpriviledged user SysV sempaphores.
3434 ## </summary>
3435 ## <param name="domain">
3436 ##      <summary>
3437 ##      Domain allowed access.
3438 ##      </summary>
3439 ## </param>
3440 #
3441 interface(`userdom_manage_unpriv_user_semaphores',`
3442         gen_require(`
3443                 attribute unpriv_userdomain;
3444         ')
3445
3446         allow $1 unpriv_userdomain:sem create_sem_perms;
3447 ')
3448
3449 ########################################
3450 ## <summary>
3451 ##      Manage unpriviledged user SysV shared
3452 ##      memory segments.
3453 ## </summary>
3454 ## <param name="domain">
3455 ##      <summary>
3456 ##      Domain allowed access.
3457 ##      </summary>
3458 ## </param>
3459 #
3460 interface(`userdom_manage_unpriv_user_shared_mem',`
3461         gen_require(`
3462                 attribute unpriv_userdomain;
3463         ')
3464
3465         allow $1 unpriv_userdomain:shm create_shm_perms;
3466 ')
3467
3468 ########################################
3469 ## <summary>
3470 ##      Execute bin_t in the unprivileged user domains. This
3471 ##      is an explicit transition, requiring the
3472 ##      caller to use setexeccon().
3473 ## </summary>
3474 ## <param name="domain">
3475 ##      <summary>
3476 ##      Domain allowed to transition.
3477 ##      </summary>
3478 ## </param>
3479 #
3480 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3481         gen_require(`
3482                 attribute unpriv_userdomain;
3483         ')
3484
3485         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3486         allow unpriv_userdomain $1:fd use;
3487         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3488         allow unpriv_userdomain $1:process sigchld;
3489 ')
3490
3491 ########################################
3492 ## <summary>
3493 ##      Execute all entrypoint files in unprivileged user
3494 ##      domains. This is an explicit transition, requiring the
3495 ##      caller to use setexeccon().
3496 ## </summary>
3497 ## <param name="domain">
3498 ##      <summary>
3499 ##      Domain allowed access.
3500 ##      </summary>
3501 ## </param>
3502 #
3503 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3504         gen_require(`
3505                 attribute unpriv_userdomain;
3506         ')
3507
3508         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3509         allow unpriv_userdomain $1:fd use;
3510         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3511         allow unpriv_userdomain $1:process sigchld;
3512 ')
3513
3514 ########################################
3515 ## <summary>
3516 ##      Search users home directories.
3517 ## </summary>
3518 ## <param name="domain">
3519 ##      <summary>
3520 ##      Domain allowed access.
3521 ##      </summary>
3522 ## </param>
3523 #
3524 interface(`userdom_search_user_home_content',`
3525         gen_require(`
3526                 type user_home_dir_t;
3527                 attribute user_home_type;
3528         ')
3529
3530         files_list_home($1)
3531         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3532         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3533 ')
3534
3535 ########################################
3536 ## <summary>
3537 ##      Send general signals to unprivileged user domains.
3538 ## </summary>
3539 ## <param name="domain">
3540 ##      <summary>
3541 ##      Domain allowed access.
3542 ##      </summary>
3543 ## </param>
3544 #
3545 interface(`userdom_signal_unpriv_users',`
3546         gen_require(`
3547                 attribute unpriv_userdomain;
3548         ')
3549
3550         allow $1 unpriv_userdomain:process signal;
3551 ')
3552
3553 ########################################
3554 ## <summary>
3555 ##      Inherit the file descriptors from unprivileged user domains.
3556 ## </summary>
3557 ## <param name="domain">
3558 ##      <summary>
3559 ##      Domain allowed access.
3560 ##      </summary>
3561 ## </param>
3562 #
3563 interface(`userdom_use_unpriv_users_fds',`
3564         gen_require(`
3565                 attribute unpriv_userdomain;
3566         ')
3567
3568         allow $1 unpriv_userdomain:fd use;
3569 ')
3570
3571 ########################################
3572 ## <summary>
3573 ##      Do not audit attempts to inherit the file descriptors
3574 ##      from unprivileged user domains.
3575 ## </summary>
3576 ## <desc>
3577 ##      <p>
3578 ##      Do not audit attempts to inherit the file descriptors
3579 ##      from unprivileged user domains. This will supress
3580 ##      SELinux denial messages when the specified domain is denied
3581 ##      the permission to inherit these file descriptors.
3582 ##      </p>
3583 ## </desc>
3584 ## <param name="domain">
3585 ##      <summary>
3586 ##      Domain to not audit.
3587 ##      </summary>
3588 ## </param>
3589 ## <infoflow type="none"/>
3590 #
3591 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3592         gen_require(`
3593                 attribute unpriv_userdomain;
3594         ')
3595
3596         dontaudit $1 unpriv_userdomain:fd use;
3597 ')
3598
3599 ########################################
3600 ## <summary>
3601 ##      Do not audit attempts to use user ptys.
3602 ## </summary>
3603 ## <param name="domain">
3604 ##      <summary>
3605 ##      Domain to not audit.
3606 ##      </summary>
3607 ## </param>
3608 #
3609 interface(`userdom_dontaudit_use_user_ptys',`
3610         gen_require(`
3611                 type user_devpts_t;
3612         ')
3613
3614         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3615 ')
3616
3617 ########################################
3618 ## <summary>
3619 ##      Relabel files to unprivileged user pty types.
3620 ## </summary>
3621 ## <param name="domain">
3622 ##      <summary>
3623 ##      Domain allowed access.
3624 ##      </summary>
3625 ## </param>
3626 #
3627 interface(`userdom_relabelto_user_ptys',`
3628         gen_require(`
3629                 type user_devpts_t;
3630         ')
3631
3632         allow $1 user_devpts_t:chr_file relabelto;
3633 ')
3634
3635 ########################################
3636 ## <summary>
3637 ##      Do not audit attempts to relabel files from
3638 ##      user pty types.
3639 ## </summary>
3640 ## <param name="domain">
3641 ##      <summary>
3642 ##      Domain to not audit.
3643 ##      </summary>
3644 ## </param>
3645 #
3646 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3647         gen_require(`
3648                 type user_devpts_t;
3649         ')
3650
3651         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3652 ')
3653
3654 ########################################
3655 ## <summary>
3656 ##      Write all users files in /tmp
3657 ## </summary>
3658 ## <param name="domain">
3659 ##      <summary>
3660 ##      Domain allowed access.
3661 ##      </summary>
3662 ## </param>
3663 #
3664 interface(`userdom_write_user_tmp_files',`
3665         gen_require(`
3666                 type user_tmp_t;
3667         ')
3668
3669         write_files_pattern($1, user_tmp_t, user_tmp_t)
3670 ')
3671
3672 ########################################
3673 ## <summary>
3674 ##      Do not audit attempts to write users
3675 ##      temporary files.
3676 ## </summary>
3677 ## <param name="domain">
3678 ##      <summary>
3679 ##      Domain to not audit.
3680 ##      </summary>
3681 ## </param>
3682 #
3683 interface(`userdom_dontaudit_write_user_tmp_files',`
3684         gen_require(`
3685                 type user_tmp_t;
3686         ')
3687
3688         dontaudit $1 user_tmp_t:file write;
3689 ')
3690
3691 ########################################
3692 ## <summary>
3693 ##      Do not audit attempts to read/write users
3694 ##      temporary fifo files.
3695 ## </summary>
3696 ## <param name="domain">
3697 ##      <summary>
3698 ##      Domain to not audit.
3699 ##      </summary>
3700 ## </param>
3701 #
3702 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3703         gen_require(`
3704                 type user_tmp_t;
3705         ')
3706
3707         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3708 ')
3709
3710 ########################################
3711 ## <summary>
3712 ##      Do not audit attempts to use user ttys.
3713 ## </summary>
3714 ## <param name="domain">
3715 ##      <summary>
3716 ##      Domain to not audit.
3717 ##      </summary>
3718 ## </param>
3719 #
3720 interface(`userdom_dontaudit_use_user_ttys',`
3721         gen_require(`
3722                 type user_tty_device_t;
3723         ')
3724
3725         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3726 ')
3727
3728 ########################################
3729 ## <summary>
3730 ##      Read the process state of all user domains.
3731 ## </summary>
3732 ## <param name="domain">
3733 ##      <summary>
3734 ##      Domain allowed access.
3735 ##      </summary>
3736 ## </param>
3737 #
3738 interface(`userdom_read_all_users_state',`
3739         gen_require(`
3740                 attribute userdomain;
3741         ')
3742
3743         read_files_pattern($1, userdomain, userdomain)
3744         read_lnk_files_pattern($1,userdomain,userdomain)
3745         kernel_search_proc($1)
3746 ')
3747
3748 ########################################
3749 ## <summary>
3750 ##      Get the attributes of all user domains.
3751 ## </summary>
3752 ## <param name="domain">
3753 ##      <summary>
3754 ##      Domain allowed access.
3755 ##      </summary>
3756 ## </param>
3757 #
3758 interface(`userdom_getattr_all_users',`
3759         gen_require(`
3760                 attribute userdomain;
3761         ')
3762
3763         allow $1 userdomain:process getattr;
3764 ')
3765
3766 ########################################
3767 ## <summary>
3768 ##      Inherit the file descriptors from all user domains
3769 ## </summary>
3770 ## <param name="domain">
3771 ##      <summary>
3772 ##      Domain allowed access.
3773 ##      </summary>
3774 ## </param>
3775 #
3776 interface(`userdom_use_all_users_fds',`
3777         gen_require(`
3778                 attribute userdomain;
3779         ')
3780
3781         allow $1 userdomain:fd use;
3782 ')
3783
3784 ########################################
3785 ## <summary>
3786 ##      Do not audit attempts to inherit the file
3787 ##      descriptors from any user domains.
3788 ## </summary>
3789 ## <param name="domain">
3790 ##      <summary>
3791 ##      Domain to not audit.
3792 ##      </summary>
3793 ## </param>
3794 #
3795 interface(`userdom_dontaudit_use_all_users_fds',`
3796         gen_require(`
3797                 attribute userdomain;
3798         ')
3799
3800         dontaudit $1 userdomain:fd use;
3801 ')
3802
3803 ########################################
3804 ## <summary>
3805 ##      Send general signals to all user domains.
3806 ## </summary>
3807 ## <param name="domain">
3808 ##      <summary>
3809 ##      Domain allowed access.
3810 ##      </summary>
3811 ## </param>
3812 #
3813 interface(`userdom_signal_all_users',`
3814         gen_require(`
3815                 attribute userdomain;
3816         ')
3817
3818         allow $1 userdomain:process signal;
3819 ')
3820
3821 ########################################
3822 ## <summary>
3823 ##      Send kill signals to all user domains.
3824 ## </summary>
3825 ## <param name="domain">
3826 ##      <summary>
3827 ##      Domain allowed access.
3828 ##      </summary>
3829 ## </param>
3830 #
3831 interface(`userdom_kill_all_users',`
3832         gen_require(`
3833                 attribute userdomain;
3834         ')
3835
3836         allow $1 userdomain:process sigkill;
3837 ')
3838
3839 ########################################
3840 ## <summary>
3841 ##      Send a SIGCHLD signal to all user domains.
3842 ## </summary>
3843 ## <param name="domain">
3844 ##      <summary>
3845 ##      Domain allowed access.
3846 ##      </summary>
3847 ## </param>
3848 #
3849 interface(`userdom_sigchld_all_users',`
3850         gen_require(`
3851                 attribute userdomain;
3852         ')
3853
3854         allow $1 userdomain:process sigchld;
3855 ')
3856
3857 ########################################
3858 ## <summary>
3859 ##      Read keys for all user domains.
3860 ## </summary>
3861 ## <param name="domain">
3862 ##      <summary>
3863 ##      Domain allowed access.
3864 ##      </summary>
3865 ## </param>
3866 #
3867 interface(`userdom_read_all_users_keys',`
3868         gen_require(`
3869                 attribute userdomain;
3870         ')
3871
3872         allow $1 userdomain:key read;
3873 ')
3874
3875 ########################################
3876 ## <summary>
3877 ##      Create keys for all user domains.
3878 ## </summary>
3879 ## <param name="domain">
3880 ##      <summary>
3881 ##      Domain allowed access.
3882 ##      </summary>
3883 ## </param>
3884 #
3885 interface(`userdom_create_all_users_keys',`
3886         gen_require(`
3887                 attribute userdomain;
3888         ')
3889
3890         allow $1 userdomain:key create;
3891 ')
3892
3893 ########################################
3894 ## <summary>
3895 ##      Send a dbus message to all user domains.
3896 ## </summary>
3897 ## <param name="domain">
3898 ##      <summary>
3899 ##      Domain allowed access.
3900 ##      </summary>
3901 ## </param>
3902 #
3903 interface(`userdom_dbus_send_all_users',`
3904         gen_require(`
3905                 attribute userdomain;
3906                 class dbus send_msg;
3907         ')
3908
3909         allow $1 userdomain:dbus send_msg;
3910 ')
3911
3912 ########################################
3913 ## <summary>
3914 ##      Allow apps to set rlimits on userdomain
3915 ## </summary>
3916 ## <param name="domain">
3917 ##      <summary>
3918 ##      Domain allowed access.
3919 ##      </summary>
3920 ## </param>
3921 #
3922 interface(`userdom_set_rlimitnh',`
3923         gen_require(`
3924                 attribute userdomain;
3925         ')
3926
3927         allow $1 userdomain:process rlimitinh;
3928 ')
3929
3930 ########################################
3931 ## <summary>
3932 ##      Define this type as a Allow apps to set rlimits on userdomain
3933 ## </summary>
3934 ## <param name="domain">
3935 ##      <summary>
3936 ##      Domain allowed access.
3937 ##      </summary>
3938 ## </param>
3939 ## <param name="userdomain_prefix">
3940 ##      <summary>
3941 ##      The prefix of the user domain (e.g., user
3942 ##      is the prefix for user_t).
3943 ## </summary>
3944 ## </param>
3945 ## <param name="domain">
3946 ##      <summary>
3947 ##      Domain allowed access.
3948 ##      </summary>
3949 ## </param>
3950 #
3951 template(`userdom_unpriv_usertype',`
3952         gen_require(`
3953                 attribute unpriv_userdomain, userdomain;
3954                 attribute $1_usertype;
3955         ')
3956         typeattribute $2  $1_usertype;
3957         typeattribute $2  unpriv_userdomain;
3958         typeattribute $2  userdomain;
3959
3960         auth_use_nsswitch($2)
3961         ubac_constrained($2)
3962 ')
3963
3964 #######################################
3965 ## <summary>
3966 ##  Define this type as a Allow apps to set rlimits on userdomain
3967 ## </summary>
3968 ## <param name="domain">
3969 ##  <summary>
3970 ##  Domain allowed access.
3971 ##  </summary>
3972 ## </param>
3973 ## <param name="userdomain_prefix">
3974 ##  <summary>
3975 ##  The prefix of the user domain (e.g., user
3976 ##  is the prefix for user_t).
3977 ## </summary>
3978 ## </param>
3979 ## <param name="domain">
3980 ##  <summary>
3981 ##  Domain allowed access.
3982 ##  </summary>
3983 ## </param>
3984 #
3985 template(`userdom_unpriv_type',`
3986     gen_require(`
3987         attribute unpriv_userdomain, userdomain;
3988     ')
3989     typeattribute $2  unpriv_userdomain;
3990     typeattribute $2  userdomain;
3991
3992     auth_use_nsswitch($2)
3993     ubac_constrained($2)
3994 ')
3995
3996 ########################################
3997 ## <summary>
3998 ##      Connect to users over an unix stream socket.
3999 ## </summary>
4000 ## <param name="domain">
4001 ##      <summary>
4002 ##      Domain allowed access.
4003 ##      </summary>
4004 ## </param>
4005 #
4006 interface(`userdom_stream_connect',`
4007         gen_require(`
4008                 type user_tmp_t;
4009                 attribute userdomain;
4010         ')
4011
4012         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
4013 ')
4014
4015 ########################################
4016 ## <summary>
4017 ##      Ptrace user domains.
4018 ## </summary>
4019 ## <param name="domain">
4020 ##      <summary>
4021 ##      Domain allowed access.
4022 ##      </summary>
4023 ## </param>
4024 #
4025 interface(`userdom_ptrace_all_users',`
4026         gen_require(`
4027                 attribute userdomain;
4028         ')
4029
4030         tunable_policy(`deny_ptrace',`',`
4031                 allow $1 userdomain:process ptrace;
4032         ')
4033 ')
4034
4035 ########################################
4036 ## <summary>
4037 ##      dontaudit Search /root
4038 ## </summary>
4039 ## <param name="domain">
4040 ##      <summary>
4041 ##      Domain to not audit.
4042 ##      </summary>
4043 ## </param>
4044 #
4045 interface(`userdom_dontaudit_search_admin_dir',`
4046         gen_require(`
4047                 type admin_home_t;
4048         ')
4049
4050         dontaudit $1 admin_home_t:dir search_dir_perms;
4051 ')
4052
4053 ########################################
4054 ## <summary>
4055 ##      dontaudit list /root
4056 ## </summary>
4057 ## <param name="domain">
4058 ##      <summary>
4059 ##      Domain to not audit.
4060 ##      </summary>
4061 ## </param>
4062 #
4063 interface(`userdom_dontaudit_list_admin_dir',`
4064         gen_require(`
4065                 type admin_home_t;
4066         ')
4067
4068         dontaudit $1 admin_home_t:dir list_dir_perms;
4069 ')
4070
4071 ########################################
4072 ## <summary>
4073 ##      Allow domain to  list /root
4074 ## </summary>
4075 ## <param name="domain">
4076 ##      <summary>
4077 ##      Domain allowed access.
4078 ##      </summary>
4079 ## </param>
4080 #
4081 interface(`userdom_list_admin_dir',`
4082         gen_require(`
4083                 type admin_home_t;
4084         ')
4085
4086         allow $1 admin_home_t:dir list_dir_perms;
4087 ')
4088
4089 ########################################
4090 ## <summary>
4091 ##      Allow Search /root
4092 ## </summary>
4093 ## <param name="domain">
4094 ##      <summary>
4095 ##      Domain allowed access.
4096 ##      </summary>
4097 ## </param>
4098 #
4099 interface(`userdom_search_admin_dir',`
4100         gen_require(`
4101                 type admin_home_t;
4102         ')
4103
4104         allow $1 admin_home_t:dir search_dir_perms;
4105 ')
4106
4107 ########################################
4108 ## <summary>
4109 ##      RW unpriviledged user SysV sempaphores.
4110 ## </summary>
4111 ## <param name="domain">
4112 ##      <summary>
4113 ##      Domain allowed access.
4114 ##      </summary>
4115 ## </param>
4116 #
4117 interface(`userdom_rw_semaphores',`
4118         gen_require(`
4119                 attribute unpriv_userdomain;
4120         ')
4121
4122         allow $1 unpriv_userdomain:sem rw_sem_perms;
4123 ')
4124
4125 ########################################
4126 ## <summary>
4127 ##      Send a message to unpriv users over a unix domain
4128 ##      datagram socket.
4129 ## </summary>
4130 ## <param name="domain">
4131 ##      <summary>
4132 ##      Domain allowed access.
4133 ##      </summary>
4134 ## </param>
4135 #
4136 interface(`userdom_dgram_send',`
4137         gen_require(`
4138                 attribute unpriv_userdomain;
4139         ')
4140
4141         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4142 ')
4143
4144 ######################################
4145 ## <summary>
4146 ##      Send a message to users over a unix domain
4147 ##      datagram socket.
4148 ## </summary>
4149 ## <param name="domain">
4150 ##      <summary>
4151 ##      Domain allowed access.
4152 ##      </summary>
4153 ## </param>
4154 #
4155 interface(`userdom_users_dgram_send',`
4156         gen_require(`
4157                  attribute userdomain;
4158       ')
4159
4160        allow $1 userdomain:unix_dgram_socket sendto;
4161 ')
4162
4163 #######################################
4164 ## <summary>
4165 ##      Allow execmod on files in homedirectory
4166 ## </summary>
4167 ## <param name="domain">
4168 ##      <summary>
4169 ##      Domain allowed access.
4170 ##      </summary>
4171 ## </param>
4172 ## <rolebase/>
4173 #
4174 interface(`userdom_execmod_user_home_files',`
4175         gen_require(`
4176                 type user_home_type;
4177         ')
4178
4179         allow $1 user_home_type:file execmod;
4180 ')
4181
4182 ########################################
4183 ## <summary>
4184 ##      Read admin home files.
4185 ## </summary>
4186 ## <param name="domain">
4187 ##      <summary>
4188 ##      Domain allowed access.
4189 ##      </summary>
4190 ## </param>
4191 ## <rolecap/>
4192 #
4193 interface(`userdom_read_admin_home_files',`
4194         gen_require(`
4195                 type admin_home_t;
4196         ')
4197
4198         read_files_pattern($1, admin_home_t, admin_home_t)
4199 ')
4200
4201 ########################################
4202 ## <summary>
4203 ##      Delete admin home files.
4204 ## </summary>
4205 ## <param name="domain">
4206 ##      <summary>
4207 ##      Domain allowed access.
4208 ##      </summary>
4209 ## </param>
4210 ## <rolecap/>
4211 #
4212 interface(`userdom_delete_admin_home_files',`
4213         gen_require(`
4214                 type admin_home_t;
4215         ')
4216
4217         allow $1 admin_home_t:file delete_file_perms;
4218 ')
4219
4220 ########################################
4221 ## <summary>
4222 ##      Execute admin home files.
4223 ## </summary>
4224 ## <param name="domain">
4225 ##      <summary>
4226 ##      Domain allowed access.
4227 ##      </summary>
4228 ## </param>
4229 ## <rolecap/>
4230 #
4231 interface(`userdom_exec_admin_home_files',`
4232         gen_require(`
4233                 type admin_home_t;
4234         ')
4235
4236         exec_files_pattern($1, admin_home_t, admin_home_t)
4237 ')
4238
4239 ########################################
4240 ## <summary>
4241 ##      Append files inherited
4242 ##      in the /root directory.
4243 ## </summary>
4244 ## <param name="domain">
4245 ##      <summary>
4246 ##      Domain allowed access.
4247 ##      </summary>
4248 ## </param>
4249 #
4250 interface(`userdom_inherit_append_admin_home_files',`
4251         gen_require(`
4252                 type admin_home_t;
4253         ')
4254
4255         allow $1 admin_home_t:file { getattr append };
4256 ')
4257
4258
4259 #######################################
4260 ## <summary>
4261 ##      Manage all files/directories in the homedir
4262 ## </summary>
4263 ## <param name="userdomain">
4264 ##      <summary>
4265 ##      The user domain
4266 ##      </summary>
4267 ## </param>
4268 ## <rolebase/>
4269 #
4270 interface(`userdom_manage_user_home_content',`
4271         gen_require(`
4272                 type user_home_dir_t, user_home_t;
4273                 attribute user_home_type;
4274         ')
4275
4276         files_list_home($1)
4277         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4278         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4279         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4280         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4281         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4282         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4283
4284 ')
4285
4286
4287 ########################################
4288 ## <summary>
4289 ##      Create objects in a user home directory
4290 ##      with an automatic type transition to
4291 ##      the user home file type.
4292 ## </summary>
4293 ## <param name="domain">
4294 ##      <summary>
4295 ##      Domain allowed access.
4296 ##      </summary>
4297 ## </param>
4298 ## <param name="object_class">
4299 ##      <summary>
4300 ##      The class of the object to be created.
4301 ##      </summary>
4302 ## </param>
4303 #
4304 interface(`userdom_user_home_dir_filetrans_pattern',`
4305         gen_require(`
4306                 type user_home_dir_t, user_home_t;
4307         ')
4308
4309         type_transition $1 user_home_dir_t:$2 user_home_t;
4310 ')
4311
4312 ########################################
4313 ## <summary>
4314 ##      Create objects in the /root directory
4315 ##      with an automatic type transition to
4316 ##      a specified private type.
4317 ## </summary>
4318 ## <param name="domain">
4319 ##      <summary>
4320 ##      Domain allowed access.
4321 ##      </summary>
4322 ## </param>
4323 ## <param name="private_type">
4324 ##      <summary>
4325 ##      The type of the object to create.
4326 ##      </summary>
4327 ## </param>
4328 ## <param name="object_class">
4329 ##      <summary>
4330 ##      The class of the object to be created.
4331 ##      </summary>
4332 ## </param>
4333 #
4334 interface(`userdom_admin_home_dir_filetrans',`
4335         gen_require(`
4336                 type admin_home_t;
4337         ')
4338
4339         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4340 ')
4341
4342 ########################################
4343 ## <summary>
4344 ##      Send signull to unprivileged user domains.
4345 ## </summary>
4346 ## <param name="domain">
4347 ##      <summary>
4348 ##      Domain allowed access.
4349 ##      </summary>
4350 ## </param>
4351 #
4352 interface(`userdom_signull_unpriv_users',`
4353         gen_require(`
4354                 attribute unpriv_userdomain;
4355         ')
4356
4357         allow $1 unpriv_userdomain:process signull;
4358 ')
4359
4360 ########################################
4361 ## <summary>
4362 ##      Write all users files in /tmp
4363 ## </summary>
4364 ## <param name="domain">
4365 ##      <summary>
4366 ##      Domain allowed access.
4367 ##      </summary>
4368 ## </param>
4369 #
4370 interface(`userdom_write_user_tmp_dirs',`
4371         gen_require(`
4372                 type user_tmp_t;
4373         ')
4374
4375         write_files_pattern($1, user_tmp_t, user_tmp_t)
4376 ')
4377
4378 ########################################
4379 ## <summary>
4380 ##      Manage keys for all user domains.
4381 ## </summary>
4382 ## <param name="domain">
4383 ##      <summary>
4384 ##      Domain allowed access.
4385 ##      </summary>
4386 ## </param>
4387 #
4388 interface(`userdom_manage_all_users_keys',`
4389         gen_require(`
4390                 attribute userdomain;
4391         ')
4392
4393         allow $1 userdomain:key manage_key_perms;
4394 ')
4395
4396
4397 ########################################
4398 ## <summary>
4399 ##      Do not audit attempts to read and write
4400 ##      unserdomain stream.
4401 ## </summary>
4402 ## <param name="domain">
4403 ##      <summary>
4404 ##      Domain to not audit.
4405 ##      </summary>
4406 ## </param>
4407 #
4408 interface(`userdom_dontaudit_rw_stream',`
4409         gen_require(`
4410                 attribute userdomain;
4411         ')
4412
4413         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4414 ')
4415
4416 ########################################
4417 ## <summary>
4418 ##      Do not audit attempts to read and write
4419 ##      unserdomain datagram socket.
4420 ## </summary>
4421 ## <param name="domain">
4422 ##      <summary>
4423 ##      Domain to not audit.
4424 ##      </summary>
4425 ## </param>
4426 #
4427 interface(`userdom_dontaudit_rw_dgram_socket',`
4428         gen_require(`
4429                 attribute userdomain;
4430         ')
4431
4432         dontaudit $1 userdomain:unix_dgram_socket { read write };
4433 ')
4434
4435 ########################################
4436 ## <summary>
4437 ##      Append files
4438 ##      in a user home subdirectory.
4439 ## </summary>
4440 ## <param name="domain">
4441 ##      <summary>
4442 ##      Domain allowed access.
4443 ##      </summary>
4444 ## </param>
4445 #
4446 interface(`userdom_append_user_home_content_files',`
4447         gen_require(`
4448                 type user_home_dir_t, user_home_t;
4449         ')
4450
4451         append_files_pattern($1, user_home_t, user_home_t)
4452         allow $1 user_home_dir_t:dir search_dir_perms;
4453         files_search_home($1)
4454 ')
4455
4456 ########################################
4457 ## <summary>
4458 ##      Read files inherited
4459 ##      in a user home subdirectory.
4460 ## </summary>
4461 ## <param name="domain">
4462 ##      <summary>
4463 ##      Domain allowed access.
4464 ##      </summary>
4465 ## </param>
4466 #
4467 interface(`userdom_read_inherited_user_home_content_files',`
4468         gen_require(`
4469                 attribute user_home_type;
4470         ')
4471
4472         allow $1 user_home_type:file { getattr read };
4473 ')
4474
4475 ########################################
4476 ## <summary>
4477 ##      Append files inherited
4478 ##      in a user home subdirectory.
4479 ## </summary>
4480 ## <param name="domain">
4481 ##      <summary>
4482 ##      Domain allowed access.
4483 ##      </summary>
4484 ## </param>
4485 #
4486 interface(`userdom_inherit_append_user_home_content_files',`
4487         gen_require(`
4488                 type user_home_t;
4489         ')
4490
4491         allow $1 user_home_t:file { getattr append };
4492 ')
4493
4494 ########################################
4495 ## <summary>
4496 ##      Append files inherited
4497 ##      in a user tmp files.
4498 ## </summary>
4499 ## <param name="domain">
4500 ##      <summary>
4501 ##      Domain allowed access.
4502 ##      </summary>
4503 ## </param>
4504 #
4505 interface(`userdom_inherit_append_user_tmp_files',`
4506         gen_require(`
4507                 type user_tmp_t;
4508         ')
4509
4510         allow $1 user_tmp_t:file { getattr append };
4511 ')
4512
4513 ######################################
4514 ## <summary>
4515 ##      Read audio files in the users homedir.
4516 ## </summary>
4517 ## <param name="domain">
4518 ##      <summary>
4519 ##      Domain allowed access.
4520 ##      </summary>
4521 ## </param>
4522 ## <rolecap/>
4523 #
4524 interface(`userdom_read_home_audio_files',`
4525         gen_require(`
4526                 type audio_home_t;
4527         ')
4528
4529         userdom_search_user_home_dirs($1)
4530         allow $1 audio_home_t:dir list_dir_perms;
4531         read_files_pattern($1, audio_home_t, audio_home_t)
4532         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4533 ')
4534
4535 ########################################
4536 ## <summary>
4537 ##      Do not audit attempts to write all user home content files.
4538 ## </summary>
4539 ## <param name="domain">
4540 ##      <summary>
4541 ##      Domain to not audit.
4542 ##      </summary>
4543 ## </param>
4544 #
4545 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4546         gen_require(`
4547                 attribute user_home_type;
4548         ')
4549
4550         dontaudit $1 user_home_type:file write_file_perms;
4551 ')
4552
4553 ########################################
4554 ## <summary>
4555 ##      Do not audit attempts to write all user tmp content files.
4556 ## </summary>
4557 ## <param name="domain">
4558 ##      <summary>
4559 ##      Domain to not audit.
4560 ##      </summary>
4561 ## </param>
4562 #
4563 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4564         gen_require(`
4565                 attribute user_tmp_type;
4566         ')
4567
4568         dontaudit $1 user_tmp_type:file write_file_perms;
4569 ')
4570
4571 ########################################
4572 ## <summary>
4573 ##      Manage all user temporary content.
4574 ## </summary>
4575 ## <param name="domain">
4576 ##      <summary>
4577 ##      Domain allowed access.
4578 ##      </summary>
4579 ## </param>
4580 #
4581 interface(`userdom_manage_all_user_tmp_content',`
4582         gen_require(`
4583                 attribute user_tmp_type;
4584         ')
4585
4586         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4587         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4588         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4589         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4590         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4591         files_search_tmp($1)
4592 ')
4593
4594 ########################################
4595 ## <summary>
4596 ##      List all user temporary content.
4597 ## </summary>
4598 ## <param name="domain">
4599 ##      <summary>
4600 ##      Domain allowed access.
4601 ##      </summary>
4602 ## </param>
4603 #
4604 interface(`userdom_list_all_user_tmp_content',`
4605         gen_require(`
4606                 attribute user_tmp_type;
4607         ')
4608
4609         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4610         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4611         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4612         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4613         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4614         files_search_var($1)
4615         files_search_tmp($1)
4616 ')
4617
4618 ########################################
4619 ## <summary>
4620 ##      Manage all user tmpfs content.
4621 ## </summary>
4622 ## <param name="domain">
4623 ##      <summary>
4624 ##      Domain allowed access.
4625 ##      </summary>
4626 ## </param>
4627 #
4628 interface(`userdom_manage_all_user_tmpfs_content',`
4629         gen_require(`
4630                 attribute user_tmpfs_type;
4631         ')
4632
4633         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4634         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4635         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4636         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4637         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4638         fs_search_tmpfs($1)
4639 ')
4640
4641 ########################################
4642 ## <summary>
4643 ##      Delete all user temporary content.
4644 ## </summary>
4645 ## <param name="domain">
4646 ##      <summary>
4647 ##      Domain allowed access.
4648 ##      </summary>
4649 ## </param>
4650 #
4651 interface(`userdom_delete_all_user_tmp_content',`
4652         gen_require(`
4653                 attribute user_tmp_type;
4654         ')
4655
4656         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4657         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4658         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4659         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4660         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4661         # /var/tmp
4662         files_search_var($1)
4663         files_delete_tmp_dir_entry($1)
4664 ')
4665
4666 ########################################
4667 ## <summary>
4668 ##      Read system SSL certificates in the users homedir.
4669 ## </summary>
4670 ## <param name="domain">
4671 ##      <summary>
4672 ##      Domain allowed access.
4673 ##      </summary>
4674 ## </param>
4675 #
4676 interface(`userdom_read_home_certs',`
4677         gen_require(`
4678                 type home_cert_t;
4679         ')
4680
4681         userdom_search_user_home_content($1)
4682         allow $1 home_cert_t:dir list_dir_perms;
4683         read_files_pattern($1, home_cert_t, home_cert_t)
4684         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4685 ')
4686
4687 ########################################
4688 ## <summary>
4689 ##      Manage system SSL certificates in the users homedir.
4690 ## </summary>
4691 ## <param name="domain">
4692 ##      <summary>
4693 ##      Domain allowed access.
4694 ##      </summary>
4695 ## </param>
4696 #
4697 interface(`userdom_manage_home_certs',`
4698         gen_require(`
4699                 type home_cert_t;
4700         ')
4701
4702         allow $1 home_cert_t:dir list_dir_perms;
4703         manage_files_pattern($1, home_cert_t, home_cert_t)
4704         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4705
4706         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4707         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4708 ')
4709
4710 #######################################
4711 ## <summary>
4712 ##  Dontaudit Write system SSL certificates in the users homedir.
4713 ## </summary>
4714 ## <param name="domain">
4715 ##  <summary>
4716 ##      Domain to not audit.
4717 ##  </summary>
4718 ## </param>
4719 #
4720 interface(`userdom_dontaudit_write_home_certs',`
4721     gen_require(`
4722         type home_cert_t;
4723     ')
4724
4725     dontaudit $1 home_cert_t:file write;
4726 ')
4727
4728 ########################################
4729 ## <summary>
4730 ##      dontaudit Search getatrr /root files
4731 ## </summary>
4732 ## <param name="domain">
4733 ##      <summary>
4734 ##      Domain to not audit.
4735 ##      </summary>
4736 ## </param>
4737 #
4738 interface(`userdom_dontaudit_getattr_admin_home_files',`
4739         gen_require(`
4740                 type admin_home_t;
4741         ')
4742
4743         dontaudit $1 admin_home_t:file getattr;
4744 ')
4745
4746 ########################################
4747 ## <summary>
4748 ##      dontaudit read /root lnk files
4749 ## </summary>
4750 ## <param name="domain">
4751 ##      <summary>
4752 ##      Domain to not audit.
4753 ##      </summary>
4754 ## </param>
4755 #
4756 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4757         gen_require(`
4758                 type admin_home_t;
4759         ')
4760
4761         dontaudit $1 admin_home_t:lnk_file read;
4762 ')
4763
4764 ########################################
4765 ## <summary>
4766 ##      dontaudit read /root files
4767 ## </summary>
4768 ## <param name="domain">
4769 ##      <summary>
4770 ##      Domain to not audit.
4771 ##      </summary>
4772 ## </param>
4773 #
4774 interface(`userdom_dontaudit_read_admin_home_files',`
4775         gen_require(`
4776                 type admin_home_t;
4777         ')
4778
4779         dontaudit $1 admin_home_t:file read_file_perms;
4780 ')
4781
4782 ########################################
4783 ## <summary>
4784 ##      Create, read, write, and delete user
4785 ##      temporary chr files.
4786 ## </summary>
4787 ## <param name="domain">
4788 ##      <summary>
4789 ##      Domain allowed access.
4790 ##      </summary>
4791 ## </param>
4792 #
4793 interface(`userdom_manage_user_tmp_chr_files',`
4794         gen_require(`
4795                 type user_tmp_t;
4796         ')
4797
4798         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4799         files_search_tmp($1)
4800 ')
4801
4802 ########################################
4803 ## <summary>
4804 ##      Create, read, write, and delete user
4805 ##      temporary blk files.
4806 ## </summary>
4807 ## <param name="domain">
4808 ##      <summary>
4809 ##      Domain allowed access.
4810 ##      </summary>
4811 ## </param>
4812 #
4813 interface(`userdom_manage_user_tmp_blk_files',`
4814         gen_require(`
4815                 type user_tmp_t;
4816         ')
4817
4818         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4819         files_search_tmp($1)
4820 ')
4821
4822 ########################################
4823 ## <summary>
4824 ##      Dontaudit attempt to set attributes on  user temporary directories.
4825 ## </summary>
4826 ## <param name="domain">
4827 ##      <summary>
4828 ##      Domain to not audit.
4829 ##      </summary>
4830 ## </param>
4831 #
4832 interface(`userdom_dontaudit_setattr_user_tmp',`
4833         gen_require(`
4834                 type user_tmp_t;
4835         ')
4836
4837         dontaudit $1 user_tmp_t:dir setattr;
4838 ')
4839
4840 ########################################
4841 ## <summary>
4842 ##      Read all inherited users files in /tmp
4843 ## </summary>
4844 ## <param name="domain">
4845 ##      <summary>
4846 ##      Domain allowed access.
4847 ##      </summary>
4848 ## </param>
4849 #
4850 interface(`userdom_read_inherited_user_tmp_files',`
4851         gen_require(`
4852                 type user_tmp_t;
4853         ')
4854
4855         allow $1 user_tmp_t:file read_inherited_file_perms;
4856 ')
4857
4858 ########################################
4859 ## <summary>
4860 ##      Write all inherited users files in /tmp
4861 ## </summary>
4862 ## <param name="domain">
4863 ##      <summary>
4864 ##      Domain allowed access.
4865 ##      </summary>
4866 ## </param>
4867 #
4868 interface(`userdom_write_inherited_user_tmp_files',`
4869         gen_require(`
4870                 type user_tmp_t;
4871         ')
4872
4873         allow $1 user_tmp_t:file write;
4874 ')
4875
4876 ########################################
4877 ## <summary>
4878 ##      Delete all users files in /tmp
4879 ## </summary>
4880 ## <param name="domain">
4881 ##      <summary>
4882 ##      Domain allowed access.
4883 ##      </summary>
4884 ## </param>
4885 #
4886 interface(`userdom_delete_user_tmp_files',`
4887         gen_require(`
4888                 type user_tmp_t;
4889         ')
4890
4891         allow $1 user_tmp_t:file delete_file_perms;
4892 ')
4893
4894 ########################################
4895 ## <summary>
4896 ##      Delete user tmpfs files.
4897 ## </summary>
4898 ## <param name="domain">
4899 ##      <summary>
4900 ##      Domain allowed access.
4901 ##      </summary>
4902 ## </param>
4903 #
4904 interface(`userdom_delete_user_tmpfs_files',`
4905         gen_require(`
4906                 type user_tmpfs_t;
4907         ')
4908
4909         allow $1 user_tmpfs_t:file delete_file_perms;
4910 ')
4911
4912 ########################################
4913 ## <summary>
4914 ##      Read/Write unpriviledged user SysV shared
4915 ##      memory segments.
4916 ## </summary>
4917 ## <param name="domain">
4918 ##      <summary>
4919 ##      Domain allowed access.
4920 ##      </summary>
4921 ## </param>
4922 #
4923 interface(`userdom_rw_unpriv_user_shared_mem',`
4924         gen_require(`
4925                 attribute unpriv_userdomain;
4926         ')
4927
4928         allow $1 unpriv_userdomain:shm rw_shm_perms;
4929 ')
4930
4931 ########################################
4932 ## <summary>
4933 ##      Do not audit attempts to search user
4934 ##      temporary directories.
4935 ## </summary>
4936 ## <param name="domain">
4937 ##      <summary>
4938 ##      Domain to not audit.
4939 ##      </summary>
4940 ## </param>
4941 #
4942 interface(`userdom_dontaudit_search_user_tmp',`
4943         gen_require(`
4944                 type user_tmp_t;
4945         ')
4946
4947         dontaudit $1 user_tmp_t:dir search_dir_perms;
4948 ')
4949
4950 ########################################
4951 ## <summary>
4952 ##      Execute a file in a user home directory
4953 ##      in the specified domain.
4954 ## </summary>
4955 ## <desc>
4956 ##      <p>
4957 ##      Execute a file in a user home directory
4958 ##      in the specified domain.
4959 ##      </p>
4960 ##      <p>
4961 ##      No interprocess communication (signals, pipes,
4962 ##      etc.) is provided by this interface since
4963 ##      the domains are not owned by this module.
4964 ##      </p>
4965 ## </desc>
4966 ## <param name="domain">
4967 ##      <summary>
4968 ##      Domain allowed access.
4969 ##      </summary>
4970 ## </param>
4971 ## <param name="target_domain">
4972 ##      <summary>
4973 ##      The type of the new process.
4974 ##      </summary>
4975 ## </param>
4976 #
4977 interface(`userdom_domtrans_user_home',`
4978         gen_require(`
4979                 type user_home_t;
4980         ')
4981
4982         read_lnk_files_pattern($1, user_home_t, user_home_t)
4983         domain_transition_pattern($1, user_home_t, $2)
4984         type_transition $1 user_home_t:process $2;
4985 ')
4986
4987 ########################################
4988 ## <summary>
4989 ##      Execute a file in a user tmp directory
4990 ##      in the specified domain.
4991 ## </summary>
4992 ## <desc>
4993 ##      <p>
4994 ##      Execute a file in a user tmp directory
4995 ##      in the specified domain.
4996 ##      </p>
4997 ##      <p>
4998 ##      No interprocess communication (signals, pipes,
4999 ##      etc.) is provided by this interface since
5000 ##      the domains are not owned by this module.
5001 ##      </p>
5002 ## </desc>
5003 ## <param name="domain">
5004 ##      <summary>
5005 ##      Domain allowed access.
5006 ##      </summary>
5007 ## </param>
5008 ## <param name="target_domain">
5009 ##      <summary>
5010 ##      The type of the new process.
5011 ##      </summary>
5012 ## </param>
5013 #
5014 interface(`userdom_domtrans_user_tmp',`
5015         gen_require(`
5016                 type user_tmp_t;
5017         ')
5018
5019         files_search_tmp($1)
5020         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
5021         domain_transition_pattern($1, user_tmp_t, $2)
5022         type_transition $1 user_tmp_t:process $2;
5023 ')
5024
5025 ########################################
5026 ## <summary>
5027 ##      Do not audit attempts to read all user home content files.
5028 ## </summary>
5029 ## <param name="domain">
5030 ##      <summary>
5031 ##      Domain to not audit.
5032 ##      </summary>
5033 ## </param>
5034 #
5035 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5036         gen_require(`
5037                 attribute user_home_type;
5038         ')
5039
5040         dontaudit $1 user_home_type:file read_file_perms;
5041 ')
5042
5043 ########################################
5044 ## <summary>
5045 ##      Do not audit attempts to read all user tmp content files.
5046 ## </summary>
5047 ## <param name="domain">
5048 ##      <summary>
5049 ##      Domain to not audit.
5050 ##      </summary>
5051 ## </param>
5052 #
5053 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5054         gen_require(`
5055                 attribute user_tmp_type;
5056         ')
5057
5058         dontaudit $1 user_tmp_type:file read_file_perms;
5059 ')
5060
5061 #######################################
5062 ## <summary>
5063 ## Read and write unpriviledged user SysV sempaphores.
5064 ## </summary>
5065 ## <param name="domain">
5066 ## <summary>
5067 ## Domain allowed access.
5068 ## </summary>
5069 ## </param>
5070 #
5071 interface(`userdom_rw_unpriv_user_semaphores',`
5072    gen_require(`
5073        attribute unpriv_userdomain;
5074    ')
5075
5076    allow $1 unpriv_userdomain:sem rw_sem_perms;
5077 ')
5078
5079 ########################################
5080 ## <summary>
5081 ##      Transition to userdom named content
5082 ## </summary>
5083 ## <param name="domain">
5084 ##      <summary>
5085 ##      Domain allowed access.
5086 ##      </summary>
5087 ## </param>
5088 #
5089 interface(`userdom_filetrans_home_content',`
5090         gen_require(`
5091                 type home_bin_t, home_cert_t;
5092                 type audio_home_t;
5093         ')
5094
5095         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5096         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5097         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5098         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5099         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5100         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5101         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5102
5103         #optional_policy(`
5104         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5105         #')
5106 ')
5107
5108 ########################################
5109 ## <summary>
5110 ##      Make the specified type able to read content in user home dirs
5111 ## </summary>
5112 ## <param name="type">
5113 ##      <summary>
5114 ##      Domain allowed access.
5115 ##      </summary>
5116 ## </param>
5117 #
5118 interface(`userdom_home_reader',`
5119         gen_require(`
5120                 attribute userdom_home_reader_type;
5121         ')
5122
5123         typeattribute $1 userdom_home_reader_type;
5124 ')
5125
5126
5127 ########################################
5128 ## <summary>
5129 ##      Make the specified type able to manage content in user home dirs
5130 ## </summary>
5131 ## <param name="type">
5132 ##      <summary>
5133 ##      Domain allowed access.
5134 ##      </summary>
5135 ## </param>
5136 #
5137 interface(`userdom_home_manager',`
5138         gen_require(`
5139                 attribute userdom_home_manager_type;
5140         ')
5141
5142         typeattribute $1 userdom_home_manager_type;
5143 ')