Add filetrans in homedir for kerberos, ssh, virt, xserver

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 4725d506456d6db9c12519fec802ce9e864d9fec..4f3ff26f03bcb3bb4847dc3c45ed181a04a7d990 100644 (file)
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1596,7 +1596,7 @@ interface(`files_root_filetrans',`
                type root_t;
        ')
 
-       filetrans_pattern($1, root_t, $2, $3)
+       filetrans_pattern($1, root_t, $2, $3, $4)
 ')
 
 ########################################
@@ -4579,7 +4579,7 @@ interface(`files_tmp_filetrans',`
                type tmp_t;
        ')
 
-       filetrans_pattern($1, tmp_t, $2, $3)
+       filetrans_pattern($1, tmp_t, $2, $3, $4)
 ')
 
 ########################################

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index db5a937560b9b6664623bf9e47c0eaeb37add895..95ff4891e7f6d138dd9e9df344f6dd6335fe2183 100644 (file)
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -136,6 +136,7 @@ optional_policy(`
 optional_policy(`
        qemu_run(staff_t, staff_r)
        virt_manage_tmpfs_files(staff_t)
+       virt_user_home_dir_filetrans(staff_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 303ada316285f05f6d6b754d86e29d261b22d73d..947ae76d2d2c5a82691764f72f27be5c47fcc4f0 100644 (file)
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -222,6 +222,7 @@ optional_policy(`
 
 optional_policy(`
        kerberos_exec_kadmind(sysadm_t)
+       kerberos_filetrans_named_content(sysadm_t)
 ')
 
 optional_policy(`
@@ -424,6 +425,7 @@ optional_policy(`
 
 optional_policy(`
        virt_stream_connect(sysadm_t)
+       virt_user_home_dir_filetrans(sysadm_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 024753f8c08edbaa385ec97003cfe4102fc84479..4c5f00650043ef3f636f70a63af2a7ee360f1f30 100644 (file)
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -339,6 +339,10 @@ optional_policy(`
        java_run_unconfined(unconfined_t, unconfined_r)
 ')
 
+optional_policy(`
+       kerberos_filetrans_named_content(unconfined_t)
+')
+
 optional_policy(`
        livecd_run(unconfined_t, unconfined_r)
 ')
@@ -441,6 +445,7 @@ optional_policy(`
 
 optional_policy(`
        virt_transition_svirt(unconfined_t, unconfined_r)
+       virt_user_home_dir_filetrans(unconfined_t)
 ')
 
 optional_policy(`
@@ -457,6 +462,7 @@ optional_policy(`
 
 optional_policy(`
        xserver_run(unconfined_t, unconfined_r)
+       xserver_manage_home_fonts(unconfined_t)
 ')
 
 ########################################

diff --git a/policy/modules/services/kerberos.if b/policy/modules/services/kerberos.if
index 65fdeb059e08d7e86a555969a5b85841b102141a..924d6bca427bbefe28930adfd20caa7c17f0387e 100644 (file)
--- a/policy/modules/services/kerberos.if
+++ b/policy/modules/services/kerberos.if
@@ -231,7 +231,7 @@ interface(`kerberos_etc_filetrans_keytab',`
        ')
 
        allow $1 krb5_keytab_t:file manage_file_perms;
-       files_etc_filetrans($1, krb5_keytab_t, file)
+       files_etc_filetrans($1, krb5_keytab_t, file, $2)
 ')
 
 ########################################
@@ -391,7 +391,7 @@ interface(`mta_tmp_filetrans_host_rcache',`
                type krb5_host_rcache_t;
        ')
 
-       files_tmp_filetrans($1, krb5_host_rcache_t, file)
+       files_tmp_filetrans($1, krb5_host_rcache_t, file, $2)
 ')
 
 ########################################
@@ -412,3 +412,71 @@ template(`kerberos_read_home_content',`
        userdom_search_user_home_dirs($1)
        read_files_pattern($1, krb5_home_t, krb5_home_t)
 ')
+
+########################################
+## <summary>
+##     create kerberos content in the  in the /root directory
+##     with an correct label.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`mta_filetrans_admin_home_content',`
+       gen_require(`
+               type kerberos_home_t;
+       ')
+
+       userdom_admin_home_dir_filetrans($1, kerberos_home_t, file, .k5login)
+')
+
+########################################
+## <summary>
+##     Transition to kerberos named content
+## </summary>
+## <param name="domain">
+##     <summary>
+##      Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`kerberos_filetrans_home_content',`
+       gen_require(`
+               type kerberos_home_t;
+       ')
+
+       userdom_user_home_dir_filetrans($1, kerberos_home_t, file, .k5login)
+')
+
+########################################
+## <summary>
+##     Transition to apache named content
+## </summary>
+## <param name="domain">
+##     <summary>
+##      Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`kerberos_filetrans_named_content',`
+       gen_require(`
+               type krb5_conf_t, krb5_keytab_t, krb5kdc_conf_t;
+               type krb5kdc_principal_t;
+       ')
+
+       files_etc_filetrans($1, krb5_conf_t, file, krb5.conf)
+       filetrans_pattern($1, krb5kdc_conf_t, krb5_keytab_t, file, kadm5\.keytab)
+       filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, principal)
+       filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, principal0)
+       filetrans_pattern($1, krb5kdc_conf_t, krb5kdc_principal_t, file, principal1)
+       filetrans_pattern($1, krb5kdc_conf_t, krb5_principal_t, file, principal1)
+
+       kerberos_etc_filetrans_keytab($1, krb5.keytab)
+       kerberos_filetrans_home_content($1)
+       kerberos_filetrans_admin_home_content($1)
+
+       kerberos_tmp_filetrans_host_rcache($1, host_0)
+       kerberos_tmp_filetrans_host_rcache($1, HTTP_23)
+')

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 7631609624a5c5d7939d4c5137168f57da1148f2..6f7eb3eabd5e37dcea5343e665b9abd5bc1e9521 100644 (file)
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -830,6 +830,7 @@ interface(`ssh_admin_home_dir_filetrans',`
        ')
 
        userdom_admin_home_dir_filetrans($1, ssh_home_t, dir, .ssh)
+       userdom_admin_home_dir_filetrans($1, ssh_home_t, dir, .shosts)
 ')
 
 ########################################
@@ -849,4 +850,5 @@ interface(`ssh_user_home_dir_filetrans',`
        ')
 
        userdom_user_home_dir_filetrans($1, ssh_home_t, dir, .ssh)
+       userdom_user_home_dir_filetrans($1, ssh_home_t, dir, .shosts)
 ')

diff --git a/policy/modules/services/virt.fc b/policy/modules/services/virt.fc
index 1b33cbb8f4bfaacd86b4991e8d6a0ac16d8d4b99..9682c441f0af37e06bf7d38d148b3f39b1ee07aa 100644 (file)
--- a/policy/modules/services/virt.fc
+++ b/policy/modules/services/virt.fc
@@ -1,6 +1,6 @@
 HOME_DIR/.libvirt(/.*)?        gen_context(system_u:object_r:virt_home_t,s0)
 HOME_DIR/.virtinst(/.*)?       gen_context(system_u:object_r:virt_home_t,s0)
-HOME_DIR/VirtualMachines(/.*)?         gen_context(system_u:object_r:virt_image_t,s0)
+HOME_DIR/VirtualMachines(/.*)?         gen_context(system_u:object_r:virt_home_t,s0)
 HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
 
 /etc/libvirt           -d      gen_context(system_u:object_r:virt_etc_t,s0)

diff --git a/policy/modules/services/virt.if b/policy/modules/services/virt.if
index b961fd7c6287313d788cf9710221dffbdaceece3..05a705440e9c8821a3ae0395dd2ef1b448db6cb2 100644 (file)
--- a/policy/modules/services/virt.if
+++ b/policy/modules/services/virt.if
@@ -736,3 +736,23 @@ interface(`virt_manage_tmpfs_files',`
 
        allow $1 virt_tmpfs_type:file manage_file_perms;
 ')
+
+########################################
+## <summary>
+##     Create .virt directory in the user home directory
+##     with an correct label.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`virt_user_home_dir_filetrans',`
+       gen_require(`
+               type virt_home_t;
+       ')
+
+       userdom_user_home_dir_filetrans($1, virt_home_t, dir, .libvirt)
+       userdom_user_home_dir_filetrans($1, virt_home_t, dir, .virtinst)
+')

diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
index 62b0b98da94256846df4a953724aede85342eb34..daed4fdbeef11a34ff3020bbc22211be0978174e 100644 (file)
--- a/policy/modules/services/xserver.fc
+++ b/policy/modules/services/xserver.fc
@@ -9,7 +9,6 @@ HOME_DIR/\.fonts/auto(/.*)?     gen_context(system_u:object_r:user_fonts_cache_t,s0)
 HOME_DIR/\.fonts\.cache-.* --  gen_context(system_u:object_r:user_fonts_cache_t,s0)
 HOME_DIR/\.DCOP.*         --   gen_context(system_u:object_r:iceauth_home_t,s0)
 HOME_DIR/\.ICEauthority.* --   gen_context(system_u:object_r:iceauth_home_t,s0)
-HOME_DIR/\.ICEauthority.* --   gen_context(system_u:object_r:iceauth_home_t,s0)
 HOME_DIR/\.serverauth.*        --      gen_context(system_u:object_r:xauth_home_t,s0)
 HOME_DIR/\.xauth.*     --      gen_context(system_u:object_r:xauth_home_t,s0)
 HOME_DIR/\.Xauthority.*        --      gen_context(system_u:object_r:xauth_home_t,s0)

diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index 33c8170f5bc493016be6e84a1847be3777973d40..4858165df37497c25d44df1b369d266fea39e931 100644 (file)
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -482,6 +482,7 @@ template(`xserver_object_types_template',`
 template(`xserver_user_x_domain_template',`
        gen_require(`
                type xdm_t, xdm_tmp_t, xserver_tmpfs_t;
+               type xdm_home_t;
                type xauth_home_t, iceauth_home_t, xserver_t;
        ')
 
@@ -493,6 +494,13 @@ template(`xserver_user_x_domain_template',`
        allow $2 xauth_home_t:file read_file_perms;
        allow $2 iceauth_home_t:file read_file_perms;
 
+       userdom_user_home_dir_filetrans($1, iceauth_home_t, file, .DCOP)
+       userdom_user_home_dir_filetrans($1, iceauth_home_t, file, .ICEauthority)
+       userdom_user_home_dir_filetrans($1, xauth_home_t, file, .Xauthority)
+       userdom_user_home_dir_filetrans($1, xauth_home_t, file, .xauth)
+       userdom_user_home_dir_filetrans($1, xdm_home_t, file, .xsession-errors)
+       userdom_user_home_dir_filetrans($1, xdm_home_t, file, .dmrc)
+
        # for when /tmp/.X11-unix is created by the system
        allow $2 xdm_t:fd use;
        allow $2 xdm_t:fifo_file rw_inherited_fifo_file_perms;
@@ -1834,7 +1842,7 @@ interface(`xserver_read_home_fonts',`
 #
 interface(`xserver_manage_home_fonts',`
        gen_require(`
-               type user_fonts_t, user_fonts_config_t;
+               type user_fonts_t, user_fonts_config_t, user_fonts_cache_t;
        ')
 
        manage_dirs_pattern($1, user_fonts_t, user_fonts_t)
@@ -1842,4 +1850,9 @@ interface(`xserver_manage_home_fonts',`
        manage_lnk_files_pattern($1, user_fonts_t, user_fonts_t)
 
        manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t)
+
+       userdom_user_home_dir_filetrans($1, user_fonts_config_t, file, .k5login)
+       userdom_user_home_dir_filetrans($1, user_fonts_t, dir, .fonts.d)
+       userdom_user_home_dir_filetrans($1, user_fonts_t, dir, .fonts)
+       userdom_user_home_dir_filetrans($1, user_fonts_cache_t, dir, .fontconfig)
 ')

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index fd286479aaffb6d86e4f5a81ece90b8061d43a49..78f35d21864519cb135a568da4851d1283712590 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -937,6 +937,7 @@ template(`userdom_login_user_template', `
 
        optional_policy(`
                kerberos_use($1_usertype)
+               kerberos_filetrans_home_content($1_usertype)
        ')
 
        optional_policy(`