policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 colord_read_lib_files($1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 dbus_system_bus_client($1_usertype)
 696
 697                 allow $1_usertype $1_usertype:dbus  send_msg;
 698
 699                 optional_policy(`
 700                         avahi_dbus_chat($1_usertype)
 701                 ')
 702
 703                 optional_policy(`
 704                         policykit_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         bluetooth_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         consolekit_dbus_chat($1_usertype)
 713                         consolekit_read_log($1_usertype)
 714                 ')
 715
 716                 optional_policy(`
 717                         devicekit_dbus_chat($1_usertype)
 718                         devicekit_dbus_chat_power($1_usertype)
 719                         devicekit_dbus_chat_disk($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 tunable_policy(`allow_user_mysql_connect',`
 784                         mysql_stream_connect($1_t)
 785                 ')
 786         ')
 787
 788         optional_policy(`
 789                 oident_manage_user_content($1_t)
 790                 oident_relabel_user_content($1_t)
 791         ')
 792
 793         optional_policy(`
 794                 # to allow monitoring of pcmcia status
 795                 pcmcia_read_pid($1_usertype)
 796         ')
 797
 798         optional_policy(`
 799                 pcscd_read_pub_files($1_usertype)
 800                 pcscd_stream_connect($1_usertype)
 801         ')
 802
 803         optional_policy(`
 804                 tunable_policy(`allow_user_postgresql_connect',`
 805                         postgresql_stream_connect($1_usertype)
 806                         postgresql_tcp_connect($1_usertype)
 807                 ')
 808         ')
 809
 810         optional_policy(`
 811                 resmgr_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 rpc_dontaudit_getattr_exports($1_usertype)
 816                 rpc_manage_nfs_rw_content($1_usertype)
 817         ')
 818
 819         optional_policy(`
 820                 rpcbind_stream_connect($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 samba_stream_connect_winbind($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 sandbox_transition($1_usertype, $1_r)
 829         ')
 830
 831         optional_policy(`
 832                 seunshare_role_template($1, $1_r, $1_t)
 833         ')
 834
 835         optional_policy(`
 836                 slrnpull_search_spool($1_usertype)
 837         ')
 838
 839         optional_policy(`
 840                 thumb_role($1_r, $1_usertype)
 841         ')
 842 ')
 843
 844 #######################################
 845 ## <summary>
 846 ##      The template for creating a login user.
 847 ## </summary>
 848 ## <desc>
 849 ##      <p>
 850 ##      This template creates a user domain, types, and
 851 ##      rules for the user's tty, pty, home directories,
 852 ##      tmp, and tmpfs files.
 853 ##      </p>
 854 ## </desc>
 855 ## <param name="userdomain_prefix">
 856 ##      <summary>
 857 ##      The prefix of the user domain (e.g., user
 858 ##      is the prefix for user_t).
 859 ##      </summary>
 860 ## </param>
 861 #
 862 template(`userdom_login_user_template', `
 863         gen_require(`
 864                 class context contains;
 865         ')
 866
 867         userdom_base_user_template($1)
 868
 869         userdom_manage_home_role($1_r, $1_usertype)
 870
 871         userdom_manage_tmp_role($1_r, $1_usertype)
 872         userdom_manage_tmpfs_role($1_r, $1_usertype)
 873
 874         ifelse(`$1',`unconfined',`',`
 875                 gen_tunable(allow_$1_exec_content, true)
 876
 877                 tunable_policy(`allow_$1_exec_content',`
 878                         userdom_exec_user_tmp_files($1_usertype)
 879                         userdom_exec_user_home_content_files($1_usertype)
 880                 ')
 881                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 882                         fs_exec_nfs_files($1_usertype)
 883                 ')
 884
 885                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 886                         fs_exec_cifs_files($1_usertype)
 887                 ')
 888         ')
 889
 890         userdom_change_password_template($1)
 891
 892         ##############################
 893         #
 894         # User domain Local policy
 895         #
 896
 897         allow $1_t self:capability { setgid chown fowner };
 898         dontaudit $1_t self:capability { sys_nice fsetid };
 899
 900         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 901         dontaudit $1_t self:process setrlimit;
 902         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 903
 904         allow $1_t self:context contains;
 905
 906         kernel_dontaudit_read_system_state($1_usertype)
 907         kernel_dontaudit_list_all_proc($1_usertype)
 908
 909         dev_read_sysfs($1_usertype)
 910         dev_read_urand($1_usertype)
 911
 912         domain_use_interactive_fds($1_usertype)
 913         # Command completion can fire hundreds of denials
 914         domain_dontaudit_exec_all_entry_files($1_usertype)
 915
 916         files_dontaudit_list_default($1_usertype)
 917         files_dontaudit_read_default_files($1_usertype)
 918         # Stat lost+found.
 919         files_getattr_lost_found_dirs($1_usertype)
 920
 921         fs_get_all_fs_quotas($1_usertype)
 922         fs_getattr_all_fs($1_usertype)
 923         fs_search_all($1_usertype)
 924         fs_list_inotifyfs($1_usertype)
 925         fs_rw_anon_inodefs_files($1_usertype)
 926
 927         auth_dontaudit_write_login_records($1_t)
 928         auth_rw_cache($1_t)
 929
 930         application_exec_all($1_t)
 931         # The library functions always try to open read-write first,
 932         # then fall back to read-only if it fails.
 933         init_dontaudit_rw_utmp($1_t)
 934
 935         # Stop warnings about access to /dev/console
 936         init_dontaudit_use_fds($1_usertype)
 937         init_dontaudit_use_script_fds($1_usertype)
 938
 939         libs_exec_lib_files($1_usertype)
 940
 941         logging_dontaudit_getattr_all_logs($1_usertype)
 942
 943         # for running TeX programs
 944         miscfiles_read_tetex_data($1_usertype)
 945         miscfiles_exec_tetex_data($1_usertype)
 946
 947         seutil_read_config($1_usertype)
 948
 949         optional_policy(`
 950                 cups_read_config($1_usertype)
 951                 cups_stream_connect($1_usertype)
 952                 cups_stream_connect_ptal($1_usertype)
 953         ')
 954
 955         optional_policy(`
 956                 kerberos_use($1_usertype)
 957                 kerberos_filetrans_home_content($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 mta_dontaudit_read_spool_symlinks($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 quota_dontaudit_getattr_db($1_usertype)
 966         ')
 967
 968         optional_policy(`
 969                 rpm_read_db($1_usertype)
 970                 rpm_dontaudit_manage_db($1_usertype)
 971                 rpm_read_cache($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 oddjob_run_mkhomedir($1_t, $1_r)
 976         ')
 977 ')
 978
 979 #######################################
 980 ## <summary>
 981 ##      The template for creating a unprivileged login user.
 982 ## </summary>
 983 ## <desc>
 984 ##      <p>
 985 ##      This template creates a user domain, types, and
 986 ##      rules for the user's tty, pty, home directories,
 987 ##      tmp, and tmpfs files.
 988 ##      </p>
 989 ## </desc>
 990 ## <param name="userdomain_prefix">
 991 ##      <summary>
 992 ##      The prefix of the user domain (e.g., user
 993 ##      is the prefix for user_t).
 994 ##      </summary>
 995 ## </param>
 996 #
 997 template(`userdom_restricted_user_template',`
 998         gen_require(`
 999                 attribute unpriv_userdomain;
1000         ')
1001
1002         userdom_login_user_template($1)
1003
1004         typeattribute $1_t unpriv_userdomain;
1005         domain_interactive_fd($1_t)
1006
1007         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1008         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1009
1010         ##############################
1011         #
1012         # Local policy
1013         #
1014
1015         optional_policy(`
1016                 loadkeys_run($1_t, $1_r)
1017         ')
1018 ')
1019
1020 #######################################
1021 ## <summary>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ## </summary>
1024 ## <desc>
1025 ##      <p>
1026 ##      The template for creating a unprivileged xwindows login user.
1027 ##      </p>
1028 ##      <p>
1029 ##      This template creates a user domain, types, and
1030 ##      rules for the user's tty, pty, home directories,
1031 ##      tmp, and tmpfs files.
1032 ##      </p>
1033 ## </desc>
1034 ## <param name="userdomain_prefix">
1035 ##      <summary>
1036 ##      The prefix of the user domain (e.g., user
1037 ##      is the prefix for user_t).
1038 ##      </summary>
1039 ## </param>
1040 #
1041 template(`userdom_restricted_xwindows_user_template',`
1042
1043         userdom_restricted_user_template($1)
1044
1045         ##############################
1046         #
1047         # Local policy
1048         #
1049
1050         auth_role($1_r, $1_t)
1051         auth_search_pam_console_data($1_usertype)
1052         auth_dontaudit_read_login_records($1_usertype)
1053
1054         dev_read_sound($1_usertype)
1055         dev_write_sound($1_usertype)
1056         # gnome keyring wants to read this.
1057         dev_dontaudit_read_rand($1_usertype)
1058         # temporarily allow since openoffice requires this
1059         dev_read_rand($1_usertype)
1060
1061         dev_read_video_dev($1_usertype)
1062         dev_write_video_dev($1_usertype)
1063         dev_rw_wireless($1_usertype)
1064
1065         libs_dontaudit_setattr_lib_files($1_usertype)
1066
1067         tunable_policy(`user_rw_noexattrfile',`
1068                 dev_rw_usbfs($1_t)
1069                 dev_rw_generic_usb_dev($1_usertype)
1070
1071                 fs_manage_noxattr_fs_files($1_usertype)
1072                 fs_manage_noxattr_fs_dirs($1_usertype)
1073                 fs_manage_dos_dirs($1_usertype)
1074                 fs_manage_dos_files($1_usertype)
1075                 storage_raw_read_removable_device($1_usertype)
1076                 storage_raw_write_removable_device($1_usertype)
1077         ')
1078
1079         logging_send_syslog_msg($1_usertype)
1080         logging_dontaudit_send_audit_msgs($1_t)
1081
1082         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1083         logging_send_audit_msgs($1_t)
1084         selinux_get_enforce_mode($1_t)
1085         seutil_exec_restorecond($1_t)
1086         seutil_read_file_contexts($1_t)
1087         seutil_read_default_contexts($1_t)
1088
1089         xserver_restricted_role($1_r, $1_t)
1090
1091         optional_policy(`
1092                 alsa_read_rw_config($1_usertype)
1093         ')
1094
1095          # cjp: needed by KDE apps
1096          # bug: #682499
1097          optional_policy(`
1098                 gnome_read_usr_config($1_usertype)
1099                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1100         ')
1101
1102         optional_policy(`
1103                 dbus_role_template($1, $1_r, $1_usertype)
1104                 dbus_system_bus_client($1_usertype)
1105                 allow $1_usertype $1_usertype:dbus send_msg;
1106
1107                 optional_policy(`
1108                         abrt_dbus_chat($1_usertype)
1109                         abrt_run_helper($1_usertype, $1_r)
1110                 ')
1111
1112                 optional_policy(`
1113                         consolekit_dontaudit_read_log($1_usertype)
1114                         consolekit_dbus_chat($1_usertype)
1115                 ')
1116
1117                 optional_policy(`
1118                         cups_dbus_chat($1_usertype)
1119                         cups_dbus_chat_config($1_usertype)
1120                 ')
1121
1122                 optional_policy(`
1123                         devicekit_dbus_chat($1_usertype)
1124                         devicekit_dbus_chat_disk($1_usertype)
1125                         devicekit_dbus_chat_power($1_usertype)
1126                 ')
1127
1128                 optional_policy(`
1129                         fprintd_dbus_chat($1_t)
1130                 ')
1131         ')
1132
1133         optional_policy(`
1134                 policykit_role($1_r, $1_usertype)
1135         ')
1136
1137         optional_policy(`
1138                 pulseaudio_role($1_r, $1_usertype)
1139                 pulseaudio_filetrans_admin_home_content($1_usertype)
1140                 pulseaudio_filetrans_home_content($1_usertype)
1141         ')
1142
1143         optional_policy(`
1144                 rtkit_scheduled($1_usertype)
1145         ')
1146
1147         optional_policy(`
1148                 setroubleshoot_dontaudit_stream_connect($1_t)
1149         ')
1150
1151         optional_policy(`
1152                 udev_read_db($1_usertype)
1153         ')
1154
1155         optional_policy(`
1156                 wm_role_template($1, $1_r, $1_t)
1157         ')
1158 ')
1159
1160 #######################################
1161 ## <summary>
1162 ##      The template for creating a unprivileged user roughly
1163 ##      equivalent to a regular linux user.
1164 ## </summary>
1165 ## <desc>
1166 ##      <p>
1167 ##      The template for creating a unprivileged user roughly
1168 ##      equivalent to a regular linux user.
1169 ##      </p>
1170 ##      <p>
1171 ##      This template creates a user domain, types, and
1172 ##      rules for the user's tty, pty, home directories,
1173 ##      tmp, and tmpfs files.
1174 ##      </p>
1175 ## </desc>
1176 ## <param name="userdomain_prefix">
1177 ##      <summary>
1178 ##      The prefix of the user domain (e.g., user
1179 ##      is the prefix for user_t).
1180 ##      </summary>
1181 ## </param>
1182 #
1183 template(`userdom_unpriv_user_template', `
1184
1185         ##############################
1186         #
1187         # Declarations
1188         #
1189
1190         # Inherit rules for ordinary users.
1191         userdom_restricted_xwindows_user_template($1)
1192         userdom_common_user_template($1)
1193
1194         ##############################
1195         #
1196         # Local policy
1197         #
1198
1199         # port access is audited even if dac would not have allowed it, so dontaudit it here
1200 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1201         # Need the following rule to allow users to run vpnc
1202         corenet_tcp_bind_xserver_port($1_t)
1203         corenet_tcp_bind_generic_node($1_usertype)
1204
1205         storage_rw_fuse($1_t)
1206
1207         files_exec_usr_files($1_t)
1208    # cjp: why?
1209         files_read_kernel_symbol_table($1_t)
1210
1211         ifndef(`enable_mls',`
1212                 fs_exec_noxattr($1_t)
1213
1214                 tunable_policy(`user_rw_noexattrfile',`
1215                         fs_manage_noxattr_fs_files($1_t)
1216                         fs_manage_noxattr_fs_dirs($1_t)
1217                         # Write floppies
1218                         storage_raw_read_removable_device($1_t)
1219                         storage_raw_write_removable_device($1_t)
1220                 ',`
1221                         storage_raw_read_removable_device($1_t)
1222                 ')
1223         ')
1224
1225         miscfiles_read_hwdata($1_usertype)
1226
1227         # Allow users to run TCP servers (bind to ports and accept connection from
1228         # the same domain and outside users) disabling this forces FTP passive mode
1229         # and may change other protocols
1230
1231         tunable_policy(`user_share_music',`
1232                 corenet_tcp_bind_daap_port($1_usertype)
1233         ')
1234
1235         tunable_policy(`user_tcp_server',`
1236                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1237         ')
1238
1239         tunable_policy(`user_setrlimit',`
1240                 allow $1_usertype self:process setrlimit;
1241         ')
1242
1243         optional_policy(`
1244                 cdrecord_role($1_r, $1_t)
1245         ')
1246
1247         optional_policy(`
1248                 cron_role($1_r, $1_t)
1249         ')
1250
1251         optional_policy(`
1252                 gpg_role($1_r, $1_usertype)
1253         ')
1254
1255         optional_policy(`
1256                 gnomeclock_dbus_chat($1_t)
1257         ')
1258
1259         optional_policy(`
1260                 gpm_stream_connect($1_usertype)
1261         ')
1262
1263         optional_policy(`
1264                 mount_run_fusermount($1_t, $1_r)
1265                 mount_read_pid_files($1_t)
1266         ')
1267
1268         optional_policy(`
1269                 wine_role_template($1, $1_r, $1_t)
1270         ')
1271
1272         optional_policy(`
1273                 postfix_run_postdrop($1_t, $1_r)
1274                 postfix_search_spool($1_t)
1275         ')
1276
1277         # Run pppd in pppd_t by default for user
1278         optional_policy(`
1279                 ppp_run_cond($1_t, $1_r)
1280         ')
1281
1282         optional_policy(`
1283                 vdagent_getattr_log($1_t)
1284                 vdagent_getattr_exec($1_t)
1285                 vdagent_stream_connect($1_t)
1286         ')
1287 ')
1288
1289 #######################################
1290 ## <summary>
1291 ##      The template for creating an administrative user.
1292 ## </summary>
1293 ## <desc>
1294 ##      <p>
1295 ##      This template creates a user domain, types, and
1296 ##      rules for the user's tty, pty, home directories,
1297 ##      tmp, and tmpfs files.
1298 ##      </p>
1299 ##      <p>
1300 ##      The privileges given to administrative users are:
1301 ##      <ul>
1302 ##              <li>Raw disk access</li>
1303 ##              <li>Set all sysctls</li>
1304 ##              <li>All kernel ring buffer controls</li>
1305 ##              <li>Create, read, write, and delete all files but shadow</li>
1306 ##              <li>Manage source and binary format SELinux policy</li>
1307 ##              <li>Run insmod</li>
1308 ##      </ul>
1309 ##      </p>
1310 ## </desc>
1311 ## <param name="userdomain_prefix">
1312 ##      <summary>
1313 ##      The prefix of the user domain (e.g., sysadm
1314 ##      is the prefix for sysadm_t).
1315 ##      </summary>
1316 ## </param>
1317 #
1318 template(`userdom_admin_user_template',`
1319         gen_require(`
1320                 attribute admindomain;
1321                 class passwd { passwd chfn chsh rootok crontab };
1322         ')
1323
1324         ##############################
1325         #
1326         # Declarations
1327         #
1328
1329         # Inherit rules for ordinary users.
1330         userdom_login_user_template($1)
1331         userdom_common_user_template($1)
1332
1333         domain_obj_id_change_exemption($1_t)
1334         role system_r types $1_t;
1335
1336         typeattribute $1_t admindomain;
1337
1338         ifdef(`direct_sysadm_daemon',`
1339                 domain_system_change_exemption($1_t)
1340         ')
1341
1342         ##############################
1343         #
1344         # $1_t local policy
1345         #
1346
1347         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1348         tunable_policy(`deny_ptrace',`',`
1349                 allow $1_t self:capability sys_ptrace;
1350         ')
1351         allow $1_t self:capability2 syslog;
1352         allow $1_t self:process { setexec setfscreate };
1353         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1354         allow $1_t self:tun_socket create;
1355         # Set password information for other users.
1356         allow $1_t self:passwd { passwd chfn chsh };
1357         # Skip authentication when pam_rootok is specified.
1358         allow $1_t self:passwd rootok;
1359
1360         # Manipulate other users crontab.
1361         allow $1_t self:passwd crontab;
1362
1363         kernel_read_software_raid_state($1_t)
1364         kernel_getattr_core_if($1_t)
1365         kernel_getattr_message_if($1_t)
1366         kernel_change_ring_buffer_level($1_t)
1367         kernel_clear_ring_buffer($1_t)
1368         kernel_read_ring_buffer($1_t)
1369         kernel_get_sysvipc_info($1_t)
1370         kernel_rw_all_sysctls($1_t)
1371         # signal unlabeled processes:
1372         kernel_kill_unlabeled($1_t)
1373         kernel_signal_unlabeled($1_t)
1374         kernel_sigstop_unlabeled($1_t)
1375         kernel_signull_unlabeled($1_t)
1376         kernel_sigchld_unlabeled($1_t)
1377         kernel_signal($1_t)
1378
1379         corenet_tcp_bind_generic_port($1_t)
1380         # allow setting up tunnels
1381         corenet_rw_tun_tap_dev($1_t)
1382
1383         dev_getattr_generic_blk_files($1_t)
1384         dev_getattr_generic_chr_files($1_t)
1385         # for lsof
1386         dev_getattr_mtrr_dev($1_t)
1387         # Allow MAKEDEV to work
1388         dev_create_all_blk_files($1_t)
1389         dev_create_all_chr_files($1_t)
1390         dev_delete_all_blk_files($1_t)
1391         dev_delete_all_chr_files($1_t)
1392         dev_rename_all_blk_files($1_t)
1393         dev_rename_all_chr_files($1_t)
1394         dev_create_generic_symlinks($1_t)
1395         dev_rw_generic_usb_dev($1_t)
1396         dev_rw_usbfs($1_t)
1397
1398         domain_setpriority_all_domains($1_t)
1399         domain_read_all_domains_state($1_t)
1400         domain_getattr_all_domains($1_t)
1401         domain_getcap_all_domains($1_t)
1402         domain_dontaudit_ptrace_all_domains($1_t)
1403         # signal all domains:
1404         domain_kill_all_domains($1_t)
1405         domain_signal_all_domains($1_t)
1406         domain_signull_all_domains($1_t)
1407         domain_sigstop_all_domains($1_t)
1408         domain_sigstop_all_domains($1_t)
1409         domain_sigchld_all_domains($1_t)
1410         # for lsof
1411         domain_getattr_all_sockets($1_t)
1412         domain_dontaudit_getattr_all_sockets($1_t)
1413
1414         files_exec_usr_src_files($1_t)
1415
1416         fs_getattr_all_fs($1_t)
1417         fs_getattr_all_files($1_t)
1418         fs_list_all($1_t)
1419         fs_set_all_quotas($1_t)
1420         fs_exec_noxattr($1_t)
1421
1422         storage_raw_read_removable_device($1_t)
1423         storage_raw_write_removable_device($1_t)
1424         storage_dontaudit_read_fixed_disk($1_t)
1425
1426         term_use_all_inherited_terms($1_t)
1427         term_use_unallocated_ttys($1_t)
1428
1429         auth_getattr_shadow($1_t)
1430         # Manage almost all files
1431         files_manage_non_security_dirs($1_t)
1432         files_manage_non_security_files($1_t)
1433         # Relabel almost all files
1434         files_relabel_non_security_files($1_t)
1435
1436         init_telinit($1_t)
1437
1438         logging_send_syslog_msg($1_t)
1439
1440         optional_policy(`
1441                 modutils_domtrans_insmod($1_t)
1442                 modutils_domtrans_depmod($1_t)
1443         ')
1444
1445         # The following rule is temporary until such time that a complete
1446         # policy management infrastructure is in place so that an administrator
1447         # cannot directly manipulate policy files with arbitrary programs.
1448         seutil_manage_src_policy($1_t)
1449         # Violates the goal of limiting write access to checkpolicy.
1450         # But presently necessary for installing the file_contexts file.
1451         seutil_manage_bin_policy($1_t)
1452
1453         systemd_config_all_services($1_t)
1454
1455         userdom_manage_user_home_content_dirs($1_t)
1456         userdom_manage_user_home_content_files($1_t)
1457         userdom_manage_user_home_content_symlinks($1_t)
1458         userdom_manage_user_home_content_pipes($1_t)
1459         userdom_manage_user_home_content_sockets($1_t)
1460         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1461
1462         tunable_policy(`user_rw_noexattrfile',`
1463                 fs_manage_noxattr_fs_files($1_t)
1464                 fs_manage_noxattr_fs_dirs($1_t)
1465         ',`
1466                 fs_read_noxattr_fs_files($1_t)
1467         ')
1468
1469         optional_policy(`
1470                 postgresql_unconfined($1_t)
1471         ')
1472
1473         optional_policy(`
1474                 userhelper_exec($1_t)
1475         ')
1476 ')
1477
1478 ########################################
1479 ## <summary>
1480 ##      Allow user to run as a secadm
1481 ## </summary>
1482 ## <desc>
1483 ##      <p>
1484 ##      Create objects in a user home directory
1485 ##      with an automatic type transition to
1486 ##      a specified private type.
1487 ##      </p>
1488 ##      <p>
1489 ##      This is a templated interface, and should only
1490 ##      be called from a per-userdomain template.
1491 ##      </p>
1492 ## </desc>
1493 ## <param name="domain">
1494 ##      <summary>
1495 ##      Domain allowed access.
1496 ##      </summary>
1497 ## </param>
1498 ## <param name="role">
1499 ##      <summary>
1500 ##      The role  of the object to create.
1501 ##      </summary>
1502 ## </param>
1503 #
1504 template(`userdom_security_admin_template',`
1505         allow $1 self:capability { dac_read_search dac_override };
1506
1507         corecmd_exec_shell($1)
1508
1509         domain_obj_id_change_exemption($1)
1510
1511         dev_relabel_all_dev_nodes($1)
1512
1513         files_create_boot_flag($1)
1514         files_create_default_dir($1)
1515         files_root_filetrans_default($1, dir)
1516
1517         # Necessary for managing /boot/efi
1518         fs_manage_dos_files($1)
1519
1520         mls_process_read_up($1)
1521         mls_file_read_all_levels($1)
1522         mls_file_upgrade($1)
1523         mls_file_downgrade($1)
1524
1525         selinux_set_enforce_mode($1)
1526         selinux_set_all_booleans($1)
1527         selinux_set_parameters($1)
1528         selinux_read_policy($1)
1529
1530         files_relabel_all_files($1)
1531         auth_relabel_shadow($1)
1532
1533         init_exec($1)
1534
1535         logging_send_syslog_msg($1)
1536         logging_read_audit_log($1)
1537         logging_read_generic_logs($1)
1538         logging_read_audit_config($1)
1539
1540         seutil_manage_bin_policy($1)
1541         seutil_manage_default_contexts($1)
1542         seutil_manage_file_contexts($1)
1543         seutil_manage_module_store($1)
1544         seutil_manage_config($1)
1545         seutil_run_checkpolicy($1,$2)
1546         seutil_run_loadpolicy($1,$2)
1547         seutil_run_semanage($1,$2)
1548         seutil_run_setsebool($1,$2)
1549         seutil_run_setfiles($1, $2)
1550
1551         seutil_manage_bin_policy($1)
1552     seutil_manage_default_contexts($1)
1553     seutil_manage_file_contexts($1)
1554     seutil_manage_module_store($1)
1555     seutil_manage_config($1)
1556
1557         optional_policy(`
1558                 aide_run($1,$2)
1559         ')
1560
1561         optional_policy(`
1562                 consoletype_exec($1)
1563         ')
1564
1565         optional_policy(`
1566                 dmesg_exec($1)
1567         ')
1568
1569         optional_policy(`
1570                 ipsec_run_setkey($1,$2)
1571         ')
1572
1573         optional_policy(`
1574                 netlabel_run_mgmt($1,$2)
1575         ')
1576
1577         optional_policy(`
1578                 samhain_run($1, $2)
1579         ')
1580 ')
1581
1582 ########################################
1583 ## <summary>
1584 ##      Make the specified type usable in a
1585 ##      user home directory.
1586 ## </summary>
1587 ## <param name="type">
1588 ##      <summary>
1589 ##      Type to be used as a file in the
1590 ##      user home directory.
1591 ##      </summary>
1592 ## </param>
1593 #
1594 interface(`userdom_user_home_content',`
1595         gen_require(`
1596                 type user_home_t;
1597                 attribute user_home_type;
1598         ')
1599
1600         allow $1 user_home_t:filesystem associate;
1601         files_type($1)
1602         ubac_constrained($1)
1603
1604         files_poly_member($1)
1605         typeattribute $1  user_home_type;
1606 ')
1607
1608 ########################################
1609 ## <summary>
1610 ##      Make the specified type usable in a
1611 ##      generic temporary directory.
1612 ## </summary>
1613 ## <param name="type">
1614 ##      <summary>
1615 ##      Type to be used as a file in the
1616 ##      generic temporary directory.
1617 ##      </summary>
1618 ## </param>
1619 #
1620 interface(`userdom_user_tmp_content',`
1621         gen_require(`
1622                 attribute user_tmp_type;
1623         ')
1624
1625         typeattribute $1 user_tmp_type;
1626
1627         files_tmp_file($1)
1628         ubac_constrained($1)
1629 ')
1630
1631 ########################################
1632 ## <summary>
1633 ##      Make the specified type usable in a
1634 ##      generic tmpfs_t directory.
1635 ## </summary>
1636 ## <param name="type">
1637 ##      <summary>
1638 ##      Type to be used as a file in the
1639 ##      generic temporary directory.
1640 ##      </summary>
1641 ## </param>
1642 #
1643 interface(`userdom_user_tmpfs_content',`
1644         gen_require(`
1645                 attribute user_tmpfs_type;
1646         ')
1647
1648         typeattribute $1 user_tmpfs_type;
1649
1650         files_tmpfs_file($1)
1651         ubac_constrained($1)
1652 ')
1653
1654 ########################################
1655 ## <summary>
1656 ##      Allow domain to attach to TUN devices created by administrative users.
1657 ## </summary>
1658 ## <param name="domain">
1659 ##      <summary>
1660 ##      Domain allowed access.
1661 ##      </summary>
1662 ## </param>
1663 #
1664 interface(`userdom_attach_admin_tun_iface',`
1665         gen_require(`
1666                 attribute admindomain;
1667         ')
1668
1669         allow $1 admindomain:tun_socket relabelfrom;
1670         allow $1 self:tun_socket relabelto;
1671 ')
1672
1673 ########################################
1674 ## <summary>
1675 ##      Set the attributes of a user pty.
1676 ## </summary>
1677 ## <param name="domain">
1678 ##      <summary>
1679 ##      Domain allowed access.
1680 ##      </summary>
1681 ## </param>
1682 #
1683 interface(`userdom_setattr_user_ptys',`
1684         gen_require(`
1685                 type user_devpts_t;
1686         ')
1687
1688         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1689 ')
1690
1691 ########################################
1692 ## <summary>
1693 ##      Create a user pty.
1694 ## </summary>
1695 ## <param name="domain">
1696 ##      <summary>
1697 ##      Domain allowed access.
1698 ##      </summary>
1699 ## </param>
1700 #
1701 interface(`userdom_create_user_pty',`
1702         gen_require(`
1703                 type user_devpts_t;
1704         ')
1705
1706         term_create_pty($1, user_devpts_t)
1707 ')
1708
1709 ########################################
1710 ## <summary>
1711 ##      Get the attributes of user home directories.
1712 ## </summary>
1713 ## <param name="domain">
1714 ##      <summary>
1715 ##      Domain allowed access.
1716 ##      </summary>
1717 ## </param>
1718 #
1719 interface(`userdom_getattr_user_home_dirs',`
1720         gen_require(`
1721                 type user_home_dir_t;
1722         ')
1723
1724         allow $1 user_home_dir_t:dir getattr_dir_perms;
1725         files_search_home($1)
1726 ')
1727
1728 ########################################
1729 ## <summary>
1730 ##      Do not audit attempts to get the attributes of user home directories.
1731 ## </summary>
1732 ## <param name="domain">
1733 ##      <summary>
1734 ##      Domain to not audit.
1735 ##      </summary>
1736 ## </param>
1737 #
1738 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1739         gen_require(`
1740                 type user_home_dir_t;
1741         ')
1742
1743         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1744 ')
1745
1746 ########################################
1747 ## <summary>
1748 ##      Search user home directories.
1749 ## </summary>
1750 ## <param name="domain">
1751 ##      <summary>
1752 ##      Domain allowed access.
1753 ##      </summary>
1754 ## </param>
1755 #
1756 interface(`userdom_search_user_home_dirs',`
1757         gen_require(`
1758                 type user_home_dir_t;
1759         ')
1760
1761         allow $1 user_home_dir_t:dir search_dir_perms;
1762         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1763         files_search_home($1)
1764 ')
1765
1766 ########################################
1767 ## <summary>
1768 ##      Do not audit attempts to search user home directories.
1769 ## </summary>
1770 ## <desc>
1771 ##      <p>
1772 ##      Do not audit attempts to search user home directories.
1773 ##      This will supress SELinux denial messages when the specified
1774 ##      domain is denied the permission to search these directories.
1775 ##      </p>
1776 ## </desc>
1777 ## <param name="domain">
1778 ##      <summary>
1779 ##      Domain to not audit.
1780 ##      </summary>
1781 ## </param>
1782 ## <infoflow type="none"/>
1783 #
1784 interface(`userdom_dontaudit_search_user_home_dirs',`
1785         gen_require(`
1786                 type user_home_dir_t;
1787         ')
1788
1789         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1790 ')
1791
1792 ########################################
1793 ## <summary>
1794 ##      List user home directories.
1795 ## </summary>
1796 ## <param name="domain">
1797 ##      <summary>
1798 ##      Domain allowed access.
1799 ##      </summary>
1800 ## </param>
1801 #
1802 interface(`userdom_list_user_home_dirs',`
1803         gen_require(`
1804                 type user_home_dir_t;
1805         ')
1806
1807         allow $1 user_home_dir_t:dir list_dir_perms;
1808         files_search_home($1)
1809
1810         tunable_policy(`use_nfs_home_dirs',`
1811                 fs_list_nfs($1)
1812         ')
1813
1814         tunable_policy(`use_samba_home_dirs',`
1815                 fs_list_cifs($1)
1816         ')
1817 ')
1818
1819 ########################################
1820 ## <summary>
1821 ##      Do not audit attempts to list user home subdirectories.
1822 ## </summary>
1823 ## <param name="domain">
1824 ##      <summary>
1825 ##      Domain to not audit.
1826 ##      </summary>
1827 ## </param>
1828 #
1829 interface(`userdom_dontaudit_list_user_home_dirs',`
1830         gen_require(`
1831                 type user_home_dir_t;
1832                 type user_home_t;
1833         ')
1834
1835         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1836         dontaudit $1 user_home_t:dir list_dir_perms;
1837 ')
1838
1839 ########################################
1840 ## <summary>
1841 ##      Create user home directories.
1842 ## </summary>
1843 ## <param name="domain">
1844 ##      <summary>
1845 ##      Domain allowed access.
1846 ##      </summary>
1847 ## </param>
1848 #
1849 interface(`userdom_create_user_home_dirs',`
1850         gen_require(`
1851                 type user_home_dir_t;
1852         ')
1853
1854         allow $1 user_home_dir_t:dir create_dir_perms;
1855 ')
1856
1857 ########################################
1858 ## <summary>
1859 ##      Create user home directories.
1860 ## </summary>
1861 ## <param name="domain">
1862 ##      <summary>
1863 ##      Domain allowed access.
1864 ##      </summary>
1865 ## </param>
1866 #
1867 interface(`userdom_manage_user_home_dirs',`
1868         gen_require(`
1869                 type user_home_dir_t;
1870         ')
1871
1872         allow $1 user_home_dir_t:dir manage_dir_perms;
1873 ')
1874
1875 ########################################
1876 ## <summary>
1877 ##      Relabel to user home directories.
1878 ## </summary>
1879 ## <param name="domain">
1880 ##      <summary>
1881 ##      Domain allowed access.
1882 ##      </summary>
1883 ## </param>
1884 #
1885 interface(`userdom_relabelto_user_home_dirs',`
1886         gen_require(`
1887                 type user_home_dir_t;
1888         ')
1889
1890         allow $1 user_home_dir_t:dir relabelto;
1891 ')
1892
1893
1894 ########################################
1895 ## <summary>
1896 ##      Relabel to user home files.
1897 ## </summary>
1898 ## <param name="domain">
1899 ##      <summary>
1900 ##      Domain allowed access.
1901 ##      </summary>
1902 ## </param>
1903 #
1904 interface(`userdom_relabelto_user_home_files',`
1905         gen_require(`
1906                 type user_home_t;
1907         ')
1908
1909         allow $1 user_home_t:file relabelto;
1910 ')
1911 ########################################
1912 ## <summary>
1913 ##      Relabel user home files.
1914 ## </summary>
1915 ## <param name="domain">
1916 ##      <summary>
1917 ##      Domain allowed access.
1918 ##      </summary>
1919 ## </param>
1920 #
1921 interface(`userdom_relabel_user_home_files',`
1922         gen_require(`
1923                 type user_home_t;
1924         ')
1925
1926         allow $1 user_home_t:file relabel_file_perms;
1927 ')
1928
1929 ########################################
1930 ## <summary>
1931 ##      Create directories in the home dir root with
1932 ##      the user home directory type.
1933 ## </summary>
1934 ## <param name="domain">
1935 ##      <summary>
1936 ##      Domain allowed access.
1937 ##      </summary>
1938 ## </param>
1939 #
1940 interface(`userdom_home_filetrans_user_home_dir',`
1941         gen_require(`
1942                 type user_home_dir_t;
1943         ')
1944
1945         files_home_filetrans($1, user_home_dir_t, dir)
1946 ')
1947
1948 ########################################
1949 ## <summary>
1950 ##      Do a domain transition to the specified
1951 ##      domain when executing a program in the
1952 ##      user home directory.
1953 ## </summary>
1954 ## <desc>
1955 ##      <p>
1956 ##      Do a domain transition to the specified
1957 ##      domain when executing a program in the
1958 ##      user home directory.
1959 ##      </p>
1960 ##      <p>
1961 ##      No interprocess communication (signals, pipes,
1962 ##      etc.) is provided by this interface since
1963 ##      the domains are not owned by this module.
1964 ##      </p>
1965 ## </desc>
1966 ## <param name="source_domain">
1967 ##      <summary>
1968 ##      Domain allowed to transition.
1969 ##      </summary>
1970 ## </param>
1971 ## <param name="target_domain">
1972 ##      <summary>
1973 ##      Domain to transition to.
1974 ##      </summary>
1975 ## </param>
1976 #
1977 interface(`userdom_user_home_domtrans',`
1978         gen_require(`
1979                 type user_home_dir_t, user_home_t;
1980         ')
1981
1982         domain_auto_trans($1, user_home_t, $2)
1983         allow $1 user_home_dir_t:dir search_dir_perms;
1984         files_search_home($1)
1985 ')
1986
1987 ########################################
1988 ## <summary>
1989 ##      Do not audit attempts to search user home content directories.
1990 ## </summary>
1991 ## <param name="domain">
1992 ##      <summary>
1993 ##      Domain to not audit.
1994 ##      </summary>
1995 ## </param>
1996 #
1997 interface(`userdom_dontaudit_search_user_home_content',`
1998         gen_require(`
1999                 type user_home_t;
2000         ')
2001
2002         dontaudit $1 user_home_t:dir search_dir_perms;
2003         fs_dontaudit_list_nfs($1)
2004         fs_dontaudit_list_cifs($1)
2005 ')
2006
2007 ########################################
2008 ## <summary>
2009 ##      List contents of users home directory.
2010 ## </summary>
2011 ## <param name="domain">
2012 ##      <summary>
2013 ##      Domain allowed access.
2014 ##      </summary>
2015 ## </param>
2016 #
2017 interface(`userdom_list_user_home_content',`
2018         gen_require(`
2019                 type user_home_dir_t;
2020                 attribute user_home_type;
2021         ')
2022
2023         files_list_home($1)
2024         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2025 ')
2026
2027 ########################################
2028 ## <summary>
2029 ##      Create, read, write, and delete directories
2030 ##      in a user home subdirectory.
2031 ## </summary>
2032 ## <param name="domain">
2033 ##      <summary>
2034 ##      Domain allowed access.
2035 ##      </summary>
2036 ## </param>
2037 #
2038 interface(`userdom_manage_user_home_content_dirs',`
2039         gen_require(`
2040                 type user_home_dir_t, user_home_t;
2041         ')
2042
2043         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2044         files_search_home($1)
2045 ')
2046
2047 ########################################
2048 ## <summary>
2049 ##      Delete directories in a user home subdirectory.
2050 ## </summary>
2051 ## <param name="domain">
2052 ##      <summary>
2053 ##      Domain allowed access.
2054 ##      </summary>
2055 ## </param>
2056 #
2057 interface(`userdom_delete_user_home_content_dirs',`
2058         gen_require(`
2059                 type user_home_t;
2060         ')
2061
2062         allow $1 user_home_t:dir delete_dir_perms;
2063 ')
2064
2065 ########################################
2066 ## <summary>
2067 ##      Delete all directories in a user home subdirectory.
2068 ## </summary>
2069 ## <param name="domain">
2070 ##      <summary>
2071 ##      Domain allowed access.
2072 ##      </summary>
2073 ## </param>
2074 #
2075 interface(`userdom_delete_all_user_home_content_dirs',`
2076         gen_require(`
2077                 attribute user_home_type;
2078         ')
2079
2080         allow $1 user_home_type:dir delete_dir_perms;
2081 ')
2082
2083 ########################################
2084 ## <summary>
2085 ##      Set the attributes of user home files.
2086 ## </summary>
2087 ## <param name="domain">
2088 ##      <summary>
2089 ##      Domain allowed access.
2090 ##      </summary>
2091 ## </param>
2092 ## <rolecap/>
2093 #
2094 interface(`userdom_setattr_user_home_content_files',`
2095         gen_require(`
2096                 type user_home_t;
2097         ')
2098
2099         allow $1 user_home_t:file setattr;
2100 ')
2101
2102 ########################################
2103 ## <summary>
2104 ##      Do not audit attempts to set the
2105 ##      attributes of user home files.
2106 ## </summary>
2107 ## <param name="domain">
2108 ##      <summary>
2109 ##      Domain to not audit.
2110 ##      </summary>
2111 ## </param>
2112 #
2113 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2114         gen_require(`
2115                 type user_home_t;
2116         ')
2117
2118         dontaudit $1 user_home_t:file setattr_file_perms;
2119 ')
2120
2121 ########################################
2122 ## <summary>
2123 ##      Set the attributes of all user home directories.
2124 ## </summary>
2125 ## <param name="domain">
2126 ##      <summary>
2127 ##      Domain allowed access.
2128 ##      </summary>
2129 ## </param>
2130 ## <rolecap/>
2131 #
2132 interface(`userdom_setattr_all_user_home_content_dirs',`
2133         gen_require(`
2134                 attribute user_home_type;
2135         ')
2136
2137         allow $1 user_home_type:dir setattr_dir_perms;
2138 ')
2139
2140 ########################################
2141 ## <summary>
2142 ##      Mmap user home files.
2143 ## </summary>
2144 ## <param name="domain">
2145 ##      <summary>
2146 ##      Domain allowed access.
2147 ##      </summary>
2148 ## </param>
2149 #
2150 interface(`userdom_mmap_user_home_content_files',`
2151         gen_require(`
2152                 type user_home_dir_t, user_home_t;
2153         ')
2154
2155         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2156         files_search_home($1)
2157 ')
2158
2159 ########################################
2160 ## <summary>
2161 ##      Read user home files.
2162 ## </summary>
2163 ## <param name="domain">
2164 ##      <summary>
2165 ##      Domain allowed access.
2166 ##      </summary>
2167 ## </param>
2168 #
2169 interface(`userdom_read_user_home_content_files',`
2170         gen_require(`
2171                 type user_home_dir_t, user_home_t;
2172         ')
2173
2174         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2175         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2176         files_search_home($1)
2177 ')
2178
2179 ########################################
2180 ## <summary>
2181 ##      Do not audit attempts to getattr user home files.
2182 ## </summary>
2183 ## <param name="domain">
2184 ##      <summary>
2185 ##      Domain to not audit.
2186 ##      </summary>
2187 ## </param>
2188 #
2189 interface(`userdom_dontaudit_getattr_user_home_content',`
2190         gen_require(`
2191                 attribute user_home_type;
2192         ')
2193
2194         dontaudit $1 user_home_type:dir getattr;
2195         dontaudit $1 user_home_type:file getattr;
2196 ')
2197
2198 ########################################
2199 ## <summary>
2200 ##      Do not audit attempts to read user home files.
2201 ## </summary>
2202 ## <param name="domain">
2203 ##      <summary>
2204 ##      Domain to not audit.
2205 ##      </summary>
2206 ## </param>
2207 #
2208 interface(`userdom_dontaudit_read_user_home_content_files',`
2209         gen_require(`
2210                 attribute user_home_type;
2211                 type user_home_dir_t;
2212         ')
2213
2214         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2215         dontaudit $1 user_home_type:dir list_dir_perms;
2216         dontaudit $1 user_home_type:file read_file_perms;
2217         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2218 ')
2219
2220 ########################################
2221 ## <summary>
2222 ##      Do not audit attempts to append user home files.
2223 ## </summary>
2224 ## <param name="domain">
2225 ##      <summary>
2226 ##      Domain to not audit.
2227 ##      </summary>
2228 ## </param>
2229 #
2230 interface(`userdom_dontaudit_append_user_home_content_files',`
2231         gen_require(`
2232                 type user_home_t;
2233         ')
2234
2235         dontaudit $1 user_home_t:file append_file_perms;
2236 ')
2237
2238 ########################################
2239 ## <summary>
2240 ##      Do not audit attempts to write user home files.
2241 ## </summary>
2242 ## <param name="domain">
2243 ##      <summary>
2244 ##      Domain to not audit.
2245 ##      </summary>
2246 ## </param>
2247 #
2248 interface(`userdom_dontaudit_write_user_home_content_files',`
2249         gen_require(`
2250                 type user_home_t;
2251         ')
2252
2253         dontaudit $1 user_home_t:file write_file_perms;
2254 ')
2255
2256 ########################################
2257 ## <summary>
2258 ##      Delete files in a user home subdirectory.
2259 ## </summary>
2260 ## <param name="domain">
2261 ##      <summary>
2262 ##      Domain allowed access.
2263 ##      </summary>
2264 ## </param>
2265 #
2266 interface(`userdom_delete_user_home_content_files',`
2267         gen_require(`
2268                 type user_home_t;
2269         ')
2270
2271         allow $1 user_home_t:file delete_file_perms;
2272 ')
2273
2274 ########################################
2275 ## <summary>
2276 ##      Delete all files in a user home subdirectory.
2277 ## </summary>
2278 ## <param name="domain">
2279 ##      <summary>
2280 ##      Domain allowed access.
2281 ##      </summary>
2282 ## </param>
2283 #
2284 interface(`userdom_delete_all_user_home_content_files',`
2285         gen_require(`
2286                 attribute user_home_type;
2287         ')
2288
2289         allow $1 user_home_type:file delete_file_perms;
2290 ')
2291
2292 ########################################
2293 ## <summary>
2294 ##      Delete sock files in a user home subdirectory.
2295 ## </summary>
2296 ## <param name="domain">
2297 ##      <summary>
2298 ##      Domain allowed access.
2299 ##      </summary>
2300 ## </param>
2301 #
2302 interface(`userdom_delete_user_home_content_sock_files',`
2303         gen_require(`
2304                 type user_home_t;
2305         ')
2306
2307         allow $1 user_home_t:sock_file delete_file_perms;
2308 ')
2309
2310 ########################################
2311 ## <summary>
2312 ##      Delete all sock files in a user home subdirectory.
2313 ## </summary>
2314 ## <param name="domain">
2315 ##      <summary>
2316 ##      Domain allowed access.
2317 ##      </summary>
2318 ## </param>
2319 #
2320 interface(`userdom_delete_all_user_home_content_sock_files',`
2321         gen_require(`
2322                 attribute user_home_type;
2323         ')
2324
2325         allow $1 user_home_type:sock_file delete_file_perms;
2326 ')
2327
2328 ########################################
2329 ## <summary>
2330 ##      Do not audit attempts to write user home files.
2331 ## </summary>
2332 ## <param name="domain">
2333 ##      <summary>
2334 ##      Domain to not audit.
2335 ##      </summary>
2336 ## </param>
2337 #
2338 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2339         gen_require(`
2340                 type user_home_t;
2341         ')
2342
2343         dontaudit $1 user_home_t:file relabel_file_perms;
2344 ')
2345
2346 ########################################
2347 ## <summary>
2348 ##      Read user home subdirectory symbolic links.
2349 ## </summary>
2350 ## <param name="domain">
2351 ##      <summary>
2352 ##      Domain allowed access.
2353 ##      </summary>
2354 ## </param>
2355 #
2356 interface(`userdom_read_user_home_content_symlinks',`
2357         gen_require(`
2358                 type user_home_dir_t, user_home_t;
2359         ')
2360
2361         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2362 ')
2363
2364 ########################################
2365 ## <summary>
2366 ##      Execute user home files.
2367 ## </summary>
2368 ## <param name="domain">
2369 ##      <summary>
2370 ##      Domain allowed access.
2371 ##      </summary>
2372 ## </param>
2373 ## <rolecap/>
2374 #
2375 interface(`userdom_exec_user_home_content_files',`
2376         gen_require(`
2377                 type user_home_dir_t;
2378                 attribute user_home_type;
2379         ')
2380
2381         files_search_home($1)
2382         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2383         dontaudit $1 user_home_type:sock_file execute;
2384         ')
2385
2386 ########################################
2387 ## <summary>
2388 ##      Do not audit attempts to execute user home files.
2389 ## </summary>
2390 ## <param name="domain">
2391 ##      <summary>
2392 ##      Domain to not audit.
2393 ##      </summary>
2394 ## </param>
2395 #
2396 interface(`userdom_dontaudit_exec_user_home_content_files',`
2397         gen_require(`
2398                 type user_home_t;
2399         ')
2400
2401         dontaudit $1 user_home_t:file exec_file_perms;
2402 ')
2403
2404 ########################################
2405 ## <summary>
2406 ##      Create, read, write, and delete files
2407 ##      in a user home subdirectory.
2408 ## </summary>
2409 ## <param name="domain">
2410 ##      <summary>
2411 ##      Domain allowed access.
2412 ##      </summary>
2413 ## </param>
2414 #
2415 interface(`userdom_manage_user_home_content_files',`
2416         gen_require(`
2417                 type user_home_dir_t, user_home_t;
2418         ')
2419
2420         manage_files_pattern($1, user_home_t, user_home_t)
2421         allow $1 user_home_dir_t:dir search_dir_perms;
2422         files_search_home($1)
2423 ')
2424
2425 ########################################
2426 ## <summary>
2427 ##      Do not audit attempts to create, read, write, and delete directories
2428 ##      in a user home subdirectory.
2429 ## </summary>
2430 ## <param name="domain">
2431 ##      <summary>
2432 ##      Domain to not audit.
2433 ##      </summary>
2434 ## </param>
2435 #
2436 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2437         gen_require(`
2438                 type user_home_dir_t, user_home_t;
2439         ')
2440
2441         dontaudit $1 user_home_t:dir manage_dir_perms;
2442 ')
2443
2444 ########################################
2445 ## <summary>
2446 ##      Create, read, write, and delete symbolic links
2447 ##      in a user home subdirectory.
2448 ## </summary>
2449 ## <param name="domain">
2450 ##      <summary>
2451 ##      Domain allowed access.
2452 ##      </summary>
2453 ## </param>
2454 #
2455 interface(`userdom_manage_user_home_content_symlinks',`
2456         gen_require(`
2457                 type user_home_dir_t, user_home_t;
2458         ')
2459
2460         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2461         allow $1 user_home_dir_t:dir search_dir_perms;
2462         files_search_home($1)
2463 ')
2464
2465 ########################################
2466 ## <summary>
2467 ##      Delete symbolic links in a user home directory.
2468 ## </summary>
2469 ## <param name="domain">
2470 ##      <summary>
2471 ##      Domain allowed access.
2472 ##      </summary>
2473 ## </param>
2474 #
2475 interface(`userdom_delete_user_home_content_symlinks',`
2476         gen_require(`
2477                 type user_home_t;
2478         ')
2479
2480         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2481 ')
2482
2483 ########################################
2484 ## <summary>
2485 ##      Delete all symbolic links in a user home directory.
2486 ## </summary>
2487 ## <param name="domain">
2488 ##      <summary>
2489 ##      Domain allowed access.
2490 ##      </summary>
2491 ## </param>
2492 #
2493 interface(`userdom_delete_all_user_home_content_symlinks',`
2494         gen_require(`
2495                 attribute user_home_type;
2496         ')
2497
2498         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2499 ')
2500
2501 ########################################
2502 ## <summary>
2503 ##      Create, read, write, and delete named pipes
2504 ##      in a user home subdirectory.
2505 ## </summary>
2506 ## <param name="domain">
2507 ##      <summary>
2508 ##      Domain allowed access.
2509 ##      </summary>
2510 ## </param>
2511 #
2512 interface(`userdom_manage_user_home_content_pipes',`
2513         gen_require(`
2514                 type user_home_dir_t, user_home_t;
2515         ')
2516
2517         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2518         allow $1 user_home_dir_t:dir search_dir_perms;
2519         files_search_home($1)
2520 ')
2521
2522 ########################################
2523 ## <summary>
2524 ##      Create, read, write, and delete named sockets
2525 ##      in a user home subdirectory.
2526 ## </summary>
2527 ## <param name="domain">
2528 ##      <summary>
2529 ##      Domain allowed access.
2530 ##      </summary>
2531 ## </param>
2532 #
2533 interface(`userdom_manage_user_home_content_sockets',`
2534         gen_require(`
2535                 type user_home_dir_t, user_home_t;
2536         ')
2537
2538         allow $1 user_home_dir_t:dir search_dir_perms;
2539         manage_sock_files_pattern($1, user_home_t, user_home_t)
2540         files_search_home($1)
2541 ')
2542
2543 ########################################
2544 ## <summary>
2545 ##      Create objects in a user home directory
2546 ##      with an automatic type transition to
2547 ##      a specified private type.
2548 ## </summary>
2549 ## <param name="domain">
2550 ##      <summary>
2551 ##      Domain allowed access.
2552 ##      </summary>
2553 ## </param>
2554 ## <param name="private_type">
2555 ##      <summary>
2556 ##      The type of the object to create.
2557 ##      </summary>
2558 ## </param>
2559 ## <param name="object_class">
2560 ##      <summary>
2561 ##      The class of the object to be created.
2562 ##      </summary>
2563 ## </param>
2564 #
2565 interface(`userdom_user_home_dir_filetrans',`
2566         gen_require(`
2567                 type user_home_dir_t;
2568         ')
2569
2570         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2571         files_search_home($1)
2572 ')
2573
2574 ########################################
2575 ## <summary>
2576 ##      Create objects in a user home directory
2577 ##      with an automatic type transition to
2578 ##      a specified private type.
2579 ## </summary>
2580 ## <param name="domain">
2581 ##      <summary>
2582 ##      Domain allowed access.
2583 ##      </summary>
2584 ## </param>
2585 ## <param name="private_type">
2586 ##      <summary>
2587 ##      The type of the object to create.
2588 ##      </summary>
2589 ## </param>
2590 ## <param name="object_class">
2591 ##      <summary>
2592 ##      The class of the object to be created.
2593 ##      </summary>
2594 ## </param>
2595 #
2596 interface(`userdom_user_home_content_filetrans',`
2597         gen_require(`
2598                 type user_home_dir_t, user_home_t;
2599         ')
2600
2601         filetrans_pattern($1, user_home_t, $2, $3, $4)
2602         allow $1 user_home_dir_t:dir search_dir_perms;
2603         files_search_home($1)
2604 ')
2605
2606 ########################################
2607 ## <summary>
2608 ##      Create objects in a user home directory
2609 ##      with an automatic type transition to
2610 ##      the user home file type.
2611 ## </summary>
2612 ## <param name="domain">
2613 ##      <summary>
2614 ##      Domain allowed access.
2615 ##      </summary>
2616 ## </param>
2617 ## <param name="object_class">
2618 ##      <summary>
2619 ##      The class of the object to be created.
2620 ##      </summary>
2621 ## </param>
2622 #
2623 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2624         gen_require(`
2625                 type user_home_dir_t, user_home_t;
2626         ')
2627
2628         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2629         files_search_home($1)
2630 ')
2631
2632 ########################################
2633 ## <summary>
2634 ##      Write to user temporary named sockets.
2635 ## </summary>
2636 ## <param name="domain">
2637 ##      <summary>
2638 ##      Domain allowed access.
2639 ##      </summary>
2640 ## </param>
2641 #
2642 interface(`userdom_write_user_tmp_sockets',`
2643         gen_require(`
2644                 type user_tmp_t;
2645         ')
2646
2647         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2648         files_search_tmp($1)
2649 ')
2650
2651 ########################################
2652 ## <summary>
2653 ##      List user temporary directories.
2654 ## </summary>
2655 ## <param name="domain">
2656 ##      <summary>
2657 ##      Domain allowed access.
2658 ##      </summary>
2659 ## </param>
2660 #
2661 interface(`userdom_list_user_tmp',`
2662         gen_require(`
2663                 type user_tmp_t;
2664         ')
2665
2666         allow $1 user_tmp_t:dir list_dir_perms;
2667         files_search_tmp($1)
2668 ')
2669
2670 ########################################
2671 ## <summary>
2672 ##      Do not audit attempts to list user
2673 ##      temporary directories.
2674 ## </summary>
2675 ## <param name="domain">
2676 ##      <summary>
2677 ##      Domain to not audit.
2678 ##      </summary>
2679 ## </param>
2680 #
2681 interface(`userdom_dontaudit_list_user_tmp',`
2682         gen_require(`
2683                 type user_tmp_t;
2684         ')
2685
2686         dontaudit $1 user_tmp_t:dir list_dir_perms;
2687 ')
2688
2689 ########################################
2690 ## <summary>
2691 ##      Do not audit attempts to manage users
2692 ##      temporary directories.
2693 ## </summary>
2694 ## <param name="domain">
2695 ##      <summary>
2696 ##      Domain to not audit.
2697 ##      </summary>
2698 ## </param>
2699 #
2700 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2701         gen_require(`
2702                 type user_tmp_t;
2703         ')
2704
2705         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2706 ')
2707
2708 ########################################
2709 ## <summary>
2710 ##      Read user temporary files.
2711 ## </summary>
2712 ## <param name="domain">
2713 ##      <summary>
2714 ##      Domain allowed access.
2715 ##      </summary>
2716 ## </param>
2717 #
2718 interface(`userdom_read_user_tmp_files',`
2719         gen_require(`
2720                 type user_tmp_t;
2721         ')
2722
2723         read_files_pattern($1, user_tmp_t, user_tmp_t)
2724         allow $1 user_tmp_t:dir list_dir_perms;
2725         files_search_tmp($1)
2726 ')
2727
2728 ########################################
2729 ## <summary>
2730 ##      Do not audit attempts to read users
2731 ##      temporary files.
2732 ## </summary>
2733 ## <param name="domain">
2734 ##      <summary>
2735 ##      Domain to not audit.
2736 ##      </summary>
2737 ## </param>
2738 #
2739 interface(`userdom_dontaudit_read_user_tmp_files',`
2740         gen_require(`
2741                 type user_tmp_t;
2742         ')
2743
2744         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2745 ')
2746
2747 ########################################
2748 ## <summary>
2749 ##      Do not audit attempts to append users
2750 ##      temporary files.
2751 ## </summary>
2752 ## <param name="domain">
2753 ##      <summary>
2754 ##      Domain to not audit.
2755 ##      </summary>
2756 ## </param>
2757 #
2758 interface(`userdom_dontaudit_append_user_tmp_files',`
2759         gen_require(`
2760                 type user_tmp_t;
2761         ')
2762
2763         dontaudit $1 user_tmp_t:file append_file_perms;
2764 ')
2765
2766 ########################################
2767 ## <summary>
2768 ##      Read and write user temporary files.
2769 ## </summary>
2770 ## <param name="domain">
2771 ##      <summary>
2772 ##      Domain allowed access.
2773 ##      </summary>
2774 ## </param>
2775 #
2776 interface(`userdom_rw_user_tmp_files',`
2777         gen_require(`
2778                 type user_tmp_t;
2779         ')
2780
2781         allow $1 user_tmp_t:dir list_dir_perms;
2782         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2783         files_search_tmp($1)
2784 ')
2785
2786 ########################################
2787 ## <summary>
2788 ##      Do not audit attempts to manage users
2789 ##      temporary files.
2790 ## </summary>
2791 ## <param name="domain">
2792 ##      <summary>
2793 ##      Domain to not audit.
2794 ##      </summary>
2795 ## </param>
2796 #
2797 interface(`userdom_dontaudit_manage_user_tmp_files',`
2798         gen_require(`
2799                 type user_tmp_t;
2800         ')
2801
2802         dontaudit $1 user_tmp_t:file manage_file_perms;
2803 ')
2804
2805 ########################################
2806 ## <summary>
2807 ##      Read user temporary symbolic links.
2808 ## </summary>
2809 ## <param name="domain">
2810 ##      <summary>
2811 ##      Domain allowed access.
2812 ##      </summary>
2813 ## </param>
2814 #
2815 interface(`userdom_read_user_tmp_symlinks',`
2816         gen_require(`
2817                 type user_tmp_t;
2818         ')
2819
2820         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2821         allow $1 user_tmp_t:dir list_dir_perms;
2822         files_search_tmp($1)
2823 ')
2824
2825 ########################################
2826 ## <summary>
2827 ##      Create, read, write, and delete user
2828 ##      temporary directories.
2829 ## </summary>
2830 ## <param name="domain">
2831 ##      <summary>
2832 ##      Domain allowed access.
2833 ##      </summary>
2834 ## </param>
2835 #
2836 interface(`userdom_manage_user_tmp_dirs',`
2837         gen_require(`
2838                 type user_tmp_t;
2839         ')
2840
2841         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2842         files_search_tmp($1)
2843 ')
2844
2845 ########################################
2846 ## <summary>
2847 ##      Create, read, write, and delete user
2848 ##      temporary files.
2849 ## </summary>
2850 ## <param name="domain">
2851 ##      <summary>
2852 ##      Domain allowed access.
2853 ##      </summary>
2854 ## </param>
2855 #
2856 interface(`userdom_manage_user_tmp_files',`
2857         gen_require(`
2858                 type user_tmp_t;
2859         ')
2860
2861         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2862         files_search_tmp($1)
2863 ')
2864
2865 ########################################
2866 ## <summary>
2867 ##      Create, read, write, and delete user
2868 ##      temporary symbolic links.
2869 ## </summary>
2870 ## <param name="domain">
2871 ##      <summary>
2872 ##      Domain allowed access.
2873 ##      </summary>
2874 ## </param>
2875 #
2876 interface(`userdom_manage_user_tmp_symlinks',`
2877         gen_require(`
2878                 type user_tmp_t;
2879         ')
2880
2881         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2882         files_search_tmp($1)
2883 ')
2884
2885 ########################################
2886 ## <summary>
2887 ##      Create, read, write, and delete user
2888 ##      temporary named pipes.
2889 ## </summary>
2890 ## <param name="domain">
2891 ##      <summary>
2892 ##      Domain allowed access.
2893 ##      </summary>
2894 ## </param>
2895 #
2896 interface(`userdom_manage_user_tmp_pipes',`
2897         gen_require(`
2898                 type user_tmp_t;
2899         ')
2900
2901         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2902         files_search_tmp($1)
2903 ')
2904
2905 ########################################
2906 ## <summary>
2907 ##      Create, read, write, and delete user
2908 ##      temporary named sockets.
2909 ## </summary>
2910 ## <param name="domain">
2911 ##      <summary>
2912 ##      Domain allowed access.
2913 ##      </summary>
2914 ## </param>
2915 #
2916 interface(`userdom_manage_user_tmp_sockets',`
2917         gen_require(`
2918                 type user_tmp_t;
2919         ')
2920
2921         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2922         files_search_tmp($1)
2923 ')
2924
2925 ########################################
2926 ## <summary>
2927 ##      Create objects in a user temporary directory
2928 ##      with an automatic type transition to
2929 ##      a specified private type.
2930 ## </summary>
2931 ## <param name="domain">
2932 ##      <summary>
2933 ##      Domain allowed access.
2934 ##      </summary>
2935 ## </param>
2936 ## <param name="private_type">
2937 ##      <summary>
2938 ##      The type of the object to create.
2939 ##      </summary>
2940 ## </param>
2941 ## <param name="object_class">
2942 ##      <summary>
2943 ##      The class of the object to be created.
2944 ##      </summary>
2945 ## </param>
2946 #
2947 interface(`userdom_user_tmp_filetrans',`
2948         gen_require(`
2949                 type user_tmp_t;
2950         ')
2951
2952         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2953         files_search_tmp($1)
2954 ')
2955
2956 ########################################
2957 ## <summary>
2958 ##      Create objects in the temporary directory
2959 ##      with an automatic type transition to
2960 ##      the user temporary type.
2961 ## </summary>
2962 ## <param name="domain">
2963 ##      <summary>
2964 ##      Domain allowed access.
2965 ##      </summary>
2966 ## </param>
2967 ## <param name="object_class">
2968 ##      <summary>
2969 ##      The class of the object to be created.
2970 ##      </summary>
2971 ## </param>
2972 #
2973 interface(`userdom_tmp_filetrans_user_tmp',`
2974         gen_require(`
2975                 type user_tmp_t;
2976         ')
2977
2978         files_tmp_filetrans($1, user_tmp_t, $2)
2979 ')
2980
2981 #######################################
2982 ## <summary>
2983 ##  Getattr user tmpfs files.
2984 ## </summary>
2985 ## <param name="domain">
2986 ##  <summary>
2987 ##  Domain allowed access.
2988 ##  </summary>
2989 ## </param>
2990 #
2991 interface(`userdom_getattr_user_tmpfs_files',`
2992     gen_require(`
2993         type user_tmpfs_t;
2994     ')
2995
2996     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2997     fs_search_tmpfs($1)
2998 ')
2999
3000 ########################################
3001 ## <summary>
3002 ##      Read user tmpfs files.
3003 ## </summary>
3004 ## <param name="domain">
3005 ##      <summary>
3006 ##      Domain allowed access.
3007 ##      </summary>
3008 ## </param>
3009 #
3010 interface(`userdom_read_user_tmpfs_files',`
3011         gen_require(`
3012                 type user_tmpfs_t;
3013         ')
3014
3015         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3016         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3017         allow $1 user_tmpfs_t:dir list_dir_perms;
3018         fs_search_tmpfs($1)
3019 ')
3020
3021 ########################################
3022 ## <summary>
3023 ##      Read/Write user tmpfs files.
3024 ## </summary>
3025 ## <param name="domain">
3026 ##      <summary>
3027 ##      Domain allowed access.
3028 ##      </summary>
3029 ## </param>
3030 #
3031 interface(`userdom_rw_user_tmpfs_files',`
3032         gen_require(`
3033                 type user_tmpfs_t;
3034         ')
3035
3036         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3037         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3038         allow $1 user_tmpfs_t:dir list_dir_perms;
3039         fs_search_tmpfs($1)
3040 ')
3041
3042 ########################################
3043 ## <summary>
3044 ##      Read/Write inherited user tmpfs files.
3045 ## </summary>
3046 ## <param name="domain">
3047 ##      <summary>
3048 ##      Domain allowed access.
3049 ##      </summary>
3050 ## </param>
3051 #
3052 interface(`userdom_rw_inherited_user_tmpfs_files',`
3053         gen_require(`
3054                 type user_tmpfs_t;
3055         ')
3056
3057         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3058 ')
3059
3060 ########################################
3061 ## <summary>
3062 ##      Execute user tmpfs files.
3063 ## </summary>
3064 ## <param name="domain">
3065 ##      <summary>
3066 ##      Domain allowed access.
3067 ##      </summary>
3068 ## </param>
3069 #
3070 interface(`userdom_execute_user_tmpfs_files',`
3071         gen_require(`
3072                 type user_tmpfs_t;
3073         ')
3074
3075         allow $1 user_tmpfs_t:file execute;
3076 ')
3077
3078 ########################################
3079 ## <summary>
3080 ##      Get the attributes of a user domain tty.
3081 ## </summary>
3082 ## <param name="domain">
3083 ##      <summary>
3084 ##      Domain allowed access.
3085 ##      </summary>
3086 ## </param>
3087 #
3088 interface(`userdom_getattr_user_ttys',`
3089         gen_require(`
3090                 type user_tty_device_t;
3091         ')
3092
3093         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3094 ')
3095
3096 ########################################
3097 ## <summary>
3098 ##      Do not audit attempts to get the attributes of a user domain tty.
3099 ## </summary>
3100 ## <param name="domain">
3101 ##      <summary>
3102 ##      Domain to not audit.
3103 ##      </summary>
3104 ## </param>
3105 #
3106 interface(`userdom_dontaudit_getattr_user_ttys',`
3107         gen_require(`
3108                 type user_tty_device_t;
3109         ')
3110
3111         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3112 ')
3113
3114 ########################################
3115 ## <summary>
3116 ##      Set the attributes of a user domain tty.
3117 ## </summary>
3118 ## <param name="domain">
3119 ##      <summary>
3120 ##      Domain allowed access.
3121 ##      </summary>
3122 ## </param>
3123 #
3124 interface(`userdom_setattr_user_ttys',`
3125         gen_require(`
3126                 type user_tty_device_t;
3127         ')
3128
3129         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3130 ')
3131
3132 ########################################
3133 ## <summary>
3134 ##      Do not audit attempts to set the attributes of a user domain tty.
3135 ## </summary>
3136 ## <param name="domain">
3137 ##      <summary>
3138 ##      Domain to not audit.
3139 ##      </summary>
3140 ## </param>
3141 #
3142 interface(`userdom_dontaudit_setattr_user_ttys',`
3143         gen_require(`
3144                 type user_tty_device_t;
3145         ')
3146
3147         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3148 ')
3149
3150 ########################################
3151 ## <summary>
3152 ##      Read and write a user domain tty.
3153 ## </summary>
3154 ## <param name="domain">
3155 ##      <summary>
3156 ##      Domain allowed access.
3157 ##      </summary>
3158 ## </param>
3159 #
3160 interface(`userdom_use_user_ttys',`
3161         gen_require(`
3162                 type user_tty_device_t;
3163         ')
3164
3165         allow $1 user_tty_device_t:chr_file rw_term_perms;
3166 ')
3167
3168 ########################################
3169 ## <summary>
3170 ##      Read and write a inherited user domain tty.
3171 ## </summary>
3172 ## <param name="domain">
3173 ##      <summary>
3174 ##      Domain allowed access.
3175 ##      </summary>
3176 ## </param>
3177 #
3178 interface(`userdom_use_inherited_user_ttys',`
3179         gen_require(`
3180                 type user_tty_device_t;
3181         ')
3182
3183         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3184 ')
3185
3186 ########################################
3187 ## <summary>
3188 ##      Read and write a user domain pty.
3189 ## </summary>
3190 ## <param name="domain">
3191 ##      <summary>
3192 ##      Domain allowed access.
3193 ##      </summary>
3194 ## </param>
3195 #
3196 interface(`userdom_use_user_ptys',`
3197         gen_require(`
3198                 type user_devpts_t;
3199         ')
3200
3201         allow $1 user_devpts_t:chr_file rw_term_perms;
3202 ')
3203
3204 ########################################
3205 ## <summary>
3206 ##      Read and write a inherited user domain pty.
3207 ## </summary>
3208 ## <param name="domain">
3209 ##      <summary>
3210 ##      Domain allowed access.
3211 ##      </summary>
3212 ## </param>
3213 #
3214 interface(`userdom_use_inherited_user_ptys',`
3215         gen_require(`
3216                 type user_devpts_t;
3217         ')
3218
3219         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3220 ')
3221
3222 ########################################
3223 ## <summary>
3224 ##      Read and write a inherited user TTYs and PTYs.
3225 ## </summary>
3226 ## <desc>
3227 ##      <p>
3228 ##      Allow the specified domain to read and write inherited user
3229 ##      TTYs and PTYs. This will allow the domain to
3230 ##      interact with the user via the terminal. Typically
3231 ##      all interactive applications will require this
3232 ##      access.
3233 ##      </p>
3234 ## </desc>
3235 ## <param name="domain">
3236 ##      <summary>
3237 ##      Domain allowed access.
3238 ##      </summary>
3239 ## </param>
3240 ## <infoflow type="both" weight="10"/>
3241 #
3242 interface(`userdom_use_inherited_user_terminals',`
3243         gen_require(`
3244                 type user_tty_device_t, user_devpts_t;
3245         ')
3246
3247         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3248         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3249 ')
3250
3251 #######################################
3252 ## <summary>
3253 ##  Allow attempts to read and write
3254 ##  a user domain tty and pty.
3255 ## </summary>
3256 ## <param name="domain">
3257 ##  <summary>
3258 ##  Domain to not audit.
3259 ##  </summary>
3260 ## </param>
3261 #
3262 interface(`userdom_use_user_terminals',`
3263     gen_require(`
3264         type user_tty_device_t, user_devpts_t;
3265     ')
3266
3267     allow $1 user_tty_device_t:chr_file rw_term_perms;
3268     allow $1 user_devpts_t:chr_file rw_term_perms;
3269 ')
3270
3271 ########################################
3272 ## <summary>
3273 ##      Do not audit attempts to read and write
3274 ##      a user domain tty and pty.
3275 ## </summary>
3276 ## <param name="domain">
3277 ##      <summary>
3278 ##      Domain to not audit.
3279 ##      </summary>
3280 ## </param>
3281 #
3282 interface(`userdom_dontaudit_use_user_terminals',`
3283         gen_require(`
3284                 type user_tty_device_t, user_devpts_t;
3285         ')
3286
3287         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3288         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3289 ')
3290
3291
3292 ########################################
3293 ## <summary>
3294 ##      Get attributes of user domain tty and pty.
3295 ## </summary>
3296 ## <param name="domain">
3297 ##      <summary>
3298 ##      Domain allowed access.
3299 ##      </summary>
3300 ## </param>
3301 #
3302 interface(`userdom_getattr_user_terminals',`
3303         gen_require(`
3304                 type user_tty_device_t, user_devpts_t;
3305         ')
3306
3307         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3308 ')
3309
3310 ########################################
3311 ## <summary>
3312 ##      Execute a shell in all user domains.  This
3313 ##      is an explicit transition, requiring the
3314 ##      caller to use setexeccon().
3315 ## </summary>
3316 ## <param name="domain">
3317 ##      <summary>
3318 ##      Domain allowed to transition.
3319 ##      </summary>
3320 ## </param>
3321 #
3322 interface(`userdom_spec_domtrans_all_users',`
3323         gen_require(`
3324                 attribute userdomain;
3325         ')
3326
3327         corecmd_shell_spec_domtrans($1, userdomain)
3328         allow userdomain $1:fd use;
3329         allow userdomain $1:fifo_file rw_file_perms;
3330         allow userdomain $1:process sigchld;
3331 ')
3332
3333 ########################################
3334 ## <summary>
3335 ##      Execute an Xserver session in all unprivileged user domains.  This
3336 ##      is an explicit transition, requiring the
3337 ##      caller to use setexeccon().
3338 ## </summary>
3339 ## <param name="domain">
3340 ##      <summary>
3341 ##      Domain allowed to transition.
3342 ##      </summary>
3343 ## </param>
3344 #
3345 interface(`userdom_xsession_spec_domtrans_all_users',`
3346         gen_require(`
3347                 attribute userdomain;
3348         ')
3349
3350         xserver_xsession_spec_domtrans($1, userdomain)
3351         allow userdomain $1:fd use;
3352         allow userdomain $1:fifo_file rw_file_perms;
3353         allow userdomain $1:process sigchld;
3354 ')
3355
3356 ########################################
3357 ## <summary>
3358 ##      Execute a shell in all unprivileged user domains.  This
3359 ##      is an explicit transition, requiring the
3360 ##      caller to use setexeccon().
3361 ## </summary>
3362 ## <param name="domain">
3363 ##      <summary>
3364 ##      Domain allowed to transition.
3365 ##      </summary>
3366 ## </param>
3367 #
3368 interface(`userdom_spec_domtrans_unpriv_users',`
3369         gen_require(`
3370                 attribute unpriv_userdomain;
3371         ')
3372
3373         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3374         allow unpriv_userdomain $1:fd use;
3375         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3376         allow unpriv_userdomain $1:process sigchld;
3377 ')
3378
3379 #####################################
3380 ## <summary>
3381 ##  Allow domain dyntrans to unpriv userdomain.
3382 ## </summary>
3383 ## <param name="domain">
3384 ##  <summary>
3385 ##  Domain allowed access.
3386 ##  </summary>
3387 ## </param>
3388 #
3389 interface(`userdom_dyntransition_unpriv_users',`
3390     gen_require(`
3391         attribute unpriv_userdomain;
3392     ')
3393
3394     allow $1 unpriv_userdomain:process dyntransition;
3395 ')
3396
3397 ########################################
3398 ## <summary>
3399 ##      Execute an Xserver session in all unprivileged user domains.  This
3400 ##      is an explicit transition, requiring the
3401 ##      caller to use setexeccon().
3402 ## </summary>
3403 ## <param name="domain">
3404 ##      <summary>
3405 ##      Domain allowed to transition.
3406 ##      </summary>
3407 ## </param>
3408 #
3409 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3410         gen_require(`
3411                 attribute unpriv_userdomain;
3412         ')
3413
3414         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3415         allow unpriv_userdomain $1:fd use;
3416         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3417         allow unpriv_userdomain $1:process sigchld;
3418 ')
3419
3420 ########################################
3421 ## <summary>
3422 ##      Manage unpriviledged user SysV sempaphores.
3423 ## </summary>
3424 ## <param name="domain">
3425 ##      <summary>
3426 ##      Domain allowed access.
3427 ##      </summary>
3428 ## </param>
3429 #
3430 interface(`userdom_manage_unpriv_user_semaphores',`
3431         gen_require(`
3432                 attribute unpriv_userdomain;
3433         ')
3434
3435         allow $1 unpriv_userdomain:sem create_sem_perms;
3436 ')
3437
3438 ########################################
3439 ## <summary>
3440 ##      Manage unpriviledged user SysV shared
3441 ##      memory segments.
3442 ## </summary>
3443 ## <param name="domain">
3444 ##      <summary>
3445 ##      Domain allowed access.
3446 ##      </summary>
3447 ## </param>
3448 #
3449 interface(`userdom_manage_unpriv_user_shared_mem',`
3450         gen_require(`
3451                 attribute unpriv_userdomain;
3452         ')
3453
3454         allow $1 unpriv_userdomain:shm create_shm_perms;
3455 ')
3456
3457 ########################################
3458 ## <summary>
3459 ##      Execute bin_t in the unprivileged user domains. This
3460 ##      is an explicit transition, requiring the
3461 ##      caller to use setexeccon().
3462 ## </summary>
3463 ## <param name="domain">
3464 ##      <summary>
3465 ##      Domain allowed to transition.
3466 ##      </summary>
3467 ## </param>
3468 #
3469 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3470         gen_require(`
3471                 attribute unpriv_userdomain;
3472         ')
3473
3474         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3475         allow unpriv_userdomain $1:fd use;
3476         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3477         allow unpriv_userdomain $1:process sigchld;
3478 ')
3479
3480 ########################################
3481 ## <summary>
3482 ##      Execute all entrypoint files in unprivileged user
3483 ##      domains. This is an explicit transition, requiring the
3484 ##      caller to use setexeccon().
3485 ## </summary>
3486 ## <param name="domain">
3487 ##      <summary>
3488 ##      Domain allowed access.
3489 ##      </summary>
3490 ## </param>
3491 #
3492 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3493         gen_require(`
3494                 attribute unpriv_userdomain;
3495         ')
3496
3497         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3498         allow unpriv_userdomain $1:fd use;
3499         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3500         allow unpriv_userdomain $1:process sigchld;
3501 ')
3502
3503 ########################################
3504 ## <summary>
3505 ##      Search users home directories.
3506 ## </summary>
3507 ## <param name="domain">
3508 ##      <summary>
3509 ##      Domain allowed access.
3510 ##      </summary>
3511 ## </param>
3512 #
3513 interface(`userdom_search_user_home_content',`
3514         gen_require(`
3515                 type user_home_dir_t;
3516                 attribute user_home_type;
3517         ')
3518
3519         files_list_home($1)
3520         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3521         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3522 ')
3523
3524 ########################################
3525 ## <summary>
3526 ##      Send general signals to unprivileged user domains.
3527 ## </summary>
3528 ## <param name="domain">
3529 ##      <summary>
3530 ##      Domain allowed access.
3531 ##      </summary>
3532 ## </param>
3533 #
3534 interface(`userdom_signal_unpriv_users',`
3535         gen_require(`
3536                 attribute unpriv_userdomain;
3537         ')
3538
3539         allow $1 unpriv_userdomain:process signal;
3540 ')
3541
3542 ########################################
3543 ## <summary>
3544 ##      Inherit the file descriptors from unprivileged user domains.
3545 ## </summary>
3546 ## <param name="domain">
3547 ##      <summary>
3548 ##      Domain allowed access.
3549 ##      </summary>
3550 ## </param>
3551 #
3552 interface(`userdom_use_unpriv_users_fds',`
3553         gen_require(`
3554                 attribute unpriv_userdomain;
3555         ')
3556
3557         allow $1 unpriv_userdomain:fd use;
3558 ')
3559
3560 ########################################
3561 ## <summary>
3562 ##      Do not audit attempts to inherit the file descriptors
3563 ##      from unprivileged user domains.
3564 ## </summary>
3565 ## <desc>
3566 ##      <p>
3567 ##      Do not audit attempts to inherit the file descriptors
3568 ##      from unprivileged user domains. This will supress
3569 ##      SELinux denial messages when the specified domain is denied
3570 ##      the permission to inherit these file descriptors.
3571 ##      </p>
3572 ## </desc>
3573 ## <param name="domain">
3574 ##      <summary>
3575 ##      Domain to not audit.
3576 ##      </summary>
3577 ## </param>
3578 ## <infoflow type="none"/>
3579 #
3580 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3581         gen_require(`
3582                 attribute unpriv_userdomain;
3583         ')
3584
3585         dontaudit $1 unpriv_userdomain:fd use;
3586 ')
3587
3588 ########################################
3589 ## <summary>
3590 ##      Do not audit attempts to use user ptys.
3591 ## </summary>
3592 ## <param name="domain">
3593 ##      <summary>
3594 ##      Domain to not audit.
3595 ##      </summary>
3596 ## </param>
3597 #
3598 interface(`userdom_dontaudit_use_user_ptys',`
3599         gen_require(`
3600                 type user_devpts_t;
3601         ')
3602
3603         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3604 ')
3605
3606 ########################################
3607 ## <summary>
3608 ##      Relabel files to unprivileged user pty types.
3609 ## </summary>
3610 ## <param name="domain">
3611 ##      <summary>
3612 ##      Domain allowed access.
3613 ##      </summary>
3614 ## </param>
3615 #
3616 interface(`userdom_relabelto_user_ptys',`
3617         gen_require(`
3618                 type user_devpts_t;
3619         ')
3620
3621         allow $1 user_devpts_t:chr_file relabelto;
3622 ')
3623
3624 ########################################
3625 ## <summary>
3626 ##      Do not audit attempts to relabel files from
3627 ##      user pty types.
3628 ## </summary>
3629 ## <param name="domain">
3630 ##      <summary>
3631 ##      Domain to not audit.
3632 ##      </summary>
3633 ## </param>
3634 #
3635 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3636         gen_require(`
3637                 type user_devpts_t;
3638         ')
3639
3640         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3641 ')
3642
3643 ########################################
3644 ## <summary>
3645 ##      Write all users files in /tmp
3646 ## </summary>
3647 ## <param name="domain">
3648 ##      <summary>
3649 ##      Domain allowed access.
3650 ##      </summary>
3651 ## </param>
3652 #
3653 interface(`userdom_write_user_tmp_files',`
3654         gen_require(`
3655                 type user_tmp_t;
3656         ')
3657
3658         write_files_pattern($1, user_tmp_t, user_tmp_t)
3659 ')
3660
3661 ########################################
3662 ## <summary>
3663 ##      Do not audit attempts to write users
3664 ##      temporary files.
3665 ## </summary>
3666 ## <param name="domain">
3667 ##      <summary>
3668 ##      Domain to not audit.
3669 ##      </summary>
3670 ## </param>
3671 #
3672 interface(`userdom_dontaudit_write_user_tmp_files',`
3673         gen_require(`
3674                 type user_tmp_t;
3675         ')
3676
3677         dontaudit $1 user_tmp_t:file write;
3678 ')
3679
3680 ########################################
3681 ## <summary>
3682 ##      Do not audit attempts to read/write users
3683 ##      temporary fifo files.
3684 ## </summary>
3685 ## <param name="domain">
3686 ##      <summary>
3687 ##      Domain to not audit.
3688 ##      </summary>
3689 ## </param>
3690 #
3691 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3692         gen_require(`
3693                 type user_tmp_t;
3694         ')
3695
3696         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3697 ')
3698
3699 ########################################
3700 ## <summary>
3701 ##      Do not audit attempts to use user ttys.
3702 ## </summary>
3703 ## <param name="domain">
3704 ##      <summary>
3705 ##      Domain to not audit.
3706 ##      </summary>
3707 ## </param>
3708 #
3709 interface(`userdom_dontaudit_use_user_ttys',`
3710         gen_require(`
3711                 type user_tty_device_t;
3712         ')
3713
3714         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3715 ')
3716
3717 ########################################
3718 ## <summary>
3719 ##      Read the process state of all user domains.
3720 ## </summary>
3721 ## <param name="domain">
3722 ##      <summary>
3723 ##      Domain allowed access.
3724 ##      </summary>
3725 ## </param>
3726 #
3727 interface(`userdom_read_all_users_state',`
3728         gen_require(`
3729                 attribute userdomain;
3730         ')
3731
3732         read_files_pattern($1, userdomain, userdomain)
3733         read_lnk_files_pattern($1,userdomain,userdomain)
3734         kernel_search_proc($1)
3735 ')
3736
3737 ########################################
3738 ## <summary>
3739 ##      Get the attributes of all user domains.
3740 ## </summary>
3741 ## <param name="domain">
3742 ##      <summary>
3743 ##      Domain allowed access.
3744 ##      </summary>
3745 ## </param>
3746 #
3747 interface(`userdom_getattr_all_users',`
3748         gen_require(`
3749                 attribute userdomain;
3750         ')
3751
3752         allow $1 userdomain:process getattr;
3753 ')
3754
3755 ########################################
3756 ## <summary>
3757 ##      Inherit the file descriptors from all user domains
3758 ## </summary>
3759 ## <param name="domain">
3760 ##      <summary>
3761 ##      Domain allowed access.
3762 ##      </summary>
3763 ## </param>
3764 #
3765 interface(`userdom_use_all_users_fds',`
3766         gen_require(`
3767                 attribute userdomain;
3768         ')
3769
3770         allow $1 userdomain:fd use;
3771 ')
3772
3773 ########################################
3774 ## <summary>
3775 ##      Do not audit attempts to inherit the file
3776 ##      descriptors from any user domains.
3777 ## </summary>
3778 ## <param name="domain">
3779 ##      <summary>
3780 ##      Domain to not audit.
3781 ##      </summary>
3782 ## </param>
3783 #
3784 interface(`userdom_dontaudit_use_all_users_fds',`
3785         gen_require(`
3786                 attribute userdomain;
3787         ')
3788
3789         dontaudit $1 userdomain:fd use;
3790 ')
3791
3792 ########################################
3793 ## <summary>
3794 ##      Send general signals to all user domains.
3795 ## </summary>
3796 ## <param name="domain">
3797 ##      <summary>
3798 ##      Domain allowed access.
3799 ##      </summary>
3800 ## </param>
3801 #
3802 interface(`userdom_signal_all_users',`
3803         gen_require(`
3804                 attribute userdomain;
3805         ')
3806
3807         allow $1 userdomain:process signal;
3808 ')
3809
3810 ########################################
3811 ## <summary>
3812 ##      Send kill signals to all user domains.
3813 ## </summary>
3814 ## <param name="domain">
3815 ##      <summary>
3816 ##      Domain allowed access.
3817 ##      </summary>
3818 ## </param>
3819 #
3820 interface(`userdom_kill_all_users',`
3821         gen_require(`
3822                 attribute userdomain;
3823         ')
3824
3825         allow $1 userdomain:process sigkill;
3826 ')
3827
3828 ########################################
3829 ## <summary>
3830 ##      Send a SIGCHLD signal to all user domains.
3831 ## </summary>
3832 ## <param name="domain">
3833 ##      <summary>
3834 ##      Domain allowed access.
3835 ##      </summary>
3836 ## </param>
3837 #
3838 interface(`userdom_sigchld_all_users',`
3839         gen_require(`
3840                 attribute userdomain;
3841         ')
3842
3843         allow $1 userdomain:process sigchld;
3844 ')
3845
3846 ########################################
3847 ## <summary>
3848 ##      Read keys for all user domains.
3849 ## </summary>
3850 ## <param name="domain">
3851 ##      <summary>
3852 ##      Domain allowed access.
3853 ##      </summary>
3854 ## </param>
3855 #
3856 interface(`userdom_read_all_users_keys',`
3857         gen_require(`
3858                 attribute userdomain;
3859         ')
3860
3861         allow $1 userdomain:key read;
3862 ')
3863
3864 ########################################
3865 ## <summary>
3866 ##      Create keys for all user domains.
3867 ## </summary>
3868 ## <param name="domain">
3869 ##      <summary>
3870 ##      Domain allowed access.
3871 ##      </summary>
3872 ## </param>
3873 #
3874 interface(`userdom_create_all_users_keys',`
3875         gen_require(`
3876                 attribute userdomain;
3877         ')
3878
3879         allow $1 userdomain:key create;
3880 ')
3881
3882 ########################################
3883 ## <summary>
3884 ##      Send a dbus message to all user domains.
3885 ## </summary>
3886 ## <param name="domain">
3887 ##      <summary>
3888 ##      Domain allowed access.
3889 ##      </summary>
3890 ## </param>
3891 #
3892 interface(`userdom_dbus_send_all_users',`
3893         gen_require(`
3894                 attribute userdomain;
3895                 class dbus send_msg;
3896         ')
3897
3898         allow $1 userdomain:dbus send_msg;
3899 ')
3900
3901 ########################################
3902 ## <summary>
3903 ##      Allow apps to set rlimits on userdomain
3904 ## </summary>
3905 ## <param name="domain">
3906 ##      <summary>
3907 ##      Domain allowed access.
3908 ##      </summary>
3909 ## </param>
3910 #
3911 interface(`userdom_set_rlimitnh',`
3912         gen_require(`
3913                 attribute userdomain;
3914         ')
3915
3916         allow $1 userdomain:process rlimitinh;
3917 ')
3918
3919 ########################################
3920 ## <summary>
3921 ##      Define this type as a Allow apps to set rlimits on userdomain
3922 ## </summary>
3923 ## <param name="domain">
3924 ##      <summary>
3925 ##      Domain allowed access.
3926 ##      </summary>
3927 ## </param>
3928 ## <param name="userdomain_prefix">
3929 ##      <summary>
3930 ##      The prefix of the user domain (e.g., user
3931 ##      is the prefix for user_t).
3932 ## </summary>
3933 ## </param>
3934 ## <param name="domain">
3935 ##      <summary>
3936 ##      Domain allowed access.
3937 ##      </summary>
3938 ## </param>
3939 #
3940 template(`userdom_unpriv_usertype',`
3941         gen_require(`
3942                 attribute unpriv_userdomain, userdomain;
3943                 attribute $1_usertype;
3944         ')
3945         typeattribute $2  $1_usertype;
3946         typeattribute $2  unpriv_userdomain;
3947         typeattribute $2  userdomain;
3948
3949         auth_use_nsswitch($2)
3950         ubac_constrained($2)
3951 ')
3952
3953 #######################################
3954 ## <summary>
3955 ##  Define this type as a Allow apps to set rlimits on userdomain
3956 ## </summary>
3957 ## <param name="domain">
3958 ##  <summary>
3959 ##  Domain allowed access.
3960 ##  </summary>
3961 ## </param>
3962 ## <param name="userdomain_prefix">
3963 ##  <summary>
3964 ##  The prefix of the user domain (e.g., user
3965 ##  is the prefix for user_t).
3966 ## </summary>
3967 ## </param>
3968 ## <param name="domain">
3969 ##  <summary>
3970 ##  Domain allowed access.
3971 ##  </summary>
3972 ## </param>
3973 #
3974 template(`userdom_unpriv_type',`
3975     gen_require(`
3976         attribute unpriv_userdomain, userdomain;
3977     ')
3978     typeattribute $2  unpriv_userdomain;
3979     typeattribute $2  userdomain;
3980
3981     auth_use_nsswitch($2)
3982     ubac_constrained($2)
3983 ')
3984
3985 ########################################
3986 ## <summary>
3987 ##      Connect to users over an unix stream socket.
3988 ## </summary>
3989 ## <param name="domain">
3990 ##      <summary>
3991 ##      Domain allowed access.
3992 ##      </summary>
3993 ## </param>
3994 #
3995 interface(`userdom_stream_connect',`
3996         gen_require(`
3997                 type user_tmp_t;
3998                 attribute userdomain;
3999         ')
4000
4001         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
4002 ')
4003
4004 ########################################
4005 ## <summary>
4006 ##      Ptrace user domains.
4007 ## </summary>
4008 ## <param name="domain">
4009 ##      <summary>
4010 ##      Domain allowed access.
4011 ##      </summary>
4012 ## </param>
4013 #
4014 interface(`userdom_ptrace_all_users',`
4015         gen_require(`
4016                 attribute userdomain;
4017         ')
4018
4019         tunable_policy(`deny_ptrace',`',`
4020                 allow $1 userdomain:process ptrace;
4021         ')
4022 ')
4023
4024 ########################################
4025 ## <summary>
4026 ##      dontaudit Search /root
4027 ## </summary>
4028 ## <param name="domain">
4029 ##      <summary>
4030 ##      Domain to not audit.
4031 ##      </summary>
4032 ## </param>
4033 #
4034 interface(`userdom_dontaudit_search_admin_dir',`
4035         gen_require(`
4036                 type admin_home_t;
4037         ')
4038
4039         dontaudit $1 admin_home_t:dir search_dir_perms;
4040 ')
4041
4042 ########################################
4043 ## <summary>
4044 ##      dontaudit list /root
4045 ## </summary>
4046 ## <param name="domain">
4047 ##      <summary>
4048 ##      Domain to not audit.
4049 ##      </summary>
4050 ## </param>
4051 #
4052 interface(`userdom_dontaudit_list_admin_dir',`
4053         gen_require(`
4054                 type admin_home_t;
4055         ')
4056
4057         dontaudit $1 admin_home_t:dir list_dir_perms;
4058 ')
4059
4060 ########################################
4061 ## <summary>
4062 ##      Allow domain to  list /root
4063 ## </summary>
4064 ## <param name="domain">
4065 ##      <summary>
4066 ##      Domain allowed access.
4067 ##      </summary>
4068 ## </param>
4069 #
4070 interface(`userdom_list_admin_dir',`
4071         gen_require(`
4072                 type admin_home_t;
4073         ')
4074
4075         allow $1 admin_home_t:dir list_dir_perms;
4076 ')
4077
4078 ########################################
4079 ## <summary>
4080 ##      Allow Search /root
4081 ## </summary>
4082 ## <param name="domain">
4083 ##      <summary>
4084 ##      Domain allowed access.
4085 ##      </summary>
4086 ## </param>
4087 #
4088 interface(`userdom_search_admin_dir',`
4089         gen_require(`
4090                 type admin_home_t;
4091         ')
4092
4093         allow $1 admin_home_t:dir search_dir_perms;
4094 ')
4095
4096 ########################################
4097 ## <summary>
4098 ##      RW unpriviledged user SysV sempaphores.
4099 ## </summary>
4100 ## <param name="domain">
4101 ##      <summary>
4102 ##      Domain allowed access.
4103 ##      </summary>
4104 ## </param>
4105 #
4106 interface(`userdom_rw_semaphores',`
4107         gen_require(`
4108                 attribute unpriv_userdomain;
4109         ')
4110
4111         allow $1 unpriv_userdomain:sem rw_sem_perms;
4112 ')
4113
4114 ########################################
4115 ## <summary>
4116 ##      Send a message to unpriv users over a unix domain
4117 ##      datagram socket.
4118 ## </summary>
4119 ## <param name="domain">
4120 ##      <summary>
4121 ##      Domain allowed access.
4122 ##      </summary>
4123 ## </param>
4124 #
4125 interface(`userdom_dgram_send',`
4126         gen_require(`
4127                 attribute unpriv_userdomain;
4128         ')
4129
4130         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4131 ')
4132
4133 ######################################
4134 ## <summary>
4135 ##      Send a message to users over a unix domain
4136 ##      datagram socket.
4137 ## </summary>
4138 ## <param name="domain">
4139 ##      <summary>
4140 ##      Domain allowed access.
4141 ##      </summary>
4142 ## </param>
4143 #
4144 interface(`userdom_users_dgram_send',`
4145         gen_require(`
4146                  attribute userdomain;
4147       ')
4148
4149        allow $1 userdomain:unix_dgram_socket sendto;
4150 ')
4151
4152 #######################################
4153 ## <summary>
4154 ##      Allow execmod on files in homedirectory
4155 ## </summary>
4156 ## <param name="domain">
4157 ##      <summary>
4158 ##      Domain allowed access.
4159 ##      </summary>
4160 ## </param>
4161 ## <rolebase/>
4162 #
4163 interface(`userdom_execmod_user_home_files',`
4164         gen_require(`
4165                 type user_home_type;
4166         ')
4167
4168         allow $1 user_home_type:file execmod;
4169 ')
4170
4171 ########################################
4172 ## <summary>
4173 ##      Read admin home files.
4174 ## </summary>
4175 ## <param name="domain">
4176 ##      <summary>
4177 ##      Domain allowed access.
4178 ##      </summary>
4179 ## </param>
4180 ## <rolecap/>
4181 #
4182 interface(`userdom_read_admin_home_files',`
4183         gen_require(`
4184                 type admin_home_t;
4185         ')
4186
4187         read_files_pattern($1, admin_home_t, admin_home_t)
4188 ')
4189
4190 ########################################
4191 ## <summary>
4192 ##      Delete admin home files.
4193 ## </summary>
4194 ## <param name="domain">
4195 ##      <summary>
4196 ##      Domain allowed access.
4197 ##      </summary>
4198 ## </param>
4199 ## <rolecap/>
4200 #
4201 interface(`userdom_delete_admin_home_files',`
4202         gen_require(`
4203                 type admin_home_t;
4204         ')
4205
4206         allow $1 admin_home_t:file delete_file_perms;
4207 ')
4208
4209 ########################################
4210 ## <summary>
4211 ##      Execute admin home files.
4212 ## </summary>
4213 ## <param name="domain">
4214 ##      <summary>
4215 ##      Domain allowed access.
4216 ##      </summary>
4217 ## </param>
4218 ## <rolecap/>
4219 #
4220 interface(`userdom_exec_admin_home_files',`
4221         gen_require(`
4222                 type admin_home_t;
4223         ')
4224
4225         exec_files_pattern($1, admin_home_t, admin_home_t)
4226 ')
4227
4228 ########################################
4229 ## <summary>
4230 ##      Append files inherited
4231 ##      in the /root directory.
4232 ## </summary>
4233 ## <param name="domain">
4234 ##      <summary>
4235 ##      Domain allowed access.
4236 ##      </summary>
4237 ## </param>
4238 #
4239 interface(`userdom_inherit_append_admin_home_files',`
4240         gen_require(`
4241                 type admin_home_t;
4242         ')
4243
4244         allow $1 admin_home_t:file { getattr append };
4245 ')
4246
4247
4248 #######################################
4249 ## <summary>
4250 ##      Manage all files/directories in the homedir
4251 ## </summary>
4252 ## <param name="userdomain">
4253 ##      <summary>
4254 ##      The user domain
4255 ##      </summary>
4256 ## </param>
4257 ## <rolebase/>
4258 #
4259 interface(`userdom_manage_user_home_content',`
4260         gen_require(`
4261                 type user_home_dir_t, user_home_t;
4262                 attribute user_home_type;
4263         ')
4264
4265         files_list_home($1)
4266         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4267         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4268         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4269         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4270         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4271         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4272
4273 ')
4274
4275
4276 ########################################
4277 ## <summary>
4278 ##      Create objects in a user home directory
4279 ##      with an automatic type transition to
4280 ##      the user home file type.
4281 ## </summary>
4282 ## <param name="domain">
4283 ##      <summary>
4284 ##      Domain allowed access.
4285 ##      </summary>
4286 ## </param>
4287 ## <param name="object_class">
4288 ##      <summary>
4289 ##      The class of the object to be created.
4290 ##      </summary>
4291 ## </param>
4292 #
4293 interface(`userdom_user_home_dir_filetrans_pattern',`
4294         gen_require(`
4295                 type user_home_dir_t, user_home_t;
4296         ')
4297
4298         type_transition $1 user_home_dir_t:$2 user_home_t;
4299 ')
4300
4301 ########################################
4302 ## <summary>
4303 ##      Create objects in the /root directory
4304 ##      with an automatic type transition to
4305 ##      a specified private type.
4306 ## </summary>
4307 ## <param name="domain">
4308 ##      <summary>
4309 ##      Domain allowed access.
4310 ##      </summary>
4311 ## </param>
4312 ## <param name="private_type">
4313 ##      <summary>
4314 ##      The type of the object to create.
4315 ##      </summary>
4316 ## </param>
4317 ## <param name="object_class">
4318 ##      <summary>
4319 ##      The class of the object to be created.
4320 ##      </summary>
4321 ## </param>
4322 #
4323 interface(`userdom_admin_home_dir_filetrans',`
4324         gen_require(`
4325                 type admin_home_t;
4326         ')
4327
4328         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4329 ')
4330
4331 ########################################
4332 ## <summary>
4333 ##      Send signull to unprivileged user domains.
4334 ## </summary>
4335 ## <param name="domain">
4336 ##      <summary>
4337 ##      Domain allowed access.
4338 ##      </summary>
4339 ## </param>
4340 #
4341 interface(`userdom_signull_unpriv_users',`
4342         gen_require(`
4343                 attribute unpriv_userdomain;
4344         ')
4345
4346         allow $1 unpriv_userdomain:process signull;
4347 ')
4348
4349 ########################################
4350 ## <summary>
4351 ##      Write all users files in /tmp
4352 ## </summary>
4353 ## <param name="domain">
4354 ##      <summary>
4355 ##      Domain allowed access.
4356 ##      </summary>
4357 ## </param>
4358 #
4359 interface(`userdom_write_user_tmp_dirs',`
4360         gen_require(`
4361                 type user_tmp_t;
4362         ')
4363
4364         write_files_pattern($1, user_tmp_t, user_tmp_t)
4365 ')
4366
4367 ########################################
4368 ## <summary>
4369 ##      Manage keys for all user domains.
4370 ## </summary>
4371 ## <param name="domain">
4372 ##      <summary>
4373 ##      Domain allowed access.
4374 ##      </summary>
4375 ## </param>
4376 #
4377 interface(`userdom_manage_all_users_keys',`
4378         gen_require(`
4379                 attribute userdomain;
4380         ')
4381
4382         allow $1 userdomain:key manage_key_perms;
4383 ')
4384
4385
4386 ########################################
4387 ## <summary>
4388 ##      Do not audit attempts to read and write
4389 ##      unserdomain stream.
4390 ## </summary>
4391 ## <param name="domain">
4392 ##      <summary>
4393 ##      Domain to not audit.
4394 ##      </summary>
4395 ## </param>
4396 #
4397 interface(`userdom_dontaudit_rw_stream',`
4398         gen_require(`
4399                 attribute userdomain;
4400         ')
4401
4402         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4403 ')
4404
4405 ########################################
4406 ## <summary>
4407 ##      Do not audit attempts to read and write
4408 ##      unserdomain datagram socket.
4409 ## </summary>
4410 ## <param name="domain">
4411 ##      <summary>
4412 ##      Domain to not audit.
4413 ##      </summary>
4414 ## </param>
4415 #
4416 interface(`userdom_dontaudit_rw_dgram_socket',`
4417         gen_require(`
4418                 attribute userdomain;
4419         ')
4420
4421         dontaudit $1 userdomain:unix_dgram_socket { read write };
4422 ')
4423
4424 ########################################
4425 ## <summary>
4426 ##      Append files
4427 ##      in a user home subdirectory.
4428 ## </summary>
4429 ## <param name="domain">
4430 ##      <summary>
4431 ##      Domain allowed access.
4432 ##      </summary>
4433 ## </param>
4434 #
4435 interface(`userdom_append_user_home_content_files',`
4436         gen_require(`
4437                 type user_home_dir_t, user_home_t;
4438         ')
4439
4440         append_files_pattern($1, user_home_t, user_home_t)
4441         allow $1 user_home_dir_t:dir search_dir_perms;
4442         files_search_home($1)
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      Read files inherited
4448 ##      in a user home subdirectory.
4449 ## </summary>
4450 ## <param name="domain">
4451 ##      <summary>
4452 ##      Domain allowed access.
4453 ##      </summary>
4454 ## </param>
4455 #
4456 interface(`userdom_read_inherited_user_home_content_files',`
4457         gen_require(`
4458                 attribute user_home_type;
4459         ')
4460
4461         allow $1 user_home_type:file { getattr read };
4462 ')
4463
4464 ########################################
4465 ## <summary>
4466 ##      Append files inherited
4467 ##      in a user home subdirectory.
4468 ## </summary>
4469 ## <param name="domain">
4470 ##      <summary>
4471 ##      Domain allowed access.
4472 ##      </summary>
4473 ## </param>
4474 #
4475 interface(`userdom_inherit_append_user_home_content_files',`
4476         gen_require(`
4477                 type user_home_t;
4478         ')
4479
4480         allow $1 user_home_t:file { getattr append };
4481 ')
4482
4483 ########################################
4484 ## <summary>
4485 ##      Append files inherited
4486 ##      in a user tmp files.
4487 ## </summary>
4488 ## <param name="domain">
4489 ##      <summary>
4490 ##      Domain allowed access.
4491 ##      </summary>
4492 ## </param>
4493 #
4494 interface(`userdom_inherit_append_user_tmp_files',`
4495         gen_require(`
4496                 type user_tmp_t;
4497         ')
4498
4499         allow $1 user_tmp_t:file { getattr append };
4500 ')
4501
4502 ######################################
4503 ## <summary>
4504 ##      Read audio files in the users homedir.
4505 ## </summary>
4506 ## <param name="domain">
4507 ##      <summary>
4508 ##      Domain allowed access.
4509 ##      </summary>
4510 ## </param>
4511 ## <rolecap/>
4512 #
4513 interface(`userdom_read_home_audio_files',`
4514         gen_require(`
4515                 type audio_home_t;
4516         ')
4517
4518         userdom_search_user_home_dirs($1)
4519         allow $1 audio_home_t:dir list_dir_perms;
4520         read_files_pattern($1, audio_home_t, audio_home_t)
4521         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4522 ')
4523
4524 ########################################
4525 ## <summary>
4526 ##      Do not audit attempts to write all user home content files.
4527 ## </summary>
4528 ## <param name="domain">
4529 ##      <summary>
4530 ##      Domain to not audit.
4531 ##      </summary>
4532 ## </param>
4533 #
4534 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4535         gen_require(`
4536                 attribute user_home_type;
4537         ')
4538
4539         dontaudit $1 user_home_type:file write_file_perms;
4540 ')
4541
4542 ########################################
4543 ## <summary>
4544 ##      Do not audit attempts to write all user tmp content files.
4545 ## </summary>
4546 ## <param name="domain">
4547 ##      <summary>
4548 ##      Domain to not audit.
4549 ##      </summary>
4550 ## </param>
4551 #
4552 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4553         gen_require(`
4554                 attribute user_tmp_type;
4555         ')
4556
4557         dontaudit $1 user_tmp_type:file write_file_perms;
4558 ')
4559
4560 ########################################
4561 ## <summary>
4562 ##      Manage all user temporary content.
4563 ## </summary>
4564 ## <param name="domain">
4565 ##      <summary>
4566 ##      Domain allowed access.
4567 ##      </summary>
4568 ## </param>
4569 #
4570 interface(`userdom_manage_all_user_tmp_content',`
4571         gen_require(`
4572                 attribute user_tmp_type;
4573         ')
4574
4575         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4576         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4577         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4578         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4579         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4580         files_search_tmp($1)
4581 ')
4582
4583 ########################################
4584 ## <summary>
4585 ##      List all user temporary content.
4586 ## </summary>
4587 ## <param name="domain">
4588 ##      <summary>
4589 ##      Domain allowed access.
4590 ##      </summary>
4591 ## </param>
4592 #
4593 interface(`userdom_list_all_user_tmp_content',`
4594         gen_require(`
4595                 attribute user_tmp_type;
4596         ')
4597
4598         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4599         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4600         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4601         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4602         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4603         files_search_var($1)
4604         files_search_tmp($1)
4605 ')
4606
4607 ########################################
4608 ## <summary>
4609 ##      Manage all user tmpfs content.
4610 ## </summary>
4611 ## <param name="domain">
4612 ##      <summary>
4613 ##      Domain allowed access.
4614 ##      </summary>
4615 ## </param>
4616 #
4617 interface(`userdom_manage_all_user_tmpfs_content',`
4618         gen_require(`
4619                 attribute user_tmpfs_type;
4620         ')
4621
4622         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4623         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4624         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4625         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4626         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4627         fs_search_tmpfs($1)
4628 ')
4629
4630 ########################################
4631 ## <summary>
4632 ##      Delete all user temporary content.
4633 ## </summary>
4634 ## <param name="domain">
4635 ##      <summary>
4636 ##      Domain allowed access.
4637 ##      </summary>
4638 ## </param>
4639 #
4640 interface(`userdom_delete_all_user_tmp_content',`
4641         gen_require(`
4642                 attribute user_tmp_type;
4643         ')
4644
4645         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4646         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4647         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4648         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4649         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4650         # /var/tmp
4651         files_search_var($1)
4652         files_delete_tmp_dir_entry($1)
4653 ')
4654
4655 ########################################
4656 ## <summary>
4657 ##      Read system SSL certificates in the users homedir.
4658 ## </summary>
4659 ## <param name="domain">
4660 ##      <summary>
4661 ##      Domain allowed access.
4662 ##      </summary>
4663 ## </param>
4664 #
4665 interface(`userdom_read_home_certs',`
4666         gen_require(`
4667                 type home_cert_t;
4668         ')
4669
4670         userdom_search_user_home_content($1)
4671         allow $1 home_cert_t:dir list_dir_perms;
4672         read_files_pattern($1, home_cert_t, home_cert_t)
4673         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4674 ')
4675
4676 ########################################
4677 ## <summary>
4678 ##      Manage system SSL certificates in the users homedir.
4679 ## </summary>
4680 ## <param name="domain">
4681 ##      <summary>
4682 ##      Domain allowed access.
4683 ##      </summary>
4684 ## </param>
4685 #
4686 interface(`userdom_manage_home_certs',`
4687         gen_require(`
4688                 type home_cert_t;
4689         ')
4690
4691         allow $1 home_cert_t:dir list_dir_perms;
4692         manage_files_pattern($1, home_cert_t, home_cert_t)
4693         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4694
4695         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4696         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4697 ')
4698
4699 #######################################
4700 ## <summary>
4701 ##  Dontaudit Write system SSL certificates in the users homedir.
4702 ## </summary>
4703 ## <param name="domain">
4704 ##  <summary>
4705 ##      Domain to not audit.
4706 ##  </summary>
4707 ## </param>
4708 #
4709 interface(`userdom_dontaudit_write_home_certs',`
4710     gen_require(`
4711         type home_cert_t;
4712     ')
4713
4714     dontaudit $1 home_cert_t:file write;
4715 ')
4716
4717 ########################################
4718 ## <summary>
4719 ##      dontaudit Search getatrr /root files
4720 ## </summary>
4721 ## <param name="domain">
4722 ##      <summary>
4723 ##      Domain to not audit.
4724 ##      </summary>
4725 ## </param>
4726 #
4727 interface(`userdom_dontaudit_getattr_admin_home_files',`
4728         gen_require(`
4729                 type admin_home_t;
4730         ')
4731
4732         dontaudit $1 admin_home_t:file getattr;
4733 ')
4734
4735 ########################################
4736 ## <summary>
4737 ##      dontaudit read /root lnk files
4738 ## </summary>
4739 ## <param name="domain">
4740 ##      <summary>
4741 ##      Domain to not audit.
4742 ##      </summary>
4743 ## </param>
4744 #
4745 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4746         gen_require(`
4747                 type admin_home_t;
4748         ')
4749
4750         dontaudit $1 admin_home_t:lnk_file read;
4751 ')
4752
4753 ########################################
4754 ## <summary>
4755 ##      dontaudit read /root files
4756 ## </summary>
4757 ## <param name="domain">
4758 ##      <summary>
4759 ##      Domain to not audit.
4760 ##      </summary>
4761 ## </param>
4762 #
4763 interface(`userdom_dontaudit_read_admin_home_files',`
4764         gen_require(`
4765                 type admin_home_t;
4766         ')
4767
4768         dontaudit $1 admin_home_t:file read_file_perms;
4769 ')
4770
4771 ########################################
4772 ## <summary>
4773 ##      Create, read, write, and delete user
4774 ##      temporary chr files.
4775 ## </summary>
4776 ## <param name="domain">
4777 ##      <summary>
4778 ##      Domain allowed access.
4779 ##      </summary>
4780 ## </param>
4781 #
4782 interface(`userdom_manage_user_tmp_chr_files',`
4783         gen_require(`
4784                 type user_tmp_t;
4785         ')
4786
4787         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4788         files_search_tmp($1)
4789 ')
4790
4791 ########################################
4792 ## <summary>
4793 ##      Create, read, write, and delete user
4794 ##      temporary blk files.
4795 ## </summary>
4796 ## <param name="domain">
4797 ##      <summary>
4798 ##      Domain allowed access.
4799 ##      </summary>
4800 ## </param>
4801 #
4802 interface(`userdom_manage_user_tmp_blk_files',`
4803         gen_require(`
4804                 type user_tmp_t;
4805         ')
4806
4807         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4808         files_search_tmp($1)
4809 ')
4810
4811 ########################################
4812 ## <summary>
4813 ##      Dontaudit attempt to set attributes on  user temporary directories.
4814 ## </summary>
4815 ## <param name="domain">
4816 ##      <summary>
4817 ##      Domain to not audit.
4818 ##      </summary>
4819 ## </param>
4820 #
4821 interface(`userdom_dontaudit_setattr_user_tmp',`
4822         gen_require(`
4823                 type user_tmp_t;
4824         ')
4825
4826         dontaudit $1 user_tmp_t:dir setattr;
4827 ')
4828
4829 ########################################
4830 ## <summary>
4831 ##      Read all inherited users files in /tmp
4832 ## </summary>
4833 ## <param name="domain">
4834 ##      <summary>
4835 ##      Domain allowed access.
4836 ##      </summary>
4837 ## </param>
4838 #
4839 interface(`userdom_read_inherited_user_tmp_files',`
4840         gen_require(`
4841                 type user_tmp_t;
4842         ')
4843
4844         allow $1 user_tmp_t:file read_inherited_file_perms;
4845 ')
4846
4847 ########################################
4848 ## <summary>
4849 ##      Write all inherited users files in /tmp
4850 ## </summary>
4851 ## <param name="domain">
4852 ##      <summary>
4853 ##      Domain allowed access.
4854 ##      </summary>
4855 ## </param>
4856 #
4857 interface(`userdom_write_inherited_user_tmp_files',`
4858         gen_require(`
4859                 type user_tmp_t;
4860         ')
4861
4862         allow $1 user_tmp_t:file write;
4863 ')
4864
4865 ########################################
4866 ## <summary>
4867 ##      Delete all users files in /tmp
4868 ## </summary>
4869 ## <param name="domain">
4870 ##      <summary>
4871 ##      Domain allowed access.
4872 ##      </summary>
4873 ## </param>
4874 #
4875 interface(`userdom_delete_user_tmp_files',`
4876         gen_require(`
4877                 type user_tmp_t;
4878         ')
4879
4880         allow $1 user_tmp_t:file delete_file_perms;
4881 ')
4882
4883 ########################################
4884 ## <summary>
4885 ##      Delete user tmpfs files.
4886 ## </summary>
4887 ## <param name="domain">
4888 ##      <summary>
4889 ##      Domain allowed access.
4890 ##      </summary>
4891 ## </param>
4892 #
4893 interface(`userdom_delete_user_tmpfs_files',`
4894         gen_require(`
4895                 type user_tmpfs_t;
4896         ')
4897
4898         allow $1 user_tmpfs_t:file delete_file_perms;
4899 ')
4900
4901 ########################################
4902 ## <summary>
4903 ##      Read/Write unpriviledged user SysV shared
4904 ##      memory segments.
4905 ## </summary>
4906 ## <param name="domain">
4907 ##      <summary>
4908 ##      Domain allowed access.
4909 ##      </summary>
4910 ## </param>
4911 #
4912 interface(`userdom_rw_unpriv_user_shared_mem',`
4913         gen_require(`
4914                 attribute unpriv_userdomain;
4915         ')
4916
4917         allow $1 unpriv_userdomain:shm rw_shm_perms;
4918 ')
4919
4920 ########################################
4921 ## <summary>
4922 ##      Do not audit attempts to search user
4923 ##      temporary directories.
4924 ## </summary>
4925 ## <param name="domain">
4926 ##      <summary>
4927 ##      Domain to not audit.
4928 ##      </summary>
4929 ## </param>
4930 #
4931 interface(`userdom_dontaudit_search_user_tmp',`
4932         gen_require(`
4933                 type user_tmp_t;
4934         ')
4935
4936         dontaudit $1 user_tmp_t:dir search_dir_perms;
4937 ')
4938
4939 ########################################
4940 ## <summary>
4941 ##      Execute a file in a user home directory
4942 ##      in the specified domain.
4943 ## </summary>
4944 ## <desc>
4945 ##      <p>
4946 ##      Execute a file in a user home directory
4947 ##      in the specified domain.
4948 ##      </p>
4949 ##      <p>
4950 ##      No interprocess communication (signals, pipes,
4951 ##      etc.) is provided by this interface since
4952 ##      the domains are not owned by this module.
4953 ##      </p>
4954 ## </desc>
4955 ## <param name="domain">
4956 ##      <summary>
4957 ##      Domain allowed access.
4958 ##      </summary>
4959 ## </param>
4960 ## <param name="target_domain">
4961 ##      <summary>
4962 ##      The type of the new process.
4963 ##      </summary>
4964 ## </param>
4965 #
4966 interface(`userdom_domtrans_user_home',`
4967         gen_require(`
4968                 type user_home_t;
4969         ')
4970
4971         read_lnk_files_pattern($1, user_home_t, user_home_t)
4972         domain_transition_pattern($1, user_home_t, $2)
4973         type_transition $1 user_home_t:process $2;
4974 ')
4975
4976 ########################################
4977 ## <summary>
4978 ##      Execute a file in a user tmp directory
4979 ##      in the specified domain.
4980 ## </summary>
4981 ## <desc>
4982 ##      <p>
4983 ##      Execute a file in a user tmp directory
4984 ##      in the specified domain.
4985 ##      </p>
4986 ##      <p>
4987 ##      No interprocess communication (signals, pipes,
4988 ##      etc.) is provided by this interface since
4989 ##      the domains are not owned by this module.
4990 ##      </p>
4991 ## </desc>
4992 ## <param name="domain">
4993 ##      <summary>
4994 ##      Domain allowed access.
4995 ##      </summary>
4996 ## </param>
4997 ## <param name="target_domain">
4998 ##      <summary>
4999 ##      The type of the new process.
5000 ##      </summary>
5001 ## </param>
5002 #
5003 interface(`userdom_domtrans_user_tmp',`
5004         gen_require(`
5005                 type user_tmp_t;
5006         ')
5007
5008         files_search_tmp($1)
5009         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
5010         domain_transition_pattern($1, user_tmp_t, $2)
5011         type_transition $1 user_tmp_t:process $2;
5012 ')
5013
5014 ########################################
5015 ## <summary>
5016 ##      Do not audit attempts to read all user home content files.
5017 ## </summary>
5018 ## <param name="domain">
5019 ##      <summary>
5020 ##      Domain to not audit.
5021 ##      </summary>
5022 ## </param>
5023 #
5024 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5025         gen_require(`
5026                 attribute user_home_type;
5027         ')
5028
5029         dontaudit $1 user_home_type:file read_file_perms;
5030 ')
5031
5032 ########################################
5033 ## <summary>
5034 ##      Do not audit attempts to read all user tmp content files.
5035 ## </summary>
5036 ## <param name="domain">
5037 ##      <summary>
5038 ##      Domain to not audit.
5039 ##      </summary>
5040 ## </param>
5041 #
5042 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5043         gen_require(`
5044                 attribute user_tmp_type;
5045         ')
5046
5047         dontaudit $1 user_tmp_type:file read_file_perms;
5048 ')
5049
5050 #######################################
5051 ## <summary>
5052 ## Read and write unpriviledged user SysV sempaphores.
5053 ## </summary>
5054 ## <param name="domain">
5055 ## <summary>
5056 ## Domain allowed access.
5057 ## </summary>
5058 ## </param>
5059 #
5060 interface(`userdom_rw_unpriv_user_semaphores',`
5061    gen_require(`
5062        attribute unpriv_userdomain;
5063    ')
5064
5065    allow $1 unpriv_userdomain:sem rw_sem_perms;
5066 ')
5067
5068 ########################################
5069 ## <summary>
5070 ##      Transition to userdom named content
5071 ## </summary>
5072 ## <param name="domain">
5073 ##      <summary>
5074 ##      Domain allowed access.
5075 ##      </summary>
5076 ## </param>
5077 #
5078 interface(`userdom_filetrans_home_content',`
5079         gen_require(`
5080                 type home_bin_t, home_cert_t;
5081                 type audio_home_t;
5082         ')
5083
5084         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5085         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5086         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5087         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5088         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5089         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5090         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5091
5092         #optional_policy(`
5093         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5094         #')
5095 ')
5096
5097 ########################################
5098 ## <summary>
5099 ##      Make the specified type able to read content in user home dirs
5100 ## </summary>
5101 ## <param name="type">
5102 ##      <summary>
5103 ##      Domain allowed access.
5104 ##      </summary>
5105 ## </param>
5106 #
5107 interface(`userdom_home_reader',`
5108         gen_require(`
5109                 attribute userdom_home_reader_type;
5110         ')
5111
5112         typeattribute $1 userdom_home_reader_type;
5113 ')
5114
5115
5116 ########################################
5117 ## <summary>
5118 ##      Make the specified type able to manage content in user home dirs
5119 ## </summary>
5120 ## <param name="type">
5121 ##      <summary>
5122 ##      Domain allowed access.
5123 ##      </summary>
5124 ## </param>
5125 #
5126 interface(`userdom_home_manager',`
5127         gen_require(`
5128                 attribute userdom_home_manager_type;
5129         ')
5130
5131         typeattribute $1 userdom_home_manager_type;
5132 ')