policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 colord_read_lib_files($1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 dbus_system_bus_client($1_usertype)
 696
 697                 allow $1_usertype $1_usertype:dbus  send_msg;
 698
 699                 optional_policy(`
 700                         avahi_dbus_chat($1_usertype)
 701                 ')
 702
 703                 optional_policy(`
 704                         policykit_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         bluetooth_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         consolekit_dbus_chat($1_usertype)
 713                         consolekit_read_log($1_usertype)
 714                 ')
 715
 716                 optional_policy(`
 717                         devicekit_dbus_chat($1_usertype)
 718                         devicekit_dbus_chat_power($1_usertype)
 719                         devicekit_dbus_chat_disk($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 tunable_policy(`allow_user_mysql_connect',`
 784                         mysql_stream_connect($1_t)
 785                 ')
 786         ')
 787
 788         optional_policy(`
 789                 oident_manage_user_content($1_t)
 790                 oident_relabel_user_content($1_t)
 791         ')
 792
 793         optional_policy(`
 794                 # to allow monitoring of pcmcia status
 795                 pcmcia_read_pid($1_usertype)
 796         ')
 797
 798         optional_policy(`
 799                 pcscd_read_pub_files($1_usertype)
 800                 pcscd_stream_connect($1_usertype)
 801         ')
 802
 803         optional_policy(`
 804                 tunable_policy(`allow_user_postgresql_connect',`
 805                         postgresql_stream_connect($1_usertype)
 806                         postgresql_tcp_connect($1_usertype)
 807                 ')
 808         ')
 809
 810         optional_policy(`
 811                 resmgr_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 rpc_dontaudit_getattr_exports($1_usertype)
 816                 rpc_manage_nfs_rw_content($1_usertype)
 817         ')
 818
 819         optional_policy(`
 820                 rpcbind_stream_connect($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 samba_stream_connect_winbind($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 sandbox_transition($1_usertype, $1_r)
 829         ')
 830
 831         optional_policy(`
 832                 seunshare_role_template($1, $1_r, $1_t)
 833         ')
 834
 835         optional_policy(`
 836                 slrnpull_search_spool($1_usertype)
 837         ')
 838
 839         optional_policy(`
 840                 thumb_role($1_r, $1_usertype)
 841         ')
 842 ')
 843
 844 #######################################
 845 ## <summary>
 846 ##      The template for creating a login user.
 847 ## </summary>
 848 ## <desc>
 849 ##      <p>
 850 ##      This template creates a user domain, types, and
 851 ##      rules for the user's tty, pty, home directories,
 852 ##      tmp, and tmpfs files.
 853 ##      </p>
 854 ## </desc>
 855 ## <param name="userdomain_prefix">
 856 ##      <summary>
 857 ##      The prefix of the user domain (e.g., user
 858 ##      is the prefix for user_t).
 859 ##      </summary>
 860 ## </param>
 861 #
 862 template(`userdom_login_user_template', `
 863         gen_require(`
 864                 class context contains;
 865         ')
 866
 867         userdom_base_user_template($1)
 868
 869         userdom_manage_home_role($1_r, $1_usertype)
 870
 871         userdom_manage_tmp_role($1_r, $1_usertype)
 872         userdom_manage_tmpfs_role($1_r, $1_usertype)
 873
 874         ifelse(`$1',`unconfined',`',`
 875                 gen_tunable(allow_$1_exec_content, true)
 876
 877                 tunable_policy(`allow_$1_exec_content',`
 878                         userdom_exec_user_tmp_files($1_usertype)
 879                         userdom_exec_user_home_content_files($1_usertype)
 880                 ')
 881                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 882                         fs_exec_nfs_files($1_usertype)
 883                 ')
 884
 885                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 886                         fs_exec_cifs_files($1_usertype)
 887                 ')
 888         ')
 889
 890         userdom_change_password_template($1)
 891
 892         ##############################
 893         #
 894         # User domain Local policy
 895         #
 896
 897         allow $1_t self:capability { setgid chown fowner };
 898         dontaudit $1_t self:capability { sys_nice fsetid };
 899
 900         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 901         dontaudit $1_t self:process setrlimit;
 902         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 903
 904         allow $1_t self:context contains;
 905
 906         kernel_dontaudit_read_system_state($1_usertype)
 907         kernel_dontaudit_list_all_proc($1_usertype)
 908
 909         dev_read_sysfs($1_usertype)
 910         dev_read_urand($1_usertype)
 911
 912         domain_use_interactive_fds($1_usertype)
 913         # Command completion can fire hundreds of denials
 914         domain_dontaudit_exec_all_entry_files($1_usertype)
 915
 916         files_dontaudit_list_default($1_usertype)
 917         files_dontaudit_read_default_files($1_usertype)
 918         # Stat lost+found.
 919         files_getattr_lost_found_dirs($1_usertype)
 920
 921         fs_get_all_fs_quotas($1_usertype)
 922         fs_getattr_all_fs($1_usertype)
 923         fs_search_all($1_usertype)
 924         fs_list_inotifyfs($1_usertype)
 925         fs_rw_anon_inodefs_files($1_usertype)
 926
 927         auth_dontaudit_write_login_records($1_t)
 928         auth_rw_cache($1_t)
 929
 930         application_exec_all($1_t)
 931         # The library functions always try to open read-write first,
 932         # then fall back to read-only if it fails.
 933         init_dontaudit_rw_utmp($1_t)
 934
 935         # Stop warnings about access to /dev/console
 936         init_dontaudit_use_fds($1_usertype)
 937         init_dontaudit_use_script_fds($1_usertype)
 938
 939         libs_exec_lib_files($1_usertype)
 940
 941         logging_dontaudit_getattr_all_logs($1_usertype)
 942
 943         # for running TeX programs
 944         miscfiles_read_tetex_data($1_usertype)
 945         miscfiles_exec_tetex_data($1_usertype)
 946
 947         seutil_read_config($1_usertype)
 948
 949         optional_policy(`
 950                 cups_read_config($1_usertype)
 951                 cups_stream_connect($1_usertype)
 952                 cups_stream_connect_ptal($1_usertype)
 953         ')
 954
 955         optional_policy(`
 956                 kerberos_use($1_usertype)
 957                 kerberos_filetrans_home_content($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 mta_dontaudit_read_spool_symlinks($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 quota_dontaudit_getattr_db($1_usertype)
 966         ')
 967
 968         optional_policy(`
 969                 rpm_read_db($1_usertype)
 970                 rpm_dontaudit_manage_db($1_usertype)
 971                 rpm_read_cache($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 oddjob_run_mkhomedir($1_t, $1_r)
 976         ')
 977 ')
 978
 979 #######################################
 980 ## <summary>
 981 ##      The template for creating a unprivileged login user.
 982 ## </summary>
 983 ## <desc>
 984 ##      <p>
 985 ##      This template creates a user domain, types, and
 986 ##      rules for the user's tty, pty, home directories,
 987 ##      tmp, and tmpfs files.
 988 ##      </p>
 989 ## </desc>
 990 ## <param name="userdomain_prefix">
 991 ##      <summary>
 992 ##      The prefix of the user domain (e.g., user
 993 ##      is the prefix for user_t).
 994 ##      </summary>
 995 ## </param>
 996 #
 997 template(`userdom_restricted_user_template',`
 998         gen_require(`
 999                 attribute unpriv_userdomain;
1000         ')
1001
1002         userdom_login_user_template($1)
1003
1004         typeattribute $1_t unpriv_userdomain;
1005         domain_interactive_fd($1_t)
1006
1007         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1008         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1009
1010         ##############################
1011         #
1012         # Local policy
1013         #
1014
1015         optional_policy(`
1016                 loadkeys_run($1_t, $1_r)
1017         ')
1018 ')
1019
1020 #######################################
1021 ## <summary>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ## </summary>
1024 ## <desc>
1025 ##      <p>
1026 ##      The template for creating a unprivileged xwindows login user.
1027 ##      </p>
1028 ##      <p>
1029 ##      This template creates a user domain, types, and
1030 ##      rules for the user's tty, pty, home directories,
1031 ##      tmp, and tmpfs files.
1032 ##      </p>
1033 ## </desc>
1034 ## <param name="userdomain_prefix">
1035 ##      <summary>
1036 ##      The prefix of the user domain (e.g., user
1037 ##      is the prefix for user_t).
1038 ##      </summary>
1039 ## </param>
1040 #
1041 template(`userdom_restricted_xwindows_user_template',`
1042
1043         userdom_restricted_user_template($1)
1044
1045         ##############################
1046         #
1047         # Local policy
1048         #
1049
1050         auth_role($1_r, $1_t)
1051         auth_search_pam_console_data($1_usertype)
1052         auth_dontaudit_read_login_records($1_usertype)
1053
1054         dev_read_sound($1_usertype)
1055         dev_write_sound($1_usertype)
1056         # gnome keyring wants to read this.
1057         dev_dontaudit_read_rand($1_usertype)
1058         # temporarily allow since openoffice requires this
1059         dev_read_rand($1_usertype)
1060
1061         dev_read_video_dev($1_usertype)
1062         dev_write_video_dev($1_usertype)
1063         dev_rw_wireless($1_usertype)
1064
1065         libs_dontaudit_setattr_lib_files($1_usertype)
1066
1067         tunable_policy(`user_rw_noexattrfile',`
1068                 dev_rw_usbfs($1_t)
1069                 dev_rw_generic_usb_dev($1_usertype)
1070
1071                 fs_manage_noxattr_fs_files($1_usertype)
1072                 fs_manage_noxattr_fs_dirs($1_usertype)
1073                 fs_manage_dos_dirs($1_usertype)
1074                 fs_manage_dos_files($1_usertype)
1075                 storage_raw_read_removable_device($1_usertype)
1076                 storage_raw_write_removable_device($1_usertype)
1077         ')
1078
1079         logging_send_syslog_msg($1_usertype)
1080         logging_dontaudit_send_audit_msgs($1_t)
1081
1082         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1083         logging_send_audit_msgs($1_t)
1084         selinux_get_enforce_mode($1_t)
1085         seutil_exec_restorecond($1_t)
1086         seutil_read_file_contexts($1_t)
1087         seutil_read_default_contexts($1_t)
1088
1089         xserver_restricted_role($1_r, $1_t)
1090
1091         optional_policy(`
1092                 alsa_read_rw_config($1_usertype)
1093         ')
1094
1095          # cjp: needed by KDE apps
1096          # bug: #682499
1097          optional_policy(`
1098                 gnome_read_usr_config($1_usertype)
1099                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1100                 # cjp: telepathy F15 bugs
1101                 telepathy_role($1_r, $1_t, $1)
1102         ')
1103
1104         optional_policy(`
1105                 dbus_role_template($1, $1_r, $1_usertype)
1106                 dbus_system_bus_client($1_usertype)
1107                 allow $1_usertype $1_usertype:dbus send_msg;
1108
1109                 optional_policy(`
1110                         abrt_dbus_chat($1_usertype)
1111                         abrt_run_helper($1_usertype, $1_r)
1112                 ')
1113
1114                 optional_policy(`
1115                         consolekit_dontaudit_read_log($1_usertype)
1116                         consolekit_dbus_chat($1_usertype)
1117                 ')
1118
1119                 optional_policy(`
1120                         cups_dbus_chat($1_usertype)
1121                         cups_dbus_chat_config($1_usertype)
1122                 ')
1123
1124                 optional_policy(`
1125                         devicekit_dbus_chat($1_usertype)
1126                         devicekit_dbus_chat_disk($1_usertype)
1127                         devicekit_dbus_chat_power($1_usertype)
1128                 ')
1129
1130                 optional_policy(`
1131                         fprintd_dbus_chat($1_t)
1132                 ')
1133         ')
1134
1135         optional_policy(`
1136                 policykit_role($1_r, $1_usertype)
1137         ')
1138
1139         optional_policy(`
1140                 pulseaudio_role($1_r, $1_usertype)
1141                 pulseaudio_filetrans_admin_home_content($1_usertype)
1142                 pulseaudio_filetrans_home_content($1_usertype)
1143         ')
1144
1145         optional_policy(`
1146                 rtkit_scheduled($1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 setroubleshoot_dontaudit_stream_connect($1_t)
1151         ')
1152
1153         optional_policy(`
1154                 udev_read_db($1_usertype)
1155         ')
1156
1157         optional_policy(`
1158                 wm_role_template($1, $1_r, $1_t)
1159         ')
1160 ')
1161
1162 #######################################
1163 ## <summary>
1164 ##      The template for creating a unprivileged user roughly
1165 ##      equivalent to a regular linux user.
1166 ## </summary>
1167 ## <desc>
1168 ##      <p>
1169 ##      The template for creating a unprivileged user roughly
1170 ##      equivalent to a regular linux user.
1171 ##      </p>
1172 ##      <p>
1173 ##      This template creates a user domain, types, and
1174 ##      rules for the user's tty, pty, home directories,
1175 ##      tmp, and tmpfs files.
1176 ##      </p>
1177 ## </desc>
1178 ## <param name="userdomain_prefix">
1179 ##      <summary>
1180 ##      The prefix of the user domain (e.g., user
1181 ##      is the prefix for user_t).
1182 ##      </summary>
1183 ## </param>
1184 #
1185 template(`userdom_unpriv_user_template', `
1186
1187         ##############################
1188         #
1189         # Declarations
1190         #
1191
1192         # Inherit rules for ordinary users.
1193         userdom_restricted_xwindows_user_template($1)
1194         userdom_common_user_template($1)
1195
1196         ##############################
1197         #
1198         # Local policy
1199         #
1200
1201         # port access is audited even if dac would not have allowed it, so dontaudit it here
1202 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1203         # Need the following rule to allow users to run vpnc
1204         corenet_tcp_bind_xserver_port($1_t)
1205         corenet_tcp_bind_generic_node($1_usertype)
1206
1207         storage_rw_fuse($1_t)
1208
1209         files_exec_usr_files($1_t)
1210    # cjp: why?
1211         files_read_kernel_symbol_table($1_t)
1212
1213         ifndef(`enable_mls',`
1214                 fs_exec_noxattr($1_t)
1215
1216                 tunable_policy(`user_rw_noexattrfile',`
1217                         fs_manage_noxattr_fs_files($1_t)
1218                         fs_manage_noxattr_fs_dirs($1_t)
1219                         # Write floppies
1220                         storage_raw_read_removable_device($1_t)
1221                         storage_raw_write_removable_device($1_t)
1222                 ',`
1223                         storage_raw_read_removable_device($1_t)
1224                 ')
1225         ')
1226
1227         miscfiles_read_hwdata($1_usertype)
1228
1229         # Allow users to run TCP servers (bind to ports and accept connection from
1230         # the same domain and outside users) disabling this forces FTP passive mode
1231         # and may change other protocols
1232
1233         tunable_policy(`user_share_music',`
1234                 corenet_tcp_bind_daap_port($1_usertype)
1235         ')
1236
1237         tunable_policy(`user_tcp_server',`
1238                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1239         ')
1240
1241         tunable_policy(`user_setrlimit',`
1242                 allow $1_usertype self:process setrlimit;
1243         ')
1244
1245         optional_policy(`
1246                 cdrecord_role($1_r, $1_t)
1247         ')
1248
1249         optional_policy(`
1250                 cron_role($1_r, $1_t)
1251         ')
1252
1253         optional_policy(`
1254                 games_rw_data($1_usertype)
1255         ')
1256
1257         optional_policy(`
1258                 gpg_role($1_r, $1_usertype)
1259         ')
1260
1261         optional_policy(`
1262                 gnomeclock_dbus_chat($1_t)
1263         ')
1264
1265         optional_policy(`
1266                 gpm_stream_connect($1_usertype)
1267         ')
1268
1269         optional_policy(`
1270                 mount_run_fusermount($1_t, $1_r)
1271                 mount_read_pid_files($1_t)
1272         ')
1273
1274         optional_policy(`
1275                 wine_role_template($1, $1_r, $1_t)
1276         ')
1277
1278         optional_policy(`
1279                 postfix_run_postdrop($1_t, $1_r)
1280                 postfix_search_spool($1_t)
1281         ')
1282
1283         # Run pppd in pppd_t by default for user
1284         optional_policy(`
1285                 ppp_run_cond($1_t, $1_r)
1286         ')
1287
1288         optional_policy(`
1289                 vdagent_getattr_log($1_t)
1290                 vdagent_getattr_exec($1_t)
1291                 vdagent_stream_connect($1_t)
1292         ')
1293 ')
1294
1295 #######################################
1296 ## <summary>
1297 ##      The template for creating an administrative user.
1298 ## </summary>
1299 ## <desc>
1300 ##      <p>
1301 ##      This template creates a user domain, types, and
1302 ##      rules for the user's tty, pty, home directories,
1303 ##      tmp, and tmpfs files.
1304 ##      </p>
1305 ##      <p>
1306 ##      The privileges given to administrative users are:
1307 ##      <ul>
1308 ##              <li>Raw disk access</li>
1309 ##              <li>Set all sysctls</li>
1310 ##              <li>All kernel ring buffer controls</li>
1311 ##              <li>Create, read, write, and delete all files but shadow</li>
1312 ##              <li>Manage source and binary format SELinux policy</li>
1313 ##              <li>Run insmod</li>
1314 ##      </ul>
1315 ##      </p>
1316 ## </desc>
1317 ## <param name="userdomain_prefix">
1318 ##      <summary>
1319 ##      The prefix of the user domain (e.g., sysadm
1320 ##      is the prefix for sysadm_t).
1321 ##      </summary>
1322 ## </param>
1323 #
1324 template(`userdom_admin_user_template',`
1325         gen_require(`
1326                 attribute admindomain;
1327                 class passwd { passwd chfn chsh rootok crontab };
1328         ')
1329
1330         ##############################
1331         #
1332         # Declarations
1333         #
1334
1335         # Inherit rules for ordinary users.
1336         userdom_login_user_template($1)
1337         userdom_common_user_template($1)
1338
1339         domain_obj_id_change_exemption($1_t)
1340         role system_r types $1_t;
1341
1342         typeattribute $1_t admindomain;
1343
1344         ifdef(`direct_sysadm_daemon',`
1345                 domain_system_change_exemption($1_t)
1346         ')
1347
1348         ##############################
1349         #
1350         # $1_t local policy
1351         #
1352
1353         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1354         tunable_policy(`deny_ptrace',`',`
1355                 allow $1_t self:capability sys_ptrace;
1356         ')
1357         allow $1_t self:capability2 syslog;
1358         allow $1_t self:process { setexec setfscreate };
1359         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1360         allow $1_t self:tun_socket create;
1361         # Set password information for other users.
1362         allow $1_t self:passwd { passwd chfn chsh };
1363         # Skip authentication when pam_rootok is specified.
1364         allow $1_t self:passwd rootok;
1365
1366         # Manipulate other users crontab.
1367         allow $1_t self:passwd crontab;
1368
1369         kernel_read_software_raid_state($1_t)
1370         kernel_getattr_core_if($1_t)
1371         kernel_getattr_message_if($1_t)
1372         kernel_change_ring_buffer_level($1_t)
1373         kernel_clear_ring_buffer($1_t)
1374         kernel_read_ring_buffer($1_t)
1375         kernel_get_sysvipc_info($1_t)
1376         kernel_rw_all_sysctls($1_t)
1377         # signal unlabeled processes:
1378         kernel_kill_unlabeled($1_t)
1379         kernel_signal_unlabeled($1_t)
1380         kernel_sigstop_unlabeled($1_t)
1381         kernel_signull_unlabeled($1_t)
1382         kernel_sigchld_unlabeled($1_t)
1383         kernel_signal($1_t)
1384
1385         corenet_tcp_bind_generic_port($1_t)
1386         # allow setting up tunnels
1387         corenet_rw_tun_tap_dev($1_t)
1388
1389         dev_getattr_generic_blk_files($1_t)
1390         dev_getattr_generic_chr_files($1_t)
1391         # for lsof
1392         dev_getattr_mtrr_dev($1_t)
1393         # Allow MAKEDEV to work
1394         dev_create_all_blk_files($1_t)
1395         dev_create_all_chr_files($1_t)
1396         dev_delete_all_blk_files($1_t)
1397         dev_delete_all_chr_files($1_t)
1398         dev_rename_all_blk_files($1_t)
1399         dev_rename_all_chr_files($1_t)
1400         dev_create_generic_symlinks($1_t)
1401         dev_rw_generic_usb_dev($1_t)
1402         dev_rw_usbfs($1_t)
1403
1404         domain_setpriority_all_domains($1_t)
1405         domain_read_all_domains_state($1_t)
1406         domain_getattr_all_domains($1_t)
1407         domain_getcap_all_domains($1_t)
1408         domain_dontaudit_ptrace_all_domains($1_t)
1409         # signal all domains:
1410         domain_kill_all_domains($1_t)
1411         domain_signal_all_domains($1_t)
1412         domain_signull_all_domains($1_t)
1413         domain_sigstop_all_domains($1_t)
1414         domain_sigstop_all_domains($1_t)
1415         domain_sigchld_all_domains($1_t)
1416         # for lsof
1417         domain_getattr_all_sockets($1_t)
1418         domain_dontaudit_getattr_all_sockets($1_t)
1419
1420         files_exec_usr_src_files($1_t)
1421
1422         fs_getattr_all_fs($1_t)
1423         fs_getattr_all_files($1_t)
1424         fs_list_all($1_t)
1425         fs_set_all_quotas($1_t)
1426         fs_exec_noxattr($1_t)
1427
1428         storage_raw_read_removable_device($1_t)
1429         storage_raw_write_removable_device($1_t)
1430         storage_dontaudit_read_fixed_disk($1_t)
1431
1432         term_use_all_inherited_terms($1_t)
1433         term_use_unallocated_ttys($1_t)
1434
1435         auth_getattr_shadow($1_t)
1436         # Manage almost all files
1437         files_manage_non_security_dirs($1_t)
1438         files_manage_non_security_files($1_t)
1439         # Relabel almost all files
1440         files_relabel_non_security_files($1_t)
1441
1442         init_telinit($1_t)
1443
1444         logging_send_syslog_msg($1_t)
1445
1446         optional_policy(`
1447                 modutils_domtrans_insmod($1_t)
1448                 modutils_domtrans_depmod($1_t)
1449         ')
1450
1451         # The following rule is temporary until such time that a complete
1452         # policy management infrastructure is in place so that an administrator
1453         # cannot directly manipulate policy files with arbitrary programs.
1454         seutil_manage_src_policy($1_t)
1455         # Violates the goal of limiting write access to checkpolicy.
1456         # But presently necessary for installing the file_contexts file.
1457         seutil_manage_bin_policy($1_t)
1458
1459         systemd_config_all_services($1_t)
1460
1461         userdom_manage_user_home_content_dirs($1_t)
1462         userdom_manage_user_home_content_files($1_t)
1463         userdom_manage_user_home_content_symlinks($1_t)
1464         userdom_manage_user_home_content_pipes($1_t)
1465         userdom_manage_user_home_content_sockets($1_t)
1466         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1467
1468         tunable_policy(`user_rw_noexattrfile',`
1469                 fs_manage_noxattr_fs_files($1_t)
1470                 fs_manage_noxattr_fs_dirs($1_t)
1471         ',`
1472                 fs_read_noxattr_fs_files($1_t)
1473         ')
1474
1475         optional_policy(`
1476                 postgresql_unconfined($1_t)
1477         ')
1478
1479         optional_policy(`
1480                 userhelper_exec($1_t)
1481         ')
1482 ')
1483
1484 ########################################
1485 ## <summary>
1486 ##      Allow user to run as a secadm
1487 ## </summary>
1488 ## <desc>
1489 ##      <p>
1490 ##      Create objects in a user home directory
1491 ##      with an automatic type transition to
1492 ##      a specified private type.
1493 ##      </p>
1494 ##      <p>
1495 ##      This is a templated interface, and should only
1496 ##      be called from a per-userdomain template.
1497 ##      </p>
1498 ## </desc>
1499 ## <param name="domain">
1500 ##      <summary>
1501 ##      Domain allowed access.
1502 ##      </summary>
1503 ## </param>
1504 ## <param name="role">
1505 ##      <summary>
1506 ##      The role  of the object to create.
1507 ##      </summary>
1508 ## </param>
1509 #
1510 template(`userdom_security_admin_template',`
1511         allow $1 self:capability { dac_read_search dac_override };
1512
1513         corecmd_exec_shell($1)
1514
1515         domain_obj_id_change_exemption($1)
1516
1517         dev_relabel_all_dev_nodes($1)
1518
1519         files_create_boot_flag($1)
1520         files_create_default_dir($1)
1521         files_root_filetrans_default($1, dir)
1522
1523         # Necessary for managing /boot/efi
1524         fs_manage_dos_files($1)
1525
1526         mls_process_read_up($1)
1527         mls_file_read_all_levels($1)
1528         mls_file_upgrade($1)
1529         mls_file_downgrade($1)
1530
1531         selinux_set_enforce_mode($1)
1532         selinux_set_all_booleans($1)
1533         selinux_set_parameters($1)
1534         selinux_read_policy($1)
1535
1536         files_relabel_all_files($1)
1537         auth_relabel_shadow($1)
1538
1539         init_exec($1)
1540
1541         logging_send_syslog_msg($1)
1542         logging_read_audit_log($1)
1543         logging_read_generic_logs($1)
1544         logging_read_audit_config($1)
1545
1546         seutil_manage_bin_policy($1)
1547         seutil_manage_default_contexts($1)
1548         seutil_manage_file_contexts($1)
1549         seutil_manage_module_store($1)
1550         seutil_manage_config($1)
1551         seutil_run_checkpolicy($1,$2)
1552         seutil_run_loadpolicy($1,$2)
1553         seutil_run_semanage($1,$2)
1554         seutil_run_setsebool($1,$2)
1555         seutil_run_setfiles($1, $2)
1556
1557         seutil_manage_bin_policy($1)
1558     seutil_manage_default_contexts($1)
1559     seutil_manage_file_contexts($1)
1560     seutil_manage_module_store($1)
1561     seutil_manage_config($1)
1562
1563         optional_policy(`
1564                 aide_run($1,$2)
1565         ')
1566
1567         optional_policy(`
1568                 consoletype_exec($1)
1569         ')
1570
1571         optional_policy(`
1572                 dmesg_exec($1)
1573         ')
1574
1575         optional_policy(`
1576                 ipsec_run_setkey($1,$2)
1577         ')
1578
1579         optional_policy(`
1580                 netlabel_run_mgmt($1,$2)
1581         ')
1582
1583         optional_policy(`
1584                 samhain_run($1, $2)
1585         ')
1586 ')
1587
1588 ########################################
1589 ## <summary>
1590 ##      Make the specified type usable in a
1591 ##      user home directory.
1592 ## </summary>
1593 ## <param name="type">
1594 ##      <summary>
1595 ##      Type to be used as a file in the
1596 ##      user home directory.
1597 ##      </summary>
1598 ## </param>
1599 #
1600 interface(`userdom_user_home_content',`
1601         gen_require(`
1602                 type user_home_t;
1603                 attribute user_home_type;
1604         ')
1605
1606         allow $1 user_home_t:filesystem associate;
1607         files_type($1)
1608         ubac_constrained($1)
1609
1610         files_poly_member($1)
1611         typeattribute $1  user_home_type;
1612 ')
1613
1614 ########################################
1615 ## <summary>
1616 ##      Make the specified type usable in a
1617 ##      generic temporary directory.
1618 ## </summary>
1619 ## <param name="type">
1620 ##      <summary>
1621 ##      Type to be used as a file in the
1622 ##      generic temporary directory.
1623 ##      </summary>
1624 ## </param>
1625 #
1626 interface(`userdom_user_tmp_content',`
1627         gen_require(`
1628                 attribute user_tmp_type;
1629         ')
1630
1631         typeattribute $1 user_tmp_type;
1632
1633         files_tmp_file($1)
1634         ubac_constrained($1)
1635 ')
1636
1637 ########################################
1638 ## <summary>
1639 ##      Make the specified type usable in a
1640 ##      generic tmpfs_t directory.
1641 ## </summary>
1642 ## <param name="type">
1643 ##      <summary>
1644 ##      Type to be used as a file in the
1645 ##      generic temporary directory.
1646 ##      </summary>
1647 ## </param>
1648 #
1649 interface(`userdom_user_tmpfs_content',`
1650         gen_require(`
1651                 attribute user_tmpfs_type;
1652         ')
1653
1654         typeattribute $1 user_tmpfs_type;
1655
1656         files_tmpfs_file($1)
1657         ubac_constrained($1)
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Allow domain to attach to TUN devices created by administrative users.
1663 ## </summary>
1664 ## <param name="domain">
1665 ##      <summary>
1666 ##      Domain allowed access.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_attach_admin_tun_iface',`
1671         gen_require(`
1672                 attribute admindomain;
1673         ')
1674
1675         allow $1 admindomain:tun_socket relabelfrom;
1676         allow $1 self:tun_socket relabelto;
1677 ')
1678
1679 ########################################
1680 ## <summary>
1681 ##      Set the attributes of a user pty.
1682 ## </summary>
1683 ## <param name="domain">
1684 ##      <summary>
1685 ##      Domain allowed access.
1686 ##      </summary>
1687 ## </param>
1688 #
1689 interface(`userdom_setattr_user_ptys',`
1690         gen_require(`
1691                 type user_devpts_t;
1692         ')
1693
1694         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1695 ')
1696
1697 ########################################
1698 ## <summary>
1699 ##      Create a user pty.
1700 ## </summary>
1701 ## <param name="domain">
1702 ##      <summary>
1703 ##      Domain allowed access.
1704 ##      </summary>
1705 ## </param>
1706 #
1707 interface(`userdom_create_user_pty',`
1708         gen_require(`
1709                 type user_devpts_t;
1710         ')
1711
1712         term_create_pty($1, user_devpts_t)
1713 ')
1714
1715 ########################################
1716 ## <summary>
1717 ##      Get the attributes of user home directories.
1718 ## </summary>
1719 ## <param name="domain">
1720 ##      <summary>
1721 ##      Domain allowed access.
1722 ##      </summary>
1723 ## </param>
1724 #
1725 interface(`userdom_getattr_user_home_dirs',`
1726         gen_require(`
1727                 type user_home_dir_t;
1728         ')
1729
1730         allow $1 user_home_dir_t:dir getattr_dir_perms;
1731         files_search_home($1)
1732 ')
1733
1734 ########################################
1735 ## <summary>
1736 ##      Do not audit attempts to get the attributes of user home directories.
1737 ## </summary>
1738 ## <param name="domain">
1739 ##      <summary>
1740 ##      Domain to not audit.
1741 ##      </summary>
1742 ## </param>
1743 #
1744 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1745         gen_require(`
1746                 type user_home_dir_t;
1747         ')
1748
1749         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1750 ')
1751
1752 ########################################
1753 ## <summary>
1754 ##      Search user home directories.
1755 ## </summary>
1756 ## <param name="domain">
1757 ##      <summary>
1758 ##      Domain allowed access.
1759 ##      </summary>
1760 ## </param>
1761 #
1762 interface(`userdom_search_user_home_dirs',`
1763         gen_require(`
1764                 type user_home_dir_t;
1765         ')
1766
1767         allow $1 user_home_dir_t:dir search_dir_perms;
1768         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1769         files_search_home($1)
1770 ')
1771
1772 ########################################
1773 ## <summary>
1774 ##      Do not audit attempts to search user home directories.
1775 ## </summary>
1776 ## <desc>
1777 ##      <p>
1778 ##      Do not audit attempts to search user home directories.
1779 ##      This will supress SELinux denial messages when the specified
1780 ##      domain is denied the permission to search these directories.
1781 ##      </p>
1782 ## </desc>
1783 ## <param name="domain">
1784 ##      <summary>
1785 ##      Domain to not audit.
1786 ##      </summary>
1787 ## </param>
1788 ## <infoflow type="none"/>
1789 #
1790 interface(`userdom_dontaudit_search_user_home_dirs',`
1791         gen_require(`
1792                 type user_home_dir_t;
1793         ')
1794
1795         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1796 ')
1797
1798 ########################################
1799 ## <summary>
1800 ##      List user home directories.
1801 ## </summary>
1802 ## <param name="domain">
1803 ##      <summary>
1804 ##      Domain allowed access.
1805 ##      </summary>
1806 ## </param>
1807 #
1808 interface(`userdom_list_user_home_dirs',`
1809         gen_require(`
1810                 type user_home_dir_t;
1811         ')
1812
1813         allow $1 user_home_dir_t:dir list_dir_perms;
1814         files_search_home($1)
1815
1816         tunable_policy(`use_nfs_home_dirs',`
1817                 fs_list_nfs($1)
1818         ')
1819
1820         tunable_policy(`use_samba_home_dirs',`
1821                 fs_list_cifs($1)
1822         ')
1823 ')
1824
1825 ########################################
1826 ## <summary>
1827 ##      Do not audit attempts to list user home subdirectories.
1828 ## </summary>
1829 ## <param name="domain">
1830 ##      <summary>
1831 ##      Domain to not audit.
1832 ##      </summary>
1833 ## </param>
1834 #
1835 interface(`userdom_dontaudit_list_user_home_dirs',`
1836         gen_require(`
1837                 type user_home_dir_t;
1838                 type user_home_t;
1839         ')
1840
1841         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1842         dontaudit $1 user_home_t:dir list_dir_perms;
1843 ')
1844
1845 ########################################
1846 ## <summary>
1847 ##      Create user home directories.
1848 ## </summary>
1849 ## <param name="domain">
1850 ##      <summary>
1851 ##      Domain allowed access.
1852 ##      </summary>
1853 ## </param>
1854 #
1855 interface(`userdom_create_user_home_dirs',`
1856         gen_require(`
1857                 type user_home_dir_t;
1858         ')
1859
1860         allow $1 user_home_dir_t:dir create_dir_perms;
1861 ')
1862
1863 ########################################
1864 ## <summary>
1865 ##      Create user home directories.
1866 ## </summary>
1867 ## <param name="domain">
1868 ##      <summary>
1869 ##      Domain allowed access.
1870 ##      </summary>
1871 ## </param>
1872 #
1873 interface(`userdom_manage_user_home_dirs',`
1874         gen_require(`
1875                 type user_home_dir_t;
1876         ')
1877
1878         allow $1 user_home_dir_t:dir manage_dir_perms;
1879 ')
1880
1881 ########################################
1882 ## <summary>
1883 ##      Relabel to user home directories.
1884 ## </summary>
1885 ## <param name="domain">
1886 ##      <summary>
1887 ##      Domain allowed access.
1888 ##      </summary>
1889 ## </param>
1890 #
1891 interface(`userdom_relabelto_user_home_dirs',`
1892         gen_require(`
1893                 type user_home_dir_t;
1894         ')
1895
1896         allow $1 user_home_dir_t:dir relabelto;
1897 ')
1898
1899
1900 ########################################
1901 ## <summary>
1902 ##      Relabel to user home files.
1903 ## </summary>
1904 ## <param name="domain">
1905 ##      <summary>
1906 ##      Domain allowed access.
1907 ##      </summary>
1908 ## </param>
1909 #
1910 interface(`userdom_relabelto_user_home_files',`
1911         gen_require(`
1912                 type user_home_t;
1913         ')
1914
1915         allow $1 user_home_t:file relabelto;
1916 ')
1917 ########################################
1918 ## <summary>
1919 ##      Relabel user home files.
1920 ## </summary>
1921 ## <param name="domain">
1922 ##      <summary>
1923 ##      Domain allowed access.
1924 ##      </summary>
1925 ## </param>
1926 #
1927 interface(`userdom_relabel_user_home_files',`
1928         gen_require(`
1929                 type user_home_t;
1930         ')
1931
1932         allow $1 user_home_t:file relabel_file_perms;
1933 ')
1934
1935 ########################################
1936 ## <summary>
1937 ##      Create directories in the home dir root with
1938 ##      the user home directory type.
1939 ## </summary>
1940 ## <param name="domain">
1941 ##      <summary>
1942 ##      Domain allowed access.
1943 ##      </summary>
1944 ## </param>
1945 #
1946 interface(`userdom_home_filetrans_user_home_dir',`
1947         gen_require(`
1948                 type user_home_dir_t;
1949         ')
1950
1951         files_home_filetrans($1, user_home_dir_t, dir)
1952 ')
1953
1954 ########################################
1955 ## <summary>
1956 ##      Do a domain transition to the specified
1957 ##      domain when executing a program in the
1958 ##      user home directory.
1959 ## </summary>
1960 ## <desc>
1961 ##      <p>
1962 ##      Do a domain transition to the specified
1963 ##      domain when executing a program in the
1964 ##      user home directory.
1965 ##      </p>
1966 ##      <p>
1967 ##      No interprocess communication (signals, pipes,
1968 ##      etc.) is provided by this interface since
1969 ##      the domains are not owned by this module.
1970 ##      </p>
1971 ## </desc>
1972 ## <param name="source_domain">
1973 ##      <summary>
1974 ##      Domain allowed to transition.
1975 ##      </summary>
1976 ## </param>
1977 ## <param name="target_domain">
1978 ##      <summary>
1979 ##      Domain to transition to.
1980 ##      </summary>
1981 ## </param>
1982 #
1983 interface(`userdom_user_home_domtrans',`
1984         gen_require(`
1985                 type user_home_dir_t, user_home_t;
1986         ')
1987
1988         domain_auto_trans($1, user_home_t, $2)
1989         allow $1 user_home_dir_t:dir search_dir_perms;
1990         files_search_home($1)
1991 ')
1992
1993 ########################################
1994 ## <summary>
1995 ##      Do not audit attempts to search user home content directories.
1996 ## </summary>
1997 ## <param name="domain">
1998 ##      <summary>
1999 ##      Domain to not audit.
2000 ##      </summary>
2001 ## </param>
2002 #
2003 interface(`userdom_dontaudit_search_user_home_content',`
2004         gen_require(`
2005                 type user_home_t;
2006         ')
2007
2008         dontaudit $1 user_home_t:dir search_dir_perms;
2009         fs_dontaudit_list_nfs($1)
2010         fs_dontaudit_list_cifs($1)
2011 ')
2012
2013 ########################################
2014 ## <summary>
2015 ##      List contents of users home directory.
2016 ## </summary>
2017 ## <param name="domain">
2018 ##      <summary>
2019 ##      Domain allowed access.
2020 ##      </summary>
2021 ## </param>
2022 #
2023 interface(`userdom_list_user_home_content',`
2024         gen_require(`
2025                 type user_home_dir_t;
2026                 attribute user_home_type;
2027         ')
2028
2029         files_list_home($1)
2030         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2031 ')
2032
2033 ########################################
2034 ## <summary>
2035 ##      Create, read, write, and delete directories
2036 ##      in a user home subdirectory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`userdom_manage_user_home_content_dirs',`
2045         gen_require(`
2046                 type user_home_dir_t, user_home_t;
2047         ')
2048
2049         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2050         files_search_home($1)
2051 ')
2052
2053 ########################################
2054 ## <summary>
2055 ##      Delete directories in a user home subdirectory.
2056 ## </summary>
2057 ## <param name="domain">
2058 ##      <summary>
2059 ##      Domain allowed access.
2060 ##      </summary>
2061 ## </param>
2062 #
2063 interface(`userdom_delete_user_home_content_dirs',`
2064         gen_require(`
2065                 type user_home_t;
2066         ')
2067
2068         allow $1 user_home_t:dir delete_dir_perms;
2069 ')
2070
2071 ########################################
2072 ## <summary>
2073 ##      Delete all directories in a user home subdirectory.
2074 ## </summary>
2075 ## <param name="domain">
2076 ##      <summary>
2077 ##      Domain allowed access.
2078 ##      </summary>
2079 ## </param>
2080 #
2081 interface(`userdom_delete_all_user_home_content_dirs',`
2082         gen_require(`
2083                 attribute user_home_type;
2084         ')
2085
2086         allow $1 user_home_type:dir delete_dir_perms;
2087 ')
2088
2089 ########################################
2090 ## <summary>
2091 ##      Set the attributes of user home files.
2092 ## </summary>
2093 ## <param name="domain">
2094 ##      <summary>
2095 ##      Domain allowed access.
2096 ##      </summary>
2097 ## </param>
2098 ## <rolecap/>
2099 #
2100 interface(`userdom_setattr_user_home_content_files',`
2101         gen_require(`
2102                 type user_home_t;
2103         ')
2104
2105         allow $1 user_home_t:file setattr;
2106 ')
2107
2108 ########################################
2109 ## <summary>
2110 ##      Do not audit attempts to set the
2111 ##      attributes of user home files.
2112 ## </summary>
2113 ## <param name="domain">
2114 ##      <summary>
2115 ##      Domain to not audit.
2116 ##      </summary>
2117 ## </param>
2118 #
2119 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2120         gen_require(`
2121                 type user_home_t;
2122         ')
2123
2124         dontaudit $1 user_home_t:file setattr_file_perms;
2125 ')
2126
2127 ########################################
2128 ## <summary>
2129 ##      Set the attributes of all user home directories.
2130 ## </summary>
2131 ## <param name="domain">
2132 ##      <summary>
2133 ##      Domain allowed access.
2134 ##      </summary>
2135 ## </param>
2136 ## <rolecap/>
2137 #
2138 interface(`userdom_setattr_all_user_home_content_dirs',`
2139         gen_require(`
2140                 attribute user_home_type;
2141         ')
2142
2143         allow $1 user_home_type:dir setattr_dir_perms;
2144 ')
2145
2146 ########################################
2147 ## <summary>
2148 ##      Mmap user home files.
2149 ## </summary>
2150 ## <param name="domain">
2151 ##      <summary>
2152 ##      Domain allowed access.
2153 ##      </summary>
2154 ## </param>
2155 #
2156 interface(`userdom_mmap_user_home_content_files',`
2157         gen_require(`
2158                 type user_home_dir_t, user_home_t;
2159         ')
2160
2161         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2162         files_search_home($1)
2163 ')
2164
2165 ########################################
2166 ## <summary>
2167 ##      Read user home files.
2168 ## </summary>
2169 ## <param name="domain">
2170 ##      <summary>
2171 ##      Domain allowed access.
2172 ##      </summary>
2173 ## </param>
2174 #
2175 interface(`userdom_read_user_home_content_files',`
2176         gen_require(`
2177                 type user_home_dir_t, user_home_t;
2178         ')
2179
2180         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2181         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2182         files_search_home($1)
2183 ')
2184
2185 ########################################
2186 ## <summary>
2187 ##      Do not audit attempts to getattr user home files.
2188 ## </summary>
2189 ## <param name="domain">
2190 ##      <summary>
2191 ##      Domain to not audit.
2192 ##      </summary>
2193 ## </param>
2194 #
2195 interface(`userdom_dontaudit_getattr_user_home_content',`
2196         gen_require(`
2197                 attribute user_home_type;
2198         ')
2199
2200         dontaudit $1 user_home_type:dir getattr;
2201         dontaudit $1 user_home_type:file getattr;
2202 ')
2203
2204 ########################################
2205 ## <summary>
2206 ##      Do not audit attempts to read user home files.
2207 ## </summary>
2208 ## <param name="domain">
2209 ##      <summary>
2210 ##      Domain to not audit.
2211 ##      </summary>
2212 ## </param>
2213 #
2214 interface(`userdom_dontaudit_read_user_home_content_files',`
2215         gen_require(`
2216                 attribute user_home_type;
2217                 type user_home_dir_t;
2218         ')
2219
2220         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2221         dontaudit $1 user_home_type:dir list_dir_perms;
2222         dontaudit $1 user_home_type:file read_file_perms;
2223         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2224 ')
2225
2226 ########################################
2227 ## <summary>
2228 ##      Do not audit attempts to append user home files.
2229 ## </summary>
2230 ## <param name="domain">
2231 ##      <summary>
2232 ##      Domain to not audit.
2233 ##      </summary>
2234 ## </param>
2235 #
2236 interface(`userdom_dontaudit_append_user_home_content_files',`
2237         gen_require(`
2238                 type user_home_t;
2239         ')
2240
2241         dontaudit $1 user_home_t:file append_file_perms;
2242 ')
2243
2244 ########################################
2245 ## <summary>
2246 ##      Do not audit attempts to write user home files.
2247 ## </summary>
2248 ## <param name="domain">
2249 ##      <summary>
2250 ##      Domain to not audit.
2251 ##      </summary>
2252 ## </param>
2253 #
2254 interface(`userdom_dontaudit_write_user_home_content_files',`
2255         gen_require(`
2256                 type user_home_t;
2257         ')
2258
2259         dontaudit $1 user_home_t:file write_file_perms;
2260 ')
2261
2262 ########################################
2263 ## <summary>
2264 ##      Delete files in a user home subdirectory.
2265 ## </summary>
2266 ## <param name="domain">
2267 ##      <summary>
2268 ##      Domain allowed access.
2269 ##      </summary>
2270 ## </param>
2271 #
2272 interface(`userdom_delete_user_home_content_files',`
2273         gen_require(`
2274                 type user_home_t;
2275         ')
2276
2277         allow $1 user_home_t:file delete_file_perms;
2278 ')
2279
2280 ########################################
2281 ## <summary>
2282 ##      Delete all files in a user home subdirectory.
2283 ## </summary>
2284 ## <param name="domain">
2285 ##      <summary>
2286 ##      Domain allowed access.
2287 ##      </summary>
2288 ## </param>
2289 #
2290 interface(`userdom_delete_all_user_home_content_files',`
2291         gen_require(`
2292                 attribute user_home_type;
2293         ')
2294
2295         allow $1 user_home_type:file delete_file_perms;
2296 ')
2297
2298 ########################################
2299 ## <summary>
2300 ##      Delete sock files in a user home subdirectory.
2301 ## </summary>
2302 ## <param name="domain">
2303 ##      <summary>
2304 ##      Domain allowed access.
2305 ##      </summary>
2306 ## </param>
2307 #
2308 interface(`userdom_delete_user_home_content_sock_files',`
2309         gen_require(`
2310                 type user_home_t;
2311         ')
2312
2313         allow $1 user_home_t:sock_file delete_file_perms;
2314 ')
2315
2316 ########################################
2317 ## <summary>
2318 ##      Delete all sock files in a user home subdirectory.
2319 ## </summary>
2320 ## <param name="domain">
2321 ##      <summary>
2322 ##      Domain allowed access.
2323 ##      </summary>
2324 ## </param>
2325 #
2326 interface(`userdom_delete_all_user_home_content_sock_files',`
2327         gen_require(`
2328                 attribute user_home_type;
2329         ')
2330
2331         allow $1 user_home_type:sock_file delete_file_perms;
2332 ')
2333
2334 ########################################
2335 ## <summary>
2336 ##      Do not audit attempts to write user home files.
2337 ## </summary>
2338 ## <param name="domain">
2339 ##      <summary>
2340 ##      Domain to not audit.
2341 ##      </summary>
2342 ## </param>
2343 #
2344 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2345         gen_require(`
2346                 type user_home_t;
2347         ')
2348
2349         dontaudit $1 user_home_t:file relabel_file_perms;
2350 ')
2351
2352 ########################################
2353 ## <summary>
2354 ##      Read user home subdirectory symbolic links.
2355 ## </summary>
2356 ## <param name="domain">
2357 ##      <summary>
2358 ##      Domain allowed access.
2359 ##      </summary>
2360 ## </param>
2361 #
2362 interface(`userdom_read_user_home_content_symlinks',`
2363         gen_require(`
2364                 type user_home_dir_t, user_home_t;
2365         ')
2366
2367         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2368 ')
2369
2370 ########################################
2371 ## <summary>
2372 ##      Execute user home files.
2373 ## </summary>
2374 ## <param name="domain">
2375 ##      <summary>
2376 ##      Domain allowed access.
2377 ##      </summary>
2378 ## </param>
2379 ## <rolecap/>
2380 #
2381 interface(`userdom_exec_user_home_content_files',`
2382         gen_require(`
2383                 type user_home_dir_t;
2384                 attribute user_home_type;
2385         ')
2386
2387         files_search_home($1)
2388         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2389         dontaudit $1 user_home_type:sock_file execute;
2390         ')
2391
2392 ########################################
2393 ## <summary>
2394 ##      Do not audit attempts to execute user home files.
2395 ## </summary>
2396 ## <param name="domain">
2397 ##      <summary>
2398 ##      Domain to not audit.
2399 ##      </summary>
2400 ## </param>
2401 #
2402 interface(`userdom_dontaudit_exec_user_home_content_files',`
2403         gen_require(`
2404                 type user_home_t;
2405         ')
2406
2407         dontaudit $1 user_home_t:file exec_file_perms;
2408 ')
2409
2410 ########################################
2411 ## <summary>
2412 ##      Create, read, write, and delete files
2413 ##      in a user home subdirectory.
2414 ## </summary>
2415 ## <param name="domain">
2416 ##      <summary>
2417 ##      Domain allowed access.
2418 ##      </summary>
2419 ## </param>
2420 #
2421 interface(`userdom_manage_user_home_content_files',`
2422         gen_require(`
2423                 type user_home_dir_t, user_home_t;
2424         ')
2425
2426         manage_files_pattern($1, user_home_t, user_home_t)
2427         allow $1 user_home_dir_t:dir search_dir_perms;
2428         files_search_home($1)
2429 ')
2430
2431 ########################################
2432 ## <summary>
2433 ##      Do not audit attempts to create, read, write, and delete directories
2434 ##      in a user home subdirectory.
2435 ## </summary>
2436 ## <param name="domain">
2437 ##      <summary>
2438 ##      Domain to not audit.
2439 ##      </summary>
2440 ## </param>
2441 #
2442 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2443         gen_require(`
2444                 type user_home_dir_t, user_home_t;
2445         ')
2446
2447         dontaudit $1 user_home_t:dir manage_dir_perms;
2448 ')
2449
2450 ########################################
2451 ## <summary>
2452 ##      Create, read, write, and delete symbolic links
2453 ##      in a user home subdirectory.
2454 ## </summary>
2455 ## <param name="domain">
2456 ##      <summary>
2457 ##      Domain allowed access.
2458 ##      </summary>
2459 ## </param>
2460 #
2461 interface(`userdom_manage_user_home_content_symlinks',`
2462         gen_require(`
2463                 type user_home_dir_t, user_home_t;
2464         ')
2465
2466         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2467         allow $1 user_home_dir_t:dir search_dir_perms;
2468         files_search_home($1)
2469 ')
2470
2471 ########################################
2472 ## <summary>
2473 ##      Delete symbolic links in a user home directory.
2474 ## </summary>
2475 ## <param name="domain">
2476 ##      <summary>
2477 ##      Domain allowed access.
2478 ##      </summary>
2479 ## </param>
2480 #
2481 interface(`userdom_delete_user_home_content_symlinks',`
2482         gen_require(`
2483                 type user_home_t;
2484         ')
2485
2486         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2487 ')
2488
2489 ########################################
2490 ## <summary>
2491 ##      Delete all symbolic links in a user home directory.
2492 ## </summary>
2493 ## <param name="domain">
2494 ##      <summary>
2495 ##      Domain allowed access.
2496 ##      </summary>
2497 ## </param>
2498 #
2499 interface(`userdom_delete_all_user_home_content_symlinks',`
2500         gen_require(`
2501                 attribute user_home_type;
2502         ')
2503
2504         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2505 ')
2506
2507 ########################################
2508 ## <summary>
2509 ##      Create, read, write, and delete named pipes
2510 ##      in a user home subdirectory.
2511 ## </summary>
2512 ## <param name="domain">
2513 ##      <summary>
2514 ##      Domain allowed access.
2515 ##      </summary>
2516 ## </param>
2517 #
2518 interface(`userdom_manage_user_home_content_pipes',`
2519         gen_require(`
2520                 type user_home_dir_t, user_home_t;
2521         ')
2522
2523         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2524         allow $1 user_home_dir_t:dir search_dir_perms;
2525         files_search_home($1)
2526 ')
2527
2528 ########################################
2529 ## <summary>
2530 ##      Create, read, write, and delete named sockets
2531 ##      in a user home subdirectory.
2532 ## </summary>
2533 ## <param name="domain">
2534 ##      <summary>
2535 ##      Domain allowed access.
2536 ##      </summary>
2537 ## </param>
2538 #
2539 interface(`userdom_manage_user_home_content_sockets',`
2540         gen_require(`
2541                 type user_home_dir_t, user_home_t;
2542         ')
2543
2544         allow $1 user_home_dir_t:dir search_dir_perms;
2545         manage_sock_files_pattern($1, user_home_t, user_home_t)
2546         files_search_home($1)
2547 ')
2548
2549 ########################################
2550 ## <summary>
2551 ##      Create objects in a user home directory
2552 ##      with an automatic type transition to
2553 ##      a specified private type.
2554 ## </summary>
2555 ## <param name="domain">
2556 ##      <summary>
2557 ##      Domain allowed access.
2558 ##      </summary>
2559 ## </param>
2560 ## <param name="private_type">
2561 ##      <summary>
2562 ##      The type of the object to create.
2563 ##      </summary>
2564 ## </param>
2565 ## <param name="object_class">
2566 ##      <summary>
2567 ##      The class of the object to be created.
2568 ##      </summary>
2569 ## </param>
2570 #
2571 interface(`userdom_user_home_dir_filetrans',`
2572         gen_require(`
2573                 type user_home_dir_t;
2574         ')
2575
2576         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2577         files_search_home($1)
2578 ')
2579
2580 ########################################
2581 ## <summary>
2582 ##      Create objects in a user home directory
2583 ##      with an automatic type transition to
2584 ##      a specified private type.
2585 ## </summary>
2586 ## <param name="domain">
2587 ##      <summary>
2588 ##      Domain allowed access.
2589 ##      </summary>
2590 ## </param>
2591 ## <param name="private_type">
2592 ##      <summary>
2593 ##      The type of the object to create.
2594 ##      </summary>
2595 ## </param>
2596 ## <param name="object_class">
2597 ##      <summary>
2598 ##      The class of the object to be created.
2599 ##      </summary>
2600 ## </param>
2601 #
2602 interface(`userdom_user_home_content_filetrans',`
2603         gen_require(`
2604                 type user_home_dir_t, user_home_t;
2605         ')
2606
2607         filetrans_pattern($1, user_home_t, $2, $3, $4)
2608         allow $1 user_home_dir_t:dir search_dir_perms;
2609         files_search_home($1)
2610 ')
2611
2612 ########################################
2613 ## <summary>
2614 ##      Create objects in a user home directory
2615 ##      with an automatic type transition to
2616 ##      the user home file type.
2617 ## </summary>
2618 ## <param name="domain">
2619 ##      <summary>
2620 ##      Domain allowed access.
2621 ##      </summary>
2622 ## </param>
2623 ## <param name="object_class">
2624 ##      <summary>
2625 ##      The class of the object to be created.
2626 ##      </summary>
2627 ## </param>
2628 #
2629 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2630         gen_require(`
2631                 type user_home_dir_t, user_home_t;
2632         ')
2633
2634         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2635         files_search_home($1)
2636 ')
2637
2638 ########################################
2639 ## <summary>
2640 ##      Write to user temporary named sockets.
2641 ## </summary>
2642 ## <param name="domain">
2643 ##      <summary>
2644 ##      Domain allowed access.
2645 ##      </summary>
2646 ## </param>
2647 #
2648 interface(`userdom_write_user_tmp_sockets',`
2649         gen_require(`
2650                 type user_tmp_t;
2651         ')
2652
2653         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2654         files_search_tmp($1)
2655 ')
2656
2657 ########################################
2658 ## <summary>
2659 ##      List user temporary directories.
2660 ## </summary>
2661 ## <param name="domain">
2662 ##      <summary>
2663 ##      Domain allowed access.
2664 ##      </summary>
2665 ## </param>
2666 #
2667 interface(`userdom_list_user_tmp',`
2668         gen_require(`
2669                 type user_tmp_t;
2670         ')
2671
2672         allow $1 user_tmp_t:dir list_dir_perms;
2673         files_search_tmp($1)
2674 ')
2675
2676 ########################################
2677 ## <summary>
2678 ##      Do not audit attempts to list user
2679 ##      temporary directories.
2680 ## </summary>
2681 ## <param name="domain">
2682 ##      <summary>
2683 ##      Domain to not audit.
2684 ##      </summary>
2685 ## </param>
2686 #
2687 interface(`userdom_dontaudit_list_user_tmp',`
2688         gen_require(`
2689                 type user_tmp_t;
2690         ')
2691
2692         dontaudit $1 user_tmp_t:dir list_dir_perms;
2693 ')
2694
2695 ########################################
2696 ## <summary>
2697 ##      Do not audit attempts to manage users
2698 ##      temporary directories.
2699 ## </summary>
2700 ## <param name="domain">
2701 ##      <summary>
2702 ##      Domain to not audit.
2703 ##      </summary>
2704 ## </param>
2705 #
2706 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2707         gen_require(`
2708                 type user_tmp_t;
2709         ')
2710
2711         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2712 ')
2713
2714 ########################################
2715 ## <summary>
2716 ##      Read user temporary files.
2717 ## </summary>
2718 ## <param name="domain">
2719 ##      <summary>
2720 ##      Domain allowed access.
2721 ##      </summary>
2722 ## </param>
2723 #
2724 interface(`userdom_read_user_tmp_files',`
2725         gen_require(`
2726                 type user_tmp_t;
2727         ')
2728
2729         read_files_pattern($1, user_tmp_t, user_tmp_t)
2730         allow $1 user_tmp_t:dir list_dir_perms;
2731         files_search_tmp($1)
2732 ')
2733
2734 ########################################
2735 ## <summary>
2736 ##      Do not audit attempts to read users
2737 ##      temporary files.
2738 ## </summary>
2739 ## <param name="domain">
2740 ##      <summary>
2741 ##      Domain to not audit.
2742 ##      </summary>
2743 ## </param>
2744 #
2745 interface(`userdom_dontaudit_read_user_tmp_files',`
2746         gen_require(`
2747                 type user_tmp_t;
2748         ')
2749
2750         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2751 ')
2752
2753 ########################################
2754 ## <summary>
2755 ##      Do not audit attempts to append users
2756 ##      temporary files.
2757 ## </summary>
2758 ## <param name="domain">
2759 ##      <summary>
2760 ##      Domain to not audit.
2761 ##      </summary>
2762 ## </param>
2763 #
2764 interface(`userdom_dontaudit_append_user_tmp_files',`
2765         gen_require(`
2766                 type user_tmp_t;
2767         ')
2768
2769         dontaudit $1 user_tmp_t:file append_file_perms;
2770 ')
2771
2772 ########################################
2773 ## <summary>
2774 ##      Read and write user temporary files.
2775 ## </summary>
2776 ## <param name="domain">
2777 ##      <summary>
2778 ##      Domain allowed access.
2779 ##      </summary>
2780 ## </param>
2781 #
2782 interface(`userdom_rw_user_tmp_files',`
2783         gen_require(`
2784                 type user_tmp_t;
2785         ')
2786
2787         allow $1 user_tmp_t:dir list_dir_perms;
2788         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2789         files_search_tmp($1)
2790 ')
2791
2792 ########################################
2793 ## <summary>
2794 ##      Do not audit attempts to manage users
2795 ##      temporary files.
2796 ## </summary>
2797 ## <param name="domain">
2798 ##      <summary>
2799 ##      Domain to not audit.
2800 ##      </summary>
2801 ## </param>
2802 #
2803 interface(`userdom_dontaudit_manage_user_tmp_files',`
2804         gen_require(`
2805                 type user_tmp_t;
2806         ')
2807
2808         dontaudit $1 user_tmp_t:file manage_file_perms;
2809 ')
2810
2811 ########################################
2812 ## <summary>
2813 ##      Read user temporary symbolic links.
2814 ## </summary>
2815 ## <param name="domain">
2816 ##      <summary>
2817 ##      Domain allowed access.
2818 ##      </summary>
2819 ## </param>
2820 #
2821 interface(`userdom_read_user_tmp_symlinks',`
2822         gen_require(`
2823                 type user_tmp_t;
2824         ')
2825
2826         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2827         allow $1 user_tmp_t:dir list_dir_perms;
2828         files_search_tmp($1)
2829 ')
2830
2831 ########################################
2832 ## <summary>
2833 ##      Create, read, write, and delete user
2834 ##      temporary directories.
2835 ## </summary>
2836 ## <param name="domain">
2837 ##      <summary>
2838 ##      Domain allowed access.
2839 ##      </summary>
2840 ## </param>
2841 #
2842 interface(`userdom_manage_user_tmp_dirs',`
2843         gen_require(`
2844                 type user_tmp_t;
2845         ')
2846
2847         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2848         files_search_tmp($1)
2849 ')
2850
2851 ########################################
2852 ## <summary>
2853 ##      Create, read, write, and delete user
2854 ##      temporary files.
2855 ## </summary>
2856 ## <param name="domain">
2857 ##      <summary>
2858 ##      Domain allowed access.
2859 ##      </summary>
2860 ## </param>
2861 #
2862 interface(`userdom_manage_user_tmp_files',`
2863         gen_require(`
2864                 type user_tmp_t;
2865         ')
2866
2867         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2868         files_search_tmp($1)
2869 ')
2870
2871 ########################################
2872 ## <summary>
2873 ##      Create, read, write, and delete user
2874 ##      temporary symbolic links.
2875 ## </summary>
2876 ## <param name="domain">
2877 ##      <summary>
2878 ##      Domain allowed access.
2879 ##      </summary>
2880 ## </param>
2881 #
2882 interface(`userdom_manage_user_tmp_symlinks',`
2883         gen_require(`
2884                 type user_tmp_t;
2885         ')
2886
2887         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2888         files_search_tmp($1)
2889 ')
2890
2891 ########################################
2892 ## <summary>
2893 ##      Create, read, write, and delete user
2894 ##      temporary named pipes.
2895 ## </summary>
2896 ## <param name="domain">
2897 ##      <summary>
2898 ##      Domain allowed access.
2899 ##      </summary>
2900 ## </param>
2901 #
2902 interface(`userdom_manage_user_tmp_pipes',`
2903         gen_require(`
2904                 type user_tmp_t;
2905         ')
2906
2907         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2908         files_search_tmp($1)
2909 ')
2910
2911 ########################################
2912 ## <summary>
2913 ##      Create, read, write, and delete user
2914 ##      temporary named sockets.
2915 ## </summary>
2916 ## <param name="domain">
2917 ##      <summary>
2918 ##      Domain allowed access.
2919 ##      </summary>
2920 ## </param>
2921 #
2922 interface(`userdom_manage_user_tmp_sockets',`
2923         gen_require(`
2924                 type user_tmp_t;
2925         ')
2926
2927         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2928         files_search_tmp($1)
2929 ')
2930
2931 ########################################
2932 ## <summary>
2933 ##      Create objects in a user temporary directory
2934 ##      with an automatic type transition to
2935 ##      a specified private type.
2936 ## </summary>
2937 ## <param name="domain">
2938 ##      <summary>
2939 ##      Domain allowed access.
2940 ##      </summary>
2941 ## </param>
2942 ## <param name="private_type">
2943 ##      <summary>
2944 ##      The type of the object to create.
2945 ##      </summary>
2946 ## </param>
2947 ## <param name="object_class">
2948 ##      <summary>
2949 ##      The class of the object to be created.
2950 ##      </summary>
2951 ## </param>
2952 #
2953 interface(`userdom_user_tmp_filetrans',`
2954         gen_require(`
2955                 type user_tmp_t;
2956         ')
2957
2958         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2959         files_search_tmp($1)
2960 ')
2961
2962 ########################################
2963 ## <summary>
2964 ##      Create objects in the temporary directory
2965 ##      with an automatic type transition to
2966 ##      the user temporary type.
2967 ## </summary>
2968 ## <param name="domain">
2969 ##      <summary>
2970 ##      Domain allowed access.
2971 ##      </summary>
2972 ## </param>
2973 ## <param name="object_class">
2974 ##      <summary>
2975 ##      The class of the object to be created.
2976 ##      </summary>
2977 ## </param>
2978 #
2979 interface(`userdom_tmp_filetrans_user_tmp',`
2980         gen_require(`
2981                 type user_tmp_t;
2982         ')
2983
2984         files_tmp_filetrans($1, user_tmp_t, $2)
2985 ')
2986
2987 #######################################
2988 ## <summary>
2989 ##  Getattr user tmpfs files.
2990 ## </summary>
2991 ## <param name="domain">
2992 ##  <summary>
2993 ##  Domain allowed access.
2994 ##  </summary>
2995 ## </param>
2996 #
2997 interface(`userdom_getattr_user_tmpfs_files',`
2998     gen_require(`
2999         type user_tmpfs_t;
3000     ')
3001
3002     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3003     fs_search_tmpfs($1)
3004 ')
3005
3006 ########################################
3007 ## <summary>
3008 ##      Read user tmpfs files.
3009 ## </summary>
3010 ## <param name="domain">
3011 ##      <summary>
3012 ##      Domain allowed access.
3013 ##      </summary>
3014 ## </param>
3015 #
3016 interface(`userdom_read_user_tmpfs_files',`
3017         gen_require(`
3018                 type user_tmpfs_t;
3019         ')
3020
3021         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3022         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3023         allow $1 user_tmpfs_t:dir list_dir_perms;
3024         fs_search_tmpfs($1)
3025 ')
3026
3027 ########################################
3028 ## <summary>
3029 ##      Read/Write user tmpfs files.
3030 ## </summary>
3031 ## <param name="domain">
3032 ##      <summary>
3033 ##      Domain allowed access.
3034 ##      </summary>
3035 ## </param>
3036 #
3037 interface(`userdom_rw_user_tmpfs_files',`
3038         gen_require(`
3039                 type user_tmpfs_t;
3040         ')
3041
3042         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3043         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3044         allow $1 user_tmpfs_t:dir list_dir_perms;
3045         fs_search_tmpfs($1)
3046 ')
3047
3048 ########################################
3049 ## <summary>
3050 ##      Read/Write inherited user tmpfs files.
3051 ## </summary>
3052 ## <param name="domain">
3053 ##      <summary>
3054 ##      Domain allowed access.
3055 ##      </summary>
3056 ## </param>
3057 #
3058 interface(`userdom_rw_inherited_user_tmpfs_files',`
3059         gen_require(`
3060                 type user_tmpfs_t;
3061         ')
3062
3063         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3064 ')
3065
3066 ########################################
3067 ## <summary>
3068 ##      Execute user tmpfs files.
3069 ## </summary>
3070 ## <param name="domain">
3071 ##      <summary>
3072 ##      Domain allowed access.
3073 ##      </summary>
3074 ## </param>
3075 #
3076 interface(`userdom_execute_user_tmpfs_files',`
3077         gen_require(`
3078                 type user_tmpfs_t;
3079         ')
3080
3081         allow $1 user_tmpfs_t:file execute;
3082 ')
3083
3084 ########################################
3085 ## <summary>
3086 ##      Get the attributes of a user domain tty.
3087 ## </summary>
3088 ## <param name="domain">
3089 ##      <summary>
3090 ##      Domain allowed access.
3091 ##      </summary>
3092 ## </param>
3093 #
3094 interface(`userdom_getattr_user_ttys',`
3095         gen_require(`
3096                 type user_tty_device_t;
3097         ')
3098
3099         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3100 ')
3101
3102 ########################################
3103 ## <summary>
3104 ##      Do not audit attempts to get the attributes of a user domain tty.
3105 ## </summary>
3106 ## <param name="domain">
3107 ##      <summary>
3108 ##      Domain to not audit.
3109 ##      </summary>
3110 ## </param>
3111 #
3112 interface(`userdom_dontaudit_getattr_user_ttys',`
3113         gen_require(`
3114                 type user_tty_device_t;
3115         ')
3116
3117         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3118 ')
3119
3120 ########################################
3121 ## <summary>
3122 ##      Set the attributes of a user domain tty.
3123 ## </summary>
3124 ## <param name="domain">
3125 ##      <summary>
3126 ##      Domain allowed access.
3127 ##      </summary>
3128 ## </param>
3129 #
3130 interface(`userdom_setattr_user_ttys',`
3131         gen_require(`
3132                 type user_tty_device_t;
3133         ')
3134
3135         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3136 ')
3137
3138 ########################################
3139 ## <summary>
3140 ##      Do not audit attempts to set the attributes of a user domain tty.
3141 ## </summary>
3142 ## <param name="domain">
3143 ##      <summary>
3144 ##      Domain to not audit.
3145 ##      </summary>
3146 ## </param>
3147 #
3148 interface(`userdom_dontaudit_setattr_user_ttys',`
3149         gen_require(`
3150                 type user_tty_device_t;
3151         ')
3152
3153         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3154 ')
3155
3156 ########################################
3157 ## <summary>
3158 ##      Read and write a user domain tty.
3159 ## </summary>
3160 ## <param name="domain">
3161 ##      <summary>
3162 ##      Domain allowed access.
3163 ##      </summary>
3164 ## </param>
3165 #
3166 interface(`userdom_use_user_ttys',`
3167         gen_require(`
3168                 type user_tty_device_t;
3169         ')
3170
3171         allow $1 user_tty_device_t:chr_file rw_term_perms;
3172 ')
3173
3174 ########################################
3175 ## <summary>
3176 ##      Read and write a inherited user domain tty.
3177 ## </summary>
3178 ## <param name="domain">
3179 ##      <summary>
3180 ##      Domain allowed access.
3181 ##      </summary>
3182 ## </param>
3183 #
3184 interface(`userdom_use_inherited_user_ttys',`
3185         gen_require(`
3186                 type user_tty_device_t;
3187         ')
3188
3189         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3190 ')
3191
3192 ########################################
3193 ## <summary>
3194 ##      Read and write a user domain pty.
3195 ## </summary>
3196 ## <param name="domain">
3197 ##      <summary>
3198 ##      Domain allowed access.
3199 ##      </summary>
3200 ## </param>
3201 #
3202 interface(`userdom_use_user_ptys',`
3203         gen_require(`
3204                 type user_devpts_t;
3205         ')
3206
3207         allow $1 user_devpts_t:chr_file rw_term_perms;
3208 ')
3209
3210 ########################################
3211 ## <summary>
3212 ##      Read and write a inherited user domain pty.
3213 ## </summary>
3214 ## <param name="domain">
3215 ##      <summary>
3216 ##      Domain allowed access.
3217 ##      </summary>
3218 ## </param>
3219 #
3220 interface(`userdom_use_inherited_user_ptys',`
3221         gen_require(`
3222                 type user_devpts_t;
3223         ')
3224
3225         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3226 ')
3227
3228 ########################################
3229 ## <summary>
3230 ##      Read and write a inherited user TTYs and PTYs.
3231 ## </summary>
3232 ## <desc>
3233 ##      <p>
3234 ##      Allow the specified domain to read and write inherited user
3235 ##      TTYs and PTYs. This will allow the domain to
3236 ##      interact with the user via the terminal. Typically
3237 ##      all interactive applications will require this
3238 ##      access.
3239 ##      </p>
3240 ## </desc>
3241 ## <param name="domain">
3242 ##      <summary>
3243 ##      Domain allowed access.
3244 ##      </summary>
3245 ## </param>
3246 ## <infoflow type="both" weight="10"/>
3247 #
3248 interface(`userdom_use_inherited_user_terminals',`
3249         gen_require(`
3250                 type user_tty_device_t, user_devpts_t;
3251         ')
3252
3253         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3254         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3255 ')
3256
3257 #######################################
3258 ## <summary>
3259 ##  Allow attempts to read and write
3260 ##  a user domain tty and pty.
3261 ## </summary>
3262 ## <param name="domain">
3263 ##  <summary>
3264 ##  Domain to not audit.
3265 ##  </summary>
3266 ## </param>
3267 #
3268 interface(`userdom_use_user_terminals',`
3269     gen_require(`
3270         type user_tty_device_t, user_devpts_t;
3271     ')
3272
3273     allow $1 user_tty_device_t:chr_file rw_term_perms;
3274     allow $1 user_devpts_t:chr_file rw_term_perms;
3275 ')
3276
3277 ########################################
3278 ## <summary>
3279 ##      Do not audit attempts to read and write
3280 ##      a user domain tty and pty.
3281 ## </summary>
3282 ## <param name="domain">
3283 ##      <summary>
3284 ##      Domain to not audit.
3285 ##      </summary>
3286 ## </param>
3287 #
3288 interface(`userdom_dontaudit_use_user_terminals',`
3289         gen_require(`
3290                 type user_tty_device_t, user_devpts_t;
3291         ')
3292
3293         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3294         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3295 ')
3296
3297
3298 ########################################
3299 ## <summary>
3300 ##      Get attributes of user domain tty and pty.
3301 ## </summary>
3302 ## <param name="domain">
3303 ##      <summary>
3304 ##      Domain allowed access.
3305 ##      </summary>
3306 ## </param>
3307 #
3308 interface(`userdom_getattr_user_terminals',`
3309         gen_require(`
3310                 type user_tty_device_t, user_devpts_t;
3311         ')
3312
3313         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3314 ')
3315
3316 ########################################
3317 ## <summary>
3318 ##      Execute a shell in all user domains.  This
3319 ##      is an explicit transition, requiring the
3320 ##      caller to use setexeccon().
3321 ## </summary>
3322 ## <param name="domain">
3323 ##      <summary>
3324 ##      Domain allowed to transition.
3325 ##      </summary>
3326 ## </param>
3327 #
3328 interface(`userdom_spec_domtrans_all_users',`
3329         gen_require(`
3330                 attribute userdomain;
3331         ')
3332
3333         corecmd_shell_spec_domtrans($1, userdomain)
3334         allow userdomain $1:fd use;
3335         allow userdomain $1:fifo_file rw_file_perms;
3336         allow userdomain $1:process sigchld;
3337 ')
3338
3339 ########################################
3340 ## <summary>
3341 ##      Execute an Xserver session in all unprivileged user domains.  This
3342 ##      is an explicit transition, requiring the
3343 ##      caller to use setexeccon().
3344 ## </summary>
3345 ## <param name="domain">
3346 ##      <summary>
3347 ##      Domain allowed to transition.
3348 ##      </summary>
3349 ## </param>
3350 #
3351 interface(`userdom_xsession_spec_domtrans_all_users',`
3352         gen_require(`
3353                 attribute userdomain;
3354         ')
3355
3356         xserver_xsession_spec_domtrans($1, userdomain)
3357         allow userdomain $1:fd use;
3358         allow userdomain $1:fifo_file rw_file_perms;
3359         allow userdomain $1:process sigchld;
3360 ')
3361
3362 ########################################
3363 ## <summary>
3364 ##      Execute a shell in all unprivileged user domains.  This
3365 ##      is an explicit transition, requiring the
3366 ##      caller to use setexeccon().
3367 ## </summary>
3368 ## <param name="domain">
3369 ##      <summary>
3370 ##      Domain allowed to transition.
3371 ##      </summary>
3372 ## </param>
3373 #
3374 interface(`userdom_spec_domtrans_unpriv_users',`
3375         gen_require(`
3376                 attribute unpriv_userdomain;
3377         ')
3378
3379         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3380         allow unpriv_userdomain $1:fd use;
3381         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3382         allow unpriv_userdomain $1:process sigchld;
3383 ')
3384
3385 #####################################
3386 ## <summary>
3387 ##  Allow domain dyntrans to unpriv userdomain.
3388 ## </summary>
3389 ## <param name="domain">
3390 ##  <summary>
3391 ##  Domain allowed access.
3392 ##  </summary>
3393 ## </param>
3394 #
3395 interface(`userdom_dyntransition_unpriv_users',`
3396     gen_require(`
3397         attribute unpriv_userdomain;
3398     ')
3399
3400     allow $1 unpriv_userdomain:process dyntransition;
3401 ')
3402
3403 ########################################
3404 ## <summary>
3405 ##      Execute an Xserver session in all unprivileged user domains.  This
3406 ##      is an explicit transition, requiring the
3407 ##      caller to use setexeccon().
3408 ## </summary>
3409 ## <param name="domain">
3410 ##      <summary>
3411 ##      Domain allowed to transition.
3412 ##      </summary>
3413 ## </param>
3414 #
3415 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3416         gen_require(`
3417                 attribute unpriv_userdomain;
3418         ')
3419
3420         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3421         allow unpriv_userdomain $1:fd use;
3422         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3423         allow unpriv_userdomain $1:process sigchld;
3424 ')
3425
3426 ########################################
3427 ## <summary>
3428 ##      Manage unpriviledged user SysV sempaphores.
3429 ## </summary>
3430 ## <param name="domain">
3431 ##      <summary>
3432 ##      Domain allowed access.
3433 ##      </summary>
3434 ## </param>
3435 #
3436 interface(`userdom_manage_unpriv_user_semaphores',`
3437         gen_require(`
3438                 attribute unpriv_userdomain;
3439         ')
3440
3441         allow $1 unpriv_userdomain:sem create_sem_perms;
3442 ')
3443
3444 ########################################
3445 ## <summary>
3446 ##      Manage unpriviledged user SysV shared
3447 ##      memory segments.
3448 ## </summary>
3449 ## <param name="domain">
3450 ##      <summary>
3451 ##      Domain allowed access.
3452 ##      </summary>
3453 ## </param>
3454 #
3455 interface(`userdom_manage_unpriv_user_shared_mem',`
3456         gen_require(`
3457                 attribute unpriv_userdomain;
3458         ')
3459
3460         allow $1 unpriv_userdomain:shm create_shm_perms;
3461 ')
3462
3463 ########################################
3464 ## <summary>
3465 ##      Execute bin_t in the unprivileged user domains. This
3466 ##      is an explicit transition, requiring the
3467 ##      caller to use setexeccon().
3468 ## </summary>
3469 ## <param name="domain">
3470 ##      <summary>
3471 ##      Domain allowed to transition.
3472 ##      </summary>
3473 ## </param>
3474 #
3475 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3476         gen_require(`
3477                 attribute unpriv_userdomain;
3478         ')
3479
3480         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3481         allow unpriv_userdomain $1:fd use;
3482         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3483         allow unpriv_userdomain $1:process sigchld;
3484 ')
3485
3486 ########################################
3487 ## <summary>
3488 ##      Execute all entrypoint files in unprivileged user
3489 ##      domains. This is an explicit transition, requiring the
3490 ##      caller to use setexeccon().
3491 ## </summary>
3492 ## <param name="domain">
3493 ##      <summary>
3494 ##      Domain allowed access.
3495 ##      </summary>
3496 ## </param>
3497 #
3498 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3499         gen_require(`
3500                 attribute unpriv_userdomain;
3501         ')
3502
3503         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3504         allow unpriv_userdomain $1:fd use;
3505         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3506         allow unpriv_userdomain $1:process sigchld;
3507 ')
3508
3509 ########################################
3510 ## <summary>
3511 ##      Search users home directories.
3512 ## </summary>
3513 ## <param name="domain">
3514 ##      <summary>
3515 ##      Domain allowed access.
3516 ##      </summary>
3517 ## </param>
3518 #
3519 interface(`userdom_search_user_home_content',`
3520         gen_require(`
3521                 type user_home_dir_t;
3522                 attribute user_home_type;
3523         ')
3524
3525         files_list_home($1)
3526         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3527         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3528 ')
3529
3530 ########################################
3531 ## <summary>
3532 ##      Send general signals to unprivileged user domains.
3533 ## </summary>
3534 ## <param name="domain">
3535 ##      <summary>
3536 ##      Domain allowed access.
3537 ##      </summary>
3538 ## </param>
3539 #
3540 interface(`userdom_signal_unpriv_users',`
3541         gen_require(`
3542                 attribute unpriv_userdomain;
3543         ')
3544
3545         allow $1 unpriv_userdomain:process signal;
3546 ')
3547
3548 ########################################
3549 ## <summary>
3550 ##      Inherit the file descriptors from unprivileged user domains.
3551 ## </summary>
3552 ## <param name="domain">
3553 ##      <summary>
3554 ##      Domain allowed access.
3555 ##      </summary>
3556 ## </param>
3557 #
3558 interface(`userdom_use_unpriv_users_fds',`
3559         gen_require(`
3560                 attribute unpriv_userdomain;
3561         ')
3562
3563         allow $1 unpriv_userdomain:fd use;
3564 ')
3565
3566 ########################################
3567 ## <summary>
3568 ##      Do not audit attempts to inherit the file descriptors
3569 ##      from unprivileged user domains.
3570 ## </summary>
3571 ## <desc>
3572 ##      <p>
3573 ##      Do not audit attempts to inherit the file descriptors
3574 ##      from unprivileged user domains. This will supress
3575 ##      SELinux denial messages when the specified domain is denied
3576 ##      the permission to inherit these file descriptors.
3577 ##      </p>
3578 ## </desc>
3579 ## <param name="domain">
3580 ##      <summary>
3581 ##      Domain to not audit.
3582 ##      </summary>
3583 ## </param>
3584 ## <infoflow type="none"/>
3585 #
3586 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3587         gen_require(`
3588                 attribute unpriv_userdomain;
3589         ')
3590
3591         dontaudit $1 unpriv_userdomain:fd use;
3592 ')
3593
3594 ########################################
3595 ## <summary>
3596 ##      Do not audit attempts to use user ptys.
3597 ## </summary>
3598 ## <param name="domain">
3599 ##      <summary>
3600 ##      Domain to not audit.
3601 ##      </summary>
3602 ## </param>
3603 #
3604 interface(`userdom_dontaudit_use_user_ptys',`
3605         gen_require(`
3606                 type user_devpts_t;
3607         ')
3608
3609         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3610 ')
3611
3612 ########################################
3613 ## <summary>
3614 ##      Relabel files to unprivileged user pty types.
3615 ## </summary>
3616 ## <param name="domain">
3617 ##      <summary>
3618 ##      Domain allowed access.
3619 ##      </summary>
3620 ## </param>
3621 #
3622 interface(`userdom_relabelto_user_ptys',`
3623         gen_require(`
3624                 type user_devpts_t;
3625         ')
3626
3627         allow $1 user_devpts_t:chr_file relabelto;
3628 ')
3629
3630 ########################################
3631 ## <summary>
3632 ##      Do not audit attempts to relabel files from
3633 ##      user pty types.
3634 ## </summary>
3635 ## <param name="domain">
3636 ##      <summary>
3637 ##      Domain to not audit.
3638 ##      </summary>
3639 ## </param>
3640 #
3641 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3642         gen_require(`
3643                 type user_devpts_t;
3644         ')
3645
3646         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3647 ')
3648
3649 ########################################
3650 ## <summary>
3651 ##      Write all users files in /tmp
3652 ## </summary>
3653 ## <param name="domain">
3654 ##      <summary>
3655 ##      Domain allowed access.
3656 ##      </summary>
3657 ## </param>
3658 #
3659 interface(`userdom_write_user_tmp_files',`
3660         gen_require(`
3661                 type user_tmp_t;
3662         ')
3663
3664         write_files_pattern($1, user_tmp_t, user_tmp_t)
3665 ')
3666
3667 ########################################
3668 ## <summary>
3669 ##      Do not audit attempts to write users
3670 ##      temporary files.
3671 ## </summary>
3672 ## <param name="domain">
3673 ##      <summary>
3674 ##      Domain to not audit.
3675 ##      </summary>
3676 ## </param>
3677 #
3678 interface(`userdom_dontaudit_write_user_tmp_files',`
3679         gen_require(`
3680                 type user_tmp_t;
3681         ')
3682
3683         dontaudit $1 user_tmp_t:file write;
3684 ')
3685
3686 ########################################
3687 ## <summary>
3688 ##      Do not audit attempts to read/write users
3689 ##      temporary fifo files.
3690 ## </summary>
3691 ## <param name="domain">
3692 ##      <summary>
3693 ##      Domain to not audit.
3694 ##      </summary>
3695 ## </param>
3696 #
3697 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3698         gen_require(`
3699                 type user_tmp_t;
3700         ')
3701
3702         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3703 ')
3704
3705 ########################################
3706 ## <summary>
3707 ##      Do not audit attempts to use user ttys.
3708 ## </summary>
3709 ## <param name="domain">
3710 ##      <summary>
3711 ##      Domain to not audit.
3712 ##      </summary>
3713 ## </param>
3714 #
3715 interface(`userdom_dontaudit_use_user_ttys',`
3716         gen_require(`
3717                 type user_tty_device_t;
3718         ')
3719
3720         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3721 ')
3722
3723 ########################################
3724 ## <summary>
3725 ##      Read the process state of all user domains.
3726 ## </summary>
3727 ## <param name="domain">
3728 ##      <summary>
3729 ##      Domain allowed access.
3730 ##      </summary>
3731 ## </param>
3732 #
3733 interface(`userdom_read_all_users_state',`
3734         gen_require(`
3735                 attribute userdomain;
3736         ')
3737
3738         read_files_pattern($1, userdomain, userdomain)
3739         read_lnk_files_pattern($1,userdomain,userdomain)
3740         kernel_search_proc($1)
3741 ')
3742
3743 ########################################
3744 ## <summary>
3745 ##      Get the attributes of all user domains.
3746 ## </summary>
3747 ## <param name="domain">
3748 ##      <summary>
3749 ##      Domain allowed access.
3750 ##      </summary>
3751 ## </param>
3752 #
3753 interface(`userdom_getattr_all_users',`
3754         gen_require(`
3755                 attribute userdomain;
3756         ')
3757
3758         allow $1 userdomain:process getattr;
3759 ')
3760
3761 ########################################
3762 ## <summary>
3763 ##      Inherit the file descriptors from all user domains
3764 ## </summary>
3765 ## <param name="domain">
3766 ##      <summary>
3767 ##      Domain allowed access.
3768 ##      </summary>
3769 ## </param>
3770 #
3771 interface(`userdom_use_all_users_fds',`
3772         gen_require(`
3773                 attribute userdomain;
3774         ')
3775
3776         allow $1 userdomain:fd use;
3777 ')
3778
3779 ########################################
3780 ## <summary>
3781 ##      Do not audit attempts to inherit the file
3782 ##      descriptors from any user domains.
3783 ## </summary>
3784 ## <param name="domain">
3785 ##      <summary>
3786 ##      Domain to not audit.
3787 ##      </summary>
3788 ## </param>
3789 #
3790 interface(`userdom_dontaudit_use_all_users_fds',`
3791         gen_require(`
3792                 attribute userdomain;
3793         ')
3794
3795         dontaudit $1 userdomain:fd use;
3796 ')
3797
3798 ########################################
3799 ## <summary>
3800 ##      Send general signals to all user domains.
3801 ## </summary>
3802 ## <param name="domain">
3803 ##      <summary>
3804 ##      Domain allowed access.
3805 ##      </summary>
3806 ## </param>
3807 #
3808 interface(`userdom_signal_all_users',`
3809         gen_require(`
3810                 attribute userdomain;
3811         ')
3812
3813         allow $1 userdomain:process signal;
3814 ')
3815
3816 ########################################
3817 ## <summary>
3818 ##      Send kill signals to all user domains.
3819 ## </summary>
3820 ## <param name="domain">
3821 ##      <summary>
3822 ##      Domain allowed access.
3823 ##      </summary>
3824 ## </param>
3825 #
3826 interface(`userdom_kill_all_users',`
3827         gen_require(`
3828                 attribute userdomain;
3829         ')
3830
3831         allow $1 userdomain:process sigkill;
3832 ')
3833
3834 ########################################
3835 ## <summary>
3836 ##      Send a SIGCHLD signal to all user domains.
3837 ## </summary>
3838 ## <param name="domain">
3839 ##      <summary>
3840 ##      Domain allowed access.
3841 ##      </summary>
3842 ## </param>
3843 #
3844 interface(`userdom_sigchld_all_users',`
3845         gen_require(`
3846                 attribute userdomain;
3847         ')
3848
3849         allow $1 userdomain:process sigchld;
3850 ')
3851
3852 ########################################
3853 ## <summary>
3854 ##      Read keys for all user domains.
3855 ## </summary>
3856 ## <param name="domain">
3857 ##      <summary>
3858 ##      Domain allowed access.
3859 ##      </summary>
3860 ## </param>
3861 #
3862 interface(`userdom_read_all_users_keys',`
3863         gen_require(`
3864                 attribute userdomain;
3865         ')
3866
3867         allow $1 userdomain:key read;
3868 ')
3869
3870 ########################################
3871 ## <summary>
3872 ##      Create keys for all user domains.
3873 ## </summary>
3874 ## <param name="domain">
3875 ##      <summary>
3876 ##      Domain allowed access.
3877 ##      </summary>
3878 ## </param>
3879 #
3880 interface(`userdom_create_all_users_keys',`
3881         gen_require(`
3882                 attribute userdomain;
3883         ')
3884
3885         allow $1 userdomain:key create;
3886 ')
3887
3888 ########################################
3889 ## <summary>
3890 ##      Send a dbus message to all user domains.
3891 ## </summary>
3892 ## <param name="domain">
3893 ##      <summary>
3894 ##      Domain allowed access.
3895 ##      </summary>
3896 ## </param>
3897 #
3898 interface(`userdom_dbus_send_all_users',`
3899         gen_require(`
3900                 attribute userdomain;
3901                 class dbus send_msg;
3902         ')
3903
3904         allow $1 userdomain:dbus send_msg;
3905 ')
3906
3907 ########################################
3908 ## <summary>
3909 ##      Allow apps to set rlimits on userdomain
3910 ## </summary>
3911 ## <param name="domain">
3912 ##      <summary>
3913 ##      Domain allowed access.
3914 ##      </summary>
3915 ## </param>
3916 #
3917 interface(`userdom_set_rlimitnh',`
3918         gen_require(`
3919                 attribute userdomain;
3920         ')
3921
3922         allow $1 userdomain:process rlimitinh;
3923 ')
3924
3925 ########################################
3926 ## <summary>
3927 ##      Define this type as a Allow apps to set rlimits on userdomain
3928 ## </summary>
3929 ## <param name="domain">
3930 ##      <summary>
3931 ##      Domain allowed access.
3932 ##      </summary>
3933 ## </param>
3934 ## <param name="userdomain_prefix">
3935 ##      <summary>
3936 ##      The prefix of the user domain (e.g., user
3937 ##      is the prefix for user_t).
3938 ## </summary>
3939 ## </param>
3940 ## <param name="domain">
3941 ##      <summary>
3942 ##      Domain allowed access.
3943 ##      </summary>
3944 ## </param>
3945 #
3946 template(`userdom_unpriv_usertype',`
3947         gen_require(`
3948                 attribute unpriv_userdomain, userdomain;
3949                 attribute $1_usertype;
3950         ')
3951         typeattribute $2  $1_usertype;
3952         typeattribute $2  unpriv_userdomain;
3953         typeattribute $2  userdomain;
3954
3955         auth_use_nsswitch($2)
3956         ubac_constrained($2)
3957 ')
3958
3959 #######################################
3960 ## <summary>
3961 ##  Define this type as a Allow apps to set rlimits on userdomain
3962 ## </summary>
3963 ## <param name="domain">
3964 ##  <summary>
3965 ##  Domain allowed access.
3966 ##  </summary>
3967 ## </param>
3968 ## <param name="userdomain_prefix">
3969 ##  <summary>
3970 ##  The prefix of the user domain (e.g., user
3971 ##  is the prefix for user_t).
3972 ## </summary>
3973 ## </param>
3974 ## <param name="domain">
3975 ##  <summary>
3976 ##  Domain allowed access.
3977 ##  </summary>
3978 ## </param>
3979 #
3980 template(`userdom_unpriv_type',`
3981     gen_require(`
3982         attribute unpriv_userdomain, userdomain;
3983     ')
3984     typeattribute $2  unpriv_userdomain;
3985     typeattribute $2  userdomain;
3986
3987     auth_use_nsswitch($2)
3988     ubac_constrained($2)
3989 ')
3990
3991 ########################################
3992 ## <summary>
3993 ##      Connect to users over an unix stream socket.
3994 ## </summary>
3995 ## <param name="domain">
3996 ##      <summary>
3997 ##      Domain allowed access.
3998 ##      </summary>
3999 ## </param>
4000 #
4001 interface(`userdom_stream_connect',`
4002         gen_require(`
4003                 type user_tmp_t;
4004                 attribute userdomain;
4005         ')
4006
4007         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
4008 ')
4009
4010 ########################################
4011 ## <summary>
4012 ##      Ptrace user domains.
4013 ## </summary>
4014 ## <param name="domain">
4015 ##      <summary>
4016 ##      Domain allowed access.
4017 ##      </summary>
4018 ## </param>
4019 #
4020 interface(`userdom_ptrace_all_users',`
4021         gen_require(`
4022                 attribute userdomain;
4023         ')
4024
4025         tunable_policy(`deny_ptrace',`',`
4026                 allow $1 userdomain:process ptrace;
4027         ')
4028 ')
4029
4030 ########################################
4031 ## <summary>
4032 ##      dontaudit Search /root
4033 ## </summary>
4034 ## <param name="domain">
4035 ##      <summary>
4036 ##      Domain to not audit.
4037 ##      </summary>
4038 ## </param>
4039 #
4040 interface(`userdom_dontaudit_search_admin_dir',`
4041         gen_require(`
4042                 type admin_home_t;
4043         ')
4044
4045         dontaudit $1 admin_home_t:dir search_dir_perms;
4046 ')
4047
4048 ########################################
4049 ## <summary>
4050 ##      dontaudit list /root
4051 ## </summary>
4052 ## <param name="domain">
4053 ##      <summary>
4054 ##      Domain to not audit.
4055 ##      </summary>
4056 ## </param>
4057 #
4058 interface(`userdom_dontaudit_list_admin_dir',`
4059         gen_require(`
4060                 type admin_home_t;
4061         ')
4062
4063         dontaudit $1 admin_home_t:dir list_dir_perms;
4064 ')
4065
4066 ########################################
4067 ## <summary>
4068 ##      Allow domain to  list /root
4069 ## </summary>
4070 ## <param name="domain">
4071 ##      <summary>
4072 ##      Domain allowed access.
4073 ##      </summary>
4074 ## </param>
4075 #
4076 interface(`userdom_list_admin_dir',`
4077         gen_require(`
4078                 type admin_home_t;
4079         ')
4080
4081         allow $1 admin_home_t:dir list_dir_perms;
4082 ')
4083
4084 ########################################
4085 ## <summary>
4086 ##      Allow Search /root
4087 ## </summary>
4088 ## <param name="domain">
4089 ##      <summary>
4090 ##      Domain allowed access.
4091 ##      </summary>
4092 ## </param>
4093 #
4094 interface(`userdom_search_admin_dir',`
4095         gen_require(`
4096                 type admin_home_t;
4097         ')
4098
4099         allow $1 admin_home_t:dir search_dir_perms;
4100 ')
4101
4102 ########################################
4103 ## <summary>
4104 ##      RW unpriviledged user SysV sempaphores.
4105 ## </summary>
4106 ## <param name="domain">
4107 ##      <summary>
4108 ##      Domain allowed access.
4109 ##      </summary>
4110 ## </param>
4111 #
4112 interface(`userdom_rw_semaphores',`
4113         gen_require(`
4114                 attribute unpriv_userdomain;
4115         ')
4116
4117         allow $1 unpriv_userdomain:sem rw_sem_perms;
4118 ')
4119
4120 ########################################
4121 ## <summary>
4122 ##      Send a message to unpriv users over a unix domain
4123 ##      datagram socket.
4124 ## </summary>
4125 ## <param name="domain">
4126 ##      <summary>
4127 ##      Domain allowed access.
4128 ##      </summary>
4129 ## </param>
4130 #
4131 interface(`userdom_dgram_send',`
4132         gen_require(`
4133                 attribute unpriv_userdomain;
4134         ')
4135
4136         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4137 ')
4138
4139 ######################################
4140 ## <summary>
4141 ##      Send a message to users over a unix domain
4142 ##      datagram socket.
4143 ## </summary>
4144 ## <param name="domain">
4145 ##      <summary>
4146 ##      Domain allowed access.
4147 ##      </summary>
4148 ## </param>
4149 #
4150 interface(`userdom_users_dgram_send',`
4151         gen_require(`
4152                  attribute userdomain;
4153       ')
4154
4155        allow $1 userdomain:unix_dgram_socket sendto;
4156 ')
4157
4158 #######################################
4159 ## <summary>
4160 ##      Allow execmod on files in homedirectory
4161 ## </summary>
4162 ## <param name="domain">
4163 ##      <summary>
4164 ##      Domain allowed access.
4165 ##      </summary>
4166 ## </param>
4167 ## <rolebase/>
4168 #
4169 interface(`userdom_execmod_user_home_files',`
4170         gen_require(`
4171                 type user_home_type;
4172         ')
4173
4174         allow $1 user_home_type:file execmod;
4175 ')
4176
4177 ########################################
4178 ## <summary>
4179 ##      Read admin home files.
4180 ## </summary>
4181 ## <param name="domain">
4182 ##      <summary>
4183 ##      Domain allowed access.
4184 ##      </summary>
4185 ## </param>
4186 ## <rolecap/>
4187 #
4188 interface(`userdom_read_admin_home_files',`
4189         gen_require(`
4190                 type admin_home_t;
4191         ')
4192
4193         read_files_pattern($1, admin_home_t, admin_home_t)
4194 ')
4195
4196 ########################################
4197 ## <summary>
4198 ##      Delete admin home files.
4199 ## </summary>
4200 ## <param name="domain">
4201 ##      <summary>
4202 ##      Domain allowed access.
4203 ##      </summary>
4204 ## </param>
4205 ## <rolecap/>
4206 #
4207 interface(`userdom_delete_admin_home_files',`
4208         gen_require(`
4209                 type admin_home_t;
4210         ')
4211
4212         allow $1 admin_home_t:file delete_file_perms;
4213 ')
4214
4215 ########################################
4216 ## <summary>
4217 ##      Execute admin home files.
4218 ## </summary>
4219 ## <param name="domain">
4220 ##      <summary>
4221 ##      Domain allowed access.
4222 ##      </summary>
4223 ## </param>
4224 ## <rolecap/>
4225 #
4226 interface(`userdom_exec_admin_home_files',`
4227         gen_require(`
4228                 type admin_home_t;
4229         ')
4230
4231         exec_files_pattern($1, admin_home_t, admin_home_t)
4232 ')
4233
4234 ########################################
4235 ## <summary>
4236 ##      Append files inherited
4237 ##      in the /root directory.
4238 ## </summary>
4239 ## <param name="domain">
4240 ##      <summary>
4241 ##      Domain allowed access.
4242 ##      </summary>
4243 ## </param>
4244 #
4245 interface(`userdom_inherit_append_admin_home_files',`
4246         gen_require(`
4247                 type admin_home_t;
4248         ')
4249
4250         allow $1 admin_home_t:file { getattr append };
4251 ')
4252
4253
4254 #######################################
4255 ## <summary>
4256 ##      Manage all files/directories in the homedir
4257 ## </summary>
4258 ## <param name="userdomain">
4259 ##      <summary>
4260 ##      The user domain
4261 ##      </summary>
4262 ## </param>
4263 ## <rolebase/>
4264 #
4265 interface(`userdom_manage_user_home_content',`
4266         gen_require(`
4267                 type user_home_dir_t, user_home_t;
4268                 attribute user_home_type;
4269         ')
4270
4271         files_list_home($1)
4272         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4273         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4274         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4275         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4276         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4277         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4278
4279 ')
4280
4281
4282 ########################################
4283 ## <summary>
4284 ##      Create objects in a user home directory
4285 ##      with an automatic type transition to
4286 ##      the user home file type.
4287 ## </summary>
4288 ## <param name="domain">
4289 ##      <summary>
4290 ##      Domain allowed access.
4291 ##      </summary>
4292 ## </param>
4293 ## <param name="object_class">
4294 ##      <summary>
4295 ##      The class of the object to be created.
4296 ##      </summary>
4297 ## </param>
4298 #
4299 interface(`userdom_user_home_dir_filetrans_pattern',`
4300         gen_require(`
4301                 type user_home_dir_t, user_home_t;
4302         ')
4303
4304         type_transition $1 user_home_dir_t:$2 user_home_t;
4305 ')
4306
4307 ########################################
4308 ## <summary>
4309 ##      Create objects in the /root directory
4310 ##      with an automatic type transition to
4311 ##      a specified private type.
4312 ## </summary>
4313 ## <param name="domain">
4314 ##      <summary>
4315 ##      Domain allowed access.
4316 ##      </summary>
4317 ## </param>
4318 ## <param name="private_type">
4319 ##      <summary>
4320 ##      The type of the object to create.
4321 ##      </summary>
4322 ## </param>
4323 ## <param name="object_class">
4324 ##      <summary>
4325 ##      The class of the object to be created.
4326 ##      </summary>
4327 ## </param>
4328 #
4329 interface(`userdom_admin_home_dir_filetrans',`
4330         gen_require(`
4331                 type admin_home_t;
4332         ')
4333
4334         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4335 ')
4336
4337 ########################################
4338 ## <summary>
4339 ##      Send signull to unprivileged user domains.
4340 ## </summary>
4341 ## <param name="domain">
4342 ##      <summary>
4343 ##      Domain allowed access.
4344 ##      </summary>
4345 ## </param>
4346 #
4347 interface(`userdom_signull_unpriv_users',`
4348         gen_require(`
4349                 attribute unpriv_userdomain;
4350         ')
4351
4352         allow $1 unpriv_userdomain:process signull;
4353 ')
4354
4355 ########################################
4356 ## <summary>
4357 ##      Write all users files in /tmp
4358 ## </summary>
4359 ## <param name="domain">
4360 ##      <summary>
4361 ##      Domain allowed access.
4362 ##      </summary>
4363 ## </param>
4364 #
4365 interface(`userdom_write_user_tmp_dirs',`
4366         gen_require(`
4367                 type user_tmp_t;
4368         ')
4369
4370         write_files_pattern($1, user_tmp_t, user_tmp_t)
4371 ')
4372
4373 ########################################
4374 ## <summary>
4375 ##      Manage keys for all user domains.
4376 ## </summary>
4377 ## <param name="domain">
4378 ##      <summary>
4379 ##      Domain allowed access.
4380 ##      </summary>
4381 ## </param>
4382 #
4383 interface(`userdom_manage_all_users_keys',`
4384         gen_require(`
4385                 attribute userdomain;
4386         ')
4387
4388         allow $1 userdomain:key manage_key_perms;
4389 ')
4390
4391
4392 ########################################
4393 ## <summary>
4394 ##      Do not audit attempts to read and write
4395 ##      unserdomain stream.
4396 ## </summary>
4397 ## <param name="domain">
4398 ##      <summary>
4399 ##      Domain to not audit.
4400 ##      </summary>
4401 ## </param>
4402 #
4403 interface(`userdom_dontaudit_rw_stream',`
4404         gen_require(`
4405                 attribute userdomain;
4406         ')
4407
4408         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4409 ')
4410
4411 ########################################
4412 ## <summary>
4413 ##      Do not audit attempts to read and write
4414 ##      unserdomain datagram socket.
4415 ## </summary>
4416 ## <param name="domain">
4417 ##      <summary>
4418 ##      Domain to not audit.
4419 ##      </summary>
4420 ## </param>
4421 #
4422 interface(`userdom_dontaudit_rw_dgram_socket',`
4423         gen_require(`
4424                 attribute userdomain;
4425         ')
4426
4427         dontaudit $1 userdomain:unix_dgram_socket { read write };
4428 ')
4429
4430 ########################################
4431 ## <summary>
4432 ##      Append files
4433 ##      in a user home subdirectory.
4434 ## </summary>
4435 ## <param name="domain">
4436 ##      <summary>
4437 ##      Domain allowed access.
4438 ##      </summary>
4439 ## </param>
4440 #
4441 interface(`userdom_append_user_home_content_files',`
4442         gen_require(`
4443                 type user_home_dir_t, user_home_t;
4444         ')
4445
4446         append_files_pattern($1, user_home_t, user_home_t)
4447         allow $1 user_home_dir_t:dir search_dir_perms;
4448         files_search_home($1)
4449 ')
4450
4451 ########################################
4452 ## <summary>
4453 ##      Read files inherited
4454 ##      in a user home subdirectory.
4455 ## </summary>
4456 ## <param name="domain">
4457 ##      <summary>
4458 ##      Domain allowed access.
4459 ##      </summary>
4460 ## </param>
4461 #
4462 interface(`userdom_read_inherited_user_home_content_files',`
4463         gen_require(`
4464                 attribute user_home_type;
4465         ')
4466
4467         allow $1 user_home_type:file { getattr read };
4468 ')
4469
4470 ########################################
4471 ## <summary>
4472 ##      Append files inherited
4473 ##      in a user home subdirectory.
4474 ## </summary>
4475 ## <param name="domain">
4476 ##      <summary>
4477 ##      Domain allowed access.
4478 ##      </summary>
4479 ## </param>
4480 #
4481 interface(`userdom_inherit_append_user_home_content_files',`
4482         gen_require(`
4483                 type user_home_t;
4484         ')
4485
4486         allow $1 user_home_t:file { getattr append };
4487 ')
4488
4489 ########################################
4490 ## <summary>
4491 ##      Append files inherited
4492 ##      in a user tmp files.
4493 ## </summary>
4494 ## <param name="domain">
4495 ##      <summary>
4496 ##      Domain allowed access.
4497 ##      </summary>
4498 ## </param>
4499 #
4500 interface(`userdom_inherit_append_user_tmp_files',`
4501         gen_require(`
4502                 type user_tmp_t;
4503         ')
4504
4505         allow $1 user_tmp_t:file { getattr append };
4506 ')
4507
4508 ######################################
4509 ## <summary>
4510 ##      Read audio files in the users homedir.
4511 ## </summary>
4512 ## <param name="domain">
4513 ##      <summary>
4514 ##      Domain allowed access.
4515 ##      </summary>
4516 ## </param>
4517 ## <rolecap/>
4518 #
4519 interface(`userdom_read_home_audio_files',`
4520         gen_require(`
4521                 type audio_home_t;
4522         ')
4523
4524         userdom_search_user_home_dirs($1)
4525         allow $1 audio_home_t:dir list_dir_perms;
4526         read_files_pattern($1, audio_home_t, audio_home_t)
4527         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4528 ')
4529
4530 ########################################
4531 ## <summary>
4532 ##      Do not audit attempts to write all user home content files.
4533 ## </summary>
4534 ## <param name="domain">
4535 ##      <summary>
4536 ##      Domain to not audit.
4537 ##      </summary>
4538 ## </param>
4539 #
4540 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4541         gen_require(`
4542                 attribute user_home_type;
4543         ')
4544
4545         dontaudit $1 user_home_type:file write_file_perms;
4546 ')
4547
4548 ########################################
4549 ## <summary>
4550 ##      Do not audit attempts to write all user tmp content files.
4551 ## </summary>
4552 ## <param name="domain">
4553 ##      <summary>
4554 ##      Domain to not audit.
4555 ##      </summary>
4556 ## </param>
4557 #
4558 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4559         gen_require(`
4560                 attribute user_tmp_type;
4561         ')
4562
4563         dontaudit $1 user_tmp_type:file write_file_perms;
4564 ')
4565
4566 ########################################
4567 ## <summary>
4568 ##      Manage all user temporary content.
4569 ## </summary>
4570 ## <param name="domain">
4571 ##      <summary>
4572 ##      Domain allowed access.
4573 ##      </summary>
4574 ## </param>
4575 #
4576 interface(`userdom_manage_all_user_tmp_content',`
4577         gen_require(`
4578                 attribute user_tmp_type;
4579         ')
4580
4581         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4582         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4583         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4584         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4585         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4586         files_search_tmp($1)
4587 ')
4588
4589 ########################################
4590 ## <summary>
4591 ##      List all user temporary content.
4592 ## </summary>
4593 ## <param name="domain">
4594 ##      <summary>
4595 ##      Domain allowed access.
4596 ##      </summary>
4597 ## </param>
4598 #
4599 interface(`userdom_list_all_user_tmp_content',`
4600         gen_require(`
4601                 attribute user_tmp_type;
4602         ')
4603
4604         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4605         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4606         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4607         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4608         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4609         files_search_var($1)
4610         files_search_tmp($1)
4611 ')
4612
4613 ########################################
4614 ## <summary>
4615 ##      Manage all user tmpfs content.
4616 ## </summary>
4617 ## <param name="domain">
4618 ##      <summary>
4619 ##      Domain allowed access.
4620 ##      </summary>
4621 ## </param>
4622 #
4623 interface(`userdom_manage_all_user_tmpfs_content',`
4624         gen_require(`
4625                 attribute user_tmpfs_type;
4626         ')
4627
4628         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4629         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4630         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4631         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4632         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4633         fs_search_tmpfs($1)
4634 ')
4635
4636 ########################################
4637 ## <summary>
4638 ##      Delete all user temporary content.
4639 ## </summary>
4640 ## <param name="domain">
4641 ##      <summary>
4642 ##      Domain allowed access.
4643 ##      </summary>
4644 ## </param>
4645 #
4646 interface(`userdom_delete_all_user_tmp_content',`
4647         gen_require(`
4648                 attribute user_tmp_type;
4649         ')
4650
4651         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4652         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4653         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4654         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4655         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4656         # /var/tmp
4657         files_search_var($1)
4658         files_delete_tmp_dir_entry($1)
4659 ')
4660
4661 ########################################
4662 ## <summary>
4663 ##      Read system SSL certificates in the users homedir.
4664 ## </summary>
4665 ## <param name="domain">
4666 ##      <summary>
4667 ##      Domain allowed access.
4668 ##      </summary>
4669 ## </param>
4670 #
4671 interface(`userdom_read_home_certs',`
4672         gen_require(`
4673                 type home_cert_t;
4674         ')
4675
4676         userdom_search_user_home_content($1)
4677         allow $1 home_cert_t:dir list_dir_perms;
4678         read_files_pattern($1, home_cert_t, home_cert_t)
4679         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4680 ')
4681
4682 ########################################
4683 ## <summary>
4684 ##      Manage system SSL certificates in the users homedir.
4685 ## </summary>
4686 ## <param name="domain">
4687 ##      <summary>
4688 ##      Domain allowed access.
4689 ##      </summary>
4690 ## </param>
4691 #
4692 interface(`userdom_manage_home_certs',`
4693         gen_require(`
4694                 type home_cert_t;
4695         ')
4696
4697         allow $1 home_cert_t:dir list_dir_perms;
4698         manage_files_pattern($1, home_cert_t, home_cert_t)
4699         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4700
4701         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4702         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4703 ')
4704
4705 #######################################
4706 ## <summary>
4707 ##  Dontaudit Write system SSL certificates in the users homedir.
4708 ## </summary>
4709 ## <param name="domain">
4710 ##  <summary>
4711 ##      Domain to not audit.
4712 ##  </summary>
4713 ## </param>
4714 #
4715 interface(`userdom_dontaudit_write_home_certs',`
4716     gen_require(`
4717         type home_cert_t;
4718     ')
4719
4720     dontaudit $1 home_cert_t:file write;
4721 ')
4722
4723 ########################################
4724 ## <summary>
4725 ##      dontaudit Search getatrr /root files
4726 ## </summary>
4727 ## <param name="domain">
4728 ##      <summary>
4729 ##      Domain to not audit.
4730 ##      </summary>
4731 ## </param>
4732 #
4733 interface(`userdom_dontaudit_getattr_admin_home_files',`
4734         gen_require(`
4735                 type admin_home_t;
4736         ')
4737
4738         dontaudit $1 admin_home_t:file getattr;
4739 ')
4740
4741 ########################################
4742 ## <summary>
4743 ##      dontaudit read /root lnk files
4744 ## </summary>
4745 ## <param name="domain">
4746 ##      <summary>
4747 ##      Domain to not audit.
4748 ##      </summary>
4749 ## </param>
4750 #
4751 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4752         gen_require(`
4753                 type admin_home_t;
4754         ')
4755
4756         dontaudit $1 admin_home_t:lnk_file read;
4757 ')
4758
4759 ########################################
4760 ## <summary>
4761 ##      dontaudit read /root files
4762 ## </summary>
4763 ## <param name="domain">
4764 ##      <summary>
4765 ##      Domain to not audit.
4766 ##      </summary>
4767 ## </param>
4768 #
4769 interface(`userdom_dontaudit_read_admin_home_files',`
4770         gen_require(`
4771                 type admin_home_t;
4772         ')
4773
4774         dontaudit $1 admin_home_t:file read_file_perms;
4775 ')
4776
4777 ########################################
4778 ## <summary>
4779 ##      Create, read, write, and delete user
4780 ##      temporary chr files.
4781 ## </summary>
4782 ## <param name="domain">
4783 ##      <summary>
4784 ##      Domain allowed access.
4785 ##      </summary>
4786 ## </param>
4787 #
4788 interface(`userdom_manage_user_tmp_chr_files',`
4789         gen_require(`
4790                 type user_tmp_t;
4791         ')
4792
4793         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4794         files_search_tmp($1)
4795 ')
4796
4797 ########################################
4798 ## <summary>
4799 ##      Create, read, write, and delete user
4800 ##      temporary blk files.
4801 ## </summary>
4802 ## <param name="domain">
4803 ##      <summary>
4804 ##      Domain allowed access.
4805 ##      </summary>
4806 ## </param>
4807 #
4808 interface(`userdom_manage_user_tmp_blk_files',`
4809         gen_require(`
4810                 type user_tmp_t;
4811         ')
4812
4813         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4814         files_search_tmp($1)
4815 ')
4816
4817 ########################################
4818 ## <summary>
4819 ##      Dontaudit attempt to set attributes on  user temporary directories.
4820 ## </summary>
4821 ## <param name="domain">
4822 ##      <summary>
4823 ##      Domain to not audit.
4824 ##      </summary>
4825 ## </param>
4826 #
4827 interface(`userdom_dontaudit_setattr_user_tmp',`
4828         gen_require(`
4829                 type user_tmp_t;
4830         ')
4831
4832         dontaudit $1 user_tmp_t:dir setattr;
4833 ')
4834
4835 ########################################
4836 ## <summary>
4837 ##      Read all inherited users files in /tmp
4838 ## </summary>
4839 ## <param name="domain">
4840 ##      <summary>
4841 ##      Domain allowed access.
4842 ##      </summary>
4843 ## </param>
4844 #
4845 interface(`userdom_read_inherited_user_tmp_files',`
4846         gen_require(`
4847                 type user_tmp_t;
4848         ')
4849
4850         allow $1 user_tmp_t:file read_inherited_file_perms;
4851 ')
4852
4853 ########################################
4854 ## <summary>
4855 ##      Write all inherited users files in /tmp
4856 ## </summary>
4857 ## <param name="domain">
4858 ##      <summary>
4859 ##      Domain allowed access.
4860 ##      </summary>
4861 ## </param>
4862 #
4863 interface(`userdom_write_inherited_user_tmp_files',`
4864         gen_require(`
4865                 type user_tmp_t;
4866         ')
4867
4868         allow $1 user_tmp_t:file write;
4869 ')
4870
4871 ########################################
4872 ## <summary>
4873 ##      Delete all users files in /tmp
4874 ## </summary>
4875 ## <param name="domain">
4876 ##      <summary>
4877 ##      Domain allowed access.
4878 ##      </summary>
4879 ## </param>
4880 #
4881 interface(`userdom_delete_user_tmp_files',`
4882         gen_require(`
4883                 type user_tmp_t;
4884         ')
4885
4886         allow $1 user_tmp_t:file delete_file_perms;
4887 ')
4888
4889 ########################################
4890 ## <summary>
4891 ##      Delete user tmpfs files.
4892 ## </summary>
4893 ## <param name="domain">
4894 ##      <summary>
4895 ##      Domain allowed access.
4896 ##      </summary>
4897 ## </param>
4898 #
4899 interface(`userdom_delete_user_tmpfs_files',`
4900         gen_require(`
4901                 type user_tmpfs_t;
4902         ')
4903
4904         allow $1 user_tmpfs_t:file delete_file_perms;
4905 ')
4906
4907 ########################################
4908 ## <summary>
4909 ##      Read/Write unpriviledged user SysV shared
4910 ##      memory segments.
4911 ## </summary>
4912 ## <param name="domain">
4913 ##      <summary>
4914 ##      Domain allowed access.
4915 ##      </summary>
4916 ## </param>
4917 #
4918 interface(`userdom_rw_unpriv_user_shared_mem',`
4919         gen_require(`
4920                 attribute unpriv_userdomain;
4921         ')
4922
4923         allow $1 unpriv_userdomain:shm rw_shm_perms;
4924 ')
4925
4926 ########################################
4927 ## <summary>
4928 ##      Do not audit attempts to search user
4929 ##      temporary directories.
4930 ## </summary>
4931 ## <param name="domain">
4932 ##      <summary>
4933 ##      Domain to not audit.
4934 ##      </summary>
4935 ## </param>
4936 #
4937 interface(`userdom_dontaudit_search_user_tmp',`
4938         gen_require(`
4939                 type user_tmp_t;
4940         ')
4941
4942         dontaudit $1 user_tmp_t:dir search_dir_perms;
4943 ')
4944
4945 ########################################
4946 ## <summary>
4947 ##      Execute a file in a user home directory
4948 ##      in the specified domain.
4949 ## </summary>
4950 ## <desc>
4951 ##      <p>
4952 ##      Execute a file in a user home directory
4953 ##      in the specified domain.
4954 ##      </p>
4955 ##      <p>
4956 ##      No interprocess communication (signals, pipes,
4957 ##      etc.) is provided by this interface since
4958 ##      the domains are not owned by this module.
4959 ##      </p>
4960 ## </desc>
4961 ## <param name="domain">
4962 ##      <summary>
4963 ##      Domain allowed access.
4964 ##      </summary>
4965 ## </param>
4966 ## <param name="target_domain">
4967 ##      <summary>
4968 ##      The type of the new process.
4969 ##      </summary>
4970 ## </param>
4971 #
4972 interface(`userdom_domtrans_user_home',`
4973         gen_require(`
4974                 type user_home_t;
4975         ')
4976
4977         read_lnk_files_pattern($1, user_home_t, user_home_t)
4978         domain_transition_pattern($1, user_home_t, $2)
4979         type_transition $1 user_home_t:process $2;
4980 ')
4981
4982 ########################################
4983 ## <summary>
4984 ##      Execute a file in a user tmp directory
4985 ##      in the specified domain.
4986 ## </summary>
4987 ## <desc>
4988 ##      <p>
4989 ##      Execute a file in a user tmp directory
4990 ##      in the specified domain.
4991 ##      </p>
4992 ##      <p>
4993 ##      No interprocess communication (signals, pipes,
4994 ##      etc.) is provided by this interface since
4995 ##      the domains are not owned by this module.
4996 ##      </p>
4997 ## </desc>
4998 ## <param name="domain">
4999 ##      <summary>
5000 ##      Domain allowed access.
5001 ##      </summary>
5002 ## </param>
5003 ## <param name="target_domain">
5004 ##      <summary>
5005 ##      The type of the new process.
5006 ##      </summary>
5007 ## </param>
5008 #
5009 interface(`userdom_domtrans_user_tmp',`
5010         gen_require(`
5011                 type user_tmp_t;
5012         ')
5013
5014         files_search_tmp($1)
5015         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
5016         domain_transition_pattern($1, user_tmp_t, $2)
5017         type_transition $1 user_tmp_t:process $2;
5018 ')
5019
5020 ########################################
5021 ## <summary>
5022 ##      Do not audit attempts to read all user home content files.
5023 ## </summary>
5024 ## <param name="domain">
5025 ##      <summary>
5026 ##      Domain to not audit.
5027 ##      </summary>
5028 ## </param>
5029 #
5030 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5031         gen_require(`
5032                 attribute user_home_type;
5033         ')
5034
5035         dontaudit $1 user_home_type:file read_file_perms;
5036 ')
5037
5038 ########################################
5039 ## <summary>
5040 ##      Do not audit attempts to read all user tmp content files.
5041 ## </summary>
5042 ## <param name="domain">
5043 ##      <summary>
5044 ##      Domain to not audit.
5045 ##      </summary>
5046 ## </param>
5047 #
5048 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5049         gen_require(`
5050                 attribute user_tmp_type;
5051         ')
5052
5053         dontaudit $1 user_tmp_type:file read_file_perms;
5054 ')
5055
5056 #######################################
5057 ## <summary>
5058 ## Read and write unpriviledged user SysV sempaphores.
5059 ## </summary>
5060 ## <param name="domain">
5061 ## <summary>
5062 ## Domain allowed access.
5063 ## </summary>
5064 ## </param>
5065 #
5066 interface(`userdom_rw_unpriv_user_semaphores',`
5067    gen_require(`
5068        attribute unpriv_userdomain;
5069    ')
5070
5071    allow $1 unpriv_userdomain:sem rw_sem_perms;
5072 ')
5073
5074 ########################################
5075 ## <summary>
5076 ##      Transition to userdom named content
5077 ## </summary>
5078 ## <param name="domain">
5079 ##      <summary>
5080 ##      Domain allowed access.
5081 ##      </summary>
5082 ## </param>
5083 #
5084 interface(`userdom_filetrans_home_content',`
5085         gen_require(`
5086                 type home_bin_t, home_cert_t;
5087                 type audio_home_t;
5088         ')
5089
5090         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5091         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5092         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5093         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5094         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5095         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5096         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5097
5098         #optional_policy(`
5099         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5100         #')
5101 ')
5102
5103 ########################################
5104 ## <summary>
5105 ##      Make the specified type able to read content in user home dirs
5106 ## </summary>
5107 ## <param name="type">
5108 ##      <summary>
5109 ##      Domain allowed access.
5110 ##      </summary>
5111 ## </param>
5112 #
5113 interface(`userdom_home_reader',`
5114         gen_require(`
5115                 attribute userdom_home_reader_type;
5116         ')
5117
5118         typeattribute $1 userdom_home_reader_type;
5119 ')
5120
5121
5122 ########################################
5123 ## <summary>
5124 ##      Make the specified type able to manage content in user home dirs
5125 ## </summary>
5126 ## <param name="type">
5127 ##      <summary>
5128 ##      Domain allowed access.
5129 ##      </summary>
5130 ## </param>
5131 #
5132 interface(`userdom_home_manager',`
5133         gen_require(`
5134                 attribute userdom_home_manager_type;
5135         ')
5136
5137         typeattribute $1 userdom_home_manager_type;
5138 ')