policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 colord_read_lib_files($1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 dbus_system_bus_client($1_usertype)
 696
 697                 allow $1_usertype $1_usertype:dbus  send_msg;
 698
 699                 optional_policy(`
 700                         avahi_dbus_chat($1_usertype)
 701                 ')
 702
 703                 optional_policy(`
 704                         policykit_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         bluetooth_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         consolekit_dbus_chat($1_usertype)
 713                         consolekit_read_log($1_usertype)
 714                 ')
 715
 716                 optional_policy(`
 717                         devicekit_dbus_chat($1_usertype)
 718                         devicekit_dbus_chat_power($1_usertype)
 719                         devicekit_dbus_chat_disk($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 tunable_policy(`allow_user_mysql_connect',`
 784                         mysql_stream_connect($1_t)
 785                 ')
 786         ')
 787
 788         optional_policy(`
 789                 oident_manage_user_content($1_t)
 790                 oident_relabel_user_content($1_t)
 791         ')
 792
 793         optional_policy(`
 794                 # to allow monitoring of pcmcia status
 795                 pcmcia_read_pid($1_usertype)
 796         ')
 797
 798         optional_policy(`
 799                 pcscd_read_pub_files($1_usertype)
 800                 pcscd_stream_connect($1_usertype)
 801         ')
 802
 803         optional_policy(`
 804                 tunable_policy(`allow_user_postgresql_connect',`
 805                         postgresql_stream_connect($1_usertype)
 806                         postgresql_tcp_connect($1_usertype)
 807                 ')
 808         ')
 809
 810         optional_policy(`
 811                 resmgr_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 rpc_dontaudit_getattr_exports($1_usertype)
 816                 rpc_manage_nfs_rw_content($1_usertype)
 817         ')
 818
 819         optional_policy(`
 820                 rpcbind_stream_connect($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 samba_stream_connect_winbind($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 sandbox_transition($1_usertype, $1_r)
 829         ')
 830
 831         optional_policy(`
 832                 seunshare_role_template($1, $1_r, $1_t)
 833         ')
 834
 835         optional_policy(`
 836                 slrnpull_search_spool($1_usertype)
 837         ')
 838
 839         optional_policy(`
 840                 thumb_role($1_r, $1_usertype)
 841         ')
 842 ')
 843
 844 #######################################
 845 ## <summary>
 846 ##      The template for creating a login user.
 847 ## </summary>
 848 ## <desc>
 849 ##      <p>
 850 ##      This template creates a user domain, types, and
 851 ##      rules for the user's tty, pty, home directories,
 852 ##      tmp, and tmpfs files.
 853 ##      </p>
 854 ## </desc>
 855 ## <param name="userdomain_prefix">
 856 ##      <summary>
 857 ##      The prefix of the user domain (e.g., user
 858 ##      is the prefix for user_t).
 859 ##      </summary>
 860 ## </param>
 861 #
 862 template(`userdom_login_user_template', `
 863         gen_require(`
 864                 class context contains;
 865         ')
 866
 867         userdom_base_user_template($1)
 868
 869         userdom_manage_home_role($1_r, $1_usertype)
 870
 871         userdom_manage_tmp_role($1_r, $1_usertype)
 872         userdom_manage_tmpfs_role($1_r, $1_usertype)
 873
 874         ifelse(`$1',`unconfined',`',`
 875                 gen_tunable(allow_$1_exec_content, true)
 876
 877                 tunable_policy(`allow_$1_exec_content',`
 878                         userdom_exec_user_tmp_files($1_usertype)
 879                         userdom_exec_user_home_content_files($1_usertype)
 880                 ')
 881                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 882                         fs_exec_nfs_files($1_usertype)
 883                 ')
 884
 885                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 886                         fs_exec_cifs_files($1_usertype)
 887                 ')
 888         ')
 889
 890         userdom_change_password_template($1)
 891
 892         ##############################
 893         #
 894         # User domain Local policy
 895         #
 896
 897         allow $1_t self:capability { setgid chown fowner };
 898         dontaudit $1_t self:capability { sys_nice fsetid };
 899
 900         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 901         dontaudit $1_t self:process setrlimit;
 902         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 903
 904         allow $1_t self:context contains;
 905
 906         kernel_dontaudit_read_system_state($1_usertype)
 907         kernel_dontaudit_list_all_proc($1_usertype)
 908
 909         dev_read_sysfs($1_usertype)
 910         dev_read_urand($1_usertype)
 911
 912         domain_use_interactive_fds($1_usertype)
 913         # Command completion can fire hundreds of denials
 914         domain_dontaudit_exec_all_entry_files($1_usertype)
 915
 916         files_dontaudit_list_default($1_usertype)
 917         files_dontaudit_read_default_files($1_usertype)
 918         # Stat lost+found.
 919         files_getattr_lost_found_dirs($1_usertype)
 920
 921         fs_get_all_fs_quotas($1_usertype)
 922         fs_getattr_all_fs($1_usertype)
 923         fs_search_all($1_usertype)
 924         fs_list_inotifyfs($1_usertype)
 925         fs_rw_anon_inodefs_files($1_usertype)
 926
 927         auth_dontaudit_write_login_records($1_t)
 928         auth_rw_cache($1_t)
 929
 930         application_exec_all($1_t)
 931         # The library functions always try to open read-write first,
 932         # then fall back to read-only if it fails.
 933         init_dontaudit_rw_utmp($1_t)
 934
 935         # Stop warnings about access to /dev/console
 936         init_dontaudit_use_fds($1_usertype)
 937         init_dontaudit_use_script_fds($1_usertype)
 938
 939         libs_exec_lib_files($1_usertype)
 940
 941         logging_dontaudit_getattr_all_logs($1_usertype)
 942
 943         # for running TeX programs
 944         miscfiles_read_tetex_data($1_usertype)
 945         miscfiles_exec_tetex_data($1_usertype)
 946
 947         seutil_read_config($1_usertype)
 948
 949         optional_policy(`
 950                 cups_read_config($1_usertype)
 951                 cups_stream_connect($1_usertype)
 952                 cups_stream_connect_ptal($1_usertype)
 953         ')
 954
 955         optional_policy(`
 956                 kerberos_use($1_usertype)
 957                 kerberos_filetrans_home_content($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 mta_dontaudit_read_spool_symlinks($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 quota_dontaudit_getattr_db($1_usertype)
 966         ')
 967
 968         optional_policy(`
 969                 rpm_read_db($1_usertype)
 970                 rpm_dontaudit_manage_db($1_usertype)
 971                 rpm_read_cache($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 oddjob_run_mkhomedir($1_t, $1_r)
 976         ')
 977 ')
 978
 979 #######################################
 980 ## <summary>
 981 ##      The template for creating a unprivileged login user.
 982 ## </summary>
 983 ## <desc>
 984 ##      <p>
 985 ##      This template creates a user domain, types, and
 986 ##      rules for the user's tty, pty, home directories,
 987 ##      tmp, and tmpfs files.
 988 ##      </p>
 989 ## </desc>
 990 ## <param name="userdomain_prefix">
 991 ##      <summary>
 992 ##      The prefix of the user domain (e.g., user
 993 ##      is the prefix for user_t).
 994 ##      </summary>
 995 ## </param>
 996 #
 997 template(`userdom_restricted_user_template',`
 998         gen_require(`
 999                 attribute unpriv_userdomain;
1000         ')
1001
1002         userdom_login_user_template($1)
1003
1004         typeattribute $1_t unpriv_userdomain;
1005         domain_interactive_fd($1_t)
1006
1007         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1008         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1009
1010         ##############################
1011         #
1012         # Local policy
1013         #
1014
1015         optional_policy(`
1016                 loadkeys_run($1_t, $1_r)
1017         ')
1018 ')
1019
1020 #######################################
1021 ## <summary>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ## </summary>
1024 ## <desc>
1025 ##      <p>
1026 ##      The template for creating a unprivileged xwindows login user.
1027 ##      </p>
1028 ##      <p>
1029 ##      This template creates a user domain, types, and
1030 ##      rules for the user's tty, pty, home directories,
1031 ##      tmp, and tmpfs files.
1032 ##      </p>
1033 ## </desc>
1034 ## <param name="userdomain_prefix">
1035 ##      <summary>
1036 ##      The prefix of the user domain (e.g., user
1037 ##      is the prefix for user_t).
1038 ##      </summary>
1039 ## </param>
1040 #
1041 template(`userdom_restricted_xwindows_user_template',`
1042
1043         userdom_restricted_user_template($1)
1044
1045         ##############################
1046         #
1047         # Local policy
1048         #
1049
1050         auth_role($1_r, $1_t)
1051         auth_search_pam_console_data($1_usertype)
1052         auth_dontaudit_read_login_records($1_usertype)
1053
1054         dev_read_sound($1_usertype)
1055         dev_write_sound($1_usertype)
1056         # gnome keyring wants to read this.
1057         dev_dontaudit_read_rand($1_usertype)
1058         # temporarily allow since openoffice requires this
1059         dev_read_rand($1_usertype)
1060
1061         dev_read_video_dev($1_usertype)
1062         dev_write_video_dev($1_usertype)
1063         dev_rw_wireless($1_usertype)
1064
1065         libs_dontaudit_setattr_lib_files($1_usertype)
1066
1067         tunable_policy(`user_rw_noexattrfile',`
1068                 dev_rw_usbfs($1_t)
1069                 dev_rw_generic_usb_dev($1_usertype)
1070
1071                 fs_manage_noxattr_fs_files($1_usertype)
1072                 fs_manage_noxattr_fs_dirs($1_usertype)
1073                 fs_manage_dos_dirs($1_usertype)
1074                 fs_manage_dos_files($1_usertype)
1075                 storage_raw_read_removable_device($1_usertype)
1076                 storage_raw_write_removable_device($1_usertype)
1077         ')
1078
1079         logging_send_syslog_msg($1_usertype)
1080         logging_dontaudit_send_audit_msgs($1_t)
1081
1082         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1083         logging_send_audit_msgs($1_t)
1084         selinux_get_enforce_mode($1_t)
1085         seutil_exec_restorecond($1_t)
1086         seutil_read_file_contexts($1_t)
1087         seutil_read_default_contexts($1_t)
1088
1089         xserver_restricted_role($1_r, $1_t)
1090
1091         optional_policy(`
1092                 alsa_read_rw_config($1_usertype)
1093         ')
1094
1095          # cjp: needed by KDE apps
1096          # bug: #682499
1097          optional_policy(`
1098                 gnome_read_usr_config($1_usertype)
1099                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1100                 # cjp: telepathy F15 bugs
1101                 telepathy_role($1_r, $1_t, $1)
1102         ')
1103
1104         optional_policy(`
1105                 dbus_role_template($1, $1_r, $1_usertype)
1106                 dbus_system_bus_client($1_usertype)
1107                 allow $1_usertype $1_usertype:dbus send_msg;
1108
1109                 optional_policy(`
1110                         abrt_dbus_chat($1_usertype)
1111                         abrt_run_helper($1_usertype, $1_r)
1112                 ')
1113
1114                 optional_policy(`
1115                         consolekit_dontaudit_read_log($1_usertype)
1116                         consolekit_dbus_chat($1_usertype)
1117                 ')
1118
1119                 optional_policy(`
1120                         cups_dbus_chat($1_usertype)
1121                         cups_dbus_chat_config($1_usertype)
1122                 ')
1123
1124                 optional_policy(`
1125                         devicekit_dbus_chat($1_usertype)
1126                         devicekit_dbus_chat_disk($1_usertype)
1127                         devicekit_dbus_chat_power($1_usertype)
1128                 ')
1129
1130                 optional_policy(`
1131                         fprintd_dbus_chat($1_t)
1132                 ')
1133         ')
1134
1135         optional_policy(`
1136                 policykit_role($1_r, $1_usertype)
1137         ')
1138
1139         optional_policy(`
1140                 pulseaudio_role($1_r, $1_usertype)
1141                 pulseaudio_filetrans_admin_home_content($1_usertype)
1142                 pulseaudio_filetrans_home_content($1_usertype)
1143         ')
1144
1145         optional_policy(`
1146                 rtkit_scheduled($1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 setroubleshoot_dontaudit_stream_connect($1_t)
1151         ')
1152
1153         optional_policy(`
1154                 udev_read_db($1_usertype)
1155         ')
1156
1157         optional_policy(`
1158                 wm_role_template($1, $1_r, $1_t)
1159         ')
1160 ')
1161
1162 #######################################
1163 ## <summary>
1164 ##      The template for creating a unprivileged user roughly
1165 ##      equivalent to a regular linux user.
1166 ## </summary>
1167 ## <desc>
1168 ##      <p>
1169 ##      The template for creating a unprivileged user roughly
1170 ##      equivalent to a regular linux user.
1171 ##      </p>
1172 ##      <p>
1173 ##      This template creates a user domain, types, and
1174 ##      rules for the user's tty, pty, home directories,
1175 ##      tmp, and tmpfs files.
1176 ##      </p>
1177 ## </desc>
1178 ## <param name="userdomain_prefix">
1179 ##      <summary>
1180 ##      The prefix of the user domain (e.g., user
1181 ##      is the prefix for user_t).
1182 ##      </summary>
1183 ## </param>
1184 #
1185 template(`userdom_unpriv_user_template', `
1186
1187         ##############################
1188         #
1189         # Declarations
1190         #
1191
1192         # Inherit rules for ordinary users.
1193         userdom_restricted_xwindows_user_template($1)
1194         userdom_common_user_template($1)
1195
1196         ##############################
1197         #
1198         # Local policy
1199         #
1200
1201         # port access is audited even if dac would not have allowed it, so dontaudit it here
1202 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1203         # Need the following rule to allow users to run vpnc
1204         corenet_tcp_bind_xserver_port($1_t)
1205         corenet_tcp_bind_generic_node($1_usertype)
1206
1207         storage_rw_fuse($1_t)
1208
1209         files_exec_usr_files($1_t)
1210    # cjp: why?
1211         files_read_kernel_symbol_table($1_t)
1212
1213         ifndef(`enable_mls',`
1214                 fs_exec_noxattr($1_t)
1215
1216                 tunable_policy(`user_rw_noexattrfile',`
1217                         fs_manage_noxattr_fs_files($1_t)
1218                         fs_manage_noxattr_fs_dirs($1_t)
1219                         # Write floppies
1220                         storage_raw_read_removable_device($1_t)
1221                         storage_raw_write_removable_device($1_t)
1222                 ',`
1223                         storage_raw_read_removable_device($1_t)
1224                 ')
1225         ')
1226
1227         miscfiles_read_hwdata($1_usertype)
1228
1229         # Allow users to run TCP servers (bind to ports and accept connection from
1230         # the same domain and outside users) disabling this forces FTP passive mode
1231         # and may change other protocols
1232
1233         tunable_policy(`user_share_music',`
1234                 corenet_tcp_bind_daap_port($1_usertype)
1235         ')
1236
1237         tunable_policy(`user_tcp_server',`
1238                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1239         ')
1240
1241         tunable_policy(`user_setrlimit',`
1242                 allow $1_usertype self:process setrlimit;
1243         ')
1244
1245         optional_policy(`
1246                 cdrecord_role($1_r, $1_t)
1247         ')
1248
1249         optional_policy(`
1250                 cron_role($1_r, $1_t)
1251         ')
1252
1253         optional_policy(`
1254                 gpg_role($1_r, $1_usertype)
1255         ')
1256
1257         optional_policy(`
1258                 gnomeclock_dbus_chat($1_t)
1259         ')
1260
1261         optional_policy(`
1262                 gpm_stream_connect($1_usertype)
1263         ')
1264
1265         optional_policy(`
1266                 mount_run_fusermount($1_t, $1_r)
1267                 mount_read_pid_files($1_t)
1268         ')
1269
1270         optional_policy(`
1271                 wine_role_template($1, $1_r, $1_t)
1272         ')
1273
1274         optional_policy(`
1275                 postfix_run_postdrop($1_t, $1_r)
1276                 postfix_search_spool($1_t)
1277         ')
1278
1279         # Run pppd in pppd_t by default for user
1280         optional_policy(`
1281                 ppp_run_cond($1_t, $1_r)
1282         ')
1283
1284         optional_policy(`
1285                 vdagent_getattr_log($1_t)
1286                 vdagent_getattr_exec($1_t)
1287                 vdagent_stream_connect($1_t)
1288         ')
1289 ')
1290
1291 #######################################
1292 ## <summary>
1293 ##      The template for creating an administrative user.
1294 ## </summary>
1295 ## <desc>
1296 ##      <p>
1297 ##      This template creates a user domain, types, and
1298 ##      rules for the user's tty, pty, home directories,
1299 ##      tmp, and tmpfs files.
1300 ##      </p>
1301 ##      <p>
1302 ##      The privileges given to administrative users are:
1303 ##      <ul>
1304 ##              <li>Raw disk access</li>
1305 ##              <li>Set all sysctls</li>
1306 ##              <li>All kernel ring buffer controls</li>
1307 ##              <li>Create, read, write, and delete all files but shadow</li>
1308 ##              <li>Manage source and binary format SELinux policy</li>
1309 ##              <li>Run insmod</li>
1310 ##      </ul>
1311 ##      </p>
1312 ## </desc>
1313 ## <param name="userdomain_prefix">
1314 ##      <summary>
1315 ##      The prefix of the user domain (e.g., sysadm
1316 ##      is the prefix for sysadm_t).
1317 ##      </summary>
1318 ## </param>
1319 #
1320 template(`userdom_admin_user_template',`
1321         gen_require(`
1322                 attribute admindomain;
1323                 class passwd { passwd chfn chsh rootok crontab };
1324         ')
1325
1326         ##############################
1327         #
1328         # Declarations
1329         #
1330
1331         # Inherit rules for ordinary users.
1332         userdom_login_user_template($1)
1333         userdom_common_user_template($1)
1334
1335         domain_obj_id_change_exemption($1_t)
1336         role system_r types $1_t;
1337
1338         typeattribute $1_t admindomain;
1339
1340         ifdef(`direct_sysadm_daemon',`
1341                 domain_system_change_exemption($1_t)
1342         ')
1343
1344         ##############################
1345         #
1346         # $1_t local policy
1347         #
1348
1349         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1350         tunable_policy(`deny_ptrace',`',`
1351                 allow $1_t self:capability sys_ptrace;
1352         ')
1353         allow $1_t self:capability2 syslog;
1354         allow $1_t self:process { setexec setfscreate };
1355         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1356         allow $1_t self:tun_socket create;
1357         # Set password information for other users.
1358         allow $1_t self:passwd { passwd chfn chsh };
1359         # Skip authentication when pam_rootok is specified.
1360         allow $1_t self:passwd rootok;
1361
1362         # Manipulate other users crontab.
1363         allow $1_t self:passwd crontab;
1364
1365         kernel_read_software_raid_state($1_t)
1366         kernel_getattr_core_if($1_t)
1367         kernel_getattr_message_if($1_t)
1368         kernel_change_ring_buffer_level($1_t)
1369         kernel_clear_ring_buffer($1_t)
1370         kernel_read_ring_buffer($1_t)
1371         kernel_get_sysvipc_info($1_t)
1372         kernel_rw_all_sysctls($1_t)
1373         # signal unlabeled processes:
1374         kernel_kill_unlabeled($1_t)
1375         kernel_signal_unlabeled($1_t)
1376         kernel_sigstop_unlabeled($1_t)
1377         kernel_signull_unlabeled($1_t)
1378         kernel_sigchld_unlabeled($1_t)
1379         kernel_signal($1_t)
1380
1381         corenet_tcp_bind_generic_port($1_t)
1382         # allow setting up tunnels
1383         corenet_rw_tun_tap_dev($1_t)
1384
1385         dev_getattr_generic_blk_files($1_t)
1386         dev_getattr_generic_chr_files($1_t)
1387         # for lsof
1388         dev_getattr_mtrr_dev($1_t)
1389         # Allow MAKEDEV to work
1390         dev_create_all_blk_files($1_t)
1391         dev_create_all_chr_files($1_t)
1392         dev_delete_all_blk_files($1_t)
1393         dev_delete_all_chr_files($1_t)
1394         dev_rename_all_blk_files($1_t)
1395         dev_rename_all_chr_files($1_t)
1396         dev_create_generic_symlinks($1_t)
1397         dev_rw_generic_usb_dev($1_t)
1398         dev_rw_usbfs($1_t)
1399
1400         domain_setpriority_all_domains($1_t)
1401         domain_read_all_domains_state($1_t)
1402         domain_getattr_all_domains($1_t)
1403         domain_getcap_all_domains($1_t)
1404         domain_dontaudit_ptrace_all_domains($1_t)
1405         # signal all domains:
1406         domain_kill_all_domains($1_t)
1407         domain_signal_all_domains($1_t)
1408         domain_signull_all_domains($1_t)
1409         domain_sigstop_all_domains($1_t)
1410         domain_sigstop_all_domains($1_t)
1411         domain_sigchld_all_domains($1_t)
1412         # for lsof
1413         domain_getattr_all_sockets($1_t)
1414         domain_dontaudit_getattr_all_sockets($1_t)
1415
1416         files_exec_usr_src_files($1_t)
1417
1418         fs_getattr_all_fs($1_t)
1419         fs_getattr_all_files($1_t)
1420         fs_list_all($1_t)
1421         fs_set_all_quotas($1_t)
1422         fs_exec_noxattr($1_t)
1423
1424         storage_raw_read_removable_device($1_t)
1425         storage_raw_write_removable_device($1_t)
1426         storage_dontaudit_read_fixed_disk($1_t)
1427
1428         term_use_all_inherited_terms($1_t)
1429         term_use_unallocated_ttys($1_t)
1430
1431         auth_getattr_shadow($1_t)
1432         # Manage almost all files
1433         files_manage_non_security_dirs($1_t)
1434         files_manage_non_security_files($1_t)
1435         # Relabel almost all files
1436         files_relabel_non_security_files($1_t)
1437
1438         init_telinit($1_t)
1439
1440         logging_send_syslog_msg($1_t)
1441
1442         optional_policy(`
1443                 modutils_domtrans_insmod($1_t)
1444                 modutils_domtrans_depmod($1_t)
1445         ')
1446
1447         # The following rule is temporary until such time that a complete
1448         # policy management infrastructure is in place so that an administrator
1449         # cannot directly manipulate policy files with arbitrary programs.
1450         seutil_manage_src_policy($1_t)
1451         # Violates the goal of limiting write access to checkpolicy.
1452         # But presently necessary for installing the file_contexts file.
1453         seutil_manage_bin_policy($1_t)
1454
1455         systemd_config_all_services($1_t)
1456
1457         userdom_manage_user_home_content_dirs($1_t)
1458         userdom_manage_user_home_content_files($1_t)
1459         userdom_manage_user_home_content_symlinks($1_t)
1460         userdom_manage_user_home_content_pipes($1_t)
1461         userdom_manage_user_home_content_sockets($1_t)
1462         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1463
1464         tunable_policy(`user_rw_noexattrfile',`
1465                 fs_manage_noxattr_fs_files($1_t)
1466                 fs_manage_noxattr_fs_dirs($1_t)
1467         ',`
1468                 fs_read_noxattr_fs_files($1_t)
1469         ')
1470
1471         optional_policy(`
1472                 postgresql_unconfined($1_t)
1473         ')
1474
1475         optional_policy(`
1476                 userhelper_exec($1_t)
1477         ')
1478 ')
1479
1480 ########################################
1481 ## <summary>
1482 ##      Allow user to run as a secadm
1483 ## </summary>
1484 ## <desc>
1485 ##      <p>
1486 ##      Create objects in a user home directory
1487 ##      with an automatic type transition to
1488 ##      a specified private type.
1489 ##      </p>
1490 ##      <p>
1491 ##      This is a templated interface, and should only
1492 ##      be called from a per-userdomain template.
1493 ##      </p>
1494 ## </desc>
1495 ## <param name="domain">
1496 ##      <summary>
1497 ##      Domain allowed access.
1498 ##      </summary>
1499 ## </param>
1500 ## <param name="role">
1501 ##      <summary>
1502 ##      The role  of the object to create.
1503 ##      </summary>
1504 ## </param>
1505 #
1506 template(`userdom_security_admin_template',`
1507         allow $1 self:capability { dac_read_search dac_override };
1508
1509         corecmd_exec_shell($1)
1510
1511         domain_obj_id_change_exemption($1)
1512
1513         dev_relabel_all_dev_nodes($1)
1514
1515         files_create_boot_flag($1)
1516         files_create_default_dir($1)
1517         files_root_filetrans_default($1, dir)
1518
1519         # Necessary for managing /boot/efi
1520         fs_manage_dos_files($1)
1521
1522         mls_process_read_up($1)
1523         mls_file_read_all_levels($1)
1524         mls_file_upgrade($1)
1525         mls_file_downgrade($1)
1526
1527         selinux_set_enforce_mode($1)
1528         selinux_set_all_booleans($1)
1529         selinux_set_parameters($1)
1530         selinux_read_policy($1)
1531
1532         files_relabel_all_files($1)
1533         auth_relabel_shadow($1)
1534
1535         init_exec($1)
1536
1537         logging_send_syslog_msg($1)
1538         logging_read_audit_log($1)
1539         logging_read_generic_logs($1)
1540         logging_read_audit_config($1)
1541
1542         seutil_manage_bin_policy($1)
1543         seutil_manage_default_contexts($1)
1544         seutil_manage_file_contexts($1)
1545         seutil_manage_module_store($1)
1546         seutil_manage_config($1)
1547         seutil_run_checkpolicy($1,$2)
1548         seutil_run_loadpolicy($1,$2)
1549         seutil_run_semanage($1,$2)
1550         seutil_run_setsebool($1,$2)
1551         seutil_run_setfiles($1, $2)
1552
1553         seutil_manage_bin_policy($1)
1554     seutil_manage_default_contexts($1)
1555     seutil_manage_file_contexts($1)
1556     seutil_manage_module_store($1)
1557     seutil_manage_config($1)
1558
1559         optional_policy(`
1560                 aide_run($1,$2)
1561         ')
1562
1563         optional_policy(`
1564                 consoletype_exec($1)
1565         ')
1566
1567         optional_policy(`
1568                 dmesg_exec($1)
1569         ')
1570
1571         optional_policy(`
1572                 ipsec_run_setkey($1,$2)
1573         ')
1574
1575         optional_policy(`
1576                 netlabel_run_mgmt($1,$2)
1577         ')
1578
1579         optional_policy(`
1580                 samhain_run($1, $2)
1581         ')
1582 ')
1583
1584 ########################################
1585 ## <summary>
1586 ##      Make the specified type usable in a
1587 ##      user home directory.
1588 ## </summary>
1589 ## <param name="type">
1590 ##      <summary>
1591 ##      Type to be used as a file in the
1592 ##      user home directory.
1593 ##      </summary>
1594 ## </param>
1595 #
1596 interface(`userdom_user_home_content',`
1597         gen_require(`
1598                 type user_home_t;
1599                 attribute user_home_type;
1600         ')
1601
1602         allow $1 user_home_t:filesystem associate;
1603         files_type($1)
1604         ubac_constrained($1)
1605
1606         files_poly_member($1)
1607         typeattribute $1  user_home_type;
1608 ')
1609
1610 ########################################
1611 ## <summary>
1612 ##      Make the specified type usable in a
1613 ##      generic temporary directory.
1614 ## </summary>
1615 ## <param name="type">
1616 ##      <summary>
1617 ##      Type to be used as a file in the
1618 ##      generic temporary directory.
1619 ##      </summary>
1620 ## </param>
1621 #
1622 interface(`userdom_user_tmp_content',`
1623         gen_require(`
1624                 attribute user_tmp_type;
1625         ')
1626
1627         typeattribute $1 user_tmp_type;
1628
1629         files_tmp_file($1)
1630         ubac_constrained($1)
1631 ')
1632
1633 ########################################
1634 ## <summary>
1635 ##      Make the specified type usable in a
1636 ##      generic tmpfs_t directory.
1637 ## </summary>
1638 ## <param name="type">
1639 ##      <summary>
1640 ##      Type to be used as a file in the
1641 ##      generic temporary directory.
1642 ##      </summary>
1643 ## </param>
1644 #
1645 interface(`userdom_user_tmpfs_content',`
1646         gen_require(`
1647                 attribute user_tmpfs_type;
1648         ')
1649
1650         typeattribute $1 user_tmpfs_type;
1651
1652         files_tmpfs_file($1)
1653         ubac_constrained($1)
1654 ')
1655
1656 ########################################
1657 ## <summary>
1658 ##      Allow domain to attach to TUN devices created by administrative users.
1659 ## </summary>
1660 ## <param name="domain">
1661 ##      <summary>
1662 ##      Domain allowed access.
1663 ##      </summary>
1664 ## </param>
1665 #
1666 interface(`userdom_attach_admin_tun_iface',`
1667         gen_require(`
1668                 attribute admindomain;
1669         ')
1670
1671         allow $1 admindomain:tun_socket relabelfrom;
1672         allow $1 self:tun_socket relabelto;
1673 ')
1674
1675 ########################################
1676 ## <summary>
1677 ##      Set the attributes of a user pty.
1678 ## </summary>
1679 ## <param name="domain">
1680 ##      <summary>
1681 ##      Domain allowed access.
1682 ##      </summary>
1683 ## </param>
1684 #
1685 interface(`userdom_setattr_user_ptys',`
1686         gen_require(`
1687                 type user_devpts_t;
1688         ')
1689
1690         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1691 ')
1692
1693 ########################################
1694 ## <summary>
1695 ##      Create a user pty.
1696 ## </summary>
1697 ## <param name="domain">
1698 ##      <summary>
1699 ##      Domain allowed access.
1700 ##      </summary>
1701 ## </param>
1702 #
1703 interface(`userdom_create_user_pty',`
1704         gen_require(`
1705                 type user_devpts_t;
1706         ')
1707
1708         term_create_pty($1, user_devpts_t)
1709 ')
1710
1711 ########################################
1712 ## <summary>
1713 ##      Get the attributes of user home directories.
1714 ## </summary>
1715 ## <param name="domain">
1716 ##      <summary>
1717 ##      Domain allowed access.
1718 ##      </summary>
1719 ## </param>
1720 #
1721 interface(`userdom_getattr_user_home_dirs',`
1722         gen_require(`
1723                 type user_home_dir_t;
1724         ')
1725
1726         allow $1 user_home_dir_t:dir getattr_dir_perms;
1727         files_search_home($1)
1728 ')
1729
1730 ########################################
1731 ## <summary>
1732 ##      Do not audit attempts to get the attributes of user home directories.
1733 ## </summary>
1734 ## <param name="domain">
1735 ##      <summary>
1736 ##      Domain to not audit.
1737 ##      </summary>
1738 ## </param>
1739 #
1740 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1741         gen_require(`
1742                 type user_home_dir_t;
1743         ')
1744
1745         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1746 ')
1747
1748 ########################################
1749 ## <summary>
1750 ##      Search user home directories.
1751 ## </summary>
1752 ## <param name="domain">
1753 ##      <summary>
1754 ##      Domain allowed access.
1755 ##      </summary>
1756 ## </param>
1757 #
1758 interface(`userdom_search_user_home_dirs',`
1759         gen_require(`
1760                 type user_home_dir_t;
1761         ')
1762
1763         allow $1 user_home_dir_t:dir search_dir_perms;
1764         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1765         files_search_home($1)
1766 ')
1767
1768 ########################################
1769 ## <summary>
1770 ##      Do not audit attempts to search user home directories.
1771 ## </summary>
1772 ## <desc>
1773 ##      <p>
1774 ##      Do not audit attempts to search user home directories.
1775 ##      This will supress SELinux denial messages when the specified
1776 ##      domain is denied the permission to search these directories.
1777 ##      </p>
1778 ## </desc>
1779 ## <param name="domain">
1780 ##      <summary>
1781 ##      Domain to not audit.
1782 ##      </summary>
1783 ## </param>
1784 ## <infoflow type="none"/>
1785 #
1786 interface(`userdom_dontaudit_search_user_home_dirs',`
1787         gen_require(`
1788                 type user_home_dir_t;
1789         ')
1790
1791         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1792 ')
1793
1794 ########################################
1795 ## <summary>
1796 ##      List user home directories.
1797 ## </summary>
1798 ## <param name="domain">
1799 ##      <summary>
1800 ##      Domain allowed access.
1801 ##      </summary>
1802 ## </param>
1803 #
1804 interface(`userdom_list_user_home_dirs',`
1805         gen_require(`
1806                 type user_home_dir_t;
1807         ')
1808
1809         allow $1 user_home_dir_t:dir list_dir_perms;
1810         files_search_home($1)
1811
1812         tunable_policy(`use_nfs_home_dirs',`
1813                 fs_list_nfs($1)
1814         ')
1815
1816         tunable_policy(`use_samba_home_dirs',`
1817                 fs_list_cifs($1)
1818         ')
1819 ')
1820
1821 ########################################
1822 ## <summary>
1823 ##      Do not audit attempts to list user home subdirectories.
1824 ## </summary>
1825 ## <param name="domain">
1826 ##      <summary>
1827 ##      Domain to not audit.
1828 ##      </summary>
1829 ## </param>
1830 #
1831 interface(`userdom_dontaudit_list_user_home_dirs',`
1832         gen_require(`
1833                 type user_home_dir_t;
1834                 type user_home_t;
1835         ')
1836
1837         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1838         dontaudit $1 user_home_t:dir list_dir_perms;
1839 ')
1840
1841 ########################################
1842 ## <summary>
1843 ##      Create user home directories.
1844 ## </summary>
1845 ## <param name="domain">
1846 ##      <summary>
1847 ##      Domain allowed access.
1848 ##      </summary>
1849 ## </param>
1850 #
1851 interface(`userdom_create_user_home_dirs',`
1852         gen_require(`
1853                 type user_home_dir_t;
1854         ')
1855
1856         allow $1 user_home_dir_t:dir create_dir_perms;
1857 ')
1858
1859 ########################################
1860 ## <summary>
1861 ##      Create user home directories.
1862 ## </summary>
1863 ## <param name="domain">
1864 ##      <summary>
1865 ##      Domain allowed access.
1866 ##      </summary>
1867 ## </param>
1868 #
1869 interface(`userdom_manage_user_home_dirs',`
1870         gen_require(`
1871                 type user_home_dir_t;
1872         ')
1873
1874         allow $1 user_home_dir_t:dir manage_dir_perms;
1875 ')
1876
1877 ########################################
1878 ## <summary>
1879 ##      Relabel to user home directories.
1880 ## </summary>
1881 ## <param name="domain">
1882 ##      <summary>
1883 ##      Domain allowed access.
1884 ##      </summary>
1885 ## </param>
1886 #
1887 interface(`userdom_relabelto_user_home_dirs',`
1888         gen_require(`
1889                 type user_home_dir_t;
1890         ')
1891
1892         allow $1 user_home_dir_t:dir relabelto;
1893 ')
1894
1895
1896 ########################################
1897 ## <summary>
1898 ##      Relabel to user home files.
1899 ## </summary>
1900 ## <param name="domain">
1901 ##      <summary>
1902 ##      Domain allowed access.
1903 ##      </summary>
1904 ## </param>
1905 #
1906 interface(`userdom_relabelto_user_home_files',`
1907         gen_require(`
1908                 type user_home_t;
1909         ')
1910
1911         allow $1 user_home_t:file relabelto;
1912 ')
1913 ########################################
1914 ## <summary>
1915 ##      Relabel user home files.
1916 ## </summary>
1917 ## <param name="domain">
1918 ##      <summary>
1919 ##      Domain allowed access.
1920 ##      </summary>
1921 ## </param>
1922 #
1923 interface(`userdom_relabel_user_home_files',`
1924         gen_require(`
1925                 type user_home_t;
1926         ')
1927
1928         allow $1 user_home_t:file relabel_file_perms;
1929 ')
1930
1931 ########################################
1932 ## <summary>
1933 ##      Create directories in the home dir root with
1934 ##      the user home directory type.
1935 ## </summary>
1936 ## <param name="domain">
1937 ##      <summary>
1938 ##      Domain allowed access.
1939 ##      </summary>
1940 ## </param>
1941 #
1942 interface(`userdom_home_filetrans_user_home_dir',`
1943         gen_require(`
1944                 type user_home_dir_t;
1945         ')
1946
1947         files_home_filetrans($1, user_home_dir_t, dir)
1948 ')
1949
1950 ########################################
1951 ## <summary>
1952 ##      Do a domain transition to the specified
1953 ##      domain when executing a program in the
1954 ##      user home directory.
1955 ## </summary>
1956 ## <desc>
1957 ##      <p>
1958 ##      Do a domain transition to the specified
1959 ##      domain when executing a program in the
1960 ##      user home directory.
1961 ##      </p>
1962 ##      <p>
1963 ##      No interprocess communication (signals, pipes,
1964 ##      etc.) is provided by this interface since
1965 ##      the domains are not owned by this module.
1966 ##      </p>
1967 ## </desc>
1968 ## <param name="source_domain">
1969 ##      <summary>
1970 ##      Domain allowed to transition.
1971 ##      </summary>
1972 ## </param>
1973 ## <param name="target_domain">
1974 ##      <summary>
1975 ##      Domain to transition to.
1976 ##      </summary>
1977 ## </param>
1978 #
1979 interface(`userdom_user_home_domtrans',`
1980         gen_require(`
1981                 type user_home_dir_t, user_home_t;
1982         ')
1983
1984         domain_auto_trans($1, user_home_t, $2)
1985         allow $1 user_home_dir_t:dir search_dir_perms;
1986         files_search_home($1)
1987 ')
1988
1989 ########################################
1990 ## <summary>
1991 ##      Do not audit attempts to search user home content directories.
1992 ## </summary>
1993 ## <param name="domain">
1994 ##      <summary>
1995 ##      Domain to not audit.
1996 ##      </summary>
1997 ## </param>
1998 #
1999 interface(`userdom_dontaudit_search_user_home_content',`
2000         gen_require(`
2001                 type user_home_t;
2002         ')
2003
2004         dontaudit $1 user_home_t:dir search_dir_perms;
2005         fs_dontaudit_list_nfs($1)
2006         fs_dontaudit_list_cifs($1)
2007 ')
2008
2009 ########################################
2010 ## <summary>
2011 ##      List contents of users home directory.
2012 ## </summary>
2013 ## <param name="domain">
2014 ##      <summary>
2015 ##      Domain allowed access.
2016 ##      </summary>
2017 ## </param>
2018 #
2019 interface(`userdom_list_user_home_content',`
2020         gen_require(`
2021                 type user_home_dir_t;
2022                 attribute user_home_type;
2023         ')
2024
2025         files_list_home($1)
2026         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2027 ')
2028
2029 ########################################
2030 ## <summary>
2031 ##      Create, read, write, and delete directories
2032 ##      in a user home subdirectory.
2033 ## </summary>
2034 ## <param name="domain">
2035 ##      <summary>
2036 ##      Domain allowed access.
2037 ##      </summary>
2038 ## </param>
2039 #
2040 interface(`userdom_manage_user_home_content_dirs',`
2041         gen_require(`
2042                 type user_home_dir_t, user_home_t;
2043         ')
2044
2045         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2046         files_search_home($1)
2047 ')
2048
2049 ########################################
2050 ## <summary>
2051 ##      Delete directories in a user home subdirectory.
2052 ## </summary>
2053 ## <param name="domain">
2054 ##      <summary>
2055 ##      Domain allowed access.
2056 ##      </summary>
2057 ## </param>
2058 #
2059 interface(`userdom_delete_user_home_content_dirs',`
2060         gen_require(`
2061                 type user_home_t;
2062         ')
2063
2064         allow $1 user_home_t:dir delete_dir_perms;
2065 ')
2066
2067 ########################################
2068 ## <summary>
2069 ##      Delete all directories in a user home subdirectory.
2070 ## </summary>
2071 ## <param name="domain">
2072 ##      <summary>
2073 ##      Domain allowed access.
2074 ##      </summary>
2075 ## </param>
2076 #
2077 interface(`userdom_delete_all_user_home_content_dirs',`
2078         gen_require(`
2079                 attribute user_home_type;
2080         ')
2081
2082         allow $1 user_home_type:dir delete_dir_perms;
2083 ')
2084
2085 ########################################
2086 ## <summary>
2087 ##      Set the attributes of user home files.
2088 ## </summary>
2089 ## <param name="domain">
2090 ##      <summary>
2091 ##      Domain allowed access.
2092 ##      </summary>
2093 ## </param>
2094 ## <rolecap/>
2095 #
2096 interface(`userdom_setattr_user_home_content_files',`
2097         gen_require(`
2098                 type user_home_t;
2099         ')
2100
2101         allow $1 user_home_t:file setattr;
2102 ')
2103
2104 ########################################
2105 ## <summary>
2106 ##      Do not audit attempts to set the
2107 ##      attributes of user home files.
2108 ## </summary>
2109 ## <param name="domain">
2110 ##      <summary>
2111 ##      Domain to not audit.
2112 ##      </summary>
2113 ## </param>
2114 #
2115 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2116         gen_require(`
2117                 type user_home_t;
2118         ')
2119
2120         dontaudit $1 user_home_t:file setattr_file_perms;
2121 ')
2122
2123 ########################################
2124 ## <summary>
2125 ##      Set the attributes of all user home directories.
2126 ## </summary>
2127 ## <param name="domain">
2128 ##      <summary>
2129 ##      Domain allowed access.
2130 ##      </summary>
2131 ## </param>
2132 ## <rolecap/>
2133 #
2134 interface(`userdom_setattr_all_user_home_content_dirs',`
2135         gen_require(`
2136                 attribute user_home_type;
2137         ')
2138
2139         allow $1 user_home_type:dir setattr_dir_perms;
2140 ')
2141
2142 ########################################
2143 ## <summary>
2144 ##      Mmap user home files.
2145 ## </summary>
2146 ## <param name="domain">
2147 ##      <summary>
2148 ##      Domain allowed access.
2149 ##      </summary>
2150 ## </param>
2151 #
2152 interface(`userdom_mmap_user_home_content_files',`
2153         gen_require(`
2154                 type user_home_dir_t, user_home_t;
2155         ')
2156
2157         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2158         files_search_home($1)
2159 ')
2160
2161 ########################################
2162 ## <summary>
2163 ##      Read user home files.
2164 ## </summary>
2165 ## <param name="domain">
2166 ##      <summary>
2167 ##      Domain allowed access.
2168 ##      </summary>
2169 ## </param>
2170 #
2171 interface(`userdom_read_user_home_content_files',`
2172         gen_require(`
2173                 type user_home_dir_t, user_home_t;
2174         ')
2175
2176         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2177         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2178         files_search_home($1)
2179 ')
2180
2181 ########################################
2182 ## <summary>
2183 ##      Do not audit attempts to getattr user home files.
2184 ## </summary>
2185 ## <param name="domain">
2186 ##      <summary>
2187 ##      Domain to not audit.
2188 ##      </summary>
2189 ## </param>
2190 #
2191 interface(`userdom_dontaudit_getattr_user_home_content',`
2192         gen_require(`
2193                 attribute user_home_type;
2194         ')
2195
2196         dontaudit $1 user_home_type:dir getattr;
2197         dontaudit $1 user_home_type:file getattr;
2198 ')
2199
2200 ########################################
2201 ## <summary>
2202 ##      Do not audit attempts to read user home files.
2203 ## </summary>
2204 ## <param name="domain">
2205 ##      <summary>
2206 ##      Domain to not audit.
2207 ##      </summary>
2208 ## </param>
2209 #
2210 interface(`userdom_dontaudit_read_user_home_content_files',`
2211         gen_require(`
2212                 attribute user_home_type;
2213                 type user_home_dir_t;
2214         ')
2215
2216         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2217         dontaudit $1 user_home_type:dir list_dir_perms;
2218         dontaudit $1 user_home_type:file read_file_perms;
2219         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2220 ')
2221
2222 ########################################
2223 ## <summary>
2224 ##      Do not audit attempts to append user home files.
2225 ## </summary>
2226 ## <param name="domain">
2227 ##      <summary>
2228 ##      Domain to not audit.
2229 ##      </summary>
2230 ## </param>
2231 #
2232 interface(`userdom_dontaudit_append_user_home_content_files',`
2233         gen_require(`
2234                 type user_home_t;
2235         ')
2236
2237         dontaudit $1 user_home_t:file append_file_perms;
2238 ')
2239
2240 ########################################
2241 ## <summary>
2242 ##      Do not audit attempts to write user home files.
2243 ## </summary>
2244 ## <param name="domain">
2245 ##      <summary>
2246 ##      Domain to not audit.
2247 ##      </summary>
2248 ## </param>
2249 #
2250 interface(`userdom_dontaudit_write_user_home_content_files',`
2251         gen_require(`
2252                 type user_home_t;
2253         ')
2254
2255         dontaudit $1 user_home_t:file write_file_perms;
2256 ')
2257
2258 ########################################
2259 ## <summary>
2260 ##      Delete files in a user home subdirectory.
2261 ## </summary>
2262 ## <param name="domain">
2263 ##      <summary>
2264 ##      Domain allowed access.
2265 ##      </summary>
2266 ## </param>
2267 #
2268 interface(`userdom_delete_user_home_content_files',`
2269         gen_require(`
2270                 type user_home_t;
2271         ')
2272
2273         allow $1 user_home_t:file delete_file_perms;
2274 ')
2275
2276 ########################################
2277 ## <summary>
2278 ##      Delete all files in a user home subdirectory.
2279 ## </summary>
2280 ## <param name="domain">
2281 ##      <summary>
2282 ##      Domain allowed access.
2283 ##      </summary>
2284 ## </param>
2285 #
2286 interface(`userdom_delete_all_user_home_content_files',`
2287         gen_require(`
2288                 attribute user_home_type;
2289         ')
2290
2291         allow $1 user_home_type:file delete_file_perms;
2292 ')
2293
2294 ########################################
2295 ## <summary>
2296 ##      Delete sock files in a user home subdirectory.
2297 ## </summary>
2298 ## <param name="domain">
2299 ##      <summary>
2300 ##      Domain allowed access.
2301 ##      </summary>
2302 ## </param>
2303 #
2304 interface(`userdom_delete_user_home_content_sock_files',`
2305         gen_require(`
2306                 type user_home_t;
2307         ')
2308
2309         allow $1 user_home_t:sock_file delete_file_perms;
2310 ')
2311
2312 ########################################
2313 ## <summary>
2314 ##      Delete all sock files in a user home subdirectory.
2315 ## </summary>
2316 ## <param name="domain">
2317 ##      <summary>
2318 ##      Domain allowed access.
2319 ##      </summary>
2320 ## </param>
2321 #
2322 interface(`userdom_delete_all_user_home_content_sock_files',`
2323         gen_require(`
2324                 attribute user_home_type;
2325         ')
2326
2327         allow $1 user_home_type:sock_file delete_file_perms;
2328 ')
2329
2330 ########################################
2331 ## <summary>
2332 ##      Do not audit attempts to write user home files.
2333 ## </summary>
2334 ## <param name="domain">
2335 ##      <summary>
2336 ##      Domain to not audit.
2337 ##      </summary>
2338 ## </param>
2339 #
2340 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2341         gen_require(`
2342                 type user_home_t;
2343         ')
2344
2345         dontaudit $1 user_home_t:file relabel_file_perms;
2346 ')
2347
2348 ########################################
2349 ## <summary>
2350 ##      Read user home subdirectory symbolic links.
2351 ## </summary>
2352 ## <param name="domain">
2353 ##      <summary>
2354 ##      Domain allowed access.
2355 ##      </summary>
2356 ## </param>
2357 #
2358 interface(`userdom_read_user_home_content_symlinks',`
2359         gen_require(`
2360                 type user_home_dir_t, user_home_t;
2361         ')
2362
2363         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2364 ')
2365
2366 ########################################
2367 ## <summary>
2368 ##      Execute user home files.
2369 ## </summary>
2370 ## <param name="domain">
2371 ##      <summary>
2372 ##      Domain allowed access.
2373 ##      </summary>
2374 ## </param>
2375 ## <rolecap/>
2376 #
2377 interface(`userdom_exec_user_home_content_files',`
2378         gen_require(`
2379                 type user_home_dir_t;
2380                 attribute user_home_type;
2381         ')
2382
2383         files_search_home($1)
2384         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2385         dontaudit $1 user_home_type:sock_file execute;
2386         ')
2387
2388 ########################################
2389 ## <summary>
2390 ##      Do not audit attempts to execute user home files.
2391 ## </summary>
2392 ## <param name="domain">
2393 ##      <summary>
2394 ##      Domain to not audit.
2395 ##      </summary>
2396 ## </param>
2397 #
2398 interface(`userdom_dontaudit_exec_user_home_content_files',`
2399         gen_require(`
2400                 type user_home_t;
2401         ')
2402
2403         dontaudit $1 user_home_t:file exec_file_perms;
2404 ')
2405
2406 ########################################
2407 ## <summary>
2408 ##      Create, read, write, and delete files
2409 ##      in a user home subdirectory.
2410 ## </summary>
2411 ## <param name="domain">
2412 ##      <summary>
2413 ##      Domain allowed access.
2414 ##      </summary>
2415 ## </param>
2416 #
2417 interface(`userdom_manage_user_home_content_files',`
2418         gen_require(`
2419                 type user_home_dir_t, user_home_t;
2420         ')
2421
2422         manage_files_pattern($1, user_home_t, user_home_t)
2423         allow $1 user_home_dir_t:dir search_dir_perms;
2424         files_search_home($1)
2425 ')
2426
2427 ########################################
2428 ## <summary>
2429 ##      Do not audit attempts to create, read, write, and delete directories
2430 ##      in a user home subdirectory.
2431 ## </summary>
2432 ## <param name="domain">
2433 ##      <summary>
2434 ##      Domain to not audit.
2435 ##      </summary>
2436 ## </param>
2437 #
2438 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2439         gen_require(`
2440                 type user_home_dir_t, user_home_t;
2441         ')
2442
2443         dontaudit $1 user_home_t:dir manage_dir_perms;
2444 ')
2445
2446 ########################################
2447 ## <summary>
2448 ##      Create, read, write, and delete symbolic links
2449 ##      in a user home subdirectory.
2450 ## </summary>
2451 ## <param name="domain">
2452 ##      <summary>
2453 ##      Domain allowed access.
2454 ##      </summary>
2455 ## </param>
2456 #
2457 interface(`userdom_manage_user_home_content_symlinks',`
2458         gen_require(`
2459                 type user_home_dir_t, user_home_t;
2460         ')
2461
2462         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2463         allow $1 user_home_dir_t:dir search_dir_perms;
2464         files_search_home($1)
2465 ')
2466
2467 ########################################
2468 ## <summary>
2469 ##      Delete symbolic links in a user home directory.
2470 ## </summary>
2471 ## <param name="domain">
2472 ##      <summary>
2473 ##      Domain allowed access.
2474 ##      </summary>
2475 ## </param>
2476 #
2477 interface(`userdom_delete_user_home_content_symlinks',`
2478         gen_require(`
2479                 type user_home_t;
2480         ')
2481
2482         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2483 ')
2484
2485 ########################################
2486 ## <summary>
2487 ##      Delete all symbolic links in a user home directory.
2488 ## </summary>
2489 ## <param name="domain">
2490 ##      <summary>
2491 ##      Domain allowed access.
2492 ##      </summary>
2493 ## </param>
2494 #
2495 interface(`userdom_delete_all_user_home_content_symlinks',`
2496         gen_require(`
2497                 attribute user_home_type;
2498         ')
2499
2500         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2501 ')
2502
2503 ########################################
2504 ## <summary>
2505 ##      Create, read, write, and delete named pipes
2506 ##      in a user home subdirectory.
2507 ## </summary>
2508 ## <param name="domain">
2509 ##      <summary>
2510 ##      Domain allowed access.
2511 ##      </summary>
2512 ## </param>
2513 #
2514 interface(`userdom_manage_user_home_content_pipes',`
2515         gen_require(`
2516                 type user_home_dir_t, user_home_t;
2517         ')
2518
2519         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2520         allow $1 user_home_dir_t:dir search_dir_perms;
2521         files_search_home($1)
2522 ')
2523
2524 ########################################
2525 ## <summary>
2526 ##      Create, read, write, and delete named sockets
2527 ##      in a user home subdirectory.
2528 ## </summary>
2529 ## <param name="domain">
2530 ##      <summary>
2531 ##      Domain allowed access.
2532 ##      </summary>
2533 ## </param>
2534 #
2535 interface(`userdom_manage_user_home_content_sockets',`
2536         gen_require(`
2537                 type user_home_dir_t, user_home_t;
2538         ')
2539
2540         allow $1 user_home_dir_t:dir search_dir_perms;
2541         manage_sock_files_pattern($1, user_home_t, user_home_t)
2542         files_search_home($1)
2543 ')
2544
2545 ########################################
2546 ## <summary>
2547 ##      Create objects in a user home directory
2548 ##      with an automatic type transition to
2549 ##      a specified private type.
2550 ## </summary>
2551 ## <param name="domain">
2552 ##      <summary>
2553 ##      Domain allowed access.
2554 ##      </summary>
2555 ## </param>
2556 ## <param name="private_type">
2557 ##      <summary>
2558 ##      The type of the object to create.
2559 ##      </summary>
2560 ## </param>
2561 ## <param name="object_class">
2562 ##      <summary>
2563 ##      The class of the object to be created.
2564 ##      </summary>
2565 ## </param>
2566 #
2567 interface(`userdom_user_home_dir_filetrans',`
2568         gen_require(`
2569                 type user_home_dir_t;
2570         ')
2571
2572         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2573         files_search_home($1)
2574 ')
2575
2576 ########################################
2577 ## <summary>
2578 ##      Create objects in a user home directory
2579 ##      with an automatic type transition to
2580 ##      a specified private type.
2581 ## </summary>
2582 ## <param name="domain">
2583 ##      <summary>
2584 ##      Domain allowed access.
2585 ##      </summary>
2586 ## </param>
2587 ## <param name="private_type">
2588 ##      <summary>
2589 ##      The type of the object to create.
2590 ##      </summary>
2591 ## </param>
2592 ## <param name="object_class">
2593 ##      <summary>
2594 ##      The class of the object to be created.
2595 ##      </summary>
2596 ## </param>
2597 #
2598 interface(`userdom_user_home_content_filetrans',`
2599         gen_require(`
2600                 type user_home_dir_t, user_home_t;
2601         ')
2602
2603         filetrans_pattern($1, user_home_t, $2, $3, $4)
2604         allow $1 user_home_dir_t:dir search_dir_perms;
2605         files_search_home($1)
2606 ')
2607
2608 ########################################
2609 ## <summary>
2610 ##      Create objects in a user home directory
2611 ##      with an automatic type transition to
2612 ##      the user home file type.
2613 ## </summary>
2614 ## <param name="domain">
2615 ##      <summary>
2616 ##      Domain allowed access.
2617 ##      </summary>
2618 ## </param>
2619 ## <param name="object_class">
2620 ##      <summary>
2621 ##      The class of the object to be created.
2622 ##      </summary>
2623 ## </param>
2624 #
2625 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2626         gen_require(`
2627                 type user_home_dir_t, user_home_t;
2628         ')
2629
2630         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2631         files_search_home($1)
2632 ')
2633
2634 ########################################
2635 ## <summary>
2636 ##      Write to user temporary named sockets.
2637 ## </summary>
2638 ## <param name="domain">
2639 ##      <summary>
2640 ##      Domain allowed access.
2641 ##      </summary>
2642 ## </param>
2643 #
2644 interface(`userdom_write_user_tmp_sockets',`
2645         gen_require(`
2646                 type user_tmp_t;
2647         ')
2648
2649         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2650         files_search_tmp($1)
2651 ')
2652
2653 ########################################
2654 ## <summary>
2655 ##      List user temporary directories.
2656 ## </summary>
2657 ## <param name="domain">
2658 ##      <summary>
2659 ##      Domain allowed access.
2660 ##      </summary>
2661 ## </param>
2662 #
2663 interface(`userdom_list_user_tmp',`
2664         gen_require(`
2665                 type user_tmp_t;
2666         ')
2667
2668         allow $1 user_tmp_t:dir list_dir_perms;
2669         files_search_tmp($1)
2670 ')
2671
2672 ########################################
2673 ## <summary>
2674 ##      Do not audit attempts to list user
2675 ##      temporary directories.
2676 ## </summary>
2677 ## <param name="domain">
2678 ##      <summary>
2679 ##      Domain to not audit.
2680 ##      </summary>
2681 ## </param>
2682 #
2683 interface(`userdom_dontaudit_list_user_tmp',`
2684         gen_require(`
2685                 type user_tmp_t;
2686         ')
2687
2688         dontaudit $1 user_tmp_t:dir list_dir_perms;
2689 ')
2690
2691 ########################################
2692 ## <summary>
2693 ##      Do not audit attempts to manage users
2694 ##      temporary directories.
2695 ## </summary>
2696 ## <param name="domain">
2697 ##      <summary>
2698 ##      Domain to not audit.
2699 ##      </summary>
2700 ## </param>
2701 #
2702 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2703         gen_require(`
2704                 type user_tmp_t;
2705         ')
2706
2707         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2708 ')
2709
2710 ########################################
2711 ## <summary>
2712 ##      Read user temporary files.
2713 ## </summary>
2714 ## <param name="domain">
2715 ##      <summary>
2716 ##      Domain allowed access.
2717 ##      </summary>
2718 ## </param>
2719 #
2720 interface(`userdom_read_user_tmp_files',`
2721         gen_require(`
2722                 type user_tmp_t;
2723         ')
2724
2725         read_files_pattern($1, user_tmp_t, user_tmp_t)
2726         allow $1 user_tmp_t:dir list_dir_perms;
2727         files_search_tmp($1)
2728 ')
2729
2730 ########################################
2731 ## <summary>
2732 ##      Do not audit attempts to read users
2733 ##      temporary files.
2734 ## </summary>
2735 ## <param name="domain">
2736 ##      <summary>
2737 ##      Domain to not audit.
2738 ##      </summary>
2739 ## </param>
2740 #
2741 interface(`userdom_dontaudit_read_user_tmp_files',`
2742         gen_require(`
2743                 type user_tmp_t;
2744         ')
2745
2746         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2747 ')
2748
2749 ########################################
2750 ## <summary>
2751 ##      Do not audit attempts to append users
2752 ##      temporary files.
2753 ## </summary>
2754 ## <param name="domain">
2755 ##      <summary>
2756 ##      Domain to not audit.
2757 ##      </summary>
2758 ## </param>
2759 #
2760 interface(`userdom_dontaudit_append_user_tmp_files',`
2761         gen_require(`
2762                 type user_tmp_t;
2763         ')
2764
2765         dontaudit $1 user_tmp_t:file append_file_perms;
2766 ')
2767
2768 ########################################
2769 ## <summary>
2770 ##      Read and write user temporary files.
2771 ## </summary>
2772 ## <param name="domain">
2773 ##      <summary>
2774 ##      Domain allowed access.
2775 ##      </summary>
2776 ## </param>
2777 #
2778 interface(`userdom_rw_user_tmp_files',`
2779         gen_require(`
2780                 type user_tmp_t;
2781         ')
2782
2783         allow $1 user_tmp_t:dir list_dir_perms;
2784         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2785         files_search_tmp($1)
2786 ')
2787
2788 ########################################
2789 ## <summary>
2790 ##      Do not audit attempts to manage users
2791 ##      temporary files.
2792 ## </summary>
2793 ## <param name="domain">
2794 ##      <summary>
2795 ##      Domain to not audit.
2796 ##      </summary>
2797 ## </param>
2798 #
2799 interface(`userdom_dontaudit_manage_user_tmp_files',`
2800         gen_require(`
2801                 type user_tmp_t;
2802         ')
2803
2804         dontaudit $1 user_tmp_t:file manage_file_perms;
2805 ')
2806
2807 ########################################
2808 ## <summary>
2809 ##      Read user temporary symbolic links.
2810 ## </summary>
2811 ## <param name="domain">
2812 ##      <summary>
2813 ##      Domain allowed access.
2814 ##      </summary>
2815 ## </param>
2816 #
2817 interface(`userdom_read_user_tmp_symlinks',`
2818         gen_require(`
2819                 type user_tmp_t;
2820         ')
2821
2822         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2823         allow $1 user_tmp_t:dir list_dir_perms;
2824         files_search_tmp($1)
2825 ')
2826
2827 ########################################
2828 ## <summary>
2829 ##      Create, read, write, and delete user
2830 ##      temporary directories.
2831 ## </summary>
2832 ## <param name="domain">
2833 ##      <summary>
2834 ##      Domain allowed access.
2835 ##      </summary>
2836 ## </param>
2837 #
2838 interface(`userdom_manage_user_tmp_dirs',`
2839         gen_require(`
2840                 type user_tmp_t;
2841         ')
2842
2843         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2844         files_search_tmp($1)
2845 ')
2846
2847 ########################################
2848 ## <summary>
2849 ##      Create, read, write, and delete user
2850 ##      temporary files.
2851 ## </summary>
2852 ## <param name="domain">
2853 ##      <summary>
2854 ##      Domain allowed access.
2855 ##      </summary>
2856 ## </param>
2857 #
2858 interface(`userdom_manage_user_tmp_files',`
2859         gen_require(`
2860                 type user_tmp_t;
2861         ')
2862
2863         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2864         files_search_tmp($1)
2865 ')
2866
2867 ########################################
2868 ## <summary>
2869 ##      Create, read, write, and delete user
2870 ##      temporary symbolic links.
2871 ## </summary>
2872 ## <param name="domain">
2873 ##      <summary>
2874 ##      Domain allowed access.
2875 ##      </summary>
2876 ## </param>
2877 #
2878 interface(`userdom_manage_user_tmp_symlinks',`
2879         gen_require(`
2880                 type user_tmp_t;
2881         ')
2882
2883         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2884         files_search_tmp($1)
2885 ')
2886
2887 ########################################
2888 ## <summary>
2889 ##      Create, read, write, and delete user
2890 ##      temporary named pipes.
2891 ## </summary>
2892 ## <param name="domain">
2893 ##      <summary>
2894 ##      Domain allowed access.
2895 ##      </summary>
2896 ## </param>
2897 #
2898 interface(`userdom_manage_user_tmp_pipes',`
2899         gen_require(`
2900                 type user_tmp_t;
2901         ')
2902
2903         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2904         files_search_tmp($1)
2905 ')
2906
2907 ########################################
2908 ## <summary>
2909 ##      Create, read, write, and delete user
2910 ##      temporary named sockets.
2911 ## </summary>
2912 ## <param name="domain">
2913 ##      <summary>
2914 ##      Domain allowed access.
2915 ##      </summary>
2916 ## </param>
2917 #
2918 interface(`userdom_manage_user_tmp_sockets',`
2919         gen_require(`
2920                 type user_tmp_t;
2921         ')
2922
2923         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2924         files_search_tmp($1)
2925 ')
2926
2927 ########################################
2928 ## <summary>
2929 ##      Create objects in a user temporary directory
2930 ##      with an automatic type transition to
2931 ##      a specified private type.
2932 ## </summary>
2933 ## <param name="domain">
2934 ##      <summary>
2935 ##      Domain allowed access.
2936 ##      </summary>
2937 ## </param>
2938 ## <param name="private_type">
2939 ##      <summary>
2940 ##      The type of the object to create.
2941 ##      </summary>
2942 ## </param>
2943 ## <param name="object_class">
2944 ##      <summary>
2945 ##      The class of the object to be created.
2946 ##      </summary>
2947 ## </param>
2948 #
2949 interface(`userdom_user_tmp_filetrans',`
2950         gen_require(`
2951                 type user_tmp_t;
2952         ')
2953
2954         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2955         files_search_tmp($1)
2956 ')
2957
2958 ########################################
2959 ## <summary>
2960 ##      Create objects in the temporary directory
2961 ##      with an automatic type transition to
2962 ##      the user temporary type.
2963 ## </summary>
2964 ## <param name="domain">
2965 ##      <summary>
2966 ##      Domain allowed access.
2967 ##      </summary>
2968 ## </param>
2969 ## <param name="object_class">
2970 ##      <summary>
2971 ##      The class of the object to be created.
2972 ##      </summary>
2973 ## </param>
2974 #
2975 interface(`userdom_tmp_filetrans_user_tmp',`
2976         gen_require(`
2977                 type user_tmp_t;
2978         ')
2979
2980         files_tmp_filetrans($1, user_tmp_t, $2)
2981 ')
2982
2983 #######################################
2984 ## <summary>
2985 ##  Getattr user tmpfs files.
2986 ## </summary>
2987 ## <param name="domain">
2988 ##  <summary>
2989 ##  Domain allowed access.
2990 ##  </summary>
2991 ## </param>
2992 #
2993 interface(`userdom_getattr_user_tmpfs_files',`
2994     gen_require(`
2995         type user_tmpfs_t;
2996     ')
2997
2998     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2999     fs_search_tmpfs($1)
3000 ')
3001
3002 ########################################
3003 ## <summary>
3004 ##      Read user tmpfs files.
3005 ## </summary>
3006 ## <param name="domain">
3007 ##      <summary>
3008 ##      Domain allowed access.
3009 ##      </summary>
3010 ## </param>
3011 #
3012 interface(`userdom_read_user_tmpfs_files',`
3013         gen_require(`
3014                 type user_tmpfs_t;
3015         ')
3016
3017         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3018         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3019         allow $1 user_tmpfs_t:dir list_dir_perms;
3020         fs_search_tmpfs($1)
3021 ')
3022
3023 ########################################
3024 ## <summary>
3025 ##      Read/Write user tmpfs files.
3026 ## </summary>
3027 ## <param name="domain">
3028 ##      <summary>
3029 ##      Domain allowed access.
3030 ##      </summary>
3031 ## </param>
3032 #
3033 interface(`userdom_rw_user_tmpfs_files',`
3034         gen_require(`
3035                 type user_tmpfs_t;
3036         ')
3037
3038         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3039         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3040         allow $1 user_tmpfs_t:dir list_dir_perms;
3041         fs_search_tmpfs($1)
3042 ')
3043
3044 ########################################
3045 ## <summary>
3046 ##      Read/Write inherited user tmpfs files.
3047 ## </summary>
3048 ## <param name="domain">
3049 ##      <summary>
3050 ##      Domain allowed access.
3051 ##      </summary>
3052 ## </param>
3053 #
3054 interface(`userdom_rw_inherited_user_tmpfs_files',`
3055         gen_require(`
3056                 type user_tmpfs_t;
3057         ')
3058
3059         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3060 ')
3061
3062 ########################################
3063 ## <summary>
3064 ##      Execute user tmpfs files.
3065 ## </summary>
3066 ## <param name="domain">
3067 ##      <summary>
3068 ##      Domain allowed access.
3069 ##      </summary>
3070 ## </param>
3071 #
3072 interface(`userdom_execute_user_tmpfs_files',`
3073         gen_require(`
3074                 type user_tmpfs_t;
3075         ')
3076
3077         allow $1 user_tmpfs_t:file execute;
3078 ')
3079
3080 ########################################
3081 ## <summary>
3082 ##      Get the attributes of a user domain tty.
3083 ## </summary>
3084 ## <param name="domain">
3085 ##      <summary>
3086 ##      Domain allowed access.
3087 ##      </summary>
3088 ## </param>
3089 #
3090 interface(`userdom_getattr_user_ttys',`
3091         gen_require(`
3092                 type user_tty_device_t;
3093         ')
3094
3095         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3096 ')
3097
3098 ########################################
3099 ## <summary>
3100 ##      Do not audit attempts to get the attributes of a user domain tty.
3101 ## </summary>
3102 ## <param name="domain">
3103 ##      <summary>
3104 ##      Domain to not audit.
3105 ##      </summary>
3106 ## </param>
3107 #
3108 interface(`userdom_dontaudit_getattr_user_ttys',`
3109         gen_require(`
3110                 type user_tty_device_t;
3111         ')
3112
3113         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3114 ')
3115
3116 ########################################
3117 ## <summary>
3118 ##      Set the attributes of a user domain tty.
3119 ## </summary>
3120 ## <param name="domain">
3121 ##      <summary>
3122 ##      Domain allowed access.
3123 ##      </summary>
3124 ## </param>
3125 #
3126 interface(`userdom_setattr_user_ttys',`
3127         gen_require(`
3128                 type user_tty_device_t;
3129         ')
3130
3131         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3132 ')
3133
3134 ########################################
3135 ## <summary>
3136 ##      Do not audit attempts to set the attributes of a user domain tty.
3137 ## </summary>
3138 ## <param name="domain">
3139 ##      <summary>
3140 ##      Domain to not audit.
3141 ##      </summary>
3142 ## </param>
3143 #
3144 interface(`userdom_dontaudit_setattr_user_ttys',`
3145         gen_require(`
3146                 type user_tty_device_t;
3147         ')
3148
3149         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3150 ')
3151
3152 ########################################
3153 ## <summary>
3154 ##      Read and write a user domain tty.
3155 ## </summary>
3156 ## <param name="domain">
3157 ##      <summary>
3158 ##      Domain allowed access.
3159 ##      </summary>
3160 ## </param>
3161 #
3162 interface(`userdom_use_user_ttys',`
3163         gen_require(`
3164                 type user_tty_device_t;
3165         ')
3166
3167         allow $1 user_tty_device_t:chr_file rw_term_perms;
3168 ')
3169
3170 ########################################
3171 ## <summary>
3172 ##      Read and write a inherited user domain tty.
3173 ## </summary>
3174 ## <param name="domain">
3175 ##      <summary>
3176 ##      Domain allowed access.
3177 ##      </summary>
3178 ## </param>
3179 #
3180 interface(`userdom_use_inherited_user_ttys',`
3181         gen_require(`
3182                 type user_tty_device_t;
3183         ')
3184
3185         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3186 ')
3187
3188 ########################################
3189 ## <summary>
3190 ##      Read and write a user domain pty.
3191 ## </summary>
3192 ## <param name="domain">
3193 ##      <summary>
3194 ##      Domain allowed access.
3195 ##      </summary>
3196 ## </param>
3197 #
3198 interface(`userdom_use_user_ptys',`
3199         gen_require(`
3200                 type user_devpts_t;
3201         ')
3202
3203         allow $1 user_devpts_t:chr_file rw_term_perms;
3204 ')
3205
3206 ########################################
3207 ## <summary>
3208 ##      Read and write a inherited user domain pty.
3209 ## </summary>
3210 ## <param name="domain">
3211 ##      <summary>
3212 ##      Domain allowed access.
3213 ##      </summary>
3214 ## </param>
3215 #
3216 interface(`userdom_use_inherited_user_ptys',`
3217         gen_require(`
3218                 type user_devpts_t;
3219         ')
3220
3221         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3222 ')
3223
3224 ########################################
3225 ## <summary>
3226 ##      Read and write a inherited user TTYs and PTYs.
3227 ## </summary>
3228 ## <desc>
3229 ##      <p>
3230 ##      Allow the specified domain to read and write inherited user
3231 ##      TTYs and PTYs. This will allow the domain to
3232 ##      interact with the user via the terminal. Typically
3233 ##      all interactive applications will require this
3234 ##      access.
3235 ##      </p>
3236 ## </desc>
3237 ## <param name="domain">
3238 ##      <summary>
3239 ##      Domain allowed access.
3240 ##      </summary>
3241 ## </param>
3242 ## <infoflow type="both" weight="10"/>
3243 #
3244 interface(`userdom_use_inherited_user_terminals',`
3245         gen_require(`
3246                 type user_tty_device_t, user_devpts_t;
3247         ')
3248
3249         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3250         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3251 ')
3252
3253 #######################################
3254 ## <summary>
3255 ##  Allow attempts to read and write
3256 ##  a user domain tty and pty.
3257 ## </summary>
3258 ## <param name="domain">
3259 ##  <summary>
3260 ##  Domain to not audit.
3261 ##  </summary>
3262 ## </param>
3263 #
3264 interface(`userdom_use_user_terminals',`
3265     gen_require(`
3266         type user_tty_device_t, user_devpts_t;
3267     ')
3268
3269     allow $1 user_tty_device_t:chr_file rw_term_perms;
3270     allow $1 user_devpts_t:chr_file rw_term_perms;
3271 ')
3272
3273 ########################################
3274 ## <summary>
3275 ##      Do not audit attempts to read and write
3276 ##      a user domain tty and pty.
3277 ## </summary>
3278 ## <param name="domain">
3279 ##      <summary>
3280 ##      Domain to not audit.
3281 ##      </summary>
3282 ## </param>
3283 #
3284 interface(`userdom_dontaudit_use_user_terminals',`
3285         gen_require(`
3286                 type user_tty_device_t, user_devpts_t;
3287         ')
3288
3289         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3290         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3291 ')
3292
3293
3294 ########################################
3295 ## <summary>
3296 ##      Get attributes of user domain tty and pty.
3297 ## </summary>
3298 ## <param name="domain">
3299 ##      <summary>
3300 ##      Domain allowed access.
3301 ##      </summary>
3302 ## </param>
3303 #
3304 interface(`userdom_getattr_user_terminals',`
3305         gen_require(`
3306                 type user_tty_device_t, user_devpts_t;
3307         ')
3308
3309         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3310 ')
3311
3312 ########################################
3313 ## <summary>
3314 ##      Execute a shell in all user domains.  This
3315 ##      is an explicit transition, requiring the
3316 ##      caller to use setexeccon().
3317 ## </summary>
3318 ## <param name="domain">
3319 ##      <summary>
3320 ##      Domain allowed to transition.
3321 ##      </summary>
3322 ## </param>
3323 #
3324 interface(`userdom_spec_domtrans_all_users',`
3325         gen_require(`
3326                 attribute userdomain;
3327         ')
3328
3329         corecmd_shell_spec_domtrans($1, userdomain)
3330         allow userdomain $1:fd use;
3331         allow userdomain $1:fifo_file rw_file_perms;
3332         allow userdomain $1:process sigchld;
3333 ')
3334
3335 ########################################
3336 ## <summary>
3337 ##      Execute an Xserver session in all unprivileged user domains.  This
3338 ##      is an explicit transition, requiring the
3339 ##      caller to use setexeccon().
3340 ## </summary>
3341 ## <param name="domain">
3342 ##      <summary>
3343 ##      Domain allowed to transition.
3344 ##      </summary>
3345 ## </param>
3346 #
3347 interface(`userdom_xsession_spec_domtrans_all_users',`
3348         gen_require(`
3349                 attribute userdomain;
3350         ')
3351
3352         xserver_xsession_spec_domtrans($1, userdomain)
3353         allow userdomain $1:fd use;
3354         allow userdomain $1:fifo_file rw_file_perms;
3355         allow userdomain $1:process sigchld;
3356 ')
3357
3358 ########################################
3359 ## <summary>
3360 ##      Execute a shell in all unprivileged user domains.  This
3361 ##      is an explicit transition, requiring the
3362 ##      caller to use setexeccon().
3363 ## </summary>
3364 ## <param name="domain">
3365 ##      <summary>
3366 ##      Domain allowed to transition.
3367 ##      </summary>
3368 ## </param>
3369 #
3370 interface(`userdom_spec_domtrans_unpriv_users',`
3371         gen_require(`
3372                 attribute unpriv_userdomain;
3373         ')
3374
3375         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3376         allow unpriv_userdomain $1:fd use;
3377         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3378         allow unpriv_userdomain $1:process sigchld;
3379 ')
3380
3381 #####################################
3382 ## <summary>
3383 ##  Allow domain dyntrans to unpriv userdomain.
3384 ## </summary>
3385 ## <param name="domain">
3386 ##  <summary>
3387 ##  Domain allowed access.
3388 ##  </summary>
3389 ## </param>
3390 #
3391 interface(`userdom_dyntransition_unpriv_users',`
3392     gen_require(`
3393         attribute unpriv_userdomain;
3394     ')
3395
3396     allow $1 unpriv_userdomain:process dyntransition;
3397 ')
3398
3399 ########################################
3400 ## <summary>
3401 ##      Execute an Xserver session in all unprivileged user domains.  This
3402 ##      is an explicit transition, requiring the
3403 ##      caller to use setexeccon().
3404 ## </summary>
3405 ## <param name="domain">
3406 ##      <summary>
3407 ##      Domain allowed to transition.
3408 ##      </summary>
3409 ## </param>
3410 #
3411 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3412         gen_require(`
3413                 attribute unpriv_userdomain;
3414         ')
3415
3416         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3417         allow unpriv_userdomain $1:fd use;
3418         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3419         allow unpriv_userdomain $1:process sigchld;
3420 ')
3421
3422 ########################################
3423 ## <summary>
3424 ##      Manage unpriviledged user SysV sempaphores.
3425 ## </summary>
3426 ## <param name="domain">
3427 ##      <summary>
3428 ##      Domain allowed access.
3429 ##      </summary>
3430 ## </param>
3431 #
3432 interface(`userdom_manage_unpriv_user_semaphores',`
3433         gen_require(`
3434                 attribute unpriv_userdomain;
3435         ')
3436
3437         allow $1 unpriv_userdomain:sem create_sem_perms;
3438 ')
3439
3440 ########################################
3441 ## <summary>
3442 ##      Manage unpriviledged user SysV shared
3443 ##      memory segments.
3444 ## </summary>
3445 ## <param name="domain">
3446 ##      <summary>
3447 ##      Domain allowed access.
3448 ##      </summary>
3449 ## </param>
3450 #
3451 interface(`userdom_manage_unpriv_user_shared_mem',`
3452         gen_require(`
3453                 attribute unpriv_userdomain;
3454         ')
3455
3456         allow $1 unpriv_userdomain:shm create_shm_perms;
3457 ')
3458
3459 ########################################
3460 ## <summary>
3461 ##      Execute bin_t in the unprivileged user domains. This
3462 ##      is an explicit transition, requiring the
3463 ##      caller to use setexeccon().
3464 ## </summary>
3465 ## <param name="domain">
3466 ##      <summary>
3467 ##      Domain allowed to transition.
3468 ##      </summary>
3469 ## </param>
3470 #
3471 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3472         gen_require(`
3473                 attribute unpriv_userdomain;
3474         ')
3475
3476         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3477         allow unpriv_userdomain $1:fd use;
3478         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3479         allow unpriv_userdomain $1:process sigchld;
3480 ')
3481
3482 ########################################
3483 ## <summary>
3484 ##      Execute all entrypoint files in unprivileged user
3485 ##      domains. This is an explicit transition, requiring the
3486 ##      caller to use setexeccon().
3487 ## </summary>
3488 ## <param name="domain">
3489 ##      <summary>
3490 ##      Domain allowed access.
3491 ##      </summary>
3492 ## </param>
3493 #
3494 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3495         gen_require(`
3496                 attribute unpriv_userdomain;
3497         ')
3498
3499         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3500         allow unpriv_userdomain $1:fd use;
3501         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3502         allow unpriv_userdomain $1:process sigchld;
3503 ')
3504
3505 ########################################
3506 ## <summary>
3507 ##      Search users home directories.
3508 ## </summary>
3509 ## <param name="domain">
3510 ##      <summary>
3511 ##      Domain allowed access.
3512 ##      </summary>
3513 ## </param>
3514 #
3515 interface(`userdom_search_user_home_content',`
3516         gen_require(`
3517                 type user_home_dir_t;
3518                 attribute user_home_type;
3519         ')
3520
3521         files_list_home($1)
3522         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3523         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3524 ')
3525
3526 ########################################
3527 ## <summary>
3528 ##      Send general signals to unprivileged user domains.
3529 ## </summary>
3530 ## <param name="domain">
3531 ##      <summary>
3532 ##      Domain allowed access.
3533 ##      </summary>
3534 ## </param>
3535 #
3536 interface(`userdom_signal_unpriv_users',`
3537         gen_require(`
3538                 attribute unpriv_userdomain;
3539         ')
3540
3541         allow $1 unpriv_userdomain:process signal;
3542 ')
3543
3544 ########################################
3545 ## <summary>
3546 ##      Inherit the file descriptors from unprivileged user domains.
3547 ## </summary>
3548 ## <param name="domain">
3549 ##      <summary>
3550 ##      Domain allowed access.
3551 ##      </summary>
3552 ## </param>
3553 #
3554 interface(`userdom_use_unpriv_users_fds',`
3555         gen_require(`
3556                 attribute unpriv_userdomain;
3557         ')
3558
3559         allow $1 unpriv_userdomain:fd use;
3560 ')
3561
3562 ########################################
3563 ## <summary>
3564 ##      Do not audit attempts to inherit the file descriptors
3565 ##      from unprivileged user domains.
3566 ## </summary>
3567 ## <desc>
3568 ##      <p>
3569 ##      Do not audit attempts to inherit the file descriptors
3570 ##      from unprivileged user domains. This will supress
3571 ##      SELinux denial messages when the specified domain is denied
3572 ##      the permission to inherit these file descriptors.
3573 ##      </p>
3574 ## </desc>
3575 ## <param name="domain">
3576 ##      <summary>
3577 ##      Domain to not audit.
3578 ##      </summary>
3579 ## </param>
3580 ## <infoflow type="none"/>
3581 #
3582 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3583         gen_require(`
3584                 attribute unpriv_userdomain;
3585         ')
3586
3587         dontaudit $1 unpriv_userdomain:fd use;
3588 ')
3589
3590 ########################################
3591 ## <summary>
3592 ##      Do not audit attempts to use user ptys.
3593 ## </summary>
3594 ## <param name="domain">
3595 ##      <summary>
3596 ##      Domain to not audit.
3597 ##      </summary>
3598 ## </param>
3599 #
3600 interface(`userdom_dontaudit_use_user_ptys',`
3601         gen_require(`
3602                 type user_devpts_t;
3603         ')
3604
3605         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3606 ')
3607
3608 ########################################
3609 ## <summary>
3610 ##      Relabel files to unprivileged user pty types.
3611 ## </summary>
3612 ## <param name="domain">
3613 ##      <summary>
3614 ##      Domain allowed access.
3615 ##      </summary>
3616 ## </param>
3617 #
3618 interface(`userdom_relabelto_user_ptys',`
3619         gen_require(`
3620                 type user_devpts_t;
3621         ')
3622
3623         allow $1 user_devpts_t:chr_file relabelto;
3624 ')
3625
3626 ########################################
3627 ## <summary>
3628 ##      Do not audit attempts to relabel files from
3629 ##      user pty types.
3630 ## </summary>
3631 ## <param name="domain">
3632 ##      <summary>
3633 ##      Domain to not audit.
3634 ##      </summary>
3635 ## </param>
3636 #
3637 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3638         gen_require(`
3639                 type user_devpts_t;
3640         ')
3641
3642         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3643 ')
3644
3645 ########################################
3646 ## <summary>
3647 ##      Write all users files in /tmp
3648 ## </summary>
3649 ## <param name="domain">
3650 ##      <summary>
3651 ##      Domain allowed access.
3652 ##      </summary>
3653 ## </param>
3654 #
3655 interface(`userdom_write_user_tmp_files',`
3656         gen_require(`
3657                 type user_tmp_t;
3658         ')
3659
3660         write_files_pattern($1, user_tmp_t, user_tmp_t)
3661 ')
3662
3663 ########################################
3664 ## <summary>
3665 ##      Do not audit attempts to write users
3666 ##      temporary files.
3667 ## </summary>
3668 ## <param name="domain">
3669 ##      <summary>
3670 ##      Domain to not audit.
3671 ##      </summary>
3672 ## </param>
3673 #
3674 interface(`userdom_dontaudit_write_user_tmp_files',`
3675         gen_require(`
3676                 type user_tmp_t;
3677         ')
3678
3679         dontaudit $1 user_tmp_t:file write;
3680 ')
3681
3682 ########################################
3683 ## <summary>
3684 ##      Do not audit attempts to read/write users
3685 ##      temporary fifo files.
3686 ## </summary>
3687 ## <param name="domain">
3688 ##      <summary>
3689 ##      Domain to not audit.
3690 ##      </summary>
3691 ## </param>
3692 #
3693 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3694         gen_require(`
3695                 type user_tmp_t;
3696         ')
3697
3698         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3699 ')
3700
3701 ########################################
3702 ## <summary>
3703 ##      Do not audit attempts to use user ttys.
3704 ## </summary>
3705 ## <param name="domain">
3706 ##      <summary>
3707 ##      Domain to not audit.
3708 ##      </summary>
3709 ## </param>
3710 #
3711 interface(`userdom_dontaudit_use_user_ttys',`
3712         gen_require(`
3713                 type user_tty_device_t;
3714         ')
3715
3716         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3717 ')
3718
3719 ########################################
3720 ## <summary>
3721 ##      Read the process state of all user domains.
3722 ## </summary>
3723 ## <param name="domain">
3724 ##      <summary>
3725 ##      Domain allowed access.
3726 ##      </summary>
3727 ## </param>
3728 #
3729 interface(`userdom_read_all_users_state',`
3730         gen_require(`
3731                 attribute userdomain;
3732         ')
3733
3734         read_files_pattern($1, userdomain, userdomain)
3735         read_lnk_files_pattern($1,userdomain,userdomain)
3736         kernel_search_proc($1)
3737 ')
3738
3739 ########################################
3740 ## <summary>
3741 ##      Get the attributes of all user domains.
3742 ## </summary>
3743 ## <param name="domain">
3744 ##      <summary>
3745 ##      Domain allowed access.
3746 ##      </summary>
3747 ## </param>
3748 #
3749 interface(`userdom_getattr_all_users',`
3750         gen_require(`
3751                 attribute userdomain;
3752         ')
3753
3754         allow $1 userdomain:process getattr;
3755 ')
3756
3757 ########################################
3758 ## <summary>
3759 ##      Inherit the file descriptors from all user domains
3760 ## </summary>
3761 ## <param name="domain">
3762 ##      <summary>
3763 ##      Domain allowed access.
3764 ##      </summary>
3765 ## </param>
3766 #
3767 interface(`userdom_use_all_users_fds',`
3768         gen_require(`
3769                 attribute userdomain;
3770         ')
3771
3772         allow $1 userdomain:fd use;
3773 ')
3774
3775 ########################################
3776 ## <summary>
3777 ##      Do not audit attempts to inherit the file
3778 ##      descriptors from any user domains.
3779 ## </summary>
3780 ## <param name="domain">
3781 ##      <summary>
3782 ##      Domain to not audit.
3783 ##      </summary>
3784 ## </param>
3785 #
3786 interface(`userdom_dontaudit_use_all_users_fds',`
3787         gen_require(`
3788                 attribute userdomain;
3789         ')
3790
3791         dontaudit $1 userdomain:fd use;
3792 ')
3793
3794 ########################################
3795 ## <summary>
3796 ##      Send general signals to all user domains.
3797 ## </summary>
3798 ## <param name="domain">
3799 ##      <summary>
3800 ##      Domain allowed access.
3801 ##      </summary>
3802 ## </param>
3803 #
3804 interface(`userdom_signal_all_users',`
3805         gen_require(`
3806                 attribute userdomain;
3807         ')
3808
3809         allow $1 userdomain:process signal;
3810 ')
3811
3812 ########################################
3813 ## <summary>
3814 ##      Send kill signals to all user domains.
3815 ## </summary>
3816 ## <param name="domain">
3817 ##      <summary>
3818 ##      Domain allowed access.
3819 ##      </summary>
3820 ## </param>
3821 #
3822 interface(`userdom_kill_all_users',`
3823         gen_require(`
3824                 attribute userdomain;
3825         ')
3826
3827         allow $1 userdomain:process sigkill;
3828 ')
3829
3830 ########################################
3831 ## <summary>
3832 ##      Send a SIGCHLD signal to all user domains.
3833 ## </summary>
3834 ## <param name="domain">
3835 ##      <summary>
3836 ##      Domain allowed access.
3837 ##      </summary>
3838 ## </param>
3839 #
3840 interface(`userdom_sigchld_all_users',`
3841         gen_require(`
3842                 attribute userdomain;
3843         ')
3844
3845         allow $1 userdomain:process sigchld;
3846 ')
3847
3848 ########################################
3849 ## <summary>
3850 ##      Read keys for all user domains.
3851 ## </summary>
3852 ## <param name="domain">
3853 ##      <summary>
3854 ##      Domain allowed access.
3855 ##      </summary>
3856 ## </param>
3857 #
3858 interface(`userdom_read_all_users_keys',`
3859         gen_require(`
3860                 attribute userdomain;
3861         ')
3862
3863         allow $1 userdomain:key read;
3864 ')
3865
3866 ########################################
3867 ## <summary>
3868 ##      Create keys for all user domains.
3869 ## </summary>
3870 ## <param name="domain">
3871 ##      <summary>
3872 ##      Domain allowed access.
3873 ##      </summary>
3874 ## </param>
3875 #
3876 interface(`userdom_create_all_users_keys',`
3877         gen_require(`
3878                 attribute userdomain;
3879         ')
3880
3881         allow $1 userdomain:key create;
3882 ')
3883
3884 ########################################
3885 ## <summary>
3886 ##      Send a dbus message to all user domains.
3887 ## </summary>
3888 ## <param name="domain">
3889 ##      <summary>
3890 ##      Domain allowed access.
3891 ##      </summary>
3892 ## </param>
3893 #
3894 interface(`userdom_dbus_send_all_users',`
3895         gen_require(`
3896                 attribute userdomain;
3897                 class dbus send_msg;
3898         ')
3899
3900         allow $1 userdomain:dbus send_msg;
3901 ')
3902
3903 ########################################
3904 ## <summary>
3905 ##      Allow apps to set rlimits on userdomain
3906 ## </summary>
3907 ## <param name="domain">
3908 ##      <summary>
3909 ##      Domain allowed access.
3910 ##      </summary>
3911 ## </param>
3912 #
3913 interface(`userdom_set_rlimitnh',`
3914         gen_require(`
3915                 attribute userdomain;
3916         ')
3917
3918         allow $1 userdomain:process rlimitinh;
3919 ')
3920
3921 ########################################
3922 ## <summary>
3923 ##      Define this type as a Allow apps to set rlimits on userdomain
3924 ## </summary>
3925 ## <param name="domain">
3926 ##      <summary>
3927 ##      Domain allowed access.
3928 ##      </summary>
3929 ## </param>
3930 ## <param name="userdomain_prefix">
3931 ##      <summary>
3932 ##      The prefix of the user domain (e.g., user
3933 ##      is the prefix for user_t).
3934 ## </summary>
3935 ## </param>
3936 ## <param name="domain">
3937 ##      <summary>
3938 ##      Domain allowed access.
3939 ##      </summary>
3940 ## </param>
3941 #
3942 template(`userdom_unpriv_usertype',`
3943         gen_require(`
3944                 attribute unpriv_userdomain, userdomain;
3945                 attribute $1_usertype;
3946         ')
3947         typeattribute $2  $1_usertype;
3948         typeattribute $2  unpriv_userdomain;
3949         typeattribute $2  userdomain;
3950
3951         auth_use_nsswitch($2)
3952         ubac_constrained($2)
3953 ')
3954
3955 #######################################
3956 ## <summary>
3957 ##  Define this type as a Allow apps to set rlimits on userdomain
3958 ## </summary>
3959 ## <param name="domain">
3960 ##  <summary>
3961 ##  Domain allowed access.
3962 ##  </summary>
3963 ## </param>
3964 ## <param name="userdomain_prefix">
3965 ##  <summary>
3966 ##  The prefix of the user domain (e.g., user
3967 ##  is the prefix for user_t).
3968 ## </summary>
3969 ## </param>
3970 ## <param name="domain">
3971 ##  <summary>
3972 ##  Domain allowed access.
3973 ##  </summary>
3974 ## </param>
3975 #
3976 template(`userdom_unpriv_type',`
3977     gen_require(`
3978         attribute unpriv_userdomain, userdomain;
3979     ')
3980     typeattribute $2  unpriv_userdomain;
3981     typeattribute $2  userdomain;
3982
3983     auth_use_nsswitch($2)
3984     ubac_constrained($2)
3985 ')
3986
3987 ########################################
3988 ## <summary>
3989 ##      Connect to users over an unix stream socket.
3990 ## </summary>
3991 ## <param name="domain">
3992 ##      <summary>
3993 ##      Domain allowed access.
3994 ##      </summary>
3995 ## </param>
3996 #
3997 interface(`userdom_stream_connect',`
3998         gen_require(`
3999                 type user_tmp_t;
4000                 attribute userdomain;
4001         ')
4002
4003         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
4004 ')
4005
4006 ########################################
4007 ## <summary>
4008 ##      Ptrace user domains.
4009 ## </summary>
4010 ## <param name="domain">
4011 ##      <summary>
4012 ##      Domain allowed access.
4013 ##      </summary>
4014 ## </param>
4015 #
4016 interface(`userdom_ptrace_all_users',`
4017         gen_require(`
4018                 attribute userdomain;
4019         ')
4020
4021         tunable_policy(`deny_ptrace',`',`
4022                 allow $1 userdomain:process ptrace;
4023         ')
4024 ')
4025
4026 ########################################
4027 ## <summary>
4028 ##      dontaudit Search /root
4029 ## </summary>
4030 ## <param name="domain">
4031 ##      <summary>
4032 ##      Domain to not audit.
4033 ##      </summary>
4034 ## </param>
4035 #
4036 interface(`userdom_dontaudit_search_admin_dir',`
4037         gen_require(`
4038                 type admin_home_t;
4039         ')
4040
4041         dontaudit $1 admin_home_t:dir search_dir_perms;
4042 ')
4043
4044 ########################################
4045 ## <summary>
4046 ##      dontaudit list /root
4047 ## </summary>
4048 ## <param name="domain">
4049 ##      <summary>
4050 ##      Domain to not audit.
4051 ##      </summary>
4052 ## </param>
4053 #
4054 interface(`userdom_dontaudit_list_admin_dir',`
4055         gen_require(`
4056                 type admin_home_t;
4057         ')
4058
4059         dontaudit $1 admin_home_t:dir list_dir_perms;
4060 ')
4061
4062 ########################################
4063 ## <summary>
4064 ##      Allow domain to  list /root
4065 ## </summary>
4066 ## <param name="domain">
4067 ##      <summary>
4068 ##      Domain allowed access.
4069 ##      </summary>
4070 ## </param>
4071 #
4072 interface(`userdom_list_admin_dir',`
4073         gen_require(`
4074                 type admin_home_t;
4075         ')
4076
4077         allow $1 admin_home_t:dir list_dir_perms;
4078 ')
4079
4080 ########################################
4081 ## <summary>
4082 ##      Allow Search /root
4083 ## </summary>
4084 ## <param name="domain">
4085 ##      <summary>
4086 ##      Domain allowed access.
4087 ##      </summary>
4088 ## </param>
4089 #
4090 interface(`userdom_search_admin_dir',`
4091         gen_require(`
4092                 type admin_home_t;
4093         ')
4094
4095         allow $1 admin_home_t:dir search_dir_perms;
4096 ')
4097
4098 ########################################
4099 ## <summary>
4100 ##      RW unpriviledged user SysV sempaphores.
4101 ## </summary>
4102 ## <param name="domain">
4103 ##      <summary>
4104 ##      Domain allowed access.
4105 ##      </summary>
4106 ## </param>
4107 #
4108 interface(`userdom_rw_semaphores',`
4109         gen_require(`
4110                 attribute unpriv_userdomain;
4111         ')
4112
4113         allow $1 unpriv_userdomain:sem rw_sem_perms;
4114 ')
4115
4116 ########################################
4117 ## <summary>
4118 ##      Send a message to unpriv users over a unix domain
4119 ##      datagram socket.
4120 ## </summary>
4121 ## <param name="domain">
4122 ##      <summary>
4123 ##      Domain allowed access.
4124 ##      </summary>
4125 ## </param>
4126 #
4127 interface(`userdom_dgram_send',`
4128         gen_require(`
4129                 attribute unpriv_userdomain;
4130         ')
4131
4132         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4133 ')
4134
4135 ######################################
4136 ## <summary>
4137 ##      Send a message to users over a unix domain
4138 ##      datagram socket.
4139 ## </summary>
4140 ## <param name="domain">
4141 ##      <summary>
4142 ##      Domain allowed access.
4143 ##      </summary>
4144 ## </param>
4145 #
4146 interface(`userdom_users_dgram_send',`
4147         gen_require(`
4148                  attribute userdomain;
4149       ')
4150
4151        allow $1 userdomain:unix_dgram_socket sendto;
4152 ')
4153
4154 #######################################
4155 ## <summary>
4156 ##      Allow execmod on files in homedirectory
4157 ## </summary>
4158 ## <param name="domain">
4159 ##      <summary>
4160 ##      Domain allowed access.
4161 ##      </summary>
4162 ## </param>
4163 ## <rolebase/>
4164 #
4165 interface(`userdom_execmod_user_home_files',`
4166         gen_require(`
4167                 type user_home_type;
4168         ')
4169
4170         allow $1 user_home_type:file execmod;
4171 ')
4172
4173 ########################################
4174 ## <summary>
4175 ##      Read admin home files.
4176 ## </summary>
4177 ## <param name="domain">
4178 ##      <summary>
4179 ##      Domain allowed access.
4180 ##      </summary>
4181 ## </param>
4182 ## <rolecap/>
4183 #
4184 interface(`userdom_read_admin_home_files',`
4185         gen_require(`
4186                 type admin_home_t;
4187         ')
4188
4189         read_files_pattern($1, admin_home_t, admin_home_t)
4190 ')
4191
4192 ########################################
4193 ## <summary>
4194 ##      Delete admin home files.
4195 ## </summary>
4196 ## <param name="domain">
4197 ##      <summary>
4198 ##      Domain allowed access.
4199 ##      </summary>
4200 ## </param>
4201 ## <rolecap/>
4202 #
4203 interface(`userdom_delete_admin_home_files',`
4204         gen_require(`
4205                 type admin_home_t;
4206         ')
4207
4208         allow $1 admin_home_t:file delete_file_perms;
4209 ')
4210
4211 ########################################
4212 ## <summary>
4213 ##      Execute admin home files.
4214 ## </summary>
4215 ## <param name="domain">
4216 ##      <summary>
4217 ##      Domain allowed access.
4218 ##      </summary>
4219 ## </param>
4220 ## <rolecap/>
4221 #
4222 interface(`userdom_exec_admin_home_files',`
4223         gen_require(`
4224                 type admin_home_t;
4225         ')
4226
4227         exec_files_pattern($1, admin_home_t, admin_home_t)
4228 ')
4229
4230 ########################################
4231 ## <summary>
4232 ##      Append files inherited
4233 ##      in the /root directory.
4234 ## </summary>
4235 ## <param name="domain">
4236 ##      <summary>
4237 ##      Domain allowed access.
4238 ##      </summary>
4239 ## </param>
4240 #
4241 interface(`userdom_inherit_append_admin_home_files',`
4242         gen_require(`
4243                 type admin_home_t;
4244         ')
4245
4246         allow $1 admin_home_t:file { getattr append };
4247 ')
4248
4249
4250 #######################################
4251 ## <summary>
4252 ##      Manage all files/directories in the homedir
4253 ## </summary>
4254 ## <param name="userdomain">
4255 ##      <summary>
4256 ##      The user domain
4257 ##      </summary>
4258 ## </param>
4259 ## <rolebase/>
4260 #
4261 interface(`userdom_manage_user_home_content',`
4262         gen_require(`
4263                 type user_home_dir_t, user_home_t;
4264                 attribute user_home_type;
4265         ')
4266
4267         files_list_home($1)
4268         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4269         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4270         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4271         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4272         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4273         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4274
4275 ')
4276
4277
4278 ########################################
4279 ## <summary>
4280 ##      Create objects in a user home directory
4281 ##      with an automatic type transition to
4282 ##      the user home file type.
4283 ## </summary>
4284 ## <param name="domain">
4285 ##      <summary>
4286 ##      Domain allowed access.
4287 ##      </summary>
4288 ## </param>
4289 ## <param name="object_class">
4290 ##      <summary>
4291 ##      The class of the object to be created.
4292 ##      </summary>
4293 ## </param>
4294 #
4295 interface(`userdom_user_home_dir_filetrans_pattern',`
4296         gen_require(`
4297                 type user_home_dir_t, user_home_t;
4298         ')
4299
4300         type_transition $1 user_home_dir_t:$2 user_home_t;
4301 ')
4302
4303 ########################################
4304 ## <summary>
4305 ##      Create objects in the /root directory
4306 ##      with an automatic type transition to
4307 ##      a specified private type.
4308 ## </summary>
4309 ## <param name="domain">
4310 ##      <summary>
4311 ##      Domain allowed access.
4312 ##      </summary>
4313 ## </param>
4314 ## <param name="private_type">
4315 ##      <summary>
4316 ##      The type of the object to create.
4317 ##      </summary>
4318 ## </param>
4319 ## <param name="object_class">
4320 ##      <summary>
4321 ##      The class of the object to be created.
4322 ##      </summary>
4323 ## </param>
4324 #
4325 interface(`userdom_admin_home_dir_filetrans',`
4326         gen_require(`
4327                 type admin_home_t;
4328         ')
4329
4330         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4331 ')
4332
4333 ########################################
4334 ## <summary>
4335 ##      Send signull to unprivileged user domains.
4336 ## </summary>
4337 ## <param name="domain">
4338 ##      <summary>
4339 ##      Domain allowed access.
4340 ##      </summary>
4341 ## </param>
4342 #
4343 interface(`userdom_signull_unpriv_users',`
4344         gen_require(`
4345                 attribute unpriv_userdomain;
4346         ')
4347
4348         allow $1 unpriv_userdomain:process signull;
4349 ')
4350
4351 ########################################
4352 ## <summary>
4353 ##      Write all users files in /tmp
4354 ## </summary>
4355 ## <param name="domain">
4356 ##      <summary>
4357 ##      Domain allowed access.
4358 ##      </summary>
4359 ## </param>
4360 #
4361 interface(`userdom_write_user_tmp_dirs',`
4362         gen_require(`
4363                 type user_tmp_t;
4364         ')
4365
4366         write_files_pattern($1, user_tmp_t, user_tmp_t)
4367 ')
4368
4369 ########################################
4370 ## <summary>
4371 ##      Manage keys for all user domains.
4372 ## </summary>
4373 ## <param name="domain">
4374 ##      <summary>
4375 ##      Domain allowed access.
4376 ##      </summary>
4377 ## </param>
4378 #
4379 interface(`userdom_manage_all_users_keys',`
4380         gen_require(`
4381                 attribute userdomain;
4382         ')
4383
4384         allow $1 userdomain:key manage_key_perms;
4385 ')
4386
4387
4388 ########################################
4389 ## <summary>
4390 ##      Do not audit attempts to read and write
4391 ##      unserdomain stream.
4392 ## </summary>
4393 ## <param name="domain">
4394 ##      <summary>
4395 ##      Domain to not audit.
4396 ##      </summary>
4397 ## </param>
4398 #
4399 interface(`userdom_dontaudit_rw_stream',`
4400         gen_require(`
4401                 attribute userdomain;
4402         ')
4403
4404         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4405 ')
4406
4407 ########################################
4408 ## <summary>
4409 ##      Do not audit attempts to read and write
4410 ##      unserdomain datagram socket.
4411 ## </summary>
4412 ## <param name="domain">
4413 ##      <summary>
4414 ##      Domain to not audit.
4415 ##      </summary>
4416 ## </param>
4417 #
4418 interface(`userdom_dontaudit_rw_dgram_socket',`
4419         gen_require(`
4420                 attribute userdomain;
4421         ')
4422
4423         dontaudit $1 userdomain:unix_dgram_socket { read write };
4424 ')
4425
4426 ########################################
4427 ## <summary>
4428 ##      Append files
4429 ##      in a user home subdirectory.
4430 ## </summary>
4431 ## <param name="domain">
4432 ##      <summary>
4433 ##      Domain allowed access.
4434 ##      </summary>
4435 ## </param>
4436 #
4437 interface(`userdom_append_user_home_content_files',`
4438         gen_require(`
4439                 type user_home_dir_t, user_home_t;
4440         ')
4441
4442         append_files_pattern($1, user_home_t, user_home_t)
4443         allow $1 user_home_dir_t:dir search_dir_perms;
4444         files_search_home($1)
4445 ')
4446
4447 ########################################
4448 ## <summary>
4449 ##      Read files inherited
4450 ##      in a user home subdirectory.
4451 ## </summary>
4452 ## <param name="domain">
4453 ##      <summary>
4454 ##      Domain allowed access.
4455 ##      </summary>
4456 ## </param>
4457 #
4458 interface(`userdom_read_inherited_user_home_content_files',`
4459         gen_require(`
4460                 attribute user_home_type;
4461         ')
4462
4463         allow $1 user_home_type:file { getattr read };
4464 ')
4465
4466 ########################################
4467 ## <summary>
4468 ##      Append files inherited
4469 ##      in a user home subdirectory.
4470 ## </summary>
4471 ## <param name="domain">
4472 ##      <summary>
4473 ##      Domain allowed access.
4474 ##      </summary>
4475 ## </param>
4476 #
4477 interface(`userdom_inherit_append_user_home_content_files',`
4478         gen_require(`
4479                 type user_home_t;
4480         ')
4481
4482         allow $1 user_home_t:file { getattr append };
4483 ')
4484
4485 ########################################
4486 ## <summary>
4487 ##      Append files inherited
4488 ##      in a user tmp files.
4489 ## </summary>
4490 ## <param name="domain">
4491 ##      <summary>
4492 ##      Domain allowed access.
4493 ##      </summary>
4494 ## </param>
4495 #
4496 interface(`userdom_inherit_append_user_tmp_files',`
4497         gen_require(`
4498                 type user_tmp_t;
4499         ')
4500
4501         allow $1 user_tmp_t:file { getattr append };
4502 ')
4503
4504 ######################################
4505 ## <summary>
4506 ##      Read audio files in the users homedir.
4507 ## </summary>
4508 ## <param name="domain">
4509 ##      <summary>
4510 ##      Domain allowed access.
4511 ##      </summary>
4512 ## </param>
4513 ## <rolecap/>
4514 #
4515 interface(`userdom_read_home_audio_files',`
4516         gen_require(`
4517                 type audio_home_t;
4518         ')
4519
4520         userdom_search_user_home_dirs($1)
4521         allow $1 audio_home_t:dir list_dir_perms;
4522         read_files_pattern($1, audio_home_t, audio_home_t)
4523         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4524 ')
4525
4526 ########################################
4527 ## <summary>
4528 ##      Do not audit attempts to write all user home content files.
4529 ## </summary>
4530 ## <param name="domain">
4531 ##      <summary>
4532 ##      Domain to not audit.
4533 ##      </summary>
4534 ## </param>
4535 #
4536 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4537         gen_require(`
4538                 attribute user_home_type;
4539         ')
4540
4541         dontaudit $1 user_home_type:file write_file_perms;
4542 ')
4543
4544 ########################################
4545 ## <summary>
4546 ##      Do not audit attempts to write all user tmp content files.
4547 ## </summary>
4548 ## <param name="domain">
4549 ##      <summary>
4550 ##      Domain to not audit.
4551 ##      </summary>
4552 ## </param>
4553 #
4554 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4555         gen_require(`
4556                 attribute user_tmp_type;
4557         ')
4558
4559         dontaudit $1 user_tmp_type:file write_file_perms;
4560 ')
4561
4562 ########################################
4563 ## <summary>
4564 ##      Manage all user temporary content.
4565 ## </summary>
4566 ## <param name="domain">
4567 ##      <summary>
4568 ##      Domain allowed access.
4569 ##      </summary>
4570 ## </param>
4571 #
4572 interface(`userdom_manage_all_user_tmp_content',`
4573         gen_require(`
4574                 attribute user_tmp_type;
4575         ')
4576
4577         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4578         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4579         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4580         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4581         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4582         files_search_tmp($1)
4583 ')
4584
4585 ########################################
4586 ## <summary>
4587 ##      List all user temporary content.
4588 ## </summary>
4589 ## <param name="domain">
4590 ##      <summary>
4591 ##      Domain allowed access.
4592 ##      </summary>
4593 ## </param>
4594 #
4595 interface(`userdom_list_all_user_tmp_content',`
4596         gen_require(`
4597                 attribute user_tmp_type;
4598         ')
4599
4600         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4601         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4602         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4603         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4604         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4605         files_search_var($1)
4606         files_search_tmp($1)
4607 ')
4608
4609 ########################################
4610 ## <summary>
4611 ##      Manage all user tmpfs content.
4612 ## </summary>
4613 ## <param name="domain">
4614 ##      <summary>
4615 ##      Domain allowed access.
4616 ##      </summary>
4617 ## </param>
4618 #
4619 interface(`userdom_manage_all_user_tmpfs_content',`
4620         gen_require(`
4621                 attribute user_tmpfs_type;
4622         ')
4623
4624         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4625         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4626         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4627         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4628         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4629         fs_search_tmpfs($1)
4630 ')
4631
4632 ########################################
4633 ## <summary>
4634 ##      Delete all user temporary content.
4635 ## </summary>
4636 ## <param name="domain">
4637 ##      <summary>
4638 ##      Domain allowed access.
4639 ##      </summary>
4640 ## </param>
4641 #
4642 interface(`userdom_delete_all_user_tmp_content',`
4643         gen_require(`
4644                 attribute user_tmp_type;
4645         ')
4646
4647         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4648         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4649         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4650         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4651         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4652         # /var/tmp
4653         files_search_var($1)
4654         files_delete_tmp_dir_entry($1)
4655 ')
4656
4657 ########################################
4658 ## <summary>
4659 ##      Read system SSL certificates in the users homedir.
4660 ## </summary>
4661 ## <param name="domain">
4662 ##      <summary>
4663 ##      Domain allowed access.
4664 ##      </summary>
4665 ## </param>
4666 #
4667 interface(`userdom_read_home_certs',`
4668         gen_require(`
4669                 type home_cert_t;
4670         ')
4671
4672         userdom_search_user_home_content($1)
4673         allow $1 home_cert_t:dir list_dir_perms;
4674         read_files_pattern($1, home_cert_t, home_cert_t)
4675         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4676 ')
4677
4678 ########################################
4679 ## <summary>
4680 ##      Manage system SSL certificates in the users homedir.
4681 ## </summary>
4682 ## <param name="domain">
4683 ##      <summary>
4684 ##      Domain allowed access.
4685 ##      </summary>
4686 ## </param>
4687 #
4688 interface(`userdom_manage_home_certs',`
4689         gen_require(`
4690                 type home_cert_t;
4691         ')
4692
4693         allow $1 home_cert_t:dir list_dir_perms;
4694         manage_files_pattern($1, home_cert_t, home_cert_t)
4695         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4696
4697         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4698         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4699 ')
4700
4701 #######################################
4702 ## <summary>
4703 ##  Dontaudit Write system SSL certificates in the users homedir.
4704 ## </summary>
4705 ## <param name="domain">
4706 ##  <summary>
4707 ##      Domain to not audit.
4708 ##  </summary>
4709 ## </param>
4710 #
4711 interface(`userdom_dontaudit_write_home_certs',`
4712     gen_require(`
4713         type home_cert_t;
4714     ')
4715
4716     dontaudit $1 home_cert_t:file write;
4717 ')
4718
4719 ########################################
4720 ## <summary>
4721 ##      dontaudit Search getatrr /root files
4722 ## </summary>
4723 ## <param name="domain">
4724 ##      <summary>
4725 ##      Domain to not audit.
4726 ##      </summary>
4727 ## </param>
4728 #
4729 interface(`userdom_dontaudit_getattr_admin_home_files',`
4730         gen_require(`
4731                 type admin_home_t;
4732         ')
4733
4734         dontaudit $1 admin_home_t:file getattr;
4735 ')
4736
4737 ########################################
4738 ## <summary>
4739 ##      dontaudit read /root lnk files
4740 ## </summary>
4741 ## <param name="domain">
4742 ##      <summary>
4743 ##      Domain to not audit.
4744 ##      </summary>
4745 ## </param>
4746 #
4747 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4748         gen_require(`
4749                 type admin_home_t;
4750         ')
4751
4752         dontaudit $1 admin_home_t:lnk_file read;
4753 ')
4754
4755 ########################################
4756 ## <summary>
4757 ##      dontaudit read /root files
4758 ## </summary>
4759 ## <param name="domain">
4760 ##      <summary>
4761 ##      Domain to not audit.
4762 ##      </summary>
4763 ## </param>
4764 #
4765 interface(`userdom_dontaudit_read_admin_home_files',`
4766         gen_require(`
4767                 type admin_home_t;
4768         ')
4769
4770         dontaudit $1 admin_home_t:file read_file_perms;
4771 ')
4772
4773 ########################################
4774 ## <summary>
4775 ##      Create, read, write, and delete user
4776 ##      temporary chr files.
4777 ## </summary>
4778 ## <param name="domain">
4779 ##      <summary>
4780 ##      Domain allowed access.
4781 ##      </summary>
4782 ## </param>
4783 #
4784 interface(`userdom_manage_user_tmp_chr_files',`
4785         gen_require(`
4786                 type user_tmp_t;
4787         ')
4788
4789         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4790         files_search_tmp($1)
4791 ')
4792
4793 ########################################
4794 ## <summary>
4795 ##      Create, read, write, and delete user
4796 ##      temporary blk files.
4797 ## </summary>
4798 ## <param name="domain">
4799 ##      <summary>
4800 ##      Domain allowed access.
4801 ##      </summary>
4802 ## </param>
4803 #
4804 interface(`userdom_manage_user_tmp_blk_files',`
4805         gen_require(`
4806                 type user_tmp_t;
4807         ')
4808
4809         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4810         files_search_tmp($1)
4811 ')
4812
4813 ########################################
4814 ## <summary>
4815 ##      Dontaudit attempt to set attributes on  user temporary directories.
4816 ## </summary>
4817 ## <param name="domain">
4818 ##      <summary>
4819 ##      Domain to not audit.
4820 ##      </summary>
4821 ## </param>
4822 #
4823 interface(`userdom_dontaudit_setattr_user_tmp',`
4824         gen_require(`
4825                 type user_tmp_t;
4826         ')
4827
4828         dontaudit $1 user_tmp_t:dir setattr;
4829 ')
4830
4831 ########################################
4832 ## <summary>
4833 ##      Read all inherited users files in /tmp
4834 ## </summary>
4835 ## <param name="domain">
4836 ##      <summary>
4837 ##      Domain allowed access.
4838 ##      </summary>
4839 ## </param>
4840 #
4841 interface(`userdom_read_inherited_user_tmp_files',`
4842         gen_require(`
4843                 type user_tmp_t;
4844         ')
4845
4846         allow $1 user_tmp_t:file read_inherited_file_perms;
4847 ')
4848
4849 ########################################
4850 ## <summary>
4851 ##      Write all inherited users files in /tmp
4852 ## </summary>
4853 ## <param name="domain">
4854 ##      <summary>
4855 ##      Domain allowed access.
4856 ##      </summary>
4857 ## </param>
4858 #
4859 interface(`userdom_write_inherited_user_tmp_files',`
4860         gen_require(`
4861                 type user_tmp_t;
4862         ')
4863
4864         allow $1 user_tmp_t:file write;
4865 ')
4866
4867 ########################################
4868 ## <summary>
4869 ##      Delete all users files in /tmp
4870 ## </summary>
4871 ## <param name="domain">
4872 ##      <summary>
4873 ##      Domain allowed access.
4874 ##      </summary>
4875 ## </param>
4876 #
4877 interface(`userdom_delete_user_tmp_files',`
4878         gen_require(`
4879                 type user_tmp_t;
4880         ')
4881
4882         allow $1 user_tmp_t:file delete_file_perms;
4883 ')
4884
4885 ########################################
4886 ## <summary>
4887 ##      Delete user tmpfs files.
4888 ## </summary>
4889 ## <param name="domain">
4890 ##      <summary>
4891 ##      Domain allowed access.
4892 ##      </summary>
4893 ## </param>
4894 #
4895 interface(`userdom_delete_user_tmpfs_files',`
4896         gen_require(`
4897                 type user_tmpfs_t;
4898         ')
4899
4900         allow $1 user_tmpfs_t:file delete_file_perms;
4901 ')
4902
4903 ########################################
4904 ## <summary>
4905 ##      Read/Write unpriviledged user SysV shared
4906 ##      memory segments.
4907 ## </summary>
4908 ## <param name="domain">
4909 ##      <summary>
4910 ##      Domain allowed access.
4911 ##      </summary>
4912 ## </param>
4913 #
4914 interface(`userdom_rw_unpriv_user_shared_mem',`
4915         gen_require(`
4916                 attribute unpriv_userdomain;
4917         ')
4918
4919         allow $1 unpriv_userdomain:shm rw_shm_perms;
4920 ')
4921
4922 ########################################
4923 ## <summary>
4924 ##      Do not audit attempts to search user
4925 ##      temporary directories.
4926 ## </summary>
4927 ## <param name="domain">
4928 ##      <summary>
4929 ##      Domain to not audit.
4930 ##      </summary>
4931 ## </param>
4932 #
4933 interface(`userdom_dontaudit_search_user_tmp',`
4934         gen_require(`
4935                 type user_tmp_t;
4936         ')
4937
4938         dontaudit $1 user_tmp_t:dir search_dir_perms;
4939 ')
4940
4941 ########################################
4942 ## <summary>
4943 ##      Execute a file in a user home directory
4944 ##      in the specified domain.
4945 ## </summary>
4946 ## <desc>
4947 ##      <p>
4948 ##      Execute a file in a user home directory
4949 ##      in the specified domain.
4950 ##      </p>
4951 ##      <p>
4952 ##      No interprocess communication (signals, pipes,
4953 ##      etc.) is provided by this interface since
4954 ##      the domains are not owned by this module.
4955 ##      </p>
4956 ## </desc>
4957 ## <param name="domain">
4958 ##      <summary>
4959 ##      Domain allowed access.
4960 ##      </summary>
4961 ## </param>
4962 ## <param name="target_domain">
4963 ##      <summary>
4964 ##      The type of the new process.
4965 ##      </summary>
4966 ## </param>
4967 #
4968 interface(`userdom_domtrans_user_home',`
4969         gen_require(`
4970                 type user_home_t;
4971         ')
4972
4973         read_lnk_files_pattern($1, user_home_t, user_home_t)
4974         domain_transition_pattern($1, user_home_t, $2)
4975         type_transition $1 user_home_t:process $2;
4976 ')
4977
4978 ########################################
4979 ## <summary>
4980 ##      Execute a file in a user tmp directory
4981 ##      in the specified domain.
4982 ## </summary>
4983 ## <desc>
4984 ##      <p>
4985 ##      Execute a file in a user tmp directory
4986 ##      in the specified domain.
4987 ##      </p>
4988 ##      <p>
4989 ##      No interprocess communication (signals, pipes,
4990 ##      etc.) is provided by this interface since
4991 ##      the domains are not owned by this module.
4992 ##      </p>
4993 ## </desc>
4994 ## <param name="domain">
4995 ##      <summary>
4996 ##      Domain allowed access.
4997 ##      </summary>
4998 ## </param>
4999 ## <param name="target_domain">
5000 ##      <summary>
5001 ##      The type of the new process.
5002 ##      </summary>
5003 ## </param>
5004 #
5005 interface(`userdom_domtrans_user_tmp',`
5006         gen_require(`
5007                 type user_tmp_t;
5008         ')
5009
5010         files_search_tmp($1)
5011         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
5012         domain_transition_pattern($1, user_tmp_t, $2)
5013         type_transition $1 user_tmp_t:process $2;
5014 ')
5015
5016 ########################################
5017 ## <summary>
5018 ##      Do not audit attempts to read all user home content files.
5019 ## </summary>
5020 ## <param name="domain">
5021 ##      <summary>
5022 ##      Domain to not audit.
5023 ##      </summary>
5024 ## </param>
5025 #
5026 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5027         gen_require(`
5028                 attribute user_home_type;
5029         ')
5030
5031         dontaudit $1 user_home_type:file read_file_perms;
5032 ')
5033
5034 ########################################
5035 ## <summary>
5036 ##      Do not audit attempts to read all user tmp content files.
5037 ## </summary>
5038 ## <param name="domain">
5039 ##      <summary>
5040 ##      Domain to not audit.
5041 ##      </summary>
5042 ## </param>
5043 #
5044 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5045         gen_require(`
5046                 attribute user_tmp_type;
5047         ')
5048
5049         dontaudit $1 user_tmp_type:file read_file_perms;
5050 ')
5051
5052 #######################################
5053 ## <summary>
5054 ## Read and write unpriviledged user SysV sempaphores.
5055 ## </summary>
5056 ## <param name="domain">
5057 ## <summary>
5058 ## Domain allowed access.
5059 ## </summary>
5060 ## </param>
5061 #
5062 interface(`userdom_rw_unpriv_user_semaphores',`
5063    gen_require(`
5064        attribute unpriv_userdomain;
5065    ')
5066
5067    allow $1 unpriv_userdomain:sem rw_sem_perms;
5068 ')
5069
5070 ########################################
5071 ## <summary>
5072 ##      Transition to userdom named content
5073 ## </summary>
5074 ## <param name="domain">
5075 ##      <summary>
5076 ##      Domain allowed access.
5077 ##      </summary>
5078 ## </param>
5079 #
5080 interface(`userdom_filetrans_home_content',`
5081         gen_require(`
5082                 type home_bin_t, home_cert_t;
5083                 type audio_home_t;
5084         ')
5085
5086         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5087         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5088         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5089         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5090         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5091         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5092         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5093
5094         #optional_policy(`
5095         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5096         #')
5097 ')
5098
5099 ########################################
5100 ## <summary>
5101 ##      Make the specified type able to read content in user home dirs
5102 ## </summary>
5103 ## <param name="type">
5104 ##      <summary>
5105 ##      Domain allowed access.
5106 ##      </summary>
5107 ## </param>
5108 #
5109 interface(`userdom_home_reader',`
5110         gen_require(`
5111                 attribute userdom_home_reader_type;
5112         ')
5113
5114         typeattribute $1 userdom_home_reader_type;
5115 ')
5116
5117
5118 ########################################
5119 ## <summary>
5120 ##      Make the specified type able to manage content in user home dirs
5121 ## </summary>
5122 ## <param name="type">
5123 ##      <summary>
5124 ##      Domain allowed access.
5125 ##      </summary>
5126 ## </param>
5127 #
5128 interface(`userdom_home_manager',`
5129         gen_require(`
5130                 attribute userdom_home_manager_type;
5131         ')
5132
5133         typeattribute $1 userdom_home_manager_type;
5134 ')