policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 alsa_read_rw_config($1_usertype)
 676                 alsa_manage_home_files($1_t)
 677                 alsa_relabel_home_files($1_t)
 678                 alsa_filetrans_named_content($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 chrome_role($1_r, $1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 colord_read_lib_files($1_usertype)
 696         ')
 697
 698         optional_policy(`
 699                 dbus_system_bus_client($1_usertype)
 700
 701                 allow $1_usertype $1_usertype:dbus  send_msg;
 702
 703                 optional_policy(`
 704                         avahi_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         policykit_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         bluetooth_dbus_chat($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         consolekit_dbus_chat($1_usertype)
 717                         consolekit_read_log($1_usertype)
 718                 ')
 719
 720                 optional_policy(`
 721                         devicekit_dbus_chat($1_usertype)
 722                         devicekit_dbus_chat_power($1_usertype)
 723                         devicekit_dbus_chat_disk($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         evolution_dbus_chat($1_usertype)
 728                         evolution_alarm_dbus_chat($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         gnome_dbus_chat_gconfdefault($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         hal_dbus_chat($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         kde_dbus_chat_backlighthelper($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         modemmanager_dbus_chat($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         networkmanager_dbus_chat($1_usertype)
 749                         networkmanager_read_lib_files($1_usertype)
 750                 ')
 751
 752                 optional_policy(`
 753                         vpn_dbus_chat($1_usertype)
 754                 ')
 755         ')
 756
 757         optional_policy(`
 758                 git_session_role($1_r, $1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inetd_use_fds($1_usertype)
 763                 inetd_rw_tcp_sockets($1_usertype)
 764         ')
 765
 766         optional_policy(`
 767                 inn_read_config($1_usertype)
 768                 inn_read_news_lib($1_usertype)
 769                 inn_read_news_spool($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 lircd_stream_connect($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 locate_read_lib_files($1_usertype)
 778         ')
 779
 780         # for running depmod as part of the kernel packaging process
 781         optional_policy(`
 782                 modutils_read_module_config($1_usertype)
 783         ')
 784
 785         optional_policy(`
 786                 mta_rw_spool($1_usertype)
 787                 mta_manage_queue($1_usertype)
 788                 mta_filetrans_home_content($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 nsplugin_role($1_r, $1_usertype)
 793         ')
 794
 795         optional_policy(`
 796                 tunable_policy(`allow_user_mysql_connect',`
 797                         mysql_stream_connect($1_t)
 798                 ')
 799         ')
 800
 801         optional_policy(`
 802                 oident_manage_user_content($1_t)
 803                 oident_relabel_user_content($1_t)
 804         ')
 805
 806         optional_policy(`
 807                 # to allow monitoring of pcmcia status
 808                 pcmcia_read_pid($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 pcscd_read_pub_files($1_usertype)
 813                 pcscd_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 tunable_policy(`allow_user_postgresql_connect',`
 818                         postgresql_stream_connect($1_usertype)
 819                         postgresql_tcp_connect($1_usertype)
 820                 ')
 821         ')
 822
 823         optional_policy(`
 824                 resmgr_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpc_dontaudit_getattr_exports($1_usertype)
 829                 rpc_manage_nfs_rw_content($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 rpcbind_stream_connect($1_usertype)
 834         ')
 835
 836         optional_policy(`
 837                 samba_stream_connect_winbind($1_usertype)
 838         ')
 839
 840         optional_policy(`
 841                 sandbox_transition($1_usertype, $1_r)
 842         ')
 843
 844         optional_policy(`
 845                 seunshare_role_template($1, $1_r, $1_t)
 846         ')
 847
 848         optional_policy(`
 849                 slrnpull_search_spool($1_usertype)
 850         ')
 851
 852 ')
 853
 854 #######################################
 855 ## <summary>
 856 ##      The template for creating a login user.
 857 ## </summary>
 858 ## <desc>
 859 ##      <p>
 860 ##      This template creates a user domain, types, and
 861 ##      rules for the user's tty, pty, home directories,
 862 ##      tmp, and tmpfs files.
 863 ##      </p>
 864 ## </desc>
 865 ## <param name="userdomain_prefix">
 866 ##      <summary>
 867 ##      The prefix of the user domain (e.g., user
 868 ##      is the prefix for user_t).
 869 ##      </summary>
 870 ## </param>
 871 #
 872 template(`userdom_login_user_template', `
 873         gen_require(`
 874                 class context contains;
 875         ')
 876
 877         userdom_base_user_template($1)
 878
 879         userdom_manage_home_role($1_r, $1_usertype)
 880
 881         userdom_manage_tmp_role($1_r, $1_usertype)
 882         userdom_manage_tmpfs_role($1_r, $1_usertype)
 883
 884         ifelse(`$1',`unconfined',`',`
 885                 gen_tunable(allow_$1_exec_content, true)
 886
 887                 tunable_policy(`allow_$1_exec_content',`
 888                         userdom_exec_user_tmp_files($1_usertype)
 889                         userdom_exec_user_home_content_files($1_usertype)
 890                 ')
 891                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 892                         fs_exec_nfs_files($1_usertype)
 893                 ')
 894
 895                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 896                         fs_exec_cifs_files($1_usertype)
 897                 ')
 898         ')
 899
 900         userdom_change_password_template($1)
 901
 902         ##############################
 903         #
 904         # User domain Local policy
 905         #
 906
 907         allow $1_t self:capability { setgid chown fowner };
 908         dontaudit $1_t self:capability { sys_nice fsetid };
 909
 910         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 911         dontaudit $1_t self:process setrlimit;
 912         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 913
 914         allow $1_t self:context contains;
 915
 916         kernel_dontaudit_read_system_state($1_usertype)
 917         kernel_dontaudit_list_all_proc($1_usertype)
 918
 919         dev_read_sysfs($1_usertype)
 920         dev_read_urand($1_usertype)
 921
 922         domain_use_interactive_fds($1_usertype)
 923         # Command completion can fire hundreds of denials
 924         domain_dontaudit_exec_all_entry_files($1_usertype)
 925
 926         files_dontaudit_list_default($1_usertype)
 927         files_dontaudit_read_default_files($1_usertype)
 928         # Stat lost+found.
 929         files_getattr_lost_found_dirs($1_usertype)
 930
 931         fs_get_all_fs_quotas($1_usertype)
 932         fs_getattr_all_fs($1_usertype)
 933         fs_search_all($1_usertype)
 934         fs_list_inotifyfs($1_usertype)
 935         fs_rw_anon_inodefs_files($1_usertype)
 936
 937         auth_dontaudit_write_login_records($1_t)
 938         auth_rw_cache($1_t)
 939
 940         application_exec_all($1_t)
 941         # The library functions always try to open read-write first,
 942         # then fall back to read-only if it fails.
 943         init_dontaudit_rw_utmp($1_t)
 944
 945         # Stop warnings about access to /dev/console
 946         init_dontaudit_use_fds($1_usertype)
 947         init_dontaudit_use_script_fds($1_usertype)
 948
 949         libs_exec_lib_files($1_usertype)
 950
 951         logging_dontaudit_getattr_all_logs($1_usertype)
 952
 953         # for running TeX programs
 954         miscfiles_read_tetex_data($1_usertype)
 955         miscfiles_exec_tetex_data($1_usertype)
 956
 957         seutil_read_config($1_usertype)
 958
 959         optional_policy(`
 960                 cups_read_config($1_usertype)
 961                 cups_stream_connect($1_usertype)
 962                 cups_stream_connect_ptal($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 kerberos_use($1_usertype)
 967                 kerberos_filetrans_home_content($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 mta_dontaudit_read_spool_symlinks($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 quota_dontaudit_getattr_db($1_usertype)
 976         ')
 977
 978         optional_policy(`
 979                 rpm_read_db($1_usertype)
 980                 rpm_dontaudit_manage_db($1_usertype)
 981                 rpm_read_cache($1_usertype)
 982         ')
 983
 984         optional_policy(`
 985                 oddjob_run_mkhomedir($1_t, $1_r)
 986         ')
 987 ')
 988
 989 #######################################
 990 ## <summary>
 991 ##      The template for creating a unprivileged login user.
 992 ## </summary>
 993 ## <desc>
 994 ##      <p>
 995 ##      This template creates a user domain, types, and
 996 ##      rules for the user's tty, pty, home directories,
 997 ##      tmp, and tmpfs files.
 998 ##      </p>
 999 ## </desc>
1000 ## <param name="userdomain_prefix">
1001 ##      <summary>
1002 ##      The prefix of the user domain (e.g., user
1003 ##      is the prefix for user_t).
1004 ##      </summary>
1005 ## </param>
1006 #
1007 template(`userdom_restricted_user_template',`
1008         gen_require(`
1009                 attribute unpriv_userdomain;
1010         ')
1011
1012         userdom_login_user_template($1)
1013
1014         typeattribute $1_t unpriv_userdomain;
1015         domain_interactive_fd($1_t)
1016
1017         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1018         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1019
1020         ##############################
1021         #
1022         # Local policy
1023         #
1024
1025         optional_policy(`
1026                 loadkeys_run($1_t, $1_r)
1027         ')
1028 ')
1029
1030 #######################################
1031 ## <summary>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ## </summary>
1034 ## <desc>
1035 ##      <p>
1036 ##      The template for creating a unprivileged xwindows login user.
1037 ##      </p>
1038 ##      <p>
1039 ##      This template creates a user domain, types, and
1040 ##      rules for the user's tty, pty, home directories,
1041 ##      tmp, and tmpfs files.
1042 ##      </p>
1043 ## </desc>
1044 ## <param name="userdomain_prefix">
1045 ##      <summary>
1046 ##      The prefix of the user domain (e.g., user
1047 ##      is the prefix for user_t).
1048 ##      </summary>
1049 ## </param>
1050 #
1051 template(`userdom_restricted_xwindows_user_template',`
1052
1053         userdom_restricted_user_template($1)
1054
1055         ##############################
1056         #
1057         # Local policy
1058         #
1059
1060         auth_role($1_r, $1_t)
1061         auth_search_pam_console_data($1_usertype)
1062         auth_dontaudit_read_login_records($1_usertype)
1063
1064         dev_read_sound($1_usertype)
1065         dev_write_sound($1_usertype)
1066         # gnome keyring wants to read this.
1067         dev_dontaudit_read_rand($1_usertype)
1068         # temporarily allow since openoffice requires this
1069         dev_read_rand($1_usertype)
1070
1071         dev_read_video_dev($1_usertype)
1072         dev_write_video_dev($1_usertype)
1073         dev_rw_wireless($1_usertype)
1074
1075         libs_dontaudit_setattr_lib_files($1_usertype)
1076
1077         tunable_policy(`user_rw_noexattrfile',`
1078                 dev_rw_usbfs($1_t)
1079                 dev_rw_generic_usb_dev($1_usertype)
1080
1081                 fs_manage_noxattr_fs_files($1_usertype)
1082                 fs_manage_noxattr_fs_dirs($1_usertype)
1083                 fs_manage_dos_dirs($1_usertype)
1084                 fs_manage_dos_files($1_usertype)
1085                 storage_raw_read_removable_device($1_usertype)
1086                 storage_raw_write_removable_device($1_usertype)
1087         ')
1088
1089         logging_send_syslog_msg($1_usertype)
1090         logging_dontaudit_send_audit_msgs($1_t)
1091
1092         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1093         logging_send_audit_msgs($1_t)
1094         selinux_get_enforce_mode($1_t)
1095         seutil_exec_restorecond($1_t)
1096         seutil_read_file_contexts($1_t)
1097         seutil_read_default_contexts($1_t)
1098
1099         xserver_restricted_role($1_r, $1_t)
1100
1101         optional_policy(`
1102                 alsa_read_rw_config($1_usertype)
1103         ')
1104
1105          # cjp: needed by KDE apps
1106          # bug: #682499
1107          optional_policy(`
1108                 gnome_read_usr_config($1_usertype)
1109                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1110                 # cjp: telepathy F15 bugs
1111                 telepathy_role($1_r, $1_t, $1)
1112         ')
1113
1114         optional_policy(`
1115                 dbus_role_template($1, $1_r, $1_usertype)
1116                 dbus_system_bus_client($1_usertype)
1117                 allow $1_usertype $1_usertype:dbus send_msg;
1118
1119                 optional_policy(`
1120                         abrt_dbus_chat($1_usertype)
1121                         abrt_run_helper($1_usertype, $1_r)
1122                 ')
1123
1124                 optional_policy(`
1125                         consolekit_dontaudit_read_log($1_usertype)
1126                         consolekit_dbus_chat($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         cups_dbus_chat($1_usertype)
1131                         cups_dbus_chat_config($1_usertype)
1132                 ')
1133
1134                 optional_policy(`
1135                         devicekit_dbus_chat($1_usertype)
1136                         devicekit_dbus_chat_disk($1_usertype)
1137                         devicekit_dbus_chat_power($1_usertype)
1138                 ')
1139
1140                 optional_policy(`
1141                         fprintd_dbus_chat($1_t)
1142                 ')
1143         ')
1144
1145         optional_policy(`
1146                 openoffice_role_template($1, $1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 policykit_role($1_r, $1_usertype)
1151         ')
1152
1153         optional_policy(`
1154                 pulseaudio_role($1_r, $1_usertype)
1155                 pulseaudio_filetrans_admin_home_content($1_usertype)
1156                 pulseaudio_filetrans_home_content($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 rtkit_scheduled($1_usertype)
1161         ')
1162
1163         optional_policy(`
1164                 setroubleshoot_dontaudit_stream_connect($1_t)
1165         ')
1166
1167         optional_policy(`
1168                 udev_read_db($1_usertype)
1169         ')
1170
1171         optional_policy(`
1172                 wm_role_template($1, $1_r, $1_t)
1173         ')
1174 ')
1175
1176 #######################################
1177 ## <summary>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ## </summary>
1181 ## <desc>
1182 ##      <p>
1183 ##      The template for creating a unprivileged user roughly
1184 ##      equivalent to a regular linux user.
1185 ##      </p>
1186 ##      <p>
1187 ##      This template creates a user domain, types, and
1188 ##      rules for the user's tty, pty, home directories,
1189 ##      tmp, and tmpfs files.
1190 ##      </p>
1191 ## </desc>
1192 ## <param name="userdomain_prefix">
1193 ##      <summary>
1194 ##      The prefix of the user domain (e.g., user
1195 ##      is the prefix for user_t).
1196 ##      </summary>
1197 ## </param>
1198 #
1199 template(`userdom_unpriv_user_template', `
1200
1201         ##############################
1202         #
1203         # Declarations
1204         #
1205
1206         # Inherit rules for ordinary users.
1207         userdom_restricted_xwindows_user_template($1)
1208         userdom_common_user_template($1)
1209
1210         ##############################
1211         #
1212         # Local policy
1213         #
1214
1215         # port access is audited even if dac would not have allowed it, so dontaudit it here
1216 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1217         # Need the following rule to allow users to run vpnc
1218         corenet_tcp_bind_xserver_port($1_t)
1219         corenet_tcp_bind_generic_node($1_usertype)
1220
1221         storage_rw_fuse($1_t)
1222
1223         files_exec_usr_files($1_t)
1224    # cjp: why?
1225         files_read_kernel_symbol_table($1_t)
1226
1227         ifndef(`enable_mls',`
1228                 fs_exec_noxattr($1_t)
1229
1230                 tunable_policy(`user_rw_noexattrfile',`
1231                         fs_manage_noxattr_fs_files($1_t)
1232                         fs_manage_noxattr_fs_dirs($1_t)
1233                         # Write floppies
1234                         storage_raw_read_removable_device($1_t)
1235                         storage_raw_write_removable_device($1_t)
1236                 ',`
1237                         storage_raw_read_removable_device($1_t)
1238                 ')
1239         ')
1240
1241         miscfiles_read_hwdata($1_usertype)
1242
1243         # Allow users to run TCP servers (bind to ports and accept connection from
1244         # the same domain and outside users) disabling this forces FTP passive mode
1245         # and may change other protocols
1246
1247         tunable_policy(`user_share_music',`
1248                 corenet_tcp_bind_daap_port($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_tcp_server',`
1252                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1253         ')
1254
1255         tunable_policy(`user_setrlimit',`
1256                 allow $1_usertype self:process setrlimit;
1257         ')
1258
1259         optional_policy(`
1260                 cdrecord_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 cron_role($1_r, $1_t)
1265         ')
1266
1267         optional_policy(`
1268                 games_rw_data($1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gpg_role($1_r, $1_usertype)
1273         ')
1274
1275         optional_policy(`
1276                 gnomeclock_dbus_chat($1_t)
1277         ')
1278
1279         optional_policy(`
1280                 gpm_stream_connect($1_usertype)
1281         ')
1282
1283         optional_policy(`
1284                 execmem_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 java_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mono_role_template($1, $1_r, $1_t)
1293         ')
1294
1295         optional_policy(`
1296                 mount_run_fusermount($1_t, $1_r)
1297                 mount_read_pid_files($1_t)
1298         ')
1299
1300         optional_policy(`
1301                 wine_role_template($1, $1_r, $1_t)
1302         ')
1303
1304         optional_policy(`
1305                 postfix_run_postdrop($1_t, $1_r)
1306         ')
1307
1308         # Run pppd in pppd_t by default for user
1309         optional_policy(`
1310                 ppp_run_cond($1_t, $1_r)
1311         ')
1312 ')
1313
1314 #######################################
1315 ## <summary>
1316 ##      The template for creating an administrative user.
1317 ## </summary>
1318 ## <desc>
1319 ##      <p>
1320 ##      This template creates a user domain, types, and
1321 ##      rules for the user's tty, pty, home directories,
1322 ##      tmp, and tmpfs files.
1323 ##      </p>
1324 ##      <p>
1325 ##      The privileges given to administrative users are:
1326 ##      <ul>
1327 ##              <li>Raw disk access</li>
1328 ##              <li>Set all sysctls</li>
1329 ##              <li>All kernel ring buffer controls</li>
1330 ##              <li>Create, read, write, and delete all files but shadow</li>
1331 ##              <li>Manage source and binary format SELinux policy</li>
1332 ##              <li>Run insmod</li>
1333 ##      </ul>
1334 ##      </p>
1335 ## </desc>
1336 ## <param name="userdomain_prefix">
1337 ##      <summary>
1338 ##      The prefix of the user domain (e.g., sysadm
1339 ##      is the prefix for sysadm_t).
1340 ##      </summary>
1341 ## </param>
1342 #
1343 template(`userdom_admin_user_template',`
1344         gen_require(`
1345                 attribute admindomain;
1346                 class passwd { passwd chfn chsh rootok crontab };
1347         ')
1348
1349         ##############################
1350         #
1351         # Declarations
1352         #
1353
1354         # Inherit rules for ordinary users.
1355         userdom_login_user_template($1)
1356         userdom_common_user_template($1)
1357
1358         domain_obj_id_change_exemption($1_t)
1359         role system_r types $1_t;
1360
1361         typeattribute $1_t admindomain;
1362
1363         ifdef(`direct_sysadm_daemon',`
1364                 domain_system_change_exemption($1_t)
1365         ')
1366
1367         ##############################
1368         #
1369         # $1_t local policy
1370         #
1371
1372         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1373         allow $1_t self:capability2 syslog;
1374         allow $1_t self:process { setexec setfscreate };
1375         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1376         allow $1_t self:tun_socket create;
1377         # Set password information for other users.
1378         allow $1_t self:passwd { passwd chfn chsh };
1379         # Skip authentication when pam_rootok is specified.
1380         allow $1_t self:passwd rootok;
1381
1382         # Manipulate other users crontab.
1383         allow $1_t self:passwd crontab;
1384
1385         kernel_read_software_raid_state($1_t)
1386         kernel_getattr_core_if($1_t)
1387         kernel_getattr_message_if($1_t)
1388         kernel_change_ring_buffer_level($1_t)
1389         kernel_clear_ring_buffer($1_t)
1390         kernel_read_ring_buffer($1_t)
1391         kernel_get_sysvipc_info($1_t)
1392         kernel_rw_all_sysctls($1_t)
1393         # signal unlabeled processes:
1394         kernel_kill_unlabeled($1_t)
1395         kernel_signal_unlabeled($1_t)
1396         kernel_sigstop_unlabeled($1_t)
1397         kernel_signull_unlabeled($1_t)
1398         kernel_sigchld_unlabeled($1_t)
1399         kernel_signal($1_t)
1400
1401         corenet_tcp_bind_generic_port($1_t)
1402         # allow setting up tunnels
1403         corenet_rw_tun_tap_dev($1_t)
1404
1405         dev_getattr_generic_blk_files($1_t)
1406         dev_getattr_generic_chr_files($1_t)
1407         # for lsof
1408         dev_getattr_mtrr_dev($1_t)
1409         # Allow MAKEDEV to work
1410         dev_create_all_blk_files($1_t)
1411         dev_create_all_chr_files($1_t)
1412         dev_delete_all_blk_files($1_t)
1413         dev_delete_all_chr_files($1_t)
1414         dev_rename_all_blk_files($1_t)
1415         dev_rename_all_chr_files($1_t)
1416         dev_create_generic_symlinks($1_t)
1417         dev_rw_generic_usb_dev($1_t)
1418         dev_rw_usbfs($1_t)
1419
1420         domain_setpriority_all_domains($1_t)
1421         domain_read_all_domains_state($1_t)
1422         domain_getattr_all_domains($1_t)
1423         domain_getcap_all_domains($1_t)
1424         domain_dontaudit_ptrace_all_domains($1_t)
1425         # signal all domains:
1426         domain_kill_all_domains($1_t)
1427         domain_signal_all_domains($1_t)
1428         domain_signull_all_domains($1_t)
1429         domain_sigstop_all_domains($1_t)
1430         domain_sigstop_all_domains($1_t)
1431         domain_sigchld_all_domains($1_t)
1432         # for lsof
1433         domain_getattr_all_sockets($1_t)
1434         domain_dontaudit_getattr_all_sockets($1_t)
1435
1436         files_exec_usr_src_files($1_t)
1437
1438         fs_getattr_all_fs($1_t)
1439         fs_getattr_all_files($1_t)
1440         fs_list_all($1_t)
1441         fs_set_all_quotas($1_t)
1442         fs_exec_noxattr($1_t)
1443
1444         storage_raw_read_removable_device($1_t)
1445         storage_raw_write_removable_device($1_t)
1446         storage_dontaudit_read_fixed_disk($1_t)
1447
1448         term_use_all_inherited_terms($1_t)
1449         term_use_unallocated_ttys($1_t)
1450
1451         auth_getattr_shadow($1_t)
1452         # Manage almost all files
1453         files_manage_non_security_files($1_t)
1454         # Relabel almost all files
1455         files_relabel_non_security_files($1_t)
1456
1457         init_telinit($1_t)
1458
1459         logging_send_syslog_msg($1_t)
1460
1461         optional_policy(`
1462                 modutils_domtrans_insmod($1_t)
1463                 modutils_domtrans_depmod($1_t)
1464         ')
1465
1466         # The following rule is temporary until such time that a complete
1467         # policy management infrastructure is in place so that an administrator
1468         # cannot directly manipulate policy files with arbitrary programs.
1469         seutil_manage_src_policy($1_t)
1470         # Violates the goal of limiting write access to checkpolicy.
1471         # But presently necessary for installing the file_contexts file.
1472         seutil_manage_bin_policy($1_t)
1473
1474         systemd_config_all_services($1_t)
1475
1476         userdom_manage_user_home_content_dirs($1_t)
1477         userdom_manage_user_home_content_files($1_t)
1478         userdom_manage_user_home_content_symlinks($1_t)
1479         userdom_manage_user_home_content_pipes($1_t)
1480         userdom_manage_user_home_content_sockets($1_t)
1481         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1482
1483         tunable_policy(`user_rw_noexattrfile',`
1484                 fs_manage_noxattr_fs_files($1_t)
1485                 fs_manage_noxattr_fs_dirs($1_t)
1486         ',`
1487                 fs_read_noxattr_fs_files($1_t)
1488         ')
1489
1490         optional_policy(`
1491                 postgresql_unconfined($1_t)
1492         ')
1493
1494         optional_policy(`
1495                 userhelper_exec($1_t)
1496         ')
1497 ')
1498
1499 ########################################
1500 ## <summary>
1501 ##      Allow user to run as a secadm
1502 ## </summary>
1503 ## <desc>
1504 ##      <p>
1505 ##      Create objects in a user home directory
1506 ##      with an automatic type transition to
1507 ##      a specified private type.
1508 ##      </p>
1509 ##      <p>
1510 ##      This is a templated interface, and should only
1511 ##      be called from a per-userdomain template.
1512 ##      </p>
1513 ## </desc>
1514 ## <param name="domain">
1515 ##      <summary>
1516 ##      Domain allowed access.
1517 ##      </summary>
1518 ## </param>
1519 ## <param name="role">
1520 ##      <summary>
1521 ##      The role  of the object to create.
1522 ##      </summary>
1523 ## </param>
1524 #
1525 template(`userdom_security_admin_template',`
1526         allow $1 self:capability { dac_read_search dac_override };
1527
1528         corecmd_exec_shell($1)
1529
1530         domain_obj_id_change_exemption($1)
1531
1532         dev_relabel_all_dev_nodes($1)
1533
1534         files_create_boot_flag($1)
1535         files_create_default_dir($1)
1536         files_root_filetrans_default($1, dir)
1537
1538         # Necessary for managing /boot/efi
1539         fs_manage_dos_files($1)
1540
1541         mls_process_read_up($1)
1542         mls_file_read_all_levels($1)
1543         mls_file_upgrade($1)
1544         mls_file_downgrade($1)
1545
1546         selinux_set_enforce_mode($1)
1547         selinux_set_all_booleans($1)
1548         selinux_set_parameters($1)
1549         selinux_read_policy($1)
1550
1551         files_relabel_all_files($1)
1552         auth_relabel_shadow($1)
1553
1554         init_exec($1)
1555
1556         logging_send_syslog_msg($1)
1557         logging_read_audit_log($1)
1558         logging_read_generic_logs($1)
1559         logging_read_audit_config($1)
1560
1561         seutil_manage_bin_policy($1)
1562         seutil_manage_default_contexts($1)
1563         seutil_manage_file_contexts($1)
1564         seutil_manage_module_store($1)
1565         seutil_manage_config($1)
1566         seutil_run_checkpolicy($1,$2)
1567         seutil_run_loadpolicy($1,$2)
1568         seutil_run_semanage($1,$2)
1569         seutil_run_setsebool($1,$2)
1570         seutil_run_setfiles($1, $2)
1571
1572         seutil_manage_bin_policy($1)
1573     seutil_manage_default_contexts($1)
1574     seutil_manage_file_contexts($1)
1575     seutil_manage_module_store($1)
1576     seutil_manage_config($1)
1577
1578         optional_policy(`
1579                 aide_run($1,$2)
1580         ')
1581
1582         optional_policy(`
1583                 consoletype_exec($1)
1584         ')
1585
1586         optional_policy(`
1587                 dmesg_exec($1)
1588         ')
1589
1590         optional_policy(`
1591                 ipsec_run_setkey($1,$2)
1592         ')
1593
1594         optional_policy(`
1595                 netlabel_run_mgmt($1,$2)
1596         ')
1597
1598         optional_policy(`
1599                 samhain_run($1, $2)
1600         ')
1601 ')
1602
1603 ########################################
1604 ## <summary>
1605 ##      Make the specified type usable in a
1606 ##      user home directory.
1607 ## </summary>
1608 ## <param name="type">
1609 ##      <summary>
1610 ##      Type to be used as a file in the
1611 ##      user home directory.
1612 ##      </summary>
1613 ## </param>
1614 #
1615 interface(`userdom_user_home_content',`
1616         gen_require(`
1617                 type user_home_t;
1618                 attribute user_home_type;
1619         ')
1620
1621         allow $1 user_home_t:filesystem associate;
1622         files_type($1)
1623         ubac_constrained($1)
1624
1625         files_poly_member($1)
1626         typeattribute $1  user_home_type;
1627 ')
1628
1629 ########################################
1630 ## <summary>
1631 ##      Make the specified type usable in a
1632 ##      generic temporary directory.
1633 ## </summary>
1634 ## <param name="type">
1635 ##      <summary>
1636 ##      Type to be used as a file in the
1637 ##      generic temporary directory.
1638 ##      </summary>
1639 ## </param>
1640 #
1641 interface(`userdom_user_tmp_content',`
1642         gen_require(`
1643                 attribute user_tmp_type;
1644         ')
1645
1646         typeattribute $1 user_tmp_type;
1647
1648         files_tmp_file($1)
1649         ubac_constrained($1)
1650 ')
1651
1652 ########################################
1653 ## <summary>
1654 ##      Make the specified type usable in a
1655 ##      generic tmpfs_t directory.
1656 ## </summary>
1657 ## <param name="type">
1658 ##      <summary>
1659 ##      Type to be used as a file in the
1660 ##      generic temporary directory.
1661 ##      </summary>
1662 ## </param>
1663 #
1664 interface(`userdom_user_tmpfs_content',`
1665         gen_require(`
1666                 attribute user_tmpfs_type;
1667         ')
1668
1669         typeattribute $1 user_tmpfs_type;
1670
1671         files_tmpfs_file($1)
1672         ubac_constrained($1)
1673 ')
1674
1675 ########################################
1676 ## <summary>
1677 ##      Allow domain to attach to TUN devices created by administrative users.
1678 ## </summary>
1679 ## <param name="domain">
1680 ##      <summary>
1681 ##      Domain allowed access.
1682 ##      </summary>
1683 ## </param>
1684 #
1685 interface(`userdom_attach_admin_tun_iface',`
1686         gen_require(`
1687                 attribute admindomain;
1688         ')
1689
1690         allow $1 admindomain:tun_socket relabelfrom;
1691         allow $1 self:tun_socket relabelto;
1692 ')
1693
1694 ########################################
1695 ## <summary>
1696 ##      Set the attributes of a user pty.
1697 ## </summary>
1698 ## <param name="domain">
1699 ##      <summary>
1700 ##      Domain allowed access.
1701 ##      </summary>
1702 ## </param>
1703 #
1704 interface(`userdom_setattr_user_ptys',`
1705         gen_require(`
1706                 type user_devpts_t;
1707         ')
1708
1709         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1710 ')
1711
1712 ########################################
1713 ## <summary>
1714 ##      Create a user pty.
1715 ## </summary>
1716 ## <param name="domain">
1717 ##      <summary>
1718 ##      Domain allowed access.
1719 ##      </summary>
1720 ## </param>
1721 #
1722 interface(`userdom_create_user_pty',`
1723         gen_require(`
1724                 type user_devpts_t;
1725         ')
1726
1727         term_create_pty($1, user_devpts_t)
1728 ')
1729
1730 ########################################
1731 ## <summary>
1732 ##      Get the attributes of user home directories.
1733 ## </summary>
1734 ## <param name="domain">
1735 ##      <summary>
1736 ##      Domain allowed access.
1737 ##      </summary>
1738 ## </param>
1739 #
1740 interface(`userdom_getattr_user_home_dirs',`
1741         gen_require(`
1742                 type user_home_dir_t;
1743         ')
1744
1745         allow $1 user_home_dir_t:dir getattr_dir_perms;
1746         files_search_home($1)
1747 ')
1748
1749 ########################################
1750 ## <summary>
1751 ##      Do not audit attempts to get the attributes of user home directories.
1752 ## </summary>
1753 ## <param name="domain">
1754 ##      <summary>
1755 ##      Domain to not audit.
1756 ##      </summary>
1757 ## </param>
1758 #
1759 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1760         gen_require(`
1761                 type user_home_dir_t;
1762         ')
1763
1764         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1765 ')
1766
1767 ########################################
1768 ## <summary>
1769 ##      Search user home directories.
1770 ## </summary>
1771 ## <param name="domain">
1772 ##      <summary>
1773 ##      Domain allowed access.
1774 ##      </summary>
1775 ## </param>
1776 #
1777 interface(`userdom_search_user_home_dirs',`
1778         gen_require(`
1779                 type user_home_dir_t;
1780         ')
1781
1782         allow $1 user_home_dir_t:dir search_dir_perms;
1783         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1784         files_search_home($1)
1785 ')
1786
1787 ########################################
1788 ## <summary>
1789 ##      Do not audit attempts to search user home directories.
1790 ## </summary>
1791 ## <desc>
1792 ##      <p>
1793 ##      Do not audit attempts to search user home directories.
1794 ##      This will supress SELinux denial messages when the specified
1795 ##      domain is denied the permission to search these directories.
1796 ##      </p>
1797 ## </desc>
1798 ## <param name="domain">
1799 ##      <summary>
1800 ##      Domain to not audit.
1801 ##      </summary>
1802 ## </param>
1803 ## <infoflow type="none"/>
1804 #
1805 interface(`userdom_dontaudit_search_user_home_dirs',`
1806         gen_require(`
1807                 type user_home_dir_t;
1808         ')
1809
1810         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1811 ')
1812
1813 ########################################
1814 ## <summary>
1815 ##      List user home directories.
1816 ## </summary>
1817 ## <param name="domain">
1818 ##      <summary>
1819 ##      Domain allowed access.
1820 ##      </summary>
1821 ## </param>
1822 #
1823 interface(`userdom_list_user_home_dirs',`
1824         gen_require(`
1825                 type user_home_dir_t;
1826         ')
1827
1828         allow $1 user_home_dir_t:dir list_dir_perms;
1829         files_search_home($1)
1830
1831         tunable_policy(`use_nfs_home_dirs',`
1832                 fs_list_nfs($1)
1833         ')
1834
1835         tunable_policy(`use_samba_home_dirs',`
1836                 fs_list_cifs($1)
1837         ')
1838 ')
1839
1840 ########################################
1841 ## <summary>
1842 ##      Do not audit attempts to list user home subdirectories.
1843 ## </summary>
1844 ## <param name="domain">
1845 ##      <summary>
1846 ##      Domain to not audit.
1847 ##      </summary>
1848 ## </param>
1849 #
1850 interface(`userdom_dontaudit_list_user_home_dirs',`
1851         gen_require(`
1852                 type user_home_dir_t;
1853                 type user_home_t;
1854         ')
1855
1856         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1857         dontaudit $1 user_home_t:dir list_dir_perms;
1858 ')
1859
1860 ########################################
1861 ## <summary>
1862 ##      Create user home directories.
1863 ## </summary>
1864 ## <param name="domain">
1865 ##      <summary>
1866 ##      Domain allowed access.
1867 ##      </summary>
1868 ## </param>
1869 #
1870 interface(`userdom_create_user_home_dirs',`
1871         gen_require(`
1872                 type user_home_dir_t;
1873         ')
1874
1875         allow $1 user_home_dir_t:dir create_dir_perms;
1876 ')
1877
1878 ########################################
1879 ## <summary>
1880 ##      Create user home directories.
1881 ## </summary>
1882 ## <param name="domain">
1883 ##      <summary>
1884 ##      Domain allowed access.
1885 ##      </summary>
1886 ## </param>
1887 #
1888 interface(`userdom_manage_user_home_dirs',`
1889         gen_require(`
1890                 type user_home_dir_t;
1891         ')
1892
1893         allow $1 user_home_dir_t:dir manage_dir_perms;
1894 ')
1895
1896 ########################################
1897 ## <summary>
1898 ##      Relabel to user home directories.
1899 ## </summary>
1900 ## <param name="domain">
1901 ##      <summary>
1902 ##      Domain allowed access.
1903 ##      </summary>
1904 ## </param>
1905 #
1906 interface(`userdom_relabelto_user_home_dirs',`
1907         gen_require(`
1908                 type user_home_dir_t;
1909         ')
1910
1911         allow $1 user_home_dir_t:dir relabelto;
1912 ')
1913
1914
1915 ########################################
1916 ## <summary>
1917 ##      Relabel to user home files.
1918 ## </summary>
1919 ## <param name="domain">
1920 ##      <summary>
1921 ##      Domain allowed access.
1922 ##      </summary>
1923 ## </param>
1924 #
1925 interface(`userdom_relabelto_user_home_files',`
1926         gen_require(`
1927                 type user_home_t;
1928         ')
1929
1930         allow $1 user_home_t:file relabelto;
1931 ')
1932 ########################################
1933 ## <summary>
1934 ##      Relabel user home files.
1935 ## </summary>
1936 ## <param name="domain">
1937 ##      <summary>
1938 ##      Domain allowed access.
1939 ##      </summary>
1940 ## </param>
1941 #
1942 interface(`userdom_relabel_user_home_files',`
1943         gen_require(`
1944                 type user_home_t;
1945         ')
1946
1947         allow $1 user_home_t:file relabel_file_perms;
1948 ')
1949
1950 ########################################
1951 ## <summary>
1952 ##      Create directories in the home dir root with
1953 ##      the user home directory type.
1954 ## </summary>
1955 ## <param name="domain">
1956 ##      <summary>
1957 ##      Domain allowed access.
1958 ##      </summary>
1959 ## </param>
1960 #
1961 interface(`userdom_home_filetrans_user_home_dir',`
1962         gen_require(`
1963                 type user_home_dir_t;
1964         ')
1965
1966         files_home_filetrans($1, user_home_dir_t, dir)
1967 ')
1968
1969 ########################################
1970 ## <summary>
1971 ##      Do a domain transition to the specified
1972 ##      domain when executing a program in the
1973 ##      user home directory.
1974 ## </summary>
1975 ## <desc>
1976 ##      <p>
1977 ##      Do a domain transition to the specified
1978 ##      domain when executing a program in the
1979 ##      user home directory.
1980 ##      </p>
1981 ##      <p>
1982 ##      No interprocess communication (signals, pipes,
1983 ##      etc.) is provided by this interface since
1984 ##      the domains are not owned by this module.
1985 ##      </p>
1986 ## </desc>
1987 ## <param name="source_domain">
1988 ##      <summary>
1989 ##      Domain allowed to transition.
1990 ##      </summary>
1991 ## </param>
1992 ## <param name="target_domain">
1993 ##      <summary>
1994 ##      Domain to transition to.
1995 ##      </summary>
1996 ## </param>
1997 #
1998 interface(`userdom_user_home_domtrans',`
1999         gen_require(`
2000                 type user_home_dir_t, user_home_t;
2001         ')
2002
2003         domain_auto_trans($1, user_home_t, $2)
2004         allow $1 user_home_dir_t:dir search_dir_perms;
2005         files_search_home($1)
2006 ')
2007
2008 ########################################
2009 ## <summary>
2010 ##      Do not audit attempts to search user home content directories.
2011 ## </summary>
2012 ## <param name="domain">
2013 ##      <summary>
2014 ##      Domain to not audit.
2015 ##      </summary>
2016 ## </param>
2017 #
2018 interface(`userdom_dontaudit_search_user_home_content',`
2019         gen_require(`
2020                 type user_home_t;
2021         ')
2022
2023         dontaudit $1 user_home_t:dir search_dir_perms;
2024         fs_dontaudit_list_nfs($1)
2025         fs_dontaudit_list_cifs($1)
2026 ')
2027
2028 ########################################
2029 ## <summary>
2030 ##      List contents of users home directory.
2031 ## </summary>
2032 ## <param name="domain">
2033 ##      <summary>
2034 ##      Domain allowed access.
2035 ##      </summary>
2036 ## </param>
2037 #
2038 interface(`userdom_list_user_home_content',`
2039         gen_require(`
2040                 type user_home_dir_t;
2041                 attribute user_home_type;
2042         ')
2043
2044         files_list_home($1)
2045         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2046 ')
2047
2048 ########################################
2049 ## <summary>
2050 ##      Create, read, write, and delete directories
2051 ##      in a user home subdirectory.
2052 ## </summary>
2053 ## <param name="domain">
2054 ##      <summary>
2055 ##      Domain allowed access.
2056 ##      </summary>
2057 ## </param>
2058 #
2059 interface(`userdom_manage_user_home_content_dirs',`
2060         gen_require(`
2061                 type user_home_dir_t, user_home_t;
2062         ')
2063
2064         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2065         files_search_home($1)
2066 ')
2067
2068 ########################################
2069 ## <summary>
2070 ##      Delete directories in a user home subdirectory.
2071 ## </summary>
2072 ## <param name="domain">
2073 ##      <summary>
2074 ##      Domain allowed access.
2075 ##      </summary>
2076 ## </param>
2077 #
2078 interface(`userdom_delete_user_home_content_dirs',`
2079         gen_require(`
2080                 type user_home_t;
2081         ')
2082
2083         allow $1 user_home_t:dir delete_dir_perms;
2084 ')
2085
2086 ########################################
2087 ## <summary>
2088 ##      Delete all directories in a user home subdirectory.
2089 ## </summary>
2090 ## <param name="domain">
2091 ##      <summary>
2092 ##      Domain allowed access.
2093 ##      </summary>
2094 ## </param>
2095 #
2096 interface(`userdom_delete_all_user_home_content_dirs',`
2097         gen_require(`
2098                 attribute user_home_type;
2099         ')
2100
2101         allow $1 user_home_type:dir delete_dir_perms;
2102 ')
2103
2104 ########################################
2105 ## <summary>
2106 ##      Set the attributes of user home files.
2107 ## </summary>
2108 ## <param name="domain">
2109 ##      <summary>
2110 ##      Domain allowed access.
2111 ##      </summary>
2112 ## </param>
2113 ## <rolecap/>
2114 #
2115 interface(`userdom_setattr_user_home_content_files',`
2116         gen_require(`
2117                 type user_home_t;
2118         ')
2119
2120         allow $1 user_home_t:file setattr;
2121 ')
2122
2123 ########################################
2124 ## <summary>
2125 ##      Do not audit attempts to set the
2126 ##      attributes of user home files.
2127 ## </summary>
2128 ## <param name="domain">
2129 ##      <summary>
2130 ##      Domain to not audit.
2131 ##      </summary>
2132 ## </param>
2133 #
2134 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2135         gen_require(`
2136                 type user_home_t;
2137         ')
2138
2139         dontaudit $1 user_home_t:file setattr_file_perms;
2140 ')
2141
2142 ########################################
2143 ## <summary>
2144 ##      Set the attributes of all user home directories.
2145 ## </summary>
2146 ## <param name="domain">
2147 ##      <summary>
2148 ##      Domain allowed access.
2149 ##      </summary>
2150 ## </param>
2151 ## <rolecap/>
2152 #
2153 interface(`userdom_setattr_all_user_home_content_dirs',`
2154         gen_require(`
2155                 attribute user_home_type;
2156         ')
2157
2158         allow $1 user_home_type:dir setattr_dir_perms;
2159 ')
2160
2161 ########################################
2162 ## <summary>
2163 ##      Mmap user home files.
2164 ## </summary>
2165 ## <param name="domain">
2166 ##      <summary>
2167 ##      Domain allowed access.
2168 ##      </summary>
2169 ## </param>
2170 #
2171 interface(`userdom_mmap_user_home_content_files',`
2172         gen_require(`
2173                 type user_home_dir_t, user_home_t;
2174         ')
2175
2176         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2177         files_search_home($1)
2178 ')
2179
2180 ########################################
2181 ## <summary>
2182 ##      Read user home files.
2183 ## </summary>
2184 ## <param name="domain">
2185 ##      <summary>
2186 ##      Domain allowed access.
2187 ##      </summary>
2188 ## </param>
2189 #
2190 interface(`userdom_read_user_home_content_files',`
2191         gen_require(`
2192                 type user_home_dir_t, user_home_t;
2193         ')
2194
2195         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2196         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2197         files_search_home($1)
2198 ')
2199
2200 ########################################
2201 ## <summary>
2202 ##      Do not audit attempts to getattr user home files.
2203 ## </summary>
2204 ## <param name="domain">
2205 ##      <summary>
2206 ##      Domain to not audit.
2207 ##      </summary>
2208 ## </param>
2209 #
2210 interface(`userdom_dontaudit_getattr_user_home_content',`
2211         gen_require(`
2212                 attribute user_home_type;
2213         ')
2214
2215         dontaudit $1 user_home_type:dir getattr;
2216         dontaudit $1 user_home_type:file getattr;
2217 ')
2218
2219 ########################################
2220 ## <summary>
2221 ##      Do not audit attempts to read user home files.
2222 ## </summary>
2223 ## <param name="domain">
2224 ##      <summary>
2225 ##      Domain to not audit.
2226 ##      </summary>
2227 ## </param>
2228 #
2229 interface(`userdom_dontaudit_read_user_home_content_files',`
2230         gen_require(`
2231                 attribute user_home_type;
2232                 type user_home_dir_t;
2233         ')
2234
2235         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2236         dontaudit $1 user_home_type:dir list_dir_perms;
2237         dontaudit $1 user_home_type:file read_file_perms;
2238         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2239 ')
2240
2241 ########################################
2242 ## <summary>
2243 ##      Do not audit attempts to append user home files.
2244 ## </summary>
2245 ## <param name="domain">
2246 ##      <summary>
2247 ##      Domain to not audit.
2248 ##      </summary>
2249 ## </param>
2250 #
2251 interface(`userdom_dontaudit_append_user_home_content_files',`
2252         gen_require(`
2253                 type user_home_t;
2254         ')
2255
2256         dontaudit $1 user_home_t:file append_file_perms;
2257 ')
2258
2259 ########################################
2260 ## <summary>
2261 ##      Do not audit attempts to write user home files.
2262 ## </summary>
2263 ## <param name="domain">
2264 ##      <summary>
2265 ##      Domain to not audit.
2266 ##      </summary>
2267 ## </param>
2268 #
2269 interface(`userdom_dontaudit_write_user_home_content_files',`
2270         gen_require(`
2271                 type user_home_t;
2272         ')
2273
2274         dontaudit $1 user_home_t:file write_file_perms;
2275 ')
2276
2277 ########################################
2278 ## <summary>
2279 ##      Delete files in a user home subdirectory.
2280 ## </summary>
2281 ## <param name="domain">
2282 ##      <summary>
2283 ##      Domain allowed access.
2284 ##      </summary>
2285 ## </param>
2286 #
2287 interface(`userdom_delete_user_home_content_files',`
2288         gen_require(`
2289                 type user_home_t;
2290         ')
2291
2292         allow $1 user_home_t:file delete_file_perms;
2293 ')
2294
2295 ########################################
2296 ## <summary>
2297 ##      Delete all files in a user home subdirectory.
2298 ## </summary>
2299 ## <param name="domain">
2300 ##      <summary>
2301 ##      Domain allowed access.
2302 ##      </summary>
2303 ## </param>
2304 #
2305 interface(`userdom_delete_all_user_home_content_files',`
2306         gen_require(`
2307                 attribute user_home_type;
2308         ')
2309
2310         allow $1 user_home_type:file delete_file_perms;
2311 ')
2312
2313 ########################################
2314 ## <summary>
2315 ##      Delete sock files in a user home subdirectory.
2316 ## </summary>
2317 ## <param name="domain">
2318 ##      <summary>
2319 ##      Domain allowed access.
2320 ##      </summary>
2321 ## </param>
2322 #
2323 interface(`userdom_delete_user_home_content_sock_files',`
2324         gen_require(`
2325                 type user_home_t;
2326         ')
2327
2328         allow $1 user_home_t:sock_file delete_file_perms;
2329 ')
2330
2331 ########################################
2332 ## <summary>
2333 ##      Delete all sock files in a user home subdirectory.
2334 ## </summary>
2335 ## <param name="domain">
2336 ##      <summary>
2337 ##      Domain allowed access.
2338 ##      </summary>
2339 ## </param>
2340 #
2341 interface(`userdom_delete_all_user_home_content_sock_files',`
2342         gen_require(`
2343                 attribute user_home_type;
2344         ')
2345
2346         allow $1 user_home_type:sock_file delete_file_perms;
2347 ')
2348
2349 ########################################
2350 ## <summary>
2351 ##      Do not audit attempts to write user home files.
2352 ## </summary>
2353 ## <param name="domain">
2354 ##      <summary>
2355 ##      Domain to not audit.
2356 ##      </summary>
2357 ## </param>
2358 #
2359 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2360         gen_require(`
2361                 type user_home_t;
2362         ')
2363
2364         dontaudit $1 user_home_t:file relabel_file_perms;
2365 ')
2366
2367 ########################################
2368 ## <summary>
2369 ##      Read user home subdirectory symbolic links.
2370 ## </summary>
2371 ## <param name="domain">
2372 ##      <summary>
2373 ##      Domain allowed access.
2374 ##      </summary>
2375 ## </param>
2376 #
2377 interface(`userdom_read_user_home_content_symlinks',`
2378         gen_require(`
2379                 type user_home_dir_t, user_home_t;
2380         ')
2381
2382         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2383 ')
2384
2385 ########################################
2386 ## <summary>
2387 ##      Execute user home files.
2388 ## </summary>
2389 ## <param name="domain">
2390 ##      <summary>
2391 ##      Domain allowed access.
2392 ##      </summary>
2393 ## </param>
2394 ## <rolecap/>
2395 #
2396 interface(`userdom_exec_user_home_content_files',`
2397         gen_require(`
2398                 type user_home_dir_t;
2399                 attribute user_home_type;
2400         ')
2401
2402         files_search_home($1)
2403         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2404         dontaudit $1 user_home_type:sock_file execute;
2405         ')
2406
2407 ########################################
2408 ## <summary>
2409 ##      Do not audit attempts to execute user home files.
2410 ## </summary>
2411 ## <param name="domain">
2412 ##      <summary>
2413 ##      Domain to not audit.
2414 ##      </summary>
2415 ## </param>
2416 #
2417 interface(`userdom_dontaudit_exec_user_home_content_files',`
2418         gen_require(`
2419                 type user_home_t;
2420         ')
2421
2422         dontaudit $1 user_home_t:file exec_file_perms;
2423 ')
2424
2425 ########################################
2426 ## <summary>
2427 ##      Create, read, write, and delete files
2428 ##      in a user home subdirectory.
2429 ## </summary>
2430 ## <param name="domain">
2431 ##      <summary>
2432 ##      Domain allowed access.
2433 ##      </summary>
2434 ## </param>
2435 #
2436 interface(`userdom_manage_user_home_content_files',`
2437         gen_require(`
2438                 type user_home_dir_t, user_home_t;
2439         ')
2440
2441         manage_files_pattern($1, user_home_t, user_home_t)
2442         allow $1 user_home_dir_t:dir search_dir_perms;
2443         files_search_home($1)
2444 ')
2445
2446 ########################################
2447 ## <summary>
2448 ##      Do not audit attempts to create, read, write, and delete directories
2449 ##      in a user home subdirectory.
2450 ## </summary>
2451 ## <param name="domain">
2452 ##      <summary>
2453 ##      Domain to not audit.
2454 ##      </summary>
2455 ## </param>
2456 #
2457 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2458         gen_require(`
2459                 type user_home_dir_t, user_home_t;
2460         ')
2461
2462         dontaudit $1 user_home_t:dir manage_dir_perms;
2463 ')
2464
2465 ########################################
2466 ## <summary>
2467 ##      Create, read, write, and delete symbolic links
2468 ##      in a user home subdirectory.
2469 ## </summary>
2470 ## <param name="domain">
2471 ##      <summary>
2472 ##      Domain allowed access.
2473 ##      </summary>
2474 ## </param>
2475 #
2476 interface(`userdom_manage_user_home_content_symlinks',`
2477         gen_require(`
2478                 type user_home_dir_t, user_home_t;
2479         ')
2480
2481         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2482         allow $1 user_home_dir_t:dir search_dir_perms;
2483         files_search_home($1)
2484 ')
2485
2486 ########################################
2487 ## <summary>
2488 ##      Delete symbolic links in a user home directory.
2489 ## </summary>
2490 ## <param name="domain">
2491 ##      <summary>
2492 ##      Domain allowed access.
2493 ##      </summary>
2494 ## </param>
2495 #
2496 interface(`userdom_delete_user_home_content_symlinks',`
2497         gen_require(`
2498                 type user_home_t;
2499         ')
2500
2501         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2502 ')
2503
2504 ########################################
2505 ## <summary>
2506 ##      Delete all symbolic links in a user home directory.
2507 ## </summary>
2508 ## <param name="domain">
2509 ##      <summary>
2510 ##      Domain allowed access.
2511 ##      </summary>
2512 ## </param>
2513 #
2514 interface(`userdom_delete_all_user_home_content_symlinks',`
2515         gen_require(`
2516                 attribute user_home_type;
2517         ')
2518
2519         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2520 ')
2521
2522 ########################################
2523 ## <summary>
2524 ##      Create, read, write, and delete named pipes
2525 ##      in a user home subdirectory.
2526 ## </summary>
2527 ## <param name="domain">
2528 ##      <summary>
2529 ##      Domain allowed access.
2530 ##      </summary>
2531 ## </param>
2532 #
2533 interface(`userdom_manage_user_home_content_pipes',`
2534         gen_require(`
2535                 type user_home_dir_t, user_home_t;
2536         ')
2537
2538         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2539         allow $1 user_home_dir_t:dir search_dir_perms;
2540         files_search_home($1)
2541 ')
2542
2543 ########################################
2544 ## <summary>
2545 ##      Create, read, write, and delete named sockets
2546 ##      in a user home subdirectory.
2547 ## </summary>
2548 ## <param name="domain">
2549 ##      <summary>
2550 ##      Domain allowed access.
2551 ##      </summary>
2552 ## </param>
2553 #
2554 interface(`userdom_manage_user_home_content_sockets',`
2555         gen_require(`
2556                 type user_home_dir_t, user_home_t;
2557         ')
2558
2559         allow $1 user_home_dir_t:dir search_dir_perms;
2560         manage_sock_files_pattern($1, user_home_t, user_home_t)
2561         files_search_home($1)
2562 ')
2563
2564 ########################################
2565 ## <summary>
2566 ##      Create objects in a user home directory
2567 ##      with an automatic type transition to
2568 ##      a specified private type.
2569 ## </summary>
2570 ## <param name="domain">
2571 ##      <summary>
2572 ##      Domain allowed access.
2573 ##      </summary>
2574 ## </param>
2575 ## <param name="private_type">
2576 ##      <summary>
2577 ##      The type of the object to create.
2578 ##      </summary>
2579 ## </param>
2580 ## <param name="object_class">
2581 ##      <summary>
2582 ##      The class of the object to be created.
2583 ##      </summary>
2584 ## </param>
2585 #
2586 interface(`userdom_user_home_dir_filetrans',`
2587         gen_require(`
2588                 type user_home_dir_t;
2589         ')
2590
2591         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2592         files_search_home($1)
2593 ')
2594
2595 ########################################
2596 ## <summary>
2597 ##      Create objects in a user home directory
2598 ##      with an automatic type transition to
2599 ##      a specified private type.
2600 ## </summary>
2601 ## <param name="domain">
2602 ##      <summary>
2603 ##      Domain allowed access.
2604 ##      </summary>
2605 ## </param>
2606 ## <param name="private_type">
2607 ##      <summary>
2608 ##      The type of the object to create.
2609 ##      </summary>
2610 ## </param>
2611 ## <param name="object_class">
2612 ##      <summary>
2613 ##      The class of the object to be created.
2614 ##      </summary>
2615 ## </param>
2616 #
2617 interface(`userdom_user_home_content_filetrans',`
2618         gen_require(`
2619                 type user_home_dir_t, user_home_t;
2620         ')
2621
2622         filetrans_pattern($1, user_home_t, $2, $3)
2623         allow $1 user_home_dir_t:dir search_dir_perms;
2624         files_search_home($1)
2625 ')
2626
2627 ########################################
2628 ## <summary>
2629 ##      Create objects in a user home directory
2630 ##      with an automatic type transition to
2631 ##      the user home file type.
2632 ## </summary>
2633 ## <param name="domain">
2634 ##      <summary>
2635 ##      Domain allowed access.
2636 ##      </summary>
2637 ## </param>
2638 ## <param name="object_class">
2639 ##      <summary>
2640 ##      The class of the object to be created.
2641 ##      </summary>
2642 ## </param>
2643 #
2644 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2645         gen_require(`
2646                 type user_home_dir_t, user_home_t;
2647         ')
2648
2649         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2650         files_search_home($1)
2651 ')
2652
2653 ########################################
2654 ## <summary>
2655 ##      Write to user temporary named sockets.
2656 ## </summary>
2657 ## <param name="domain">
2658 ##      <summary>
2659 ##      Domain allowed access.
2660 ##      </summary>
2661 ## </param>
2662 #
2663 interface(`userdom_write_user_tmp_sockets',`
2664         gen_require(`
2665                 type user_tmp_t;
2666         ')
2667
2668         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2669         files_search_tmp($1)
2670 ')
2671
2672 ########################################
2673 ## <summary>
2674 ##      List user temporary directories.
2675 ## </summary>
2676 ## <param name="domain">
2677 ##      <summary>
2678 ##      Domain allowed access.
2679 ##      </summary>
2680 ## </param>
2681 #
2682 interface(`userdom_list_user_tmp',`
2683         gen_require(`
2684                 type user_tmp_t;
2685         ')
2686
2687         allow $1 user_tmp_t:dir list_dir_perms;
2688         files_search_tmp($1)
2689 ')
2690
2691 ########################################
2692 ## <summary>
2693 ##      Do not audit attempts to list user
2694 ##      temporary directories.
2695 ## </summary>
2696 ## <param name="domain">
2697 ##      <summary>
2698 ##      Domain to not audit.
2699 ##      </summary>
2700 ## </param>
2701 #
2702 interface(`userdom_dontaudit_list_user_tmp',`
2703         gen_require(`
2704                 type user_tmp_t;
2705         ')
2706
2707         dontaudit $1 user_tmp_t:dir list_dir_perms;
2708 ')
2709
2710 ########################################
2711 ## <summary>
2712 ##      Do not audit attempts to manage users
2713 ##      temporary directories.
2714 ## </summary>
2715 ## <param name="domain">
2716 ##      <summary>
2717 ##      Domain to not audit.
2718 ##      </summary>
2719 ## </param>
2720 #
2721 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2722         gen_require(`
2723                 type user_tmp_t;
2724         ')
2725
2726         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2727 ')
2728
2729 ########################################
2730 ## <summary>
2731 ##      Read user temporary files.
2732 ## </summary>
2733 ## <param name="domain">
2734 ##      <summary>
2735 ##      Domain allowed access.
2736 ##      </summary>
2737 ## </param>
2738 #
2739 interface(`userdom_read_user_tmp_files',`
2740         gen_require(`
2741                 type user_tmp_t;
2742         ')
2743
2744         read_files_pattern($1, user_tmp_t, user_tmp_t)
2745         allow $1 user_tmp_t:dir list_dir_perms;
2746         files_search_tmp($1)
2747 ')
2748
2749 ########################################
2750 ## <summary>
2751 ##      Do not audit attempts to read users
2752 ##      temporary files.
2753 ## </summary>
2754 ## <param name="domain">
2755 ##      <summary>
2756 ##      Domain to not audit.
2757 ##      </summary>
2758 ## </param>
2759 #
2760 interface(`userdom_dontaudit_read_user_tmp_files',`
2761         gen_require(`
2762                 type user_tmp_t;
2763         ')
2764
2765         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2766 ')
2767
2768 ########################################
2769 ## <summary>
2770 ##      Do not audit attempts to append users
2771 ##      temporary files.
2772 ## </summary>
2773 ## <param name="domain">
2774 ##      <summary>
2775 ##      Domain to not audit.
2776 ##      </summary>
2777 ## </param>
2778 #
2779 interface(`userdom_dontaudit_append_user_tmp_files',`
2780         gen_require(`
2781                 type user_tmp_t;
2782         ')
2783
2784         dontaudit $1 user_tmp_t:file append_file_perms;
2785 ')
2786
2787 ########################################
2788 ## <summary>
2789 ##      Read and write user temporary files.
2790 ## </summary>
2791 ## <param name="domain">
2792 ##      <summary>
2793 ##      Domain allowed access.
2794 ##      </summary>
2795 ## </param>
2796 #
2797 interface(`userdom_rw_user_tmp_files',`
2798         gen_require(`
2799                 type user_tmp_t;
2800         ')
2801
2802         allow $1 user_tmp_t:dir list_dir_perms;
2803         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2804         files_search_tmp($1)
2805 ')
2806
2807 ########################################
2808 ## <summary>
2809 ##      Do not audit attempts to manage users
2810 ##      temporary files.
2811 ## </summary>
2812 ## <param name="domain">
2813 ##      <summary>
2814 ##      Domain to not audit.
2815 ##      </summary>
2816 ## </param>
2817 #
2818 interface(`userdom_dontaudit_manage_user_tmp_files',`
2819         gen_require(`
2820                 type user_tmp_t;
2821         ')
2822
2823         dontaudit $1 user_tmp_t:file manage_file_perms;
2824 ')
2825
2826 ########################################
2827 ## <summary>
2828 ##      Read user temporary symbolic links.
2829 ## </summary>
2830 ## <param name="domain">
2831 ##      <summary>
2832 ##      Domain allowed access.
2833 ##      </summary>
2834 ## </param>
2835 #
2836 interface(`userdom_read_user_tmp_symlinks',`
2837         gen_require(`
2838                 type user_tmp_t;
2839         ')
2840
2841         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2842         allow $1 user_tmp_t:dir list_dir_perms;
2843         files_search_tmp($1)
2844 ')
2845
2846 ########################################
2847 ## <summary>
2848 ##      Create, read, write, and delete user
2849 ##      temporary directories.
2850 ## </summary>
2851 ## <param name="domain">
2852 ##      <summary>
2853 ##      Domain allowed access.
2854 ##      </summary>
2855 ## </param>
2856 #
2857 interface(`userdom_manage_user_tmp_dirs',`
2858         gen_require(`
2859                 type user_tmp_t;
2860         ')
2861
2862         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2863         files_search_tmp($1)
2864 ')
2865
2866 ########################################
2867 ## <summary>
2868 ##      Create, read, write, and delete user
2869 ##      temporary files.
2870 ## </summary>
2871 ## <param name="domain">
2872 ##      <summary>
2873 ##      Domain allowed access.
2874 ##      </summary>
2875 ## </param>
2876 #
2877 interface(`userdom_manage_user_tmp_files',`
2878         gen_require(`
2879                 type user_tmp_t;
2880         ')
2881
2882         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2883         files_search_tmp($1)
2884 ')
2885
2886 ########################################
2887 ## <summary>
2888 ##      Create, read, write, and delete user
2889 ##      temporary symbolic links.
2890 ## </summary>
2891 ## <param name="domain">
2892 ##      <summary>
2893 ##      Domain allowed access.
2894 ##      </summary>
2895 ## </param>
2896 #
2897 interface(`userdom_manage_user_tmp_symlinks',`
2898         gen_require(`
2899                 type user_tmp_t;
2900         ')
2901
2902         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2903         files_search_tmp($1)
2904 ')
2905
2906 ########################################
2907 ## <summary>
2908 ##      Create, read, write, and delete user
2909 ##      temporary named pipes.
2910 ## </summary>
2911 ## <param name="domain">
2912 ##      <summary>
2913 ##      Domain allowed access.
2914 ##      </summary>
2915 ## </param>
2916 #
2917 interface(`userdom_manage_user_tmp_pipes',`
2918         gen_require(`
2919                 type user_tmp_t;
2920         ')
2921
2922         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2923         files_search_tmp($1)
2924 ')
2925
2926 ########################################
2927 ## <summary>
2928 ##      Create, read, write, and delete user
2929 ##      temporary named sockets.
2930 ## </summary>
2931 ## <param name="domain">
2932 ##      <summary>
2933 ##      Domain allowed access.
2934 ##      </summary>
2935 ## </param>
2936 #
2937 interface(`userdom_manage_user_tmp_sockets',`
2938         gen_require(`
2939                 type user_tmp_t;
2940         ')
2941
2942         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2943         files_search_tmp($1)
2944 ')
2945
2946 ########################################
2947 ## <summary>
2948 ##      Create objects in a user temporary directory
2949 ##      with an automatic type transition to
2950 ##      a specified private type.
2951 ## </summary>
2952 ## <param name="domain">
2953 ##      <summary>
2954 ##      Domain allowed access.
2955 ##      </summary>
2956 ## </param>
2957 ## <param name="private_type">
2958 ##      <summary>
2959 ##      The type of the object to create.
2960 ##      </summary>
2961 ## </param>
2962 ## <param name="object_class">
2963 ##      <summary>
2964 ##      The class of the object to be created.
2965 ##      </summary>
2966 ## </param>
2967 #
2968 interface(`userdom_user_tmp_filetrans',`
2969         gen_require(`
2970                 type user_tmp_t;
2971         ')
2972
2973         filetrans_pattern($1, user_tmp_t, $2, $3)
2974         files_search_tmp($1)
2975 ')
2976
2977 ########################################
2978 ## <summary>
2979 ##      Create objects in the temporary directory
2980 ##      with an automatic type transition to
2981 ##      the user temporary type.
2982 ## </summary>
2983 ## <param name="domain">
2984 ##      <summary>
2985 ##      Domain allowed access.
2986 ##      </summary>
2987 ## </param>
2988 ## <param name="object_class">
2989 ##      <summary>
2990 ##      The class of the object to be created.
2991 ##      </summary>
2992 ## </param>
2993 #
2994 interface(`userdom_tmp_filetrans_user_tmp',`
2995         gen_require(`
2996                 type user_tmp_t;
2997         ')
2998
2999         files_tmp_filetrans($1, user_tmp_t, $2)
3000 ')
3001
3002 ########################################
3003 ## <summary>
3004 ##      Read user tmpfs files.
3005 ## </summary>
3006 ## <param name="domain">
3007 ##      <summary>
3008 ##      Domain allowed access.
3009 ##      </summary>
3010 ## </param>
3011 #
3012 interface(`userdom_read_user_tmpfs_files',`
3013         gen_require(`
3014                 type user_tmpfs_t;
3015         ')
3016
3017         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3018         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3019         allow $1 user_tmpfs_t:dir list_dir_perms;
3020         fs_search_tmpfs($1)
3021 ')
3022
3023 ########################################
3024 ## <summary>
3025 ##      Read/Write user tmpfs files.
3026 ## </summary>
3027 ## <param name="domain">
3028 ##      <summary>
3029 ##      Domain allowed access.
3030 ##      </summary>
3031 ## </param>
3032 #
3033 interface(`userdom_rw_user_tmpfs_files',`
3034         gen_require(`
3035                 type user_tmpfs_t;
3036         ')
3037
3038         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3039         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3040         allow $1 user_tmpfs_t:dir list_dir_perms;
3041         fs_search_tmpfs($1)
3042 ')
3043
3044 ########################################
3045 ## <summary>
3046 ##      Get the attributes of a user domain tty.
3047 ## </summary>
3048 ## <param name="domain">
3049 ##      <summary>
3050 ##      Domain allowed access.
3051 ##      </summary>
3052 ## </param>
3053 #
3054 interface(`userdom_getattr_user_ttys',`
3055         gen_require(`
3056                 type user_tty_device_t;
3057         ')
3058
3059         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3060 ')
3061
3062 ########################################
3063 ## <summary>
3064 ##      Do not audit attempts to get the attributes of a user domain tty.
3065 ## </summary>
3066 ## <param name="domain">
3067 ##      <summary>
3068 ##      Domain to not audit.
3069 ##      </summary>
3070 ## </param>
3071 #
3072 interface(`userdom_dontaudit_getattr_user_ttys',`
3073         gen_require(`
3074                 type user_tty_device_t;
3075         ')
3076
3077         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3078 ')
3079
3080 ########################################
3081 ## <summary>
3082 ##      Set the attributes of a user domain tty.
3083 ## </summary>
3084 ## <param name="domain">
3085 ##      <summary>
3086 ##      Domain allowed access.
3087 ##      </summary>
3088 ## </param>
3089 #
3090 interface(`userdom_setattr_user_ttys',`
3091         gen_require(`
3092                 type user_tty_device_t;
3093         ')
3094
3095         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3096 ')
3097
3098 ########################################
3099 ## <summary>
3100 ##      Do not audit attempts to set the attributes of a user domain tty.
3101 ## </summary>
3102 ## <param name="domain">
3103 ##      <summary>
3104 ##      Domain to not audit.
3105 ##      </summary>
3106 ## </param>
3107 #
3108 interface(`userdom_dontaudit_setattr_user_ttys',`
3109         gen_require(`
3110                 type user_tty_device_t;
3111         ')
3112
3113         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3114 ')
3115
3116 ########################################
3117 ## <summary>
3118 ##      Read and write a user domain tty.
3119 ## </summary>
3120 ## <param name="domain">
3121 ##      <summary>
3122 ##      Domain allowed access.
3123 ##      </summary>
3124 ## </param>
3125 #
3126 interface(`userdom_use_user_ttys',`
3127         gen_require(`
3128                 type user_tty_device_t;
3129         ')
3130
3131         allow $1 user_tty_device_t:chr_file rw_term_perms;
3132 ')
3133
3134 ########################################
3135 ## <summary>
3136 ##      Read and write a inherited user domain tty.
3137 ## </summary>
3138 ## <param name="domain">
3139 ##      <summary>
3140 ##      Domain allowed access.
3141 ##      </summary>
3142 ## </param>
3143 #
3144 interface(`userdom_use_inherited_user_ttys',`
3145         gen_require(`
3146                 type user_tty_device_t;
3147         ')
3148
3149         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3150 ')
3151
3152 ########################################
3153 ## <summary>
3154 ##      Read and write a user domain pty.
3155 ## </summary>
3156 ## <param name="domain">
3157 ##      <summary>
3158 ##      Domain allowed access.
3159 ##      </summary>
3160 ## </param>
3161 #
3162 interface(`userdom_use_user_ptys',`
3163         gen_require(`
3164                 type user_devpts_t;
3165         ')
3166
3167         allow $1 user_devpts_t:chr_file rw_term_perms;
3168 ')
3169
3170 ########################################
3171 ## <summary>
3172 ##      Read and write a inherited user domain pty.
3173 ## </summary>
3174 ## <param name="domain">
3175 ##      <summary>
3176 ##      Domain allowed access.
3177 ##      </summary>
3178 ## </param>
3179 #
3180 interface(`userdom_use_inherited_user_ptys',`
3181         gen_require(`
3182                 type user_devpts_t;
3183         ')
3184
3185         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3186 ')
3187
3188 ########################################
3189 ## <summary>
3190 ##      Read and write a inherited user TTYs and PTYs.
3191 ## </summary>
3192 ## <desc>
3193 ##      <p>
3194 ##      Allow the specified domain to read and write inherited user
3195 ##      TTYs and PTYs. This will allow the domain to
3196 ##      interact with the user via the terminal. Typically
3197 ##      all interactive applications will require this
3198 ##      access.
3199 ##      </p>
3200 ## </desc>
3201 ## <param name="domain">
3202 ##      <summary>
3203 ##      Domain allowed access.
3204 ##      </summary>
3205 ## </param>
3206 ## <infoflow type="both" weight="10"/>
3207 #
3208 interface(`userdom_use_inherited_user_terminals',`
3209         gen_require(`
3210                 type user_tty_device_t, user_devpts_t;
3211         ')
3212
3213         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3214         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3215 ')
3216
3217 #######################################
3218 ## <summary>
3219 ##  Allow attempts to read and write
3220 ##  a user domain tty and pty.
3221 ## </summary>
3222 ## <param name="domain">
3223 ##  <summary>
3224 ##  Domain to not audit.
3225 ##  </summary>
3226 ## </param>
3227 #
3228 interface(`userdom_use_user_terminals',`
3229     gen_require(`
3230         type user_tty_device_t, user_devpts_t;
3231     ')
3232
3233     allow $1 user_tty_device_t:chr_file rw_term_perms;
3234     allow $1 user_devpts_t:chr_file rw_term_perms;
3235 ')
3236
3237 ########################################
3238 ## <summary>
3239 ##      Do not audit attempts to read and write
3240 ##      a user domain tty and pty.
3241 ## </summary>
3242 ## <param name="domain">
3243 ##      <summary>
3244 ##      Domain to not audit.
3245 ##      </summary>
3246 ## </param>
3247 #
3248 interface(`userdom_dontaudit_use_user_terminals',`
3249         gen_require(`
3250                 type user_tty_device_t, user_devpts_t;
3251         ')
3252
3253         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3254         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3255 ')
3256
3257
3258 ########################################
3259 ## <summary>
3260 ##      Get attributes of user domain tty and pty.
3261 ## </summary>
3262 ## <param name="domain">
3263 ##      <summary>
3264 ##      Domain allowed access.
3265 ##      </summary>
3266 ## </param>
3267 #
3268 interface(`userdom_getattr_user_terminals',`
3269         gen_require(`
3270                 type user_tty_device_t, user_devpts_t;
3271         ')
3272
3273         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3274 ')
3275
3276 ########################################
3277 ## <summary>
3278 ##      Execute a shell in all user domains.  This
3279 ##      is an explicit transition, requiring the
3280 ##      caller to use setexeccon().
3281 ## </summary>
3282 ## <param name="domain">
3283 ##      <summary>
3284 ##      Domain allowed to transition.
3285 ##      </summary>
3286 ## </param>
3287 #
3288 interface(`userdom_spec_domtrans_all_users',`
3289         gen_require(`
3290                 attribute userdomain;
3291         ')
3292
3293         corecmd_shell_spec_domtrans($1, userdomain)
3294         allow userdomain $1:fd use;
3295         allow userdomain $1:fifo_file rw_file_perms;
3296         allow userdomain $1:process sigchld;
3297 ')
3298
3299 ########################################
3300 ## <summary>
3301 ##      Execute an Xserver session in all unprivileged user domains.  This
3302 ##      is an explicit transition, requiring the
3303 ##      caller to use setexeccon().
3304 ## </summary>
3305 ## <param name="domain">
3306 ##      <summary>
3307 ##      Domain allowed to transition.
3308 ##      </summary>
3309 ## </param>
3310 #
3311 interface(`userdom_xsession_spec_domtrans_all_users',`
3312         gen_require(`
3313                 attribute userdomain;
3314         ')
3315
3316         xserver_xsession_spec_domtrans($1, userdomain)
3317         allow userdomain $1:fd use;
3318         allow userdomain $1:fifo_file rw_file_perms;
3319         allow userdomain $1:process sigchld;
3320 ')
3321
3322 ########################################
3323 ## <summary>
3324 ##      Execute a shell in all unprivileged user domains.  This
3325 ##      is an explicit transition, requiring the
3326 ##      caller to use setexeccon().
3327 ## </summary>
3328 ## <param name="domain">
3329 ##      <summary>
3330 ##      Domain allowed to transition.
3331 ##      </summary>
3332 ## </param>
3333 #
3334 interface(`userdom_spec_domtrans_unpriv_users',`
3335         gen_require(`
3336                 attribute unpriv_userdomain;
3337         ')
3338
3339         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3340         allow unpriv_userdomain $1:fd use;
3341         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3342         allow unpriv_userdomain $1:process sigchld;
3343 ')
3344
3345 ########################################
3346 ## <summary>
3347 ##      Execute an Xserver session in all unprivileged user domains.  This
3348 ##      is an explicit transition, requiring the
3349 ##      caller to use setexeccon().
3350 ## </summary>
3351 ## <param name="domain">
3352 ##      <summary>
3353 ##      Domain allowed to transition.
3354 ##      </summary>
3355 ## </param>
3356 #
3357 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3358         gen_require(`
3359                 attribute unpriv_userdomain;
3360         ')
3361
3362         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3363         allow unpriv_userdomain $1:fd use;
3364         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3365         allow unpriv_userdomain $1:process sigchld;
3366 ')
3367
3368 ########################################
3369 ## <summary>
3370 ##      Manage unpriviledged user SysV sempaphores.
3371 ## </summary>
3372 ## <param name="domain">
3373 ##      <summary>
3374 ##      Domain allowed access.
3375 ##      </summary>
3376 ## </param>
3377 #
3378 interface(`userdom_manage_unpriv_user_semaphores',`
3379         gen_require(`
3380                 attribute unpriv_userdomain;
3381         ')
3382
3383         allow $1 unpriv_userdomain:sem create_sem_perms;
3384 ')
3385
3386 ########################################
3387 ## <summary>
3388 ##      Manage unpriviledged user SysV shared
3389 ##      memory segments.
3390 ## </summary>
3391 ## <param name="domain">
3392 ##      <summary>
3393 ##      Domain allowed access.
3394 ##      </summary>
3395 ## </param>
3396 #
3397 interface(`userdom_manage_unpriv_user_shared_mem',`
3398         gen_require(`
3399                 attribute unpriv_userdomain;
3400         ')
3401
3402         allow $1 unpriv_userdomain:shm create_shm_perms;
3403 ')
3404
3405 ########################################
3406 ## <summary>
3407 ##      Execute bin_t in the unprivileged user domains. This
3408 ##      is an explicit transition, requiring the
3409 ##      caller to use setexeccon().
3410 ## </summary>
3411 ## <param name="domain">
3412 ##      <summary>
3413 ##      Domain allowed to transition.
3414 ##      </summary>
3415 ## </param>
3416 #
3417 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3418         gen_require(`
3419                 attribute unpriv_userdomain;
3420         ')
3421
3422         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3423         allow unpriv_userdomain $1:fd use;
3424         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3425         allow unpriv_userdomain $1:process sigchld;
3426 ')
3427
3428 ########################################
3429 ## <summary>
3430 ##      Execute all entrypoint files in unprivileged user
3431 ##      domains. This is an explicit transition, requiring the
3432 ##      caller to use setexeccon().
3433 ## </summary>
3434 ## <param name="domain">
3435 ##      <summary>
3436 ##      Domain allowed access.
3437 ##      </summary>
3438 ## </param>
3439 #
3440 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3441         gen_require(`
3442                 attribute unpriv_userdomain;
3443         ')
3444
3445         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3446         allow unpriv_userdomain $1:fd use;
3447         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3448         allow unpriv_userdomain $1:process sigchld;
3449 ')
3450
3451 ########################################
3452 ## <summary>
3453 ##      Search users home directories.
3454 ## </summary>
3455 ## <param name="domain">
3456 ##      <summary>
3457 ##      Domain allowed access.
3458 ##      </summary>
3459 ## </param>
3460 #
3461 interface(`userdom_search_user_home_content',`
3462         gen_require(`
3463                 type user_home_dir_t;
3464                 attribute user_home_type;
3465         ')
3466
3467         files_list_home($1)
3468         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3469         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3470 ')
3471
3472 ########################################
3473 ## <summary>
3474 ##      Send general signals to unprivileged user domains.
3475 ## </summary>
3476 ## <param name="domain">
3477 ##      <summary>
3478 ##      Domain allowed access.
3479 ##      </summary>
3480 ## </param>
3481 #
3482 interface(`userdom_signal_unpriv_users',`
3483         gen_require(`
3484                 attribute unpriv_userdomain;
3485         ')
3486
3487         allow $1 unpriv_userdomain:process signal;
3488 ')
3489
3490 ########################################
3491 ## <summary>
3492 ##      Inherit the file descriptors from unprivileged user domains.
3493 ## </summary>
3494 ## <param name="domain">
3495 ##      <summary>
3496 ##      Domain allowed access.
3497 ##      </summary>
3498 ## </param>
3499 #
3500 interface(`userdom_use_unpriv_users_fds',`
3501         gen_require(`
3502                 attribute unpriv_userdomain;
3503         ')
3504
3505         allow $1 unpriv_userdomain:fd use;
3506 ')
3507
3508 ########################################
3509 ## <summary>
3510 ##      Do not audit attempts to inherit the file descriptors
3511 ##      from unprivileged user domains.
3512 ## </summary>
3513 ## <desc>
3514 ##      <p>
3515 ##      Do not audit attempts to inherit the file descriptors
3516 ##      from unprivileged user domains. This will supress
3517 ##      SELinux denial messages when the specified domain is denied
3518 ##      the permission to inherit these file descriptors.
3519 ##      </p>
3520 ## </desc>
3521 ## <param name="domain">
3522 ##      <summary>
3523 ##      Domain to not audit.
3524 ##      </summary>
3525 ## </param>
3526 ## <infoflow type="none"/>
3527 #
3528 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3529         gen_require(`
3530                 attribute unpriv_userdomain;
3531         ')
3532
3533         dontaudit $1 unpriv_userdomain:fd use;
3534 ')
3535
3536 ########################################
3537 ## <summary>
3538 ##      Do not audit attempts to use user ptys.
3539 ## </summary>
3540 ## <param name="domain">
3541 ##      <summary>
3542 ##      Domain to not audit.
3543 ##      </summary>
3544 ## </param>
3545 #
3546 interface(`userdom_dontaudit_use_user_ptys',`
3547         gen_require(`
3548                 type user_devpts_t;
3549         ')
3550
3551         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3552 ')
3553
3554 ########################################
3555 ## <summary>
3556 ##      Relabel files to unprivileged user pty types.
3557 ## </summary>
3558 ## <param name="domain">
3559 ##      <summary>
3560 ##      Domain allowed access.
3561 ##      </summary>
3562 ## </param>
3563 #
3564 interface(`userdom_relabelto_user_ptys',`
3565         gen_require(`
3566                 type user_devpts_t;
3567         ')
3568
3569         allow $1 user_devpts_t:chr_file relabelto;
3570 ')
3571
3572 ########################################
3573 ## <summary>
3574 ##      Do not audit attempts to relabel files from
3575 ##      user pty types.
3576 ## </summary>
3577 ## <param name="domain">
3578 ##      <summary>
3579 ##      Domain to not audit.
3580 ##      </summary>
3581 ## </param>
3582 #
3583 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3584         gen_require(`
3585                 type user_devpts_t;
3586         ')
3587
3588         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3589 ')
3590
3591 ########################################
3592 ## <summary>
3593 ##      Write all users files in /tmp
3594 ## </summary>
3595 ## <param name="domain">
3596 ##      <summary>
3597 ##      Domain allowed access.
3598 ##      </summary>
3599 ## </param>
3600 #
3601 interface(`userdom_write_user_tmp_files',`
3602         gen_require(`
3603                 type user_tmp_t;
3604         ')
3605
3606         write_files_pattern($1, user_tmp_t, user_tmp_t)
3607 ')
3608
3609 ########################################
3610 ## <summary>
3611 ##      Do not audit attempts to write users
3612 ##      temporary files.
3613 ## </summary>
3614 ## <param name="domain">
3615 ##      <summary>
3616 ##      Domain to not audit.
3617 ##      </summary>
3618 ## </param>
3619 #
3620 interface(`userdom_dontaudit_write_user_tmp_files',`
3621         gen_require(`
3622                 type user_tmp_t;
3623         ')
3624
3625         dontaudit $1 user_tmp_t:file write;
3626 ')
3627
3628 ########################################
3629 ## <summary>
3630 ##      Do not audit attempts to read/write users
3631 ##      temporary fifo files.
3632 ## </summary>
3633 ## <param name="domain">
3634 ##      <summary>
3635 ##      Domain to not audit.
3636 ##      </summary>
3637 ## </param>
3638 #
3639 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3640         gen_require(`
3641                 type user_tmp_t;
3642         ')
3643
3644         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3645 ')
3646
3647 ########################################
3648 ## <summary>
3649 ##      Do not audit attempts to use user ttys.
3650 ## </summary>
3651 ## <param name="domain">
3652 ##      <summary>
3653 ##      Domain to not audit.
3654 ##      </summary>
3655 ## </param>
3656 #
3657 interface(`userdom_dontaudit_use_user_ttys',`
3658         gen_require(`
3659                 type user_tty_device_t;
3660         ')
3661
3662         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3663 ')
3664
3665 ########################################
3666 ## <summary>
3667 ##      Read the process state of all user domains.
3668 ## </summary>
3669 ## <param name="domain">
3670 ##      <summary>
3671 ##      Domain allowed access.
3672 ##      </summary>
3673 ## </param>
3674 #
3675 interface(`userdom_read_all_users_state',`
3676         gen_require(`
3677                 attribute userdomain;
3678         ')
3679
3680         read_files_pattern($1, userdomain, userdomain)
3681         read_lnk_files_pattern($1,userdomain,userdomain)
3682         kernel_search_proc($1)
3683 ')
3684
3685 ########################################
3686 ## <summary>
3687 ##      Get the attributes of all user domains.
3688 ## </summary>
3689 ## <param name="domain">
3690 ##      <summary>
3691 ##      Domain allowed access.
3692 ##      </summary>
3693 ## </param>
3694 #
3695 interface(`userdom_getattr_all_users',`
3696         gen_require(`
3697                 attribute userdomain;
3698         ')
3699
3700         allow $1 userdomain:process getattr;
3701 ')
3702
3703 ########################################
3704 ## <summary>
3705 ##      Inherit the file descriptors from all user domains
3706 ## </summary>
3707 ## <param name="domain">
3708 ##      <summary>
3709 ##      Domain allowed access.
3710 ##      </summary>
3711 ## </param>
3712 #
3713 interface(`userdom_use_all_users_fds',`
3714         gen_require(`
3715                 attribute userdomain;
3716         ')
3717
3718         allow $1 userdomain:fd use;
3719 ')
3720
3721 ########################################
3722 ## <summary>
3723 ##      Do not audit attempts to inherit the file
3724 ##      descriptors from any user domains.
3725 ## </summary>
3726 ## <param name="domain">
3727 ##      <summary>
3728 ##      Domain to not audit.
3729 ##      </summary>
3730 ## </param>
3731 #
3732 interface(`userdom_dontaudit_use_all_users_fds',`
3733         gen_require(`
3734                 attribute userdomain;
3735         ')
3736
3737         dontaudit $1 userdomain:fd use;
3738 ')
3739
3740 ########################################
3741 ## <summary>
3742 ##      Send general signals to all user domains.
3743 ## </summary>
3744 ## <param name="domain">
3745 ##      <summary>
3746 ##      Domain allowed access.
3747 ##      </summary>
3748 ## </param>
3749 #
3750 interface(`userdom_signal_all_users',`
3751         gen_require(`
3752                 attribute userdomain;
3753         ')
3754
3755         allow $1 userdomain:process signal;
3756 ')
3757
3758 ########################################
3759 ## <summary>
3760 ##      Send kill signals to all user domains.
3761 ## </summary>
3762 ## <param name="domain">
3763 ##      <summary>
3764 ##      Domain allowed access.
3765 ##      </summary>
3766 ## </param>
3767 #
3768 interface(`userdom_kill_all_users',`
3769         gen_require(`
3770                 attribute userdomain;
3771         ')
3772
3773         allow $1 userdomain:process sigkill;
3774 ')
3775
3776 ########################################
3777 ## <summary>
3778 ##      Send a SIGCHLD signal to all user domains.
3779 ## </summary>
3780 ## <param name="domain">
3781 ##      <summary>
3782 ##      Domain allowed access.
3783 ##      </summary>
3784 ## </param>
3785 #
3786 interface(`userdom_sigchld_all_users',`
3787         gen_require(`
3788                 attribute userdomain;
3789         ')
3790
3791         allow $1 userdomain:process sigchld;
3792 ')
3793
3794 ########################################
3795 ## <summary>
3796 ##      Create keys for all user domains.
3797 ## </summary>
3798 ## <param name="domain">
3799 ##      <summary>
3800 ##      Domain allowed access.
3801 ##      </summary>
3802 ## </param>
3803 #
3804 interface(`userdom_create_all_users_keys',`
3805         gen_require(`
3806                 attribute userdomain;
3807         ')
3808
3809         allow $1 userdomain:key create;
3810 ')
3811
3812 ########################################
3813 ## <summary>
3814 ##      Send a dbus message to all user domains.
3815 ## </summary>
3816 ## <param name="domain">
3817 ##      <summary>
3818 ##      Domain allowed access.
3819 ##      </summary>
3820 ## </param>
3821 #
3822 interface(`userdom_dbus_send_all_users',`
3823         gen_require(`
3824                 attribute userdomain;
3825                 class dbus send_msg;
3826         ')
3827
3828         allow $1 userdomain:dbus send_msg;
3829 ')
3830
3831 ########################################
3832 ## <summary>
3833 ##      Allow apps to set rlimits on userdomain
3834 ## </summary>
3835 ## <param name="domain">
3836 ##      <summary>
3837 ##      Domain allowed access.
3838 ##      </summary>
3839 ## </param>
3840 #
3841 interface(`userdom_set_rlimitnh',`
3842         gen_require(`
3843                 attribute userdomain;
3844         ')
3845
3846         allow $1 userdomain:process rlimitinh;
3847 ')
3848
3849 ########################################
3850 ## <summary>
3851 ##      Define this type as a Allow apps to set rlimits on userdomain
3852 ## </summary>
3853 ## <param name="domain">
3854 ##      <summary>
3855 ##      Domain allowed access.
3856 ##      </summary>
3857 ## </param>
3858 ## <param name="userdomain_prefix">
3859 ##      <summary>
3860 ##      The prefix of the user domain (e.g., user
3861 ##      is the prefix for user_t).
3862 ## </summary>
3863 ## </param>
3864 ## <param name="domain">
3865 ##      <summary>
3866 ##      Domain allowed access.
3867 ##      </summary>
3868 ## </param>
3869 #
3870 template(`userdom_unpriv_usertype',`
3871         gen_require(`
3872                 attribute unpriv_userdomain, userdomain;
3873                 attribute $1_usertype;
3874         ')
3875         typeattribute $2  $1_usertype;
3876         typeattribute $2  unpriv_userdomain;
3877         typeattribute $2  userdomain;
3878
3879         auth_use_nsswitch($2)
3880         ubac_constrained($2)
3881 ')
3882
3883 ########################################
3884 ## <summary>
3885 ##      Connect to users over an unix stream socket.
3886 ## </summary>
3887 ## <param name="domain">
3888 ##      <summary>
3889 ##      Domain allowed access.
3890 ##      </summary>
3891 ## </param>
3892 #
3893 interface(`userdom_stream_connect',`
3894         gen_require(`
3895                 type user_tmp_t;
3896                 attribute userdomain;
3897         ')
3898
3899         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3900 ')
3901
3902 ########################################
3903 ## <summary>
3904 ##      Ptrace user domains.
3905 ## </summary>
3906 ## <param name="domain">
3907 ##      <summary>
3908 ##      Domain allowed access.
3909 ##      </summary>
3910 ## </param>
3911 #
3912 interface(`userdom_ptrace_all_users',`
3913         gen_require(`
3914                 attribute userdomain;
3915         ')
3916
3917         allow $1 userdomain:process ptrace;
3918 ')
3919
3920 ########################################
3921 ## <summary>
3922 ##      dontaudit Search /root
3923 ## </summary>
3924 ## <param name="domain">
3925 ##      <summary>
3926 ##      Domain to not audit.
3927 ##      </summary>
3928 ## </param>
3929 #
3930 interface(`userdom_dontaudit_search_admin_dir',`
3931         gen_require(`
3932                 type admin_home_t;
3933         ')
3934
3935         dontaudit $1 admin_home_t:dir search_dir_perms;
3936 ')
3937
3938 ########################################
3939 ## <summary>
3940 ##      dontaudit list /root
3941 ## </summary>
3942 ## <param name="domain">
3943 ##      <summary>
3944 ##      Domain to not audit.
3945 ##      </summary>
3946 ## </param>
3947 #
3948 interface(`userdom_dontaudit_list_admin_dir',`
3949         gen_require(`
3950                 type admin_home_t;
3951         ')
3952
3953         dontaudit $1 admin_home_t:dir list_dir_perms;
3954 ')
3955
3956 ########################################
3957 ## <summary>
3958 ##      Allow domain to  list /root
3959 ## </summary>
3960 ## <param name="domain">
3961 ##      <summary>
3962 ##      Domain allowed access.
3963 ##      </summary>
3964 ## </param>
3965 #
3966 interface(`userdom_list_admin_dir',`
3967         gen_require(`
3968                 type admin_home_t;
3969         ')
3970
3971         allow $1 admin_home_t:dir list_dir_perms;
3972 ')
3973
3974 ########################################
3975 ## <summary>
3976 ##      Allow Search /root
3977 ## </summary>
3978 ## <param name="domain">
3979 ##      <summary>
3980 ##      Domain allowed access.
3981 ##      </summary>
3982 ## </param>
3983 #
3984 interface(`userdom_search_admin_dir',`
3985         gen_require(`
3986                 type admin_home_t;
3987         ')
3988
3989         allow $1 admin_home_t:dir search_dir_perms;
3990 ')
3991
3992 ########################################
3993 ## <summary>
3994 ##      RW unpriviledged user SysV sempaphores.
3995 ## </summary>
3996 ## <param name="domain">
3997 ##      <summary>
3998 ##      Domain allowed access.
3999 ##      </summary>
4000 ## </param>
4001 #
4002 interface(`userdom_rw_semaphores',`
4003         gen_require(`
4004                 attribute unpriv_userdomain;
4005         ')
4006
4007         allow $1 unpriv_userdomain:sem rw_sem_perms;
4008 ')
4009
4010 ########################################
4011 ## <summary>
4012 ##      Send a message to unpriv users over a unix domain
4013 ##      datagram socket.
4014 ## </summary>
4015 ## <param name="domain">
4016 ##      <summary>
4017 ##      Domain allowed access.
4018 ##      </summary>
4019 ## </param>
4020 #
4021 interface(`userdom_dgram_send',`
4022         gen_require(`
4023                 attribute unpriv_userdomain;
4024         ')
4025
4026         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4027 ')
4028
4029 ######################################
4030 ## <summary>
4031 ##      Send a message to users over a unix domain
4032 ##      datagram socket.
4033 ## </summary>
4034 ## <param name="domain">
4035 ##      <summary>
4036 ##      Domain allowed access.
4037 ##      </summary>
4038 ## </param>
4039 #
4040 interface(`userdom_users_dgram_send',`
4041         gen_require(`
4042                  attribute userdomain;
4043       ')
4044
4045        allow $1 userdomain:unix_dgram_socket sendto;
4046 ')
4047
4048 #######################################
4049 ## <summary>
4050 ##      Allow execmod on files in homedirectory
4051 ## </summary>
4052 ## <param name="domain">
4053 ##      <summary>
4054 ##      Domain allowed access.
4055 ##      </summary>
4056 ## </param>
4057 ## <rolebase/>
4058 #
4059 interface(`userdom_execmod_user_home_files',`
4060         gen_require(`
4061                 type user_home_type;
4062         ')
4063
4064         allow $1 user_home_type:file execmod;
4065 ')
4066
4067 ########################################
4068 ## <summary>
4069 ##      Read admin home files.
4070 ## </summary>
4071 ## <param name="domain">
4072 ##      <summary>
4073 ##      Domain allowed access.
4074 ##      </summary>
4075 ## </param>
4076 ## <rolecap/>
4077 #
4078 interface(`userdom_read_admin_home_files',`
4079         gen_require(`
4080                 type admin_home_t;
4081         ')
4082
4083         read_files_pattern($1, admin_home_t, admin_home_t)
4084 ')
4085
4086 ########################################
4087 ## <summary>
4088 ##      Execute admin home files.
4089 ## </summary>
4090 ## <param name="domain">
4091 ##      <summary>
4092 ##      Domain allowed access.
4093 ##      </summary>
4094 ## </param>
4095 ## <rolecap/>
4096 #
4097 interface(`userdom_exec_admin_home_files',`
4098         gen_require(`
4099                 type admin_home_t;
4100         ')
4101
4102         exec_files_pattern($1, admin_home_t, admin_home_t)
4103 ')
4104
4105 ########################################
4106 ## <summary>
4107 ##      Append files inherited
4108 ##      in the /root directory.
4109 ## </summary>
4110 ## <param name="domain">
4111 ##      <summary>
4112 ##      Domain allowed access.
4113 ##      </summary>
4114 ## </param>
4115 #
4116 interface(`userdom_inherit_append_admin_home_files',`
4117         gen_require(`
4118                 type admin_home_t;
4119         ')
4120
4121         allow $1 admin_home_t:file { getattr append };
4122 ')
4123
4124
4125 #######################################
4126 ## <summary>
4127 ##      Manage all files/directories in the homedir
4128 ## </summary>
4129 ## <param name="userdomain">
4130 ##      <summary>
4131 ##      The user domain
4132 ##      </summary>
4133 ## </param>
4134 ## <rolebase/>
4135 #
4136 interface(`userdom_manage_user_home_content',`
4137         gen_require(`
4138                 type user_home_dir_t, user_home_t;
4139                 attribute user_home_type;
4140         ')
4141
4142         files_list_home($1)
4143         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4144         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4145         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4146         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4147         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4148         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4149
4150 ')
4151
4152
4153 ########################################
4154 ## <summary>
4155 ##      Create objects in a user home directory
4156 ##      with an automatic type transition to
4157 ##      the user home file type.
4158 ## </summary>
4159 ## <param name="domain">
4160 ##      <summary>
4161 ##      Domain allowed access.
4162 ##      </summary>
4163 ## </param>
4164 ## <param name="object_class">
4165 ##      <summary>
4166 ##      The class of the object to be created.
4167 ##      </summary>
4168 ## </param>
4169 #
4170 interface(`userdom_user_home_dir_filetrans_pattern',`
4171         gen_require(`
4172                 type user_home_dir_t, user_home_t;
4173         ')
4174
4175         type_transition $1 user_home_dir_t:$2 user_home_t;
4176 ')
4177
4178 ########################################
4179 ## <summary>
4180 ##      Create objects in the /root directory
4181 ##      with an automatic type transition to
4182 ##      a specified private type.
4183 ## </summary>
4184 ## <param name="domain">
4185 ##      <summary>
4186 ##      Domain allowed access.
4187 ##      </summary>
4188 ## </param>
4189 ## <param name="private_type">
4190 ##      <summary>
4191 ##      The type of the object to create.
4192 ##      </summary>
4193 ## </param>
4194 ## <param name="object_class">
4195 ##      <summary>
4196 ##      The class of the object to be created.
4197 ##      </summary>
4198 ## </param>
4199 #
4200 interface(`userdom_admin_home_dir_filetrans',`
4201         gen_require(`
4202                 type admin_home_t;
4203         ')
4204
4205         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4206 ')
4207
4208 ########################################
4209 ## <summary>
4210 ##      Send signull to unprivileged user domains.
4211 ## </summary>
4212 ## <param name="domain">
4213 ##      <summary>
4214 ##      Domain allowed access.
4215 ##      </summary>
4216 ## </param>
4217 #
4218 interface(`userdom_signull_unpriv_users',`
4219         gen_require(`
4220                 attribute unpriv_userdomain;
4221         ')
4222
4223         allow $1 unpriv_userdomain:process signull;
4224 ')
4225
4226 ########################################
4227 ## <summary>
4228 ##      Write all users files in /tmp
4229 ## </summary>
4230 ## <param name="domain">
4231 ##      <summary>
4232 ##      Domain allowed access.
4233 ##      </summary>
4234 ## </param>
4235 #
4236 interface(`userdom_write_user_tmp_dirs',`
4237         gen_require(`
4238                 type user_tmp_t;
4239         ')
4240
4241         write_files_pattern($1, user_tmp_t, user_tmp_t)
4242 ')
4243
4244 ########################################
4245 ## <summary>
4246 ##      Manage keys for all user domains.
4247 ## </summary>
4248 ## <param name="domain">
4249 ##      <summary>
4250 ##      Domain allowed access.
4251 ##      </summary>
4252 ## </param>
4253 #
4254 interface(`userdom_manage_all_users_keys',`
4255         gen_require(`
4256                 attribute userdomain;
4257         ')
4258
4259         allow $1 userdomain:key manage_key_perms;
4260 ')
4261
4262
4263 ########################################
4264 ## <summary>
4265 ##      Do not audit attempts to read and write
4266 ##      unserdomain stream.
4267 ## </summary>
4268 ## <param name="domain">
4269 ##      <summary>
4270 ##      Domain to not audit.
4271 ##      </summary>
4272 ## </param>
4273 #
4274 interface(`userdom_dontaudit_rw_stream',`
4275         gen_require(`
4276                 attribute userdomain;
4277         ')
4278
4279         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4280 ')
4281
4282 ########################################
4283 ## <summary>
4284 ##      Do not audit attempts to read and write
4285 ##      unserdomain datagram socket.
4286 ## </summary>
4287 ## <param name="domain">
4288 ##      <summary>
4289 ##      Domain to not audit.
4290 ##      </summary>
4291 ## </param>
4292 #
4293 interface(`userdom_dontaudit_rw_dgram_socket',`
4294         gen_require(`
4295                 attribute userdomain;
4296         ')
4297
4298         dontaudit $1 userdomain:unix_dgram_socket { read write };
4299 ')
4300
4301 ########################################
4302 ## <summary>
4303 ##      Append files
4304 ##      in a user home subdirectory.
4305 ## </summary>
4306 ## <param name="domain">
4307 ##      <summary>
4308 ##      Domain allowed access.
4309 ##      </summary>
4310 ## </param>
4311 #
4312 interface(`userdom_append_user_home_content_files',`
4313         gen_require(`
4314                 type user_home_dir_t, user_home_t;
4315         ')
4316
4317         append_files_pattern($1, user_home_t, user_home_t)
4318         allow $1 user_home_dir_t:dir search_dir_perms;
4319         files_search_home($1)
4320 ')
4321
4322 ########################################
4323 ## <summary>
4324 ##      Read files inherited
4325 ##      in a user home subdirectory.
4326 ## </summary>
4327 ## <param name="domain">
4328 ##      <summary>
4329 ##      Domain allowed access.
4330 ##      </summary>
4331 ## </param>
4332 #
4333 interface(`userdom_read_inherited_user_home_content_files',`
4334         gen_require(`
4335                 attribute user_home_type;
4336         ')
4337
4338         allow $1 user_home_type:file { getattr read };
4339 ')
4340
4341 ########################################
4342 ## <summary>
4343 ##      Append files inherited
4344 ##      in a user home subdirectory.
4345 ## </summary>
4346 ## <param name="domain">
4347 ##      <summary>
4348 ##      Domain allowed access.
4349 ##      </summary>
4350 ## </param>
4351 #
4352 interface(`userdom_inherit_append_user_home_content_files',`
4353         gen_require(`
4354                 type user_home_t;
4355         ')
4356
4357         allow $1 user_home_t:file { getattr append };
4358 ')
4359
4360 ########################################
4361 ## <summary>
4362 ##      Append files inherited
4363 ##      in a user tmp files.
4364 ## </summary>
4365 ## <param name="domain">
4366 ##      <summary>
4367 ##      Domain allowed access.
4368 ##      </summary>
4369 ## </param>
4370 #
4371 interface(`userdom_inherit_append_user_tmp_files',`
4372         gen_require(`
4373                 type user_tmp_t;
4374         ')
4375
4376         allow $1 user_tmp_t:file { getattr append };
4377 ')
4378
4379 ######################################
4380 ## <summary>
4381 ##      Read audio files in the users homedir.
4382 ## </summary>
4383 ## <param name="domain">
4384 ##      <summary>
4385 ##      Domain allowed access.
4386 ##      </summary>
4387 ## </param>
4388 ## <rolecap/>
4389 #
4390 interface(`userdom_read_home_audio_files',`
4391         gen_require(`
4392                 type audio_home_t;
4393         ')
4394
4395         userdom_search_user_home_dirs($1)
4396         allow $1 audio_home_t:dir list_dir_perms;
4397         read_files_pattern($1, audio_home_t, audio_home_t)
4398         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4399 ')
4400
4401 ########################################
4402 ## <summary>
4403 ##      Do not audit attempts to write all user home content files.
4404 ## </summary>
4405 ## <param name="domain">
4406 ##      <summary>
4407 ##      Domain to not audit.
4408 ##      </summary>
4409 ## </param>
4410 #
4411 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4412         gen_require(`
4413                 attribute user_home_type;
4414         ')
4415
4416         dontaudit $1 user_home_type:file write_file_perms;
4417 ')
4418
4419 ########################################
4420 ## <summary>
4421 ##      Do not audit attempts to write all user tmp content files.
4422 ## </summary>
4423 ## <param name="domain">
4424 ##      <summary>
4425 ##      Domain to not audit.
4426 ##      </summary>
4427 ## </param>
4428 #
4429 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4430         gen_require(`
4431                 attribute user_tmp_type;
4432         ')
4433
4434         dontaudit $1 user_tmp_type:file write_file_perms;
4435 ')
4436
4437 ########################################
4438 ## <summary>
4439 ##      Manage all user temporary content.
4440 ## </summary>
4441 ## <param name="domain">
4442 ##      <summary>
4443 ##      Domain allowed access.
4444 ##      </summary>
4445 ## </param>
4446 #
4447 interface(`userdom_manage_all_user_tmp_content',`
4448         gen_require(`
4449                 attribute user_tmp_type;
4450         ')
4451
4452         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4453         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4454         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4455         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4456         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4457         files_search_tmp($1)
4458 ')
4459
4460 ########################################
4461 ## <summary>
4462 ##      List all user temporary content.
4463 ## </summary>
4464 ## <param name="domain">
4465 ##      <summary>
4466 ##      Domain allowed access.
4467 ##      </summary>
4468 ## </param>
4469 #
4470 interface(`userdom_list_all_user_tmp_content',`
4471         gen_require(`
4472                 attribute user_tmp_type;
4473         ')
4474
4475         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4476         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4477         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4478         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4479         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4480         files_search_var($1)
4481         files_search_tmp($1)
4482 ')
4483
4484 ########################################
4485 ## <summary>
4486 ##      Manage all user tmpfs content.
4487 ## </summary>
4488 ## <param name="domain">
4489 ##      <summary>
4490 ##      Domain allowed access.
4491 ##      </summary>
4492 ## </param>
4493 #
4494 interface(`userdom_manage_all_user_tmpfs_content',`
4495         gen_require(`
4496                 attribute user_tmpfs_type;
4497         ')
4498
4499         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4500         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4501         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4502         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4503         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4504         fs_search_tmpfs($1)
4505 ')
4506
4507 ########################################
4508 ## <summary>
4509 ##      Delete all user temporary content.
4510 ## </summary>
4511 ## <param name="domain">
4512 ##      <summary>
4513 ##      Domain allowed access.
4514 ##      </summary>
4515 ## </param>
4516 #
4517 interface(`userdom_delete_all_user_tmp_content',`
4518         gen_require(`
4519                 attribute user_tmp_type;
4520         ')
4521
4522         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4523         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4524         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4525         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4526         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4527         # /var/tmp
4528         files_search_var($1)
4529         files_delete_tmp_dir_entry($1)
4530 ')
4531
4532 ########################################
4533 ## <summary>
4534 ##      Read system SSL certificates in the users homedir.
4535 ## </summary>
4536 ## <param name="domain">
4537 ##      <summary>
4538 ##      Domain allowed access.
4539 ##      </summary>
4540 ## </param>
4541 #
4542 interface(`userdom_read_home_certs',`
4543         gen_require(`
4544                 type home_cert_t;
4545         ')
4546
4547         userdom_search_user_home_content($1)
4548         allow $1 home_cert_t:dir list_dir_perms;
4549         read_files_pattern($1, home_cert_t, home_cert_t)
4550         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4551 ')
4552
4553 #######################################
4554 ## <summary>
4555 ##  Dontaudit Write system SSL certificates in the users homedir.
4556 ## </summary>
4557 ## <param name="domain">
4558 ##  <summary>
4559 ##      Domain to not audit.
4560 ##  </summary>
4561 ## </param>
4562 #
4563 interface(`userdom_dontaudit_write_home_certs',`
4564     gen_require(`
4565         type home_cert_t;
4566     ')
4567
4568     dontaudit $1 home_cert_t:file write;
4569 ')
4570
4571 ########################################
4572 ## <summary>
4573 ##      dontaudit Search getatrr /root files
4574 ## </summary>
4575 ## <param name="domain">
4576 ##      <summary>
4577 ##      Domain to not audit.
4578 ##      </summary>
4579 ## </param>
4580 #
4581 interface(`userdom_dontaudit_getattr_admin_home_files',`
4582         gen_require(`
4583                 type admin_home_t;
4584         ')
4585
4586         dontaudit $1 admin_home_t:file getattr;
4587 ')
4588
4589 ########################################
4590 ## <summary>
4591 ##      dontaudit read /root lnk files
4592 ## </summary>
4593 ## <param name="domain">
4594 ##      <summary>
4595 ##      Domain to not audit.
4596 ##      </summary>
4597 ## </param>
4598 #
4599 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4600         gen_require(`
4601                 type admin_home_t;
4602         ')
4603
4604         dontaudit $1 admin_home_t:lnk_file read;
4605 ')
4606
4607 ########################################
4608 ## <summary>
4609 ##      dontaudit read /root files
4610 ## </summary>
4611 ## <param name="domain">
4612 ##      <summary>
4613 ##      Domain to not audit.
4614 ##      </summary>
4615 ## </param>
4616 #
4617 interface(`userdom_dontaudit_read_admin_home_files',`
4618         gen_require(`
4619                 type admin_home_t;
4620         ')
4621
4622         dontaudit $1 admin_home_t:file read_file_perms;
4623 ')
4624
4625 ########################################
4626 ## <summary>
4627 ##      Create, read, write, and delete user
4628 ##      temporary chr files.
4629 ## </summary>
4630 ## <param name="domain">
4631 ##      <summary>
4632 ##      Domain allowed access.
4633 ##      </summary>
4634 ## </param>
4635 #
4636 interface(`userdom_manage_user_tmp_chr_files',`
4637         gen_require(`
4638                 type user_tmp_t;
4639         ')
4640
4641         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4642         files_search_tmp($1)
4643 ')
4644
4645 ########################################
4646 ## <summary>
4647 ##      Create, read, write, and delete user
4648 ##      temporary blk files.
4649 ## </summary>
4650 ## <param name="domain">
4651 ##      <summary>
4652 ##      Domain allowed access.
4653 ##      </summary>
4654 ## </param>
4655 #
4656 interface(`userdom_manage_user_tmp_blk_files',`
4657         gen_require(`
4658                 type user_tmp_t;
4659         ')
4660
4661         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4662         files_search_tmp($1)
4663 ')
4664
4665 ########################################
4666 ## <summary>
4667 ##      Dontaudit attempt to set attributes on  user temporary directories.
4668 ## </summary>
4669 ## <param name="domain">
4670 ##      <summary>
4671 ##      Domain to not audit.
4672 ##      </summary>
4673 ## </param>
4674 #
4675 interface(`userdom_dontaudit_setattr_user_tmp',`
4676         gen_require(`
4677                 type user_tmp_t;
4678         ')
4679
4680         dontaudit $1 user_tmp_t:dir setattr;
4681 ')
4682
4683 ########################################
4684 ## <summary>
4685 ##      Write all inherited users files in /tmp
4686 ## </summary>
4687 ## <param name="domain">
4688 ##      <summary>
4689 ##      Domain allowed access.
4690 ##      </summary>
4691 ## </param>
4692 #
4693 interface(`userdom_write_inherited_user_tmp_files',`
4694         gen_require(`
4695                 type user_tmp_t;
4696         ')
4697
4698         allow $1 user_tmp_t:file write;
4699 ')
4700
4701 ########################################
4702 ## <summary>
4703 ##      Delete all users files in /tmp
4704 ## </summary>
4705 ## <param name="domain">
4706 ##      <summary>
4707 ##      Domain allowed access.
4708 ##      </summary>
4709 ## </param>
4710 #
4711 interface(`userdom_delete_user_tmp_files',`
4712         gen_require(`
4713                 type user_tmp_t;
4714         ')
4715
4716         allow $1 user_tmp_t:file delete_file_perms;
4717 ')
4718
4719 ########################################
4720 ## <summary>
4721 ##      Delete user tmpfs files.
4722 ## </summary>
4723 ## <param name="domain">
4724 ##      <summary>
4725 ##      Domain allowed access.
4726 ##      </summary>
4727 ## </param>
4728 #
4729 interface(`userdom_delete_user_tmpfs_files',`
4730         gen_require(`
4731                 type user_tmpfs_t;
4732         ')
4733
4734         allow $1 user_tmpfs_t:file delete_file_perms;
4735 ')
4736
4737 ########################################
4738 ## <summary>
4739 ##      Read/Write unpriviledged user SysV shared
4740 ##      memory segments.
4741 ## </summary>
4742 ## <param name="domain">
4743 ##      <summary>
4744 ##      Domain allowed access.
4745 ##      </summary>
4746 ## </param>
4747 #
4748 interface(`userdom_rw_unpriv_user_shared_mem',`
4749         gen_require(`
4750                 attribute unpriv_userdomain;
4751         ')
4752
4753         allow $1 unpriv_userdomain:shm rw_shm_perms;
4754 ')
4755
4756 ########################################
4757 ## <summary>
4758 ##      Do not audit attempts to search user
4759 ##      temporary directories.
4760 ## </summary>
4761 ## <param name="domain">
4762 ##      <summary>
4763 ##      Domain to not audit.
4764 ##      </summary>
4765 ## </param>
4766 #
4767 interface(`userdom_dontaudit_search_user_tmp',`
4768         gen_require(`
4769                 type user_tmp_t;
4770         ')
4771
4772         dontaudit $1 user_tmp_t:dir search_dir_perms;
4773 ')
4774
4775 ########################################
4776 ## <summary>
4777 ##      Execute a file in a user home directory
4778 ##      in the specified domain.
4779 ## </summary>
4780 ## <desc>
4781 ##      <p>
4782 ##      Execute a file in a user home directory
4783 ##      in the specified domain.
4784 ##      </p>
4785 ##      <p>
4786 ##      No interprocess communication (signals, pipes,
4787 ##      etc.) is provided by this interface since
4788 ##      the domains are not owned by this module.
4789 ##      </p>
4790 ## </desc>
4791 ## <param name="domain">
4792 ##      <summary>
4793 ##      Domain allowed access.
4794 ##      </summary>
4795 ## </param>
4796 ## <param name="target_domain">
4797 ##      <summary>
4798 ##      The type of the new process.
4799 ##      </summary>
4800 ## </param>
4801 #
4802 interface(`userdom_domtrans_user_home',`
4803         gen_require(`
4804                 type user_home_t;
4805         ')
4806
4807         read_lnk_files_pattern($1, user_home_t, user_home_t)
4808         domain_transition_pattern($1, user_home_t, $2)
4809         type_transition $1 user_home_t:process $2;
4810 ')
4811
4812 ########################################
4813 ## <summary>
4814 ##      Execute a file in a user tmp directory
4815 ##      in the specified domain.
4816 ## </summary>
4817 ## <desc>
4818 ##      <p>
4819 ##      Execute a file in a user tmp directory
4820 ##      in the specified domain.
4821 ##      </p>
4822 ##      <p>
4823 ##      No interprocess communication (signals, pipes,
4824 ##      etc.) is provided by this interface since
4825 ##      the domains are not owned by this module.
4826 ##      </p>
4827 ## </desc>
4828 ## <param name="domain">
4829 ##      <summary>
4830 ##      Domain allowed access.
4831 ##      </summary>
4832 ## </param>
4833 ## <param name="target_domain">
4834 ##      <summary>
4835 ##      The type of the new process.
4836 ##      </summary>
4837 ## </param>
4838 #
4839 interface(`userdom_domtrans_user_tmp',`
4840         gen_require(`
4841                 type user_tmp_t;
4842         ')
4843
4844         files_search_tmp($1)
4845         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4846         domain_transition_pattern($1, user_tmp_t, $2)
4847         type_transition $1 user_tmp_t:process $2;
4848 ')
4849
4850 ########################################
4851 ## <summary>
4852 ##      Do not audit attempts to read all user home content files.
4853 ## </summary>
4854 ## <param name="domain">
4855 ##      <summary>
4856 ##      Domain to not audit.
4857 ##      </summary>
4858 ## </param>
4859 #
4860 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4861         gen_require(`
4862                 attribute user_home_type;
4863         ')
4864
4865         dontaudit $1 user_home_type:file read_file_perms;
4866 ')
4867
4868 ########################################
4869 ## <summary>
4870 ##      Do not audit attempts to read all user tmp content files.
4871 ## </summary>
4872 ## <param name="domain">
4873 ##      <summary>
4874 ##      Domain to not audit.
4875 ##      </summary>
4876 ## </param>
4877 #
4878 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4879         gen_require(`
4880                 attribute user_tmp_type;
4881         ')
4882
4883         dontaudit $1 user_tmp_type:file read_file_perms;
4884 ')
4885
4886 #######################################
4887 ## <summary>
4888 ## Read and write unpriviledged user SysV sempaphores.
4889 ## </summary>
4890 ## <param name="domain">
4891 ## <summary>
4892 ## Domain allowed access.
4893 ## </summary>
4894 ## </param>
4895 #
4896 interface(`userdom_rw_unpriv_user_semaphores',`
4897    gen_require(`
4898        attribute unpriv_userdomain;
4899    ')
4900
4901    allow $1 unpriv_userdomain:sem rw_sem_perms;
4902 ')