policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         miscfiles_read_localization($1_t)
 136         miscfiles_read_generic_certs($1_t)
 137
 138         miscfiles_read_all_certs($1_usertype)
 139         miscfiles_read_localization($1_usertype)
 140         miscfiles_read_man_pages($1_usertype)
 141         miscfiles_read_public_files($1_usertype)
 142
 143         tunable_policy(`allow_execmem',`
 144                 # Allow loading DSOs that require executable stack.
 145                 allow $1_t self:process execmem;
 146         ')
 147
 148         tunable_policy(`allow_execmem && allow_execstack',`
 149                 # Allow making the stack executable via mprotect.
 150                 allow $1_t self:process execstack;
 151         ')
 152
 153         optional_policy(`
 154                 fs_list_cgroup_dirs($1_usertype)
 155         ')
 156
 157         optional_policy(`
 158                 ssh_rw_stream_sockets($1_usertype)
 159                 ssh_delete_tmp($1_t)
 160                 ssh_signal($1_t)
 161         ')
 162 ')
 163
 164 #######################################
 165 ## <summary>
 166 ##      Allow a home directory for which the
 167 ##      role has read-only access.
 168 ## </summary>
 169 ## <desc>
 170 ##      <p>
 171 ##      Allow a home directory for which the
 172 ##      role has read-only access.
 173 ##      </p>
 174 ##      <p>
 175 ##      This does not allow execute access.
 176 ##      </p>
 177 ## </desc>
 178 ## <param name="role">
 179 ##      <summary>
 180 ##      The user role
 181 ##      </summary>
 182 ## </param>
 183 ## <param name="userdomain">
 184 ##      <summary>
 185 ##      The user domain
 186 ##      </summary>
 187 ## </param>
 188 ## <rolebase/>
 189 #
 190 interface(`userdom_ro_home_role',`
 191         gen_require(`
 192                 type user_home_t, user_home_dir_t;
 193         ')
 194
 195         role $1 types { user_home_t user_home_dir_t };
 196
 197         ##############################
 198         #
 199         # Domain access to home dir
 200         #
 201
 202         type_member $2 user_home_dir_t:dir user_home_dir_t;
 203
 204         # read-only home directory
 205         allow $2 user_home_dir_t:dir list_dir_perms;
 206         allow $2 user_home_t:dir list_dir_perms;
 207         allow $2 user_home_t:file entrypoint;
 208         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 209         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 210         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         files_list_home($2)
 213
 214 ')
 215
 216 #######################################
 217 ## <summary>
 218 ##      Allow a home directory for which the
 219 ##      role has full access.
 220 ## </summary>
 221 ## <desc>
 222 ##      <p>
 223 ##      Allow a home directory for which the
 224 ##      role has full access.
 225 ##      </p>
 226 ##      <p>
 227 ##      This does not allow execute access.
 228 ##      </p>
 229 ## </desc>
 230 ## <param name="role">
 231 ##      <summary>
 232 ##      The user role
 233 ##      </summary>
 234 ## </param>
 235 ## <param name="userdomain">
 236 ##      <summary>
 237 ##      The user domain
 238 ##      </summary>
 239 ## </param>
 240 ## <rolebase/>
 241 #
 242 interface(`userdom_manage_home_role',`
 243         gen_require(`
 244                 type user_home_t, user_home_dir_t;
 245                 attribute user_home_type;
 246         ')
 247
 248         role $1 types { user_home_type user_home_dir_t };
 249
 250         ##############################
 251         #
 252         # Domain access to home dir
 253         #
 254
 255         type_member $2 user_home_dir_t:dir user_home_dir_t;
 256
 257         # full control of the home directory
 258         allow $2 user_home_t:dir mounton;
 259         allow $2 user_home_t:file entrypoint;
 260
 261         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 262         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 263         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 264         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 265         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 274         files_list_home($2)
 275
 276         # cjp: this should probably be removed:
 277         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 278
 279         tunable_policy(`use_nfs_home_dirs',`
 280                 fs_mount_nfs($2)
 281                 fs_mounton_nfs($2)
 282                 fs_manage_nfs_dirs($2)
 283                 fs_manage_nfs_files($2)
 284                 fs_manage_nfs_symlinks($2)
 285                 fs_manage_nfs_named_sockets($2)
 286                 fs_manage_nfs_named_pipes($2)
 287         ')
 288
 289         tunable_policy(`use_samba_home_dirs',`
 290                 fs_mount_cifs($2)
 291                 fs_mounton_cifs($2)
 292                 fs_manage_cifs_dirs($2)
 293                 fs_manage_cifs_files($2)
 294                 fs_manage_cifs_symlinks($2)
 295                 fs_manage_cifs_named_sockets($2)
 296                 fs_manage_cifs_named_pipes($2)
 297         ')
 298 ')
 299
 300 #######################################
 301 ## <summary>
 302 ##      Manage user temporary files
 303 ## </summary>
 304 ## <param name="role">
 305 ##      <summary>
 306 ##      Role allowed access.
 307 ##      </summary>
 308 ## </param>
 309 ## <param name="domain">
 310 ##      <summary>
 311 ##      Domain allowed access.
 312 ##      </summary>
 313 ## </param>
 314 ## <rolebase/>
 315 #
 316 interface(`userdom_manage_tmp_role',`
 317         gen_require(`
 318                 type user_tmp_t;
 319         ')
 320
 321         role $1 types user_tmp_t;
 322
 323         files_poly_member_tmp($2, user_tmp_t)
 324
 325         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 326         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 327         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 328         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 329         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 330         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 331         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 332 ')
 333
 334 #######################################
 335 ## <summary>
 336 ##      Dontaudit search of user bin dirs.
 337 ## </summary>
 338 ## <param name="domain">
 339 ##      <summary>
 340 ##      Domain allowed access.
 341 ##      </summary>
 342 ## </param>
 343 #
 344 interface(`userdom_dontaudit_search_user_bin_dirs',`
 345         gen_require(`
 346                 type home_bin_t;
 347         ')
 348
 349         dontaudit $1 home_bin_t:dir search_dir_perms;
 350 ')
 351
 352 #######################################
 353 ## <summary>
 354 ##      Execute user bin files.
 355 ## </summary>
 356 ## <param name="domain">
 357 ##      <summary>
 358 ##      Domain allowed access.
 359 ##      </summary>
 360 ## </param>
 361 #
 362 interface(`userdom_exec_user_bin_files',`
 363         gen_require(`
 364                 attribute user_home_type;
 365                 type home_bin_t, user_home_dir_t;
 366         ')
 367
 368         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 369         files_search_home($1)
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      The execute access user temporary files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 ## <rolebase/>
 382 #
 383 interface(`userdom_exec_user_tmp_files',`
 384         gen_require(`
 385                 type user_tmp_t;
 386         ')
 387
 388         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 389         dontaudit $1 user_tmp_t:sock_file execute;
 390         files_search_tmp($1)
 391 ')
 392
 393 #######################################
 394 ## <summary>
 395 ##      Role access for the user tmpfs type
 396 ##      that the user has full access.
 397 ## </summary>
 398 ## <desc>
 399 ##      <p>
 400 ##      Role access for the user tmpfs type
 401 ##      that the user has full access.
 402 ##      </p>
 403 ##      <p>
 404 ##      This does not allow execute access.
 405 ##      </p>
 406 ## </desc>
 407 ## <param name="role">
 408 ##      <summary>
 409 ##      Role allowed access.
 410 ##      </summary>
 411 ## </param>
 412 ## <param name="domain">
 413 ##      <summary>
 414 ##      Domain allowed access.
 415 ##      </summary>
 416 ## </param>
 417 ## <rolecap/>
 418 #
 419 interface(`userdom_manage_tmpfs_role',`
 420         gen_require(`
 421                 type user_tmpfs_t;
 422         ')
 423
 424         role $1 types user_tmpfs_t;
 425
 426         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 427         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 428         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 429         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 430         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 431         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 432 ')
 433
 434 #######################################
 435 ## <summary>
 436 ##      The interface allowing the user basic
 437 ##      network permissions
 438 ## </summary>
 439 ## <param name="userdomain">
 440 ##      <summary>
 441 ##      The user domain
 442 ##      </summary>
 443 ## </param>
 444 ## <rolebase/>
 445 #
 446 interface(`userdom_basic_networking',`
 447
 448         allow $1 self:tcp_socket create_stream_socket_perms;
 449         allow $1 self:udp_socket create_socket_perms;
 450
 451         corenet_all_recvfrom_unlabeled($1)
 452         corenet_all_recvfrom_netlabel($1)
 453         corenet_tcp_sendrecv_generic_if($1)
 454         corenet_udp_sendrecv_generic_if($1)
 455         corenet_tcp_sendrecv_generic_node($1)
 456         corenet_udp_sendrecv_generic_node($1)
 457         corenet_tcp_sendrecv_all_ports($1)
 458         corenet_udp_sendrecv_all_ports($1)
 459         corenet_tcp_connect_all_ports($1)
 460         corenet_sendrecv_all_client_packets($1)
 461
 462         optional_policy(`
 463                 init_tcp_recvfrom_all_daemons($1)
 464                 init_udp_recvfrom_all_daemons($1)
 465         ')
 466
 467         optional_policy(`
 468                 ipsec_match_default_spd($1)
 469         ')
 470
 471 ')
 472
 473 #######################################
 474 ## <summary>
 475 ##      The template for creating a user xwindows client.  (Deprecated)
 476 ## </summary>
 477 ## <param name="userdomain_prefix">
 478 ##      <summary>
 479 ##      The prefix of the user domain (e.g., user
 480 ##      is the prefix for user_t).
 481 ##      </summary>
 482 ## </param>
 483 ## <rolebase/>
 484 #
 485 template(`userdom_xwindows_client_template',`
 486         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 487         gen_require(`
 488                 type $1_t, user_tmpfs_t;
 489         ')
 490
 491         dev_rw_xserver_misc($1_t)
 492         dev_rw_power_management($1_t)
 493         dev_read_input($1_t)
 494         dev_read_misc($1_t)
 495         dev_write_misc($1_t)
 496         # open office is looking for the following
 497         dev_getattr_agp_dev($1_t)
 498         dev_dontaudit_rw_dri($1_t)
 499         # GNOME checks for usb and other devices:
 500         dev_rw_usbfs($1_t)
 501         dev_rw_generic_usb_dev($1_t)
 502
 503         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 504         xserver_xsession_entry_type($1_t)
 505         xserver_dontaudit_write_log($1_t)
 506         xserver_stream_connect_xdm($1_t)
 507         # certain apps want to read xdm.pid file
 508         xserver_read_xdm_pid($1_t)
 509         # gnome-session creates socket under /tmp/.ICE-unix/
 510         xserver_create_xdm_tmp_sockets($1_t)
 511         # Needed for escd, remove if we get escd policy
 512         xserver_manage_xdm_tmp_files($1_t)
 513 ')
 514
 515 #######################################
 516 ## <summary>
 517 ##      The template for allowing the user to change passwords.
 518 ## </summary>
 519 ## <param name="userdomain_prefix">
 520 ##      <summary>
 521 ##      The prefix of the user domain (e.g., user
 522 ##      is the prefix for user_t).
 523 ##      </summary>
 524 ## </param>
 525 ## <rolebase/>
 526 #
 527 template(`userdom_change_password_template',`
 528         gen_require(`
 529                 type $1_t;
 530                 role $1_r;
 531         ')
 532
 533         optional_policy(`
 534                 usermanage_run_chfn($1_t,$1_r)
 535                 usermanage_run_passwd($1_t,$1_r)
 536         ')
 537 ')
 538
 539 #######################################
 540 ## <summary>
 541 ##      The template containing rules common to unprivileged
 542 ##      users and administrative users.
 543 ## </summary>
 544 ## <desc>
 545 ##      <p>
 546 ##      This template creates a user domain, types, and
 547 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 548 ##      </p>
 549 ## </desc>
 550 ## <param name="userdomain_prefix">
 551 ##      <summary>
 552 ##      The prefix of the user domain (e.g., user
 553 ##      is the prefix for user_t).
 554 ##      </summary>
 555 ## </param>
 556 #
 557 template(`userdom_common_user_template',`
 558         gen_require(`
 559                 attribute unpriv_userdomain;
 560         ')
 561
 562         userdom_basic_networking($1_usertype)
 563
 564         ##############################
 565         #
 566         # User domain Local policy
 567         #
 568
 569         # evolution and gnome-session try to create a netlink socket
 570         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 571         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 572         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 573         allow $1_t self:socket create_socket_perms;
 574
 575         allow $1_usertype unpriv_userdomain:fd use;
 576
 577         kernel_read_system_state($1_usertype)
 578         kernel_read_network_state($1_usertype)
 579         kernel_read_software_raid_state($1_usertype)
 580         kernel_read_net_sysctls($1_usertype)
 581         # Very permissive allowing every domain to see every type:
 582         kernel_get_sysvipc_info($1_usertype)
 583         # Find CDROM devices:
 584         kernel_read_device_sysctls($1_usertype)
 585         kernel_request_load_module($1_usertype)
 586
 587         corenet_udp_bind_generic_node($1_usertype)
 588         corenet_udp_bind_generic_port($1_usertype)
 589
 590         dev_read_rand($1_usertype)
 591         dev_write_sound($1_usertype)
 592         dev_read_sound($1_usertype)
 593         dev_read_sound_mixer($1_usertype)
 594         dev_write_sound_mixer($1_usertype)
 595
 596         files_exec_etc_files($1_usertype)
 597         files_search_locks($1_usertype)
 598         # Check to see if cdrom is mounted
 599         files_search_mnt($1_usertype)
 600         # cjp: perhaps should cut back on file reads:
 601         files_read_var_files($1_usertype)
 602         files_read_var_symlinks($1_usertype)
 603         files_read_generic_spool($1_usertype)
 604         files_read_var_lib_files($1_usertype)
 605         # Stat lost+found.
 606         files_getattr_lost_found_dirs($1_usertype)
 607         files_read_config_files($1_usertype)
 608         fs_read_noxattr_fs_files($1_usertype)
 609         fs_read_noxattr_fs_symlinks($1_usertype)
 610         fs_rw_cgroup_files($1_usertype)
 611
 612         application_getattr_socket($1_usertype)
 613
 614         logging_send_syslog_msg($1_usertype)
 615         logging_send_audit_msgs($1_usertype)
 616         selinux_get_enforce_mode($1_usertype)
 617
 618         # cjp: some of this probably can be removed
 619         selinux_get_fs_mount($1_usertype)
 620         selinux_validate_context($1_usertype)
 621         selinux_compute_access_vector($1_usertype)
 622         selinux_compute_create_context($1_usertype)
 623         selinux_compute_relabel_context($1_usertype)
 624         selinux_compute_user_contexts($1_usertype)
 625
 626         # for eject
 627         storage_getattr_fixed_disk_dev($1_usertype)
 628
 629         auth_read_login_records($1_usertype)
 630         auth_run_pam($1_t,$1_r)
 631         auth_run_utempter($1_t,$1_r)
 632
 633         init_read_utmp($1_usertype)
 634
 635         seutil_read_file_contexts($1_usertype)
 636         seutil_read_default_contexts($1_usertype)
 637         seutil_run_newrole($1_t,$1_r)
 638         seutil_exec_checkpolicy($1_t)
 639         seutil_exec_setfiles($1_usertype)
 640         # for when the network connection is killed
 641         # this is needed when a login role can change
 642         # to this one.
 643         seutil_dontaudit_signal_newrole($1_t)
 644
 645         tunable_policy(`user_direct_mouse',`
 646                 dev_read_mouse($1_usertype)
 647         ')
 648
 649         tunable_policy(`user_ttyfile_stat',`
 650                 term_getattr_all_ttys($1_t)
 651         ')
 652
 653         optional_policy(`
 654                 alsa_read_rw_config($1_usertype)
 655                 alsa_manage_home_files($1_t)
 656                 alsa_relabel_home_files($1_t)
 657         ')
 658
 659         optional_policy(`
 660                 # Allow graphical boot to check battery lifespan
 661                 apm_stream_connect($1_usertype)
 662         ')
 663
 664         optional_policy(`
 665                 canna_stream_connect($1_usertype)
 666         ')
 667
 668         optional_policy(`
 669                 chrome_role($1_r, $1_usertype)
 670         ')
 671
 672         optional_policy(`
 673                 colord_read_lib_files($1_usertype)
 674         ')
 675
 676         optional_policy(`
 677                 dbus_system_bus_client($1_usertype)
 678
 679                 allow $1_usertype $1_usertype:dbus  send_msg;
 680
 681                 optional_policy(`
 682                         avahi_dbus_chat($1_usertype)
 683                 ')
 684
 685                 optional_policy(`
 686                         policykit_dbus_chat($1_usertype)
 687                 ')
 688
 689                 optional_policy(`
 690                         bluetooth_dbus_chat($1_usertype)
 691                 ')
 692
 693                 optional_policy(`
 694                         consolekit_dbus_chat($1_usertype)
 695                         consolekit_read_log($1_usertype)
 696                 ')
 697
 698                 optional_policy(`
 699                         devicekit_dbus_chat($1_usertype)
 700                         devicekit_dbus_chat_power($1_usertype)
 701                         devicekit_dbus_chat_disk($1_usertype)
 702                 ')
 703
 704                 optional_policy(`
 705                         evolution_dbus_chat($1_usertype)
 706                         evolution_alarm_dbus_chat($1_usertype)
 707                 ')
 708
 709                 optional_policy(`
 710                         gnome_dbus_chat_gconfdefault($1_usertype)
 711                 ')
 712
 713                 optional_policy(`
 714                         hal_dbus_chat($1_usertype)
 715                 ')
 716
 717                 optional_policy(`
 718                         kde_dbus_chat_backlighthelper($1_usertype)
 719                 ')
 720
 721                 optional_policy(`
 722                         modemmanager_dbus_chat($1_usertype)
 723                 ')
 724
 725                 optional_policy(`
 726                         networkmanager_dbus_chat($1_usertype)
 727                         networkmanager_read_lib_files($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         vpn_dbus_chat($1_usertype)
 732                 ')
 733         ')
 734
 735         optional_policy(`
 736                 git_session_role($1_r, $1_usertype)
 737         ')
 738
 739         optional_policy(`
 740                 inetd_use_fds($1_usertype)
 741                 inetd_rw_tcp_sockets($1_usertype)
 742         ')
 743
 744         optional_policy(`
 745                 inn_read_config($1_usertype)
 746                 inn_read_news_lib($1_usertype)
 747                 inn_read_news_spool($1_usertype)
 748         ')
 749
 750         optional_policy(`
 751                 lircd_stream_connect($1_usertype)
 752         ')
 753
 754         optional_policy(`
 755                 locate_read_lib_files($1_usertype)
 756         ')
 757
 758         # for running depmod as part of the kernel packaging process
 759         optional_policy(`
 760                 modutils_read_module_config($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 mta_rw_spool($1_usertype)
 765                 mta_manage_queue($1_usertype)
 766         ')
 767
 768         optional_policy(`
 769                 nsplugin_role($1_r, $1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 tunable_policy(`allow_user_mysql_connect',`
 774                         mysql_stream_connect($1_t)
 775                 ')
 776         ')
 777
 778         optional_policy(`
 779                 oident_manage_user_content($1_t)
 780                 oident_relabel_user_content($1_t)
 781         ')
 782
 783         optional_policy(`
 784                 # to allow monitoring of pcmcia status
 785                 pcmcia_read_pid($1_usertype)
 786         ')
 787
 788         optional_policy(`
 789                 pcscd_read_pub_files($1_usertype)
 790                 pcscd_stream_connect($1_usertype)
 791         ')
 792
 793         optional_policy(`
 794                 tunable_policy(`allow_user_postgresql_connect',`
 795                         postgresql_stream_connect($1_usertype)
 796                         postgresql_tcp_connect($1_usertype)
 797                 ')
 798         ')
 799
 800         optional_policy(`
 801                 resmgr_stream_connect($1_usertype)
 802         ')
 803
 804         optional_policy(`
 805                 rpc_dontaudit_getattr_exports($1_usertype)
 806                 rpc_manage_nfs_rw_content($1_usertype)
 807         ')
 808
 809         optional_policy(`
 810                 rpcbind_stream_connect($1_usertype)
 811         ')
 812
 813         optional_policy(`
 814                 samba_stream_connect_winbind($1_usertype)
 815         ')
 816
 817         optional_policy(`
 818                 sandbox_transition($1_usertype, $1_r)
 819         ')
 820
 821         optional_policy(`
 822                 seunshare_role_template($1, $1_r, $1_t)
 823         ')
 824
 825         optional_policy(`
 826                 slrnpull_search_spool($1_usertype)
 827         ')
 828
 829 ')
 830
 831 #######################################
 832 ## <summary>
 833 ##      The template for creating a login user.
 834 ## </summary>
 835 ## <desc>
 836 ##      <p>
 837 ##      This template creates a user domain, types, and
 838 ##      rules for the user's tty, pty, home directories,
 839 ##      tmp, and tmpfs files.
 840 ##      </p>
 841 ## </desc>
 842 ## <param name="userdomain_prefix">
 843 ##      <summary>
 844 ##      The prefix of the user domain (e.g., user
 845 ##      is the prefix for user_t).
 846 ##      </summary>
 847 ## </param>
 848 #
 849 template(`userdom_login_user_template', `
 850         gen_require(`
 851                 class context contains;
 852         ')
 853
 854         userdom_base_user_template($1)
 855
 856         userdom_manage_home_role($1_r, $1_usertype)
 857
 858         userdom_manage_tmp_role($1_r, $1_usertype)
 859         userdom_manage_tmpfs_role($1_r, $1_usertype)
 860
 861         ifelse(`$1',`unconfined',`',`
 862                 gen_tunable(allow_$1_exec_content, true)
 863
 864                 tunable_policy(`allow_$1_exec_content',`
 865                         userdom_exec_user_tmp_files($1_usertype)
 866                         userdom_exec_user_home_content_files($1_usertype)
 867                 ')
 868                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 869                         fs_exec_nfs_files($1_usertype)
 870                 ')
 871
 872                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 873                         fs_exec_cifs_files($1_usertype)
 874                 ')
 875         ')
 876
 877         userdom_change_password_template($1)
 878
 879         ##############################
 880         #
 881         # User domain Local policy
 882         #
 883
 884         allow $1_t self:capability { setgid chown fowner };
 885         dontaudit $1_t self:capability { sys_nice fsetid };
 886
 887         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 888         dontaudit $1_t self:process setrlimit;
 889         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 890
 891         allow $1_t self:context contains;
 892
 893         kernel_dontaudit_read_system_state($1_usertype)
 894         kernel_dontaudit_list_all_proc($1_usertype)
 895
 896         dev_read_sysfs($1_usertype)
 897         dev_read_urand($1_usertype)
 898
 899         domain_use_interactive_fds($1_usertype)
 900         # Command completion can fire hundreds of denials
 901         domain_dontaudit_exec_all_entry_files($1_usertype)
 902
 903         files_dontaudit_list_default($1_usertype)
 904         files_dontaudit_read_default_files($1_usertype)
 905         # Stat lost+found.
 906         files_getattr_lost_found_dirs($1_usertype)
 907
 908         fs_get_all_fs_quotas($1_usertype)
 909         fs_getattr_all_fs($1_usertype)
 910         fs_search_all($1_usertype)
 911         fs_list_inotifyfs($1_usertype)
 912         fs_rw_anon_inodefs_files($1_usertype)
 913
 914         auth_dontaudit_write_login_records($1_t)
 915         auth_rw_cache($1_t)
 916
 917         # Stop warnings about access to /dev/console
 918         init_dontaudit_use_fds($1_usertype)
 919         init_dontaudit_use_script_fds($1_usertype)
 920
 921         libs_exec_lib_files($1_usertype)
 922
 923         logging_dontaudit_getattr_all_logs($1_usertype)
 924
 925         # for running TeX programs
 926         miscfiles_read_tetex_data($1_usertype)
 927         miscfiles_exec_tetex_data($1_usertype)
 928
 929         seutil_read_config($1_usertype)
 930
 931         optional_policy(`
 932                 cups_read_config($1_usertype)
 933                 cups_stream_connect($1_usertype)
 934                 cups_stream_connect_ptal($1_usertype)
 935         ')
 936
 937         optional_policy(`
 938                 kerberos_use($1_usertype)
 939         ')
 940
 941         optional_policy(`
 942                 mta_dontaudit_read_spool_symlinks($1_usertype)
 943         ')
 944
 945         optional_policy(`
 946                 quota_dontaudit_getattr_db($1_usertype)
 947         ')
 948
 949         optional_policy(`
 950                 rpm_read_db($1_usertype)
 951                 rpm_dontaudit_manage_db($1_usertype)
 952                 rpm_read_cache($1_usertype)
 953         ')
 954
 955         optional_policy(`
 956                 oddjob_run_mkhomedir($1_t, $1_r)
 957         ')
 958 ')
 959
 960 #######################################
 961 ## <summary>
 962 ##      The template for creating a unprivileged login user.
 963 ## </summary>
 964 ## <desc>
 965 ##      <p>
 966 ##      This template creates a user domain, types, and
 967 ##      rules for the user's tty, pty, home directories,
 968 ##      tmp, and tmpfs files.
 969 ##      </p>
 970 ## </desc>
 971 ## <param name="userdomain_prefix">
 972 ##      <summary>
 973 ##      The prefix of the user domain (e.g., user
 974 ##      is the prefix for user_t).
 975 ##      </summary>
 976 ## </param>
 977 #
 978 template(`userdom_restricted_user_template',`
 979         gen_require(`
 980                 attribute unpriv_userdomain;
 981         ')
 982
 983         userdom_login_user_template($1)
 984
 985         typeattribute $1_t unpriv_userdomain;
 986         domain_interactive_fd($1_t)
 987
 988         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 989         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 990
 991         ##############################
 992         #
 993         # Local policy
 994         #
 995
 996         optional_policy(`
 997                 loadkeys_run($1_t,$1_r)
 998         ')
 999 ')
1000
1001 #######################################
1002 ## <summary>
1003 ##      The template for creating a unprivileged xwindows login user.
1004 ## </summary>
1005 ## <desc>
1006 ##      <p>
1007 ##      The template for creating a unprivileged xwindows login user.
1008 ##      </p>
1009 ##      <p>
1010 ##      This template creates a user domain, types, and
1011 ##      rules for the user's tty, pty, home directories,
1012 ##      tmp, and tmpfs files.
1013 ##      </p>
1014 ## </desc>
1015 ## <param name="userdomain_prefix">
1016 ##      <summary>
1017 ##      The prefix of the user domain (e.g., user
1018 ##      is the prefix for user_t).
1019 ##      </summary>
1020 ## </param>
1021 #
1022 template(`userdom_restricted_xwindows_user_template',`
1023
1024         userdom_restricted_user_template($1)
1025
1026         ##############################
1027         #
1028         # Local policy
1029         #
1030
1031         auth_role($1_r, $1_t)
1032         auth_search_pam_console_data($1_usertype)
1033         auth_dontaudit_read_login_records($1_usertype)
1034
1035         dev_read_sound($1_usertype)
1036         dev_write_sound($1_usertype)
1037         # gnome keyring wants to read this.
1038         dev_dontaudit_read_rand($1_usertype)
1039         # temporarily allow since openoffice requires this
1040         dev_read_rand($1_usertype)
1041
1042         dev_read_video_dev($1_usertype)
1043         dev_write_video_dev($1_usertype)
1044         dev_rw_wireless($1_usertype)
1045
1046         libs_dontaudit_setattr_lib_files($1_usertype)
1047
1048         tunable_policy(`user_rw_noexattrfile',`
1049                 dev_rw_usbfs($1_t)
1050                 dev_rw_generic_usb_dev($1_usertype)
1051
1052                 fs_manage_noxattr_fs_files($1_usertype)
1053                 fs_manage_noxattr_fs_dirs($1_usertype)
1054                 fs_manage_dos_dirs($1_usertype)
1055                 fs_manage_dos_files($1_usertype)
1056                 storage_raw_read_removable_device($1_usertype)
1057                 storage_raw_write_removable_device($1_usertype)
1058         ')
1059
1060         logging_send_syslog_msg($1_usertype)
1061         logging_dontaudit_send_audit_msgs($1_t)
1062
1063         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1064         logging_send_audit_msgs($1_t)
1065         selinux_get_enforce_mode($1_t)
1066         seutil_exec_restorecond($1_t)
1067         seutil_read_file_contexts($1_t)
1068         seutil_read_default_contexts($1_t)
1069
1070         xserver_restricted_role($1_r, $1_t)
1071
1072         optional_policy(`
1073                 alsa_read_rw_config($1_usertype)
1074         ')
1075
1076          # cjp: needed by KDE apps
1077          # bug: #682499
1078          optional_policy(`
1079                 gnome_read_usr_config($1_usertype)
1080         ')
1081
1082         optional_policy(`
1083                 dbus_role_template($1, $1_r, $1_usertype)
1084                 dbus_system_bus_client($1_usertype)
1085                 allow $1_usertype $1_usertype:dbus send_msg;
1086
1087                 optional_policy(`
1088                         abrt_dbus_chat($1_usertype)
1089                         abrt_run_helper($1_usertype, $1_r)
1090                 ')
1091
1092                 optional_policy(`
1093                         consolekit_dontaudit_read_log($1_usertype)
1094                         consolekit_dbus_chat($1_usertype)
1095                 ')
1096
1097                 optional_policy(`
1098                         cups_dbus_chat($1_usertype)
1099                         cups_dbus_chat_config($1_usertype)
1100                 ')
1101
1102                 optional_policy(`
1103                         devicekit_dbus_chat($1_usertype)
1104                         devicekit_dbus_chat_disk($1_usertype)
1105                         devicekit_dbus_chat_power($1_usertype)
1106                 ')
1107
1108                 optional_policy(`
1109                         fprintd_dbus_chat($1_t)
1110                 ')
1111         ')
1112
1113         optional_policy(`
1114                 openoffice_role_template($1, $1_r, $1_usertype)
1115         ')
1116
1117         optional_policy(`
1118                 policykit_role($1_r, $1_usertype)
1119         ')
1120
1121         optional_policy(`
1122                 pulseaudio_role($1_r, $1_usertype)
1123         ')
1124
1125         optional_policy(`
1126                 rtkit_scheduled($1_usertype)
1127         ')
1128
1129         optional_policy(`
1130                 setroubleshoot_dontaudit_stream_connect($1_t)
1131         ')
1132
1133         optional_policy(`
1134                 udev_read_db($1_usertype)
1135         ')
1136
1137         optional_policy(`
1138                 wm_role_template($1, $1_r, $1_t)
1139         ')
1140 ')
1141
1142 #######################################
1143 ## <summary>
1144 ##      The template for creating a unprivileged user roughly
1145 ##      equivalent to a regular linux user.
1146 ## </summary>
1147 ## <desc>
1148 ##      <p>
1149 ##      The template for creating a unprivileged user roughly
1150 ##      equivalent to a regular linux user.
1151 ##      </p>
1152 ##      <p>
1153 ##      This template creates a user domain, types, and
1154 ##      rules for the user's tty, pty, home directories,
1155 ##      tmp, and tmpfs files.
1156 ##      </p>
1157 ## </desc>
1158 ## <param name="userdomain_prefix">
1159 ##      <summary>
1160 ##      The prefix of the user domain (e.g., user
1161 ##      is the prefix for user_t).
1162 ##      </summary>
1163 ## </param>
1164 #
1165 template(`userdom_unpriv_user_template', `
1166
1167         ##############################
1168         #
1169         # Declarations
1170         #
1171
1172         # Inherit rules for ordinary users.
1173         userdom_restricted_xwindows_user_template($1)
1174         userdom_common_user_template($1)
1175
1176         ##############################
1177         #
1178         # Local policy
1179         #
1180
1181         # port access is audited even if dac would not have allowed it, so dontaudit it here
1182 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1183         # Need the following rule to allow users to run vpnc
1184         corenet_tcp_bind_xserver_port($1_t)
1185         corenet_tcp_bind_generic_node($1_usertype)
1186
1187         storage_rw_fuse($1_t)
1188
1189         miscfiles_read_hwdata($1_usertype)
1190
1191         # Allow users to run TCP servers (bind to ports and accept connection from
1192         # the same domain and outside users) disabling this forces FTP passive mode
1193         # and may change other protocols
1194
1195         tunable_policy(`user_share_music',`
1196                 corenet_tcp_bind_daap_port($1_usertype)
1197         ')
1198
1199         tunable_policy(`user_tcp_server',`
1200                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1201         ')
1202
1203         tunable_policy(`user_setrlimit',`
1204                 allow $1_usertype self:process setrlimit;
1205         ')
1206
1207         optional_policy(`
1208                 cdrecord_role($1_r, $1_t)
1209         ')
1210
1211         optional_policy(`
1212                 cron_role($1_r, $1_t)
1213         ')
1214
1215         optional_policy(`
1216                 games_rw_data($1_usertype)
1217         ')
1218
1219         optional_policy(`
1220                 gpg_role($1_r, $1_usertype)
1221         ')
1222
1223         optional_policy(`
1224                 gnomeclock_dbus_chat($1_t)
1225         ')
1226
1227         optional_policy(`
1228                 gpm_stream_connect($1_usertype)
1229         ')
1230
1231         optional_policy(`
1232                 execmem_role_template($1, $1_r, $1_t)
1233         ')
1234
1235         optional_policy(`
1236                 java_role_template($1, $1_r, $1_t)
1237         ')
1238
1239         optional_policy(`
1240                 mono_role_template($1, $1_r, $1_t)
1241         ')
1242
1243         optional_policy(`
1244                 mount_run_fusermount($1_t, $1_r)
1245                 mount_read_pid_files($1_t)
1246         ')
1247
1248         optional_policy(`
1249                 wine_role_template($1, $1_r, $1_t)
1250         ')
1251
1252         optional_policy(`
1253                 postfix_run_postdrop($1_t, $1_r)
1254         ')
1255
1256         # Run pppd in pppd_t by default for user
1257         optional_policy(`
1258                 ppp_run_cond($1_t, $1_r)
1259         ')
1260 ')
1261
1262 #######################################
1263 ## <summary>
1264 ##      The template for creating an administrative user.
1265 ## </summary>
1266 ## <desc>
1267 ##      <p>
1268 ##      This template creates a user domain, types, and
1269 ##      rules for the user's tty, pty, home directories,
1270 ##      tmp, and tmpfs files.
1271 ##      </p>
1272 ##      <p>
1273 ##      The privileges given to administrative users are:
1274 ##      <ul>
1275 ##              <li>Raw disk access</li>
1276 ##              <li>Set all sysctls</li>
1277 ##              <li>All kernel ring buffer controls</li>
1278 ##              <li>Create, read, write, and delete all files but shadow</li>
1279 ##              <li>Manage source and binary format SELinux policy</li>
1280 ##              <li>Run insmod</li>
1281 ##      </ul>
1282 ##      </p>
1283 ## </desc>
1284 ## <param name="userdomain_prefix">
1285 ##      <summary>
1286 ##      The prefix of the user domain (e.g., sysadm
1287 ##      is the prefix for sysadm_t).
1288 ##      </summary>
1289 ## </param>
1290 #
1291 template(`userdom_admin_user_template',`
1292         gen_require(`
1293                 attribute admindomain;
1294                 class passwd { passwd chfn chsh rootok crontab };
1295         ')
1296
1297         ##############################
1298         #
1299         # Declarations
1300         #
1301
1302         # Inherit rules for ordinary users.
1303         userdom_login_user_template($1)
1304         userdom_common_user_template($1)
1305
1306         domain_obj_id_change_exemption($1_t)
1307         role system_r types $1_t;
1308
1309         typeattribute $1_t admindomain;
1310
1311         ifdef(`direct_sysadm_daemon',`
1312                 domain_system_change_exemption($1_t)
1313         ')
1314
1315         ##############################
1316         #
1317         # $1_t local policy
1318         #
1319
1320         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1321         allow $1_t self:capability2 syslog;
1322         allow $1_t self:process { setexec setfscreate };
1323         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1324         allow $1_t self:tun_socket create;
1325         # Set password information for other users.
1326         allow $1_t self:passwd { passwd chfn chsh };
1327         # Skip authentication when pam_rootok is specified.
1328         allow $1_t self:passwd rootok;
1329
1330         # Manipulate other users crontab.
1331         allow $1_t self:passwd crontab;
1332
1333         kernel_read_software_raid_state($1_t)
1334         kernel_getattr_core_if($1_t)
1335         kernel_getattr_message_if($1_t)
1336         kernel_change_ring_buffer_level($1_t)
1337         kernel_clear_ring_buffer($1_t)
1338         kernel_read_ring_buffer($1_t)
1339         kernel_get_sysvipc_info($1_t)
1340         kernel_rw_all_sysctls($1_t)
1341         # signal unlabeled processes:
1342         kernel_kill_unlabeled($1_t)
1343         kernel_signal_unlabeled($1_t)
1344         kernel_sigstop_unlabeled($1_t)
1345         kernel_signull_unlabeled($1_t)
1346         kernel_sigchld_unlabeled($1_t)
1347         kernel_signal($1_t)
1348
1349         corenet_tcp_bind_generic_port($1_t)
1350         # allow setting up tunnels
1351         corenet_rw_tun_tap_dev($1_t)
1352
1353         dev_getattr_generic_blk_files($1_t)
1354         dev_getattr_generic_chr_files($1_t)
1355         # for lsof
1356         dev_getattr_mtrr_dev($1_t)
1357         # Allow MAKEDEV to work
1358         dev_create_all_blk_files($1_t)
1359         dev_create_all_chr_files($1_t)
1360         dev_delete_all_blk_files($1_t)
1361         dev_delete_all_chr_files($1_t)
1362         dev_rename_all_blk_files($1_t)
1363         dev_rename_all_chr_files($1_t)
1364         dev_create_generic_symlinks($1_t)
1365         dev_rw_generic_usb_dev($1_t)
1366         dev_rw_usbfs($1_t)
1367
1368         domain_setpriority_all_domains($1_t)
1369         domain_read_all_domains_state($1_t)
1370         domain_getattr_all_domains($1_t)
1371         domain_getcap_all_domains($1_t)
1372         domain_dontaudit_ptrace_all_domains($1_t)
1373         # signal all domains:
1374         domain_kill_all_domains($1_t)
1375         domain_signal_all_domains($1_t)
1376         domain_signull_all_domains($1_t)
1377         domain_sigstop_all_domains($1_t)
1378         domain_sigstop_all_domains($1_t)
1379         domain_sigchld_all_domains($1_t)
1380         # for lsof
1381         domain_getattr_all_sockets($1_t)
1382         domain_dontaudit_getattr_all_sockets($1_t)
1383
1384         files_exec_usr_src_files($1_t)
1385
1386         fs_getattr_all_fs($1_t)
1387         fs_getattr_all_files($1_t)
1388         fs_list_all($1_t)
1389         fs_set_all_quotas($1_t)
1390         fs_exec_noxattr($1_t)
1391
1392         storage_raw_read_removable_device($1_t)
1393         storage_raw_write_removable_device($1_t)
1394         storage_dontaudit_read_fixed_disk($1_t)
1395
1396         term_use_all_inherited_terms($1_t)
1397
1398         auth_getattr_shadow($1_t)
1399         # Manage almost all files
1400         auth_manage_all_files_except_shadow($1_t)
1401         # Relabel almost all files
1402         auth_relabel_all_files_except_shadow($1_t)
1403
1404         init_telinit($1_t)
1405
1406         logging_send_syslog_msg($1_t)
1407
1408         optional_policy(`
1409                 modutils_domtrans_insmod($1_t)
1410                 modutils_domtrans_depmod($1_t)
1411         ')
1412
1413         # The following rule is temporary until such time that a complete
1414         # policy management infrastructure is in place so that an administrator
1415         # cannot directly manipulate policy files with arbitrary programs.
1416         seutil_manage_src_policy($1_t)
1417         # Violates the goal of limiting write access to checkpolicy.
1418         # But presently necessary for installing the file_contexts file.
1419         seutil_manage_bin_policy($1_t)
1420
1421         userdom_manage_user_home_content_dirs($1_t)
1422         userdom_manage_user_home_content_files($1_t)
1423         userdom_manage_user_home_content_symlinks($1_t)
1424         userdom_manage_user_home_content_pipes($1_t)
1425         userdom_manage_user_home_content_sockets($1_t)
1426         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1427
1428         tunable_policy(`user_rw_noexattrfile',`
1429                 fs_manage_noxattr_fs_files($1_t)
1430                 fs_manage_noxattr_fs_dirs($1_t)
1431         ',`
1432                 fs_read_noxattr_fs_files($1_t)
1433         ')
1434
1435         optional_policy(`
1436                 postgresql_unconfined($1_t)
1437         ')
1438
1439         optional_policy(`
1440                 userhelper_exec($1_t)
1441         ')
1442 ')
1443
1444 ########################################
1445 ## <summary>
1446 ##      Allow user to run as a secadm
1447 ## </summary>
1448 ## <desc>
1449 ##      <p>
1450 ##      Create objects in a user home directory
1451 ##      with an automatic type transition to
1452 ##      a specified private type.
1453 ##      </p>
1454 ##      <p>
1455 ##      This is a templated interface, and should only
1456 ##      be called from a per-userdomain template.
1457 ##      </p>
1458 ## </desc>
1459 ## <param name="domain">
1460 ##      <summary>
1461 ##      Domain allowed access.
1462 ##      </summary>
1463 ## </param>
1464 ## <param name="role">
1465 ##      <summary>
1466 ##      The role  of the object to create.
1467 ##      </summary>
1468 ## </param>
1469 #
1470 template(`userdom_security_admin_template',`
1471         allow $1 self:capability { dac_read_search dac_override };
1472
1473         corecmd_exec_shell($1)
1474
1475         domain_obj_id_change_exemption($1)
1476
1477         dev_relabel_all_dev_nodes($1)
1478
1479         files_create_boot_flag($1)
1480         files_create_default_dir($1)
1481         files_root_filetrans_default($1, dir)
1482
1483         # Necessary for managing /boot/efi
1484         fs_manage_dos_files($1)
1485
1486         mls_process_read_up($1)
1487         mls_file_read_all_levels($1)
1488         mls_file_upgrade($1)
1489         mls_file_downgrade($1)
1490
1491         selinux_set_enforce_mode($1)
1492         selinux_set_all_booleans($1)
1493         selinux_set_parameters($1)
1494         selinux_read_policy($1)
1495
1496         auth_relabel_all_files_except_shadow($1)
1497         auth_relabel_shadow($1)
1498
1499         init_exec($1)
1500
1501         logging_send_syslog_msg($1)
1502         logging_read_audit_log($1)
1503         logging_read_generic_logs($1)
1504         logging_read_audit_config($1)
1505
1506         seutil_manage_bin_policy($1)
1507         seutil_run_checkpolicy($1,$2)
1508         seutil_run_loadpolicy($1,$2)
1509         seutil_run_semanage($1,$2)
1510         seutil_run_setsebool($1,$2)
1511         seutil_run_setfiles($1, $2)
1512
1513         optional_policy(`
1514                 aide_run($1,$2)
1515         ')
1516
1517         optional_policy(`
1518                 consoletype_exec($1)
1519         ')
1520
1521         optional_policy(`
1522                 dmesg_exec($1)
1523         ')
1524
1525         optional_policy(`
1526                 ipsec_run_setkey($1,$2)
1527         ')
1528
1529         optional_policy(`
1530                 netlabel_run_mgmt($1,$2)
1531         ')
1532
1533         optional_policy(`
1534                 samhain_run($1, $2)
1535         ')
1536 ')
1537
1538 ########################################
1539 ## <summary>
1540 ##      Make the specified type usable in a
1541 ##      user home directory.
1542 ## </summary>
1543 ## <param name="type">
1544 ##      <summary>
1545 ##      Type to be used as a file in the
1546 ##      user home directory.
1547 ##      </summary>
1548 ## </param>
1549 #
1550 interface(`userdom_user_home_content',`
1551         gen_require(`
1552                 type user_home_t;
1553                 attribute user_home_type;
1554         ')
1555
1556         allow $1 user_home_t:filesystem associate;
1557         files_type($1)
1558         ubac_constrained($1)
1559
1560         files_poly_member($1)
1561         typeattribute $1  user_home_type;
1562 ')
1563
1564 ########################################
1565 ## <summary>
1566 ##      Make the specified type usable in a
1567 ##      generic temporary directory.
1568 ## </summary>
1569 ## <param name="type">
1570 ##      <summary>
1571 ##      Type to be used as a file in the
1572 ##      generic temporary directory.
1573 ##      </summary>
1574 ## </param>
1575 #
1576 interface(`userdom_user_tmp_content',`
1577         gen_require(`
1578                 attribute user_tmp_type;
1579         ')
1580
1581         typeattribute $1 user_tmp_type;
1582
1583         files_tmp_file($1)
1584         ubac_constrained($1)
1585 ')
1586
1587 ########################################
1588 ## <summary>
1589 ##      Allow domain to attach to TUN devices created by administrative users.
1590 ## </summary>
1591 ## <param name="domain">
1592 ##      <summary>
1593 ##      Domain allowed access.
1594 ##      </summary>
1595 ## </param>
1596 #
1597 interface(`userdom_attach_admin_tun_iface',`
1598         gen_require(`
1599                 attribute admindomain;
1600         ')
1601
1602         allow $1 admindomain:tun_socket relabelfrom;
1603         allow $1 self:tun_socket relabelto;
1604 ')
1605
1606 ########################################
1607 ## <summary>
1608 ##      Set the attributes of a user pty.
1609 ## </summary>
1610 ## <param name="domain">
1611 ##      <summary>
1612 ##      Domain allowed access.
1613 ##      </summary>
1614 ## </param>
1615 #
1616 interface(`userdom_setattr_user_ptys',`
1617         gen_require(`
1618                 type user_devpts_t;
1619         ')
1620
1621         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1622 ')
1623
1624 ########################################
1625 ## <summary>
1626 ##      Create a user pty.
1627 ## </summary>
1628 ## <param name="domain">
1629 ##      <summary>
1630 ##      Domain allowed access.
1631 ##      </summary>
1632 ## </param>
1633 #
1634 interface(`userdom_create_user_pty',`
1635         gen_require(`
1636                 type user_devpts_t;
1637         ')
1638
1639         term_create_pty($1, user_devpts_t)
1640 ')
1641
1642 ########################################
1643 ## <summary>
1644 ##      Get the attributes of user home directories.
1645 ## </summary>
1646 ## <param name="domain">
1647 ##      <summary>
1648 ##      Domain allowed access.
1649 ##      </summary>
1650 ## </param>
1651 #
1652 interface(`userdom_getattr_user_home_dirs',`
1653         gen_require(`
1654                 type user_home_dir_t;
1655         ')
1656
1657         allow $1 user_home_dir_t:dir getattr_dir_perms;
1658         files_search_home($1)
1659 ')
1660
1661 ########################################
1662 ## <summary>
1663 ##      Do not audit attempts to get the attributes of user home directories.
1664 ## </summary>
1665 ## <param name="domain">
1666 ##      <summary>
1667 ##      Domain to not audit.
1668 ##      </summary>
1669 ## </param>
1670 #
1671 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1672         gen_require(`
1673                 type user_home_dir_t;
1674         ')
1675
1676         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1677 ')
1678
1679 ########################################
1680 ## <summary>
1681 ##      Search user home directories.
1682 ## </summary>
1683 ## <param name="domain">
1684 ##      <summary>
1685 ##      Domain allowed access.
1686 ##      </summary>
1687 ## </param>
1688 #
1689 interface(`userdom_search_user_home_dirs',`
1690         gen_require(`
1691                 type user_home_dir_t;
1692         ')
1693
1694         allow $1 user_home_dir_t:dir search_dir_perms;
1695         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1696         files_search_home($1)
1697 ')
1698
1699 ########################################
1700 ## <summary>
1701 ##      Do not audit attempts to search user home directories.
1702 ## </summary>
1703 ## <desc>
1704 ##      <p>
1705 ##      Do not audit attempts to search user home directories.
1706 ##      This will supress SELinux denial messages when the specified
1707 ##      domain is denied the permission to search these directories.
1708 ##      </p>
1709 ## </desc>
1710 ## <param name="domain">
1711 ##      <summary>
1712 ##      Domain to not audit.
1713 ##      </summary>
1714 ## </param>
1715 ## <infoflow type="none"/>
1716 #
1717 interface(`userdom_dontaudit_search_user_home_dirs',`
1718         gen_require(`
1719                 type user_home_dir_t;
1720         ')
1721
1722         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1723 ')
1724
1725 ########################################
1726 ## <summary>
1727 ##      List user home directories.
1728 ## </summary>
1729 ## <param name="domain">
1730 ##      <summary>
1731 ##      Domain allowed access.
1732 ##      </summary>
1733 ## </param>
1734 #
1735 interface(`userdom_list_user_home_dirs',`
1736         gen_require(`
1737                 type user_home_dir_t;
1738         ')
1739
1740         allow $1 user_home_dir_t:dir list_dir_perms;
1741         files_search_home($1)
1742
1743         tunable_policy(`use_nfs_home_dirs',`
1744                 fs_list_nfs($1)
1745         ')
1746
1747         tunable_policy(`use_samba_home_dirs',`
1748                 fs_list_cifs($1)
1749         ')
1750 ')
1751
1752 ########################################
1753 ## <summary>
1754 ##      Do not audit attempts to list user home subdirectories.
1755 ## </summary>
1756 ## <param name="domain">
1757 ##      <summary>
1758 ##      Domain to not audit.
1759 ##      </summary>
1760 ## </param>
1761 #
1762 interface(`userdom_dontaudit_list_user_home_dirs',`
1763         gen_require(`
1764                 type user_home_dir_t;
1765                 type user_home_t;
1766         ')
1767
1768         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1769         dontaudit $1 user_home_t:dir list_dir_perms;
1770 ')
1771
1772 ########################################
1773 ## <summary>
1774 ##      Create user home directories.
1775 ## </summary>
1776 ## <param name="domain">
1777 ##      <summary>
1778 ##      Domain allowed access.
1779 ##      </summary>
1780 ## </param>
1781 #
1782 interface(`userdom_create_user_home_dirs',`
1783         gen_require(`
1784                 type user_home_dir_t;
1785         ')
1786
1787         allow $1 user_home_dir_t:dir create_dir_perms;
1788 ')
1789
1790 ########################################
1791 ## <summary>
1792 ##      Create user home directories.
1793 ## </summary>
1794 ## <param name="domain">
1795 ##      <summary>
1796 ##      Domain allowed access.
1797 ##      </summary>
1798 ## </param>
1799 #
1800 interface(`userdom_manage_user_home_dirs',`
1801         gen_require(`
1802                 type user_home_dir_t;
1803         ')
1804
1805         allow $1 user_home_dir_t:dir manage_dir_perms;
1806 ')
1807
1808 ########################################
1809 ## <summary>
1810 ##      Relabel to user home directories.
1811 ## </summary>
1812 ## <param name="domain">
1813 ##      <summary>
1814 ##      Domain allowed access.
1815 ##      </summary>
1816 ## </param>
1817 #
1818 interface(`userdom_relabelto_user_home_dirs',`
1819         gen_require(`
1820                 type user_home_dir_t;
1821         ')
1822
1823         allow $1 user_home_dir_t:dir relabelto;
1824 ')
1825
1826
1827 ########################################
1828 ## <summary>
1829 ##      Relabel to user home files.
1830 ## </summary>
1831 ## <param name="domain">
1832 ##      <summary>
1833 ##      Domain allowed access.
1834 ##      </summary>
1835 ## </param>
1836 #
1837 interface(`userdom_relabelto_user_home_files',`
1838         gen_require(`
1839                 type user_home_t;
1840         ')
1841
1842         allow $1 user_home_t:file relabelto;
1843 ')
1844 ########################################
1845 ## <summary>
1846 ##      Relabel user home files.
1847 ## </summary>
1848 ## <param name="domain">
1849 ##      <summary>
1850 ##      Domain allowed access.
1851 ##      </summary>
1852 ## </param>
1853 #
1854 interface(`userdom_relabel_user_home_files',`
1855         gen_require(`
1856                 type user_home_t;
1857         ')
1858
1859         allow $1 user_home_t:file relabel_file_perms;
1860 ')
1861
1862 ########################################
1863 ## <summary>
1864 ##      Create directories in the home dir root with
1865 ##      the user home directory type.
1866 ## </summary>
1867 ## <param name="domain">
1868 ##      <summary>
1869 ##      Domain allowed access.
1870 ##      </summary>
1871 ## </param>
1872 #
1873 interface(`userdom_home_filetrans_user_home_dir',`
1874         gen_require(`
1875                 type user_home_dir_t;
1876         ')
1877
1878         files_home_filetrans($1, user_home_dir_t, dir)
1879 ')
1880
1881 ########################################
1882 ## <summary>
1883 ##      Do a domain transition to the specified
1884 ##      domain when executing a program in the
1885 ##      user home directory.
1886 ## </summary>
1887 ## <desc>
1888 ##      <p>
1889 ##      Do a domain transition to the specified
1890 ##      domain when executing a program in the
1891 ##      user home directory.
1892 ##      </p>
1893 ##      <p>
1894 ##      No interprocess communication (signals, pipes,
1895 ##      etc.) is provided by this interface since
1896 ##      the domains are not owned by this module.
1897 ##      </p>
1898 ## </desc>
1899 ## <param name="source_domain">
1900 ##      <summary>
1901 ##      Domain allowed to transition.
1902 ##      </summary>
1903 ## </param>
1904 ## <param name="target_domain">
1905 ##      <summary>
1906 ##      Domain to transition to.
1907 ##      </summary>
1908 ## </param>
1909 #
1910 interface(`userdom_user_home_domtrans',`
1911         gen_require(`
1912                 type user_home_dir_t, user_home_t;
1913         ')
1914
1915         domain_auto_trans($1, user_home_t, $2)
1916         allow $1 user_home_dir_t:dir search_dir_perms;
1917         files_search_home($1)
1918 ')
1919
1920 ########################################
1921 ## <summary>
1922 ##      Do not audit attempts to search user home content directories.
1923 ## </summary>
1924 ## <param name="domain">
1925 ##      <summary>
1926 ##      Domain to not audit.
1927 ##      </summary>
1928 ## </param>
1929 #
1930 interface(`userdom_dontaudit_search_user_home_content',`
1931         gen_require(`
1932                 type user_home_t;
1933         ')
1934
1935         dontaudit $1 user_home_t:dir search_dir_perms;
1936         fs_dontaudit_list_nfs($1)
1937         fs_dontaudit_list_cifs($1)
1938 ')
1939
1940 ########################################
1941 ## <summary>
1942 ##      List contents of users home directory.
1943 ## </summary>
1944 ## <param name="domain">
1945 ##      <summary>
1946 ##      Domain allowed access.
1947 ##      </summary>
1948 ## </param>
1949 #
1950 interface(`userdom_list_user_home_content',`
1951         gen_require(`
1952                 type user_home_dir_t;
1953                 attribute user_home_type;
1954         ')
1955
1956         files_list_home($1)
1957         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1958 ')
1959
1960 ########################################
1961 ## <summary>
1962 ##      Create, read, write, and delete directories
1963 ##      in a user home subdirectory.
1964 ## </summary>
1965 ## <param name="domain">
1966 ##      <summary>
1967 ##      Domain allowed access.
1968 ##      </summary>
1969 ## </param>
1970 #
1971 interface(`userdom_manage_user_home_content_dirs',`
1972         gen_require(`
1973                 type user_home_dir_t, user_home_t;
1974         ')
1975
1976         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1977         files_search_home($1)
1978 ')
1979
1980 ########################################
1981 ## <summary>
1982 ##      Delete directories in a user home subdirectory.
1983 ## </summary>
1984 ## <param name="domain">
1985 ##      <summary>
1986 ##      Domain allowed access.
1987 ##      </summary>
1988 ## </param>
1989 #
1990 interface(`userdom_delete_user_home_content_dirs',`
1991         gen_require(`
1992                 type user_home_t;
1993         ')
1994
1995         allow $1 user_home_t:dir delete_dir_perms;
1996 ')
1997
1998 ########################################
1999 ## <summary>
2000 ##      Set the attributes of user home files.
2001 ## </summary>
2002 ## <param name="domain">
2003 ##      <summary>
2004 ##      Domain allowed access.
2005 ##      </summary>
2006 ## </param>
2007 ## <rolecap/>
2008 #
2009 interface(`userdom_setattr_user_home_content_files',`
2010         gen_require(`
2011                 type user_home_t;
2012         ')
2013
2014         allow $1 user_home_t:file setattr;
2015 ')
2016
2017 ########################################
2018 ## <summary>
2019 ##      Do not audit attempts to set the
2020 ##      attributes of user home files.
2021 ## </summary>
2022 ## <param name="domain">
2023 ##      <summary>
2024 ##      Domain to not audit.
2025 ##      </summary>
2026 ## </param>
2027 #
2028 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2029         gen_require(`
2030                 type user_home_t;
2031         ')
2032
2033         dontaudit $1 user_home_t:file setattr_file_perms;
2034 ')
2035
2036 ########################################
2037 ## <summary>
2038 ##      Mmap user home files.
2039 ## </summary>
2040 ## <param name="domain">
2041 ##      <summary>
2042 ##      Domain allowed access.
2043 ##      </summary>
2044 ## </param>
2045 #
2046 interface(`userdom_mmap_user_home_content_files',`
2047         gen_require(`
2048                 type user_home_dir_t, user_home_t;
2049         ')
2050
2051         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2052         files_search_home($1)
2053 ')
2054
2055 ########################################
2056 ## <summary>
2057 ##      Read user home files.
2058 ## </summary>
2059 ## <param name="domain">
2060 ##      <summary>
2061 ##      Domain allowed access.
2062 ##      </summary>
2063 ## </param>
2064 #
2065 interface(`userdom_read_user_home_content_files',`
2066         gen_require(`
2067                 type user_home_dir_t, user_home_t;
2068         ')
2069
2070         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2071         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2072         files_search_home($1)
2073 ')
2074
2075 ########################################
2076 ## <summary>
2077 ##      Do not audit attempts to getattr user home files.
2078 ## </summary>
2079 ## <param name="domain">
2080 ##      <summary>
2081 ##      Domain to not audit.
2082 ##      </summary>
2083 ## </param>
2084 #
2085 interface(`userdom_dontaudit_getattr_user_home_content',`
2086         gen_require(`
2087                 attribute user_home_type;
2088         ')
2089
2090         dontaudit $1 user_home_type:dir getattr;
2091         dontaudit $1 user_home_type:file getattr;
2092 ')
2093
2094 ########################################
2095 ## <summary>
2096 ##      Do not audit attempts to read user home files.
2097 ## </summary>
2098 ## <param name="domain">
2099 ##      <summary>
2100 ##      Domain to not audit.
2101 ##      </summary>
2102 ## </param>
2103 #
2104 interface(`userdom_dontaudit_read_user_home_content_files',`
2105         gen_require(`
2106                 attribute user_home_type;
2107                 type user_home_dir_t;
2108         ')
2109
2110         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2111         dontaudit $1 user_home_type:dir list_dir_perms;
2112         dontaudit $1 user_home_type:file read_file_perms;
2113         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2114 ')
2115
2116 ########################################
2117 ## <summary>
2118 ##      Do not audit attempts to append user home files.
2119 ## </summary>
2120 ## <param name="domain">
2121 ##      <summary>
2122 ##      Domain to not audit.
2123 ##      </summary>
2124 ## </param>
2125 #
2126 interface(`userdom_dontaudit_append_user_home_content_files',`
2127         gen_require(`
2128                 type user_home_t;
2129         ')
2130
2131         dontaudit $1 user_home_t:file append_file_perms;
2132 ')
2133
2134 ########################################
2135 ## <summary>
2136 ##      Do not audit attempts to write user home files.
2137 ## </summary>
2138 ## <param name="domain">
2139 ##      <summary>
2140 ##      Domain to not audit.
2141 ##      </summary>
2142 ## </param>
2143 #
2144 interface(`userdom_dontaudit_write_user_home_content_files',`
2145         gen_require(`
2146                 type user_home_t;
2147         ')
2148
2149         dontaudit $1 user_home_t:file write_file_perms;
2150 ')
2151
2152 ########################################
2153 ## <summary>
2154 ##      Delete files in a user home subdirectory.
2155 ## </summary>
2156 ## <param name="domain">
2157 ##      <summary>
2158 ##      Domain allowed access.
2159 ##      </summary>
2160 ## </param>
2161 #
2162 interface(`userdom_delete_user_home_content_files',`
2163         gen_require(`
2164                 type user_home_t;
2165         ')
2166
2167         allow $1 user_home_t:file delete_file_perms;
2168 ')
2169
2170 ########################################
2171 ## <summary>
2172 ##      Delete sock files in a user home subdirectory.
2173 ## </summary>
2174 ## <param name="domain">
2175 ##      <summary>
2176 ##      Domain allowed access.
2177 ##      </summary>
2178 ## </param>
2179 #
2180 interface(`userdom_delete_user_home_content_sock_files',`
2181         gen_require(`
2182                 type user_home_t;
2183         ')
2184
2185         allow $1 user_home_t:sock_file delete_file_perms;
2186 ')
2187
2188 ########################################
2189 ## <summary>
2190 ##      Do not audit attempts to write user home files.
2191 ## </summary>
2192 ## <param name="domain">
2193 ##      <summary>
2194 ##      Domain to not audit.
2195 ##      </summary>
2196 ## </param>
2197 #
2198 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2199         gen_require(`
2200                 type user_home_t;
2201         ')
2202
2203         dontaudit $1 user_home_t:file relabel_file_perms;
2204 ')
2205
2206 ########################################
2207 ## <summary>
2208 ##      Read user home subdirectory symbolic links.
2209 ## </summary>
2210 ## <param name="domain">
2211 ##      <summary>
2212 ##      Domain allowed access.
2213 ##      </summary>
2214 ## </param>
2215 #
2216 interface(`userdom_read_user_home_content_symlinks',`
2217         gen_require(`
2218                 type user_home_dir_t, user_home_t;
2219         ')
2220
2221         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2222 ')
2223
2224 ########################################
2225 ## <summary>
2226 ##      Execute user home files.
2227 ## </summary>
2228 ## <param name="domain">
2229 ##      <summary>
2230 ##      Domain allowed access.
2231 ##      </summary>
2232 ## </param>
2233 ## <rolecap/>
2234 #
2235 interface(`userdom_exec_user_home_content_files',`
2236         gen_require(`
2237                 type user_home_dir_t;
2238                 attribute user_home_type;
2239         ')
2240
2241         files_search_home($1)
2242         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2243         dontaudit $1 user_home_type:sock_file execute;
2244         ')
2245
2246 ########################################
2247 ## <summary>
2248 ##      Do not audit attempts to execute user home files.
2249 ## </summary>
2250 ## <param name="domain">
2251 ##      <summary>
2252 ##      Domain to not audit.
2253 ##      </summary>
2254 ## </param>
2255 #
2256 interface(`userdom_dontaudit_exec_user_home_content_files',`
2257         gen_require(`
2258                 type user_home_t;
2259         ')
2260
2261         dontaudit $1 user_home_t:file exec_file_perms;
2262 ')
2263
2264 ########################################
2265 ## <summary>
2266 ##      Create, read, write, and delete files
2267 ##      in a user home subdirectory.
2268 ## </summary>
2269 ## <param name="domain">
2270 ##      <summary>
2271 ##      Domain allowed access.
2272 ##      </summary>
2273 ## </param>
2274 #
2275 interface(`userdom_manage_user_home_content_files',`
2276         gen_require(`
2277                 type user_home_dir_t, user_home_t;
2278         ')
2279
2280         manage_files_pattern($1, user_home_t, user_home_t)
2281         allow $1 user_home_dir_t:dir search_dir_perms;
2282         files_search_home($1)
2283 ')
2284
2285 ########################################
2286 ## <summary>
2287 ##      Do not audit attempts to create, read, write, and delete directories
2288 ##      in a user home subdirectory.
2289 ## </summary>
2290 ## <param name="domain">
2291 ##      <summary>
2292 ##      Domain to not audit.
2293 ##      </summary>
2294 ## </param>
2295 #
2296 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2297         gen_require(`
2298                 type user_home_dir_t, user_home_t;
2299         ')
2300
2301         dontaudit $1 user_home_t:dir manage_dir_perms;
2302 ')
2303
2304 ########################################
2305 ## <summary>
2306 ##      Create, read, write, and delete symbolic links
2307 ##      in a user home subdirectory.
2308 ## </summary>
2309 ## <param name="domain">
2310 ##      <summary>
2311 ##      Domain allowed access.
2312 ##      </summary>
2313 ## </param>
2314 #
2315 interface(`userdom_manage_user_home_content_symlinks',`
2316         gen_require(`
2317                 type user_home_dir_t, user_home_t;
2318         ')
2319
2320         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2321         allow $1 user_home_dir_t:dir search_dir_perms;
2322         files_search_home($1)
2323 ')
2324
2325 ########################################
2326 ## <summary>
2327 ##      Delete symbolic links in a user home directory.
2328 ## </summary>
2329 ## <param name="domain">
2330 ##      <summary>
2331 ##      Domain allowed access.
2332 ##      </summary>
2333 ## </param>
2334 #
2335 interface(`userdom_delete_user_home_content_symlinks',`
2336         gen_require(`
2337                 type user_home_t;
2338         ')
2339
2340         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2341 ')
2342
2343 ########################################
2344 ## <summary>
2345 ##      Create, read, write, and delete named pipes
2346 ##      in a user home subdirectory.
2347 ## </summary>
2348 ## <param name="domain">
2349 ##      <summary>
2350 ##      Domain allowed access.
2351 ##      </summary>
2352 ## </param>
2353 #
2354 interface(`userdom_manage_user_home_content_pipes',`
2355         gen_require(`
2356                 type user_home_dir_t, user_home_t;
2357         ')
2358
2359         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2360         allow $1 user_home_dir_t:dir search_dir_perms;
2361         files_search_home($1)
2362 ')
2363
2364 ########################################
2365 ## <summary>
2366 ##      Create, read, write, and delete named sockets
2367 ##      in a user home subdirectory.
2368 ## </summary>
2369 ## <param name="domain">
2370 ##      <summary>
2371 ##      Domain allowed access.
2372 ##      </summary>
2373 ## </param>
2374 #
2375 interface(`userdom_manage_user_home_content_sockets',`
2376         gen_require(`
2377                 type user_home_dir_t, user_home_t;
2378         ')
2379
2380         allow $1 user_home_dir_t:dir search_dir_perms;
2381         manage_sock_files_pattern($1, user_home_t, user_home_t)
2382         files_search_home($1)
2383 ')
2384
2385 ########################################
2386 ## <summary>
2387 ##      Create objects in a user home directory
2388 ##      with an automatic type transition to
2389 ##      a specified private type.
2390 ## </summary>
2391 ## <param name="domain">
2392 ##      <summary>
2393 ##      Domain allowed access.
2394 ##      </summary>
2395 ## </param>
2396 ## <param name="private_type">
2397 ##      <summary>
2398 ##      The type of the object to create.
2399 ##      </summary>
2400 ## </param>
2401 ## <param name="object_class">
2402 ##      <summary>
2403 ##      The class of the object to be created.
2404 ##      </summary>
2405 ## </param>
2406 #
2407 interface(`userdom_user_home_dir_filetrans',`
2408         gen_require(`
2409                 type user_home_dir_t;
2410         ')
2411
2412         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2413         files_search_home($1)
2414 ')
2415
2416 ########################################
2417 ## <summary>
2418 ##      Create objects in a user home directory
2419 ##      with an automatic type transition to
2420 ##      a specified private type.
2421 ## </summary>
2422 ## <param name="domain">
2423 ##      <summary>
2424 ##      Domain allowed access.
2425 ##      </summary>
2426 ## </param>
2427 ## <param name="private_type">
2428 ##      <summary>
2429 ##      The type of the object to create.
2430 ##      </summary>
2431 ## </param>
2432 ## <param name="object_class">
2433 ##      <summary>
2434 ##      The class of the object to be created.
2435 ##      </summary>
2436 ## </param>
2437 #
2438 interface(`userdom_user_home_content_filetrans',`
2439         gen_require(`
2440                 type user_home_dir_t, user_home_t;
2441         ')
2442
2443         filetrans_pattern($1, user_home_t, $2, $3)
2444         allow $1 user_home_dir_t:dir search_dir_perms;
2445         files_search_home($1)
2446 ')
2447
2448 ########################################
2449 ## <summary>
2450 ##      Create objects in a user home directory
2451 ##      with an automatic type transition to
2452 ##      the user home file type.
2453 ## </summary>
2454 ## <param name="domain">
2455 ##      <summary>
2456 ##      Domain allowed access.
2457 ##      </summary>
2458 ## </param>
2459 ## <param name="object_class">
2460 ##      <summary>
2461 ##      The class of the object to be created.
2462 ##      </summary>
2463 ## </param>
2464 #
2465 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2466         gen_require(`
2467                 type user_home_dir_t, user_home_t;
2468         ')
2469
2470         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2471         files_search_home($1)
2472 ')
2473
2474 ########################################
2475 ## <summary>
2476 ##      Write to user temporary named sockets.
2477 ## </summary>
2478 ## <param name="domain">
2479 ##      <summary>
2480 ##      Domain allowed access.
2481 ##      </summary>
2482 ## </param>
2483 #
2484 interface(`userdom_write_user_tmp_sockets',`
2485         gen_require(`
2486                 type user_tmp_t;
2487         ')
2488
2489         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2490         files_search_tmp($1)
2491 ')
2492
2493 ########################################
2494 ## <summary>
2495 ##      List user temporary directories.
2496 ## </summary>
2497 ## <param name="domain">
2498 ##      <summary>
2499 ##      Domain allowed access.
2500 ##      </summary>
2501 ## </param>
2502 #
2503 interface(`userdom_list_user_tmp',`
2504         gen_require(`
2505                 type user_tmp_t;
2506         ')
2507
2508         allow $1 user_tmp_t:dir list_dir_perms;
2509         files_search_tmp($1)
2510 ')
2511
2512 ########################################
2513 ## <summary>
2514 ##      Do not audit attempts to list user
2515 ##      temporary directories.
2516 ## </summary>
2517 ## <param name="domain">
2518 ##      <summary>
2519 ##      Domain to not audit.
2520 ##      </summary>
2521 ## </param>
2522 #
2523 interface(`userdom_dontaudit_list_user_tmp',`
2524         gen_require(`
2525                 type user_tmp_t;
2526         ')
2527
2528         dontaudit $1 user_tmp_t:dir list_dir_perms;
2529 ')
2530
2531 ########################################
2532 ## <summary>
2533 ##      Do not audit attempts to manage users
2534 ##      temporary directories.
2535 ## </summary>
2536 ## <param name="domain">
2537 ##      <summary>
2538 ##      Domain to not audit.
2539 ##      </summary>
2540 ## </param>
2541 #
2542 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2543         gen_require(`
2544                 type user_tmp_t;
2545         ')
2546
2547         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2548 ')
2549
2550 ########################################
2551 ## <summary>
2552 ##      Read user temporary files.
2553 ## </summary>
2554 ## <param name="domain">
2555 ##      <summary>
2556 ##      Domain allowed access.
2557 ##      </summary>
2558 ## </param>
2559 #
2560 interface(`userdom_read_user_tmp_files',`
2561         gen_require(`
2562                 type user_tmp_t;
2563         ')
2564
2565         read_files_pattern($1, user_tmp_t, user_tmp_t)
2566         allow $1 user_tmp_t:dir list_dir_perms;
2567         files_search_tmp($1)
2568 ')
2569
2570 ########################################
2571 ## <summary>
2572 ##      Do not audit attempts to read users
2573 ##      temporary files.
2574 ## </summary>
2575 ## <param name="domain">
2576 ##      <summary>
2577 ##      Domain to not audit.
2578 ##      </summary>
2579 ## </param>
2580 #
2581 interface(`userdom_dontaudit_read_user_tmp_files',`
2582         gen_require(`
2583                 type user_tmp_t;
2584         ')
2585
2586         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2587 ')
2588
2589 ########################################
2590 ## <summary>
2591 ##      Do not audit attempts to append users
2592 ##      temporary files.
2593 ## </summary>
2594 ## <param name="domain">
2595 ##      <summary>
2596 ##      Domain to not audit.
2597 ##      </summary>
2598 ## </param>
2599 #
2600 interface(`userdom_dontaudit_append_user_tmp_files',`
2601         gen_require(`
2602                 type user_tmp_t;
2603         ')
2604
2605         dontaudit $1 user_tmp_t:file append_file_perms;
2606 ')
2607
2608 ########################################
2609 ## <summary>
2610 ##      Read and write user temporary files.
2611 ## </summary>
2612 ## <param name="domain">
2613 ##      <summary>
2614 ##      Domain allowed access.
2615 ##      </summary>
2616 ## </param>
2617 #
2618 interface(`userdom_rw_user_tmp_files',`
2619         gen_require(`
2620                 type user_tmp_t;
2621         ')
2622
2623         allow $1 user_tmp_t:dir list_dir_perms;
2624         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2625         files_search_tmp($1)
2626 ')
2627
2628 ########################################
2629 ## <summary>
2630 ##      Do not audit attempts to manage users
2631 ##      temporary files.
2632 ## </summary>
2633 ## <param name="domain">
2634 ##      <summary>
2635 ##      Domain to not audit.
2636 ##      </summary>
2637 ## </param>
2638 #
2639 interface(`userdom_dontaudit_manage_user_tmp_files',`
2640         gen_require(`
2641                 type user_tmp_t;
2642         ')
2643
2644         dontaudit $1 user_tmp_t:file manage_file_perms;
2645 ')
2646
2647 ########################################
2648 ## <summary>
2649 ##      Read user temporary symbolic links.
2650 ## </summary>
2651 ## <param name="domain">
2652 ##      <summary>
2653 ##      Domain allowed access.
2654 ##      </summary>
2655 ## </param>
2656 #
2657 interface(`userdom_read_user_tmp_symlinks',`
2658         gen_require(`
2659                 type user_tmp_t;
2660         ')
2661
2662         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2663         allow $1 user_tmp_t:dir list_dir_perms;
2664         files_search_tmp($1)
2665 ')
2666
2667 ########################################
2668 ## <summary>
2669 ##      Create, read, write, and delete user
2670 ##      temporary directories.
2671 ## </summary>
2672 ## <param name="domain">
2673 ##      <summary>
2674 ##      Domain allowed access.
2675 ##      </summary>
2676 ## </param>
2677 #
2678 interface(`userdom_manage_user_tmp_dirs',`
2679         gen_require(`
2680                 type user_tmp_t;
2681         ')
2682
2683         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2684         files_search_tmp($1)
2685 ')
2686
2687 ########################################
2688 ## <summary>
2689 ##      Create, read, write, and delete user
2690 ##      temporary files.
2691 ## </summary>
2692 ## <param name="domain">
2693 ##      <summary>
2694 ##      Domain allowed access.
2695 ##      </summary>
2696 ## </param>
2697 #
2698 interface(`userdom_manage_user_tmp_files',`
2699         gen_require(`
2700                 type user_tmp_t;
2701         ')
2702
2703         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2704         files_search_tmp($1)
2705 ')
2706
2707 ########################################
2708 ## <summary>
2709 ##      Create, read, write, and delete user
2710 ##      temporary symbolic links.
2711 ## </summary>
2712 ## <param name="domain">
2713 ##      <summary>
2714 ##      Domain allowed access.
2715 ##      </summary>
2716 ## </param>
2717 #
2718 interface(`userdom_manage_user_tmp_symlinks',`
2719         gen_require(`
2720                 type user_tmp_t;
2721         ')
2722
2723         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2724         files_search_tmp($1)
2725 ')
2726
2727 ########################################
2728 ## <summary>
2729 ##      Create, read, write, and delete user
2730 ##      temporary named pipes.
2731 ## </summary>
2732 ## <param name="domain">
2733 ##      <summary>
2734 ##      Domain allowed access.
2735 ##      </summary>
2736 ## </param>
2737 #
2738 interface(`userdom_manage_user_tmp_pipes',`
2739         gen_require(`
2740                 type user_tmp_t;
2741         ')
2742
2743         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2744         files_search_tmp($1)
2745 ')
2746
2747 ########################################
2748 ## <summary>
2749 ##      Create, read, write, and delete user
2750 ##      temporary named sockets.
2751 ## </summary>
2752 ## <param name="domain">
2753 ##      <summary>
2754 ##      Domain allowed access.
2755 ##      </summary>
2756 ## </param>
2757 #
2758 interface(`userdom_manage_user_tmp_sockets',`
2759         gen_require(`
2760                 type user_tmp_t;
2761         ')
2762
2763         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2764         files_search_tmp($1)
2765 ')
2766
2767 ########################################
2768 ## <summary>
2769 ##      Create objects in a user temporary directory
2770 ##      with an automatic type transition to
2771 ##      a specified private type.
2772 ## </summary>
2773 ## <param name="domain">
2774 ##      <summary>
2775 ##      Domain allowed access.
2776 ##      </summary>
2777 ## </param>
2778 ## <param name="private_type">
2779 ##      <summary>
2780 ##      The type of the object to create.
2781 ##      </summary>
2782 ## </param>
2783 ## <param name="object_class">
2784 ##      <summary>
2785 ##      The class of the object to be created.
2786 ##      </summary>
2787 ## </param>
2788 #
2789 interface(`userdom_user_tmp_filetrans',`
2790         gen_require(`
2791                 type user_tmp_t;
2792         ')
2793
2794         filetrans_pattern($1, user_tmp_t, $2, $3)
2795         files_search_tmp($1)
2796 ')
2797
2798 ########################################
2799 ## <summary>
2800 ##      Create objects in the temporary directory
2801 ##      with an automatic type transition to
2802 ##      the user temporary type.
2803 ## </summary>
2804 ## <param name="domain">
2805 ##      <summary>
2806 ##      Domain allowed access.
2807 ##      </summary>
2808 ## </param>
2809 ## <param name="object_class">
2810 ##      <summary>
2811 ##      The class of the object to be created.
2812 ##      </summary>
2813 ## </param>
2814 #
2815 interface(`userdom_tmp_filetrans_user_tmp',`
2816         gen_require(`
2817                 type user_tmp_t;
2818         ')
2819
2820         files_tmp_filetrans($1, user_tmp_t, $2)
2821 ')
2822
2823 ########################################
2824 ## <summary>
2825 ##      Read user tmpfs files.
2826 ## </summary>
2827 ## <param name="domain">
2828 ##      <summary>
2829 ##      Domain allowed access.
2830 ##      </summary>
2831 ## </param>
2832 #
2833 interface(`userdom_read_user_tmpfs_files',`
2834         gen_require(`
2835                 type user_tmpfs_t;
2836         ')
2837
2838         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2839         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2840         allow $1 user_tmpfs_t:dir list_dir_perms;
2841         fs_search_tmpfs($1)
2842 ')
2843
2844 ########################################
2845 ## <summary>
2846 ##      Read/Write user tmpfs files.
2847 ## </summary>
2848 ## <param name="domain">
2849 ##      <summary>
2850 ##      Domain allowed access.
2851 ##      </summary>
2852 ## </param>
2853 #
2854 interface(`userdom_rw_user_tmpfs_files',`
2855         gen_require(`
2856                 type user_tmpfs_t;
2857         ')
2858
2859         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2860         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2861         allow $1 user_tmpfs_t:dir list_dir_perms;
2862         fs_search_tmpfs($1)
2863 ')
2864
2865 ########################################
2866 ## <summary>
2867 ##      Get the attributes of a user domain tty.
2868 ## </summary>
2869 ## <param name="domain">
2870 ##      <summary>
2871 ##      Domain allowed access.
2872 ##      </summary>
2873 ## </param>
2874 #
2875 interface(`userdom_getattr_user_ttys',`
2876         gen_require(`
2877                 type user_tty_device_t;
2878         ')
2879
2880         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2881 ')
2882
2883 ########################################
2884 ## <summary>
2885 ##      Do not audit attempts to get the attributes of a user domain tty.
2886 ## </summary>
2887 ## <param name="domain">
2888 ##      <summary>
2889 ##      Domain to not audit.
2890 ##      </summary>
2891 ## </param>
2892 #
2893 interface(`userdom_dontaudit_getattr_user_ttys',`
2894         gen_require(`
2895                 type user_tty_device_t;
2896         ')
2897
2898         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2899 ')
2900
2901 ########################################
2902 ## <summary>
2903 ##      Set the attributes of a user domain tty.
2904 ## </summary>
2905 ## <param name="domain">
2906 ##      <summary>
2907 ##      Domain allowed access.
2908 ##      </summary>
2909 ## </param>
2910 #
2911 interface(`userdom_setattr_user_ttys',`
2912         gen_require(`
2913                 type user_tty_device_t;
2914         ')
2915
2916         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2917 ')
2918
2919 ########################################
2920 ## <summary>
2921 ##      Do not audit attempts to set the attributes of a user domain tty.
2922 ## </summary>
2923 ## <param name="domain">
2924 ##      <summary>
2925 ##      Domain to not audit.
2926 ##      </summary>
2927 ## </param>
2928 #
2929 interface(`userdom_dontaudit_setattr_user_ttys',`
2930         gen_require(`
2931                 type user_tty_device_t;
2932         ')
2933
2934         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2935 ')
2936
2937 ########################################
2938 ## <summary>
2939 ##      Read and write a user domain tty.
2940 ## </summary>
2941 ## <param name="domain">
2942 ##      <summary>
2943 ##      Domain allowed access.
2944 ##      </summary>
2945 ## </param>
2946 #
2947 interface(`userdom_use_user_ttys',`
2948         gen_require(`
2949                 type user_tty_device_t;
2950         ')
2951
2952         allow $1 user_tty_device_t:chr_file rw_term_perms;
2953 ')
2954
2955 ########################################
2956 ## <summary>
2957 ##      Read and write a inherited user domain tty.
2958 ## </summary>
2959 ## <param name="domain">
2960 ##      <summary>
2961 ##      Domain allowed access.
2962 ##      </summary>
2963 ## </param>
2964 #
2965 interface(`userdom_use_inherited_user_ttys',`
2966         gen_require(`
2967                 type user_tty_device_t;
2968         ')
2969
2970         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
2971 ')
2972
2973 ########################################
2974 ## <summary>
2975 ##      Read and write a user domain pty.
2976 ## </summary>
2977 ## <param name="domain">
2978 ##      <summary>
2979 ##      Domain allowed access.
2980 ##      </summary>
2981 ## </param>
2982 #
2983 interface(`userdom_use_user_ptys',`
2984         gen_require(`
2985                 type user_devpts_t;
2986         ')
2987
2988         allow $1 user_devpts_t:chr_file rw_term_perms;
2989 ')
2990
2991 ########################################
2992 ## <summary>
2993 ##      Read and write a inherited user domain pty.
2994 ## </summary>
2995 ## <param name="domain">
2996 ##      <summary>
2997 ##      Domain allowed access.
2998 ##      </summary>
2999 ## </param>
3000 #
3001 interface(`userdom_use_inherited_user_ptys',`
3002         gen_require(`
3003                 type user_devpts_t;
3004         ')
3005
3006         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3007 ')
3008
3009 ########################################
3010 ## <summary>
3011 ##      Read and write a inherited user TTYs and PTYs.
3012 ## </summary>
3013 ## <desc>
3014 ##      <p>
3015 ##      Allow the specified domain to read and write inherited user
3016 ##      TTYs and PTYs. This will allow the domain to
3017 ##      interact with the user via the terminal. Typically
3018 ##      all interactive applications will require this
3019 ##      access.
3020 ##      </p>
3021 ## </desc>
3022 ## <param name="domain">
3023 ##      <summary>
3024 ##      Domain allowed access.
3025 ##      </summary>
3026 ## </param>
3027 ## <infoflow type="both" weight="10"/>
3028 #
3029 interface(`userdom_use_inherited_user_terminals',`
3030         gen_require(`
3031                 type user_tty_device_t, user_devpts_t;
3032         ')
3033
3034         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3035         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3036 ')
3037
3038 #######################################
3039 ## <summary>
3040 ##  Allow attempts to read and write
3041 ##  a user domain tty and pty.
3042 ## </summary>
3043 ## <param name="domain">
3044 ##  <summary>
3045 ##  Domain to not audit.
3046 ##  </summary>
3047 ## </param>
3048 #
3049 interface(`userdom_use_user_terminals',`
3050     gen_require(`
3051         type user_tty_device_t, user_devpts_t;
3052     ')
3053
3054     allow $1 user_tty_device_t:chr_file rw_term_perms;
3055     allow $1 user_devpts_t:chr_file rw_term_perms;
3056 ')
3057
3058 ########################################
3059 ## <summary>
3060 ##      Do not audit attempts to read and write
3061 ##      a user domain tty and pty.
3062 ## </summary>
3063 ## <param name="domain">
3064 ##      <summary>
3065 ##      Domain to not audit.
3066 ##      </summary>
3067 ## </param>
3068 #
3069 interface(`userdom_dontaudit_use_user_terminals',`
3070         gen_require(`
3071                 type user_tty_device_t, user_devpts_t;
3072         ')
3073
3074         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3075         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3076 ')
3077
3078 ########################################
3079 ## <summary>
3080 ##      Execute a shell in all user domains.  This
3081 ##      is an explicit transition, requiring the
3082 ##      caller to use setexeccon().
3083 ## </summary>
3084 ## <param name="domain">
3085 ##      <summary>
3086 ##      Domain allowed to transition.
3087 ##      </summary>
3088 ## </param>
3089 #
3090 interface(`userdom_spec_domtrans_all_users',`
3091         gen_require(`
3092                 attribute userdomain;
3093         ')
3094
3095         corecmd_shell_spec_domtrans($1, userdomain)
3096         allow userdomain $1:fd use;
3097         allow userdomain $1:fifo_file rw_file_perms;
3098         allow userdomain $1:process sigchld;
3099 ')
3100
3101 ########################################
3102 ## <summary>
3103 ##      Execute an Xserver session in all unprivileged user domains.  This
3104 ##      is an explicit transition, requiring the
3105 ##      caller to use setexeccon().
3106 ## </summary>
3107 ## <param name="domain">
3108 ##      <summary>
3109 ##      Domain allowed to transition.
3110 ##      </summary>
3111 ## </param>
3112 #
3113 interface(`userdom_xsession_spec_domtrans_all_users',`
3114         gen_require(`
3115                 attribute userdomain;
3116         ')
3117
3118         xserver_xsession_spec_domtrans($1, userdomain)
3119         allow userdomain $1:fd use;
3120         allow userdomain $1:fifo_file rw_file_perms;
3121         allow userdomain $1:process sigchld;
3122 ')
3123
3124 ########################################
3125 ## <summary>
3126 ##      Execute a shell in all unprivileged user domains.  This
3127 ##      is an explicit transition, requiring the
3128 ##      caller to use setexeccon().
3129 ## </summary>
3130 ## <param name="domain">
3131 ##      <summary>
3132 ##      Domain allowed to transition.
3133 ##      </summary>
3134 ## </param>
3135 #
3136 interface(`userdom_spec_domtrans_unpriv_users',`
3137         gen_require(`
3138                 attribute unpriv_userdomain;
3139         ')
3140
3141         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3142         allow unpriv_userdomain $1:fd use;
3143         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3144         allow unpriv_userdomain $1:process sigchld;
3145 ')
3146
3147 ########################################
3148 ## <summary>
3149 ##      Execute an Xserver session in all unprivileged user domains.  This
3150 ##      is an explicit transition, requiring the
3151 ##      caller to use setexeccon().
3152 ## </summary>
3153 ## <param name="domain">
3154 ##      <summary>
3155 ##      Domain allowed to transition.
3156 ##      </summary>
3157 ## </param>
3158 #
3159 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3160         gen_require(`
3161                 attribute unpriv_userdomain;
3162         ')
3163
3164         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3165         allow unpriv_userdomain $1:fd use;
3166         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3167         allow unpriv_userdomain $1:process sigchld;
3168 ')
3169
3170 ########################################
3171 ## <summary>
3172 ##      Manage unpriviledged user SysV sempaphores.
3173 ## </summary>
3174 ## <param name="domain">
3175 ##      <summary>
3176 ##      Domain allowed access.
3177 ##      </summary>
3178 ## </param>
3179 #
3180 interface(`userdom_manage_unpriv_user_semaphores',`
3181         gen_require(`
3182                 attribute unpriv_userdomain;
3183         ')
3184
3185         allow $1 unpriv_userdomain:sem create_sem_perms;
3186 ')
3187
3188 ########################################
3189 ## <summary>
3190 ##      Manage unpriviledged user SysV shared
3191 ##      memory segments.
3192 ## </summary>
3193 ## <param name="domain">
3194 ##      <summary>
3195 ##      Domain allowed access.
3196 ##      </summary>
3197 ## </param>
3198 #
3199 interface(`userdom_manage_unpriv_user_shared_mem',`
3200         gen_require(`
3201                 attribute unpriv_userdomain;
3202         ')
3203
3204         allow $1 unpriv_userdomain:shm create_shm_perms;
3205 ')
3206
3207 ########################################
3208 ## <summary>
3209 ##      Execute bin_t in the unprivileged user domains. This
3210 ##      is an explicit transition, requiring the
3211 ##      caller to use setexeccon().
3212 ## </summary>
3213 ## <param name="domain">
3214 ##      <summary>
3215 ##      Domain allowed to transition.
3216 ##      </summary>
3217 ## </param>
3218 #
3219 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3220         gen_require(`
3221                 attribute unpriv_userdomain;
3222         ')
3223
3224         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3225         allow unpriv_userdomain $1:fd use;
3226         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3227         allow unpriv_userdomain $1:process sigchld;
3228 ')
3229
3230 ########################################
3231 ## <summary>
3232 ##      Execute all entrypoint files in unprivileged user
3233 ##      domains. This is an explicit transition, requiring the
3234 ##      caller to use setexeccon().
3235 ## </summary>
3236 ## <param name="domain">
3237 ##      <summary>
3238 ##      Domain allowed access.
3239 ##      </summary>
3240 ## </param>
3241 #
3242 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3243         gen_require(`
3244                 attribute unpriv_userdomain;
3245         ')
3246
3247         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3248         allow unpriv_userdomain $1:fd use;
3249         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3250         allow unpriv_userdomain $1:process sigchld;
3251 ')
3252
3253 ########################################
3254 ## <summary>
3255 ##      Search users home directories.
3256 ## </summary>
3257 ## <param name="domain">
3258 ##      <summary>
3259 ##      Domain allowed access.
3260 ##      </summary>
3261 ## </param>
3262 #
3263 interface(`userdom_search_user_home_content',`
3264         gen_require(`
3265                 type user_home_dir_t;
3266                 attribute user_home_type;
3267         ')
3268
3269         files_list_home($1)
3270         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3271         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3272 ')
3273
3274 ########################################
3275 ## <summary>
3276 ##      Send general signals to unprivileged user domains.
3277 ## </summary>
3278 ## <param name="domain">
3279 ##      <summary>
3280 ##      Domain allowed access.
3281 ##      </summary>
3282 ## </param>
3283 #
3284 interface(`userdom_signal_unpriv_users',`
3285         gen_require(`
3286                 attribute unpriv_userdomain;
3287         ')
3288
3289         allow $1 unpriv_userdomain:process signal;
3290 ')
3291
3292 ########################################
3293 ## <summary>
3294 ##      Inherit the file descriptors from unprivileged user domains.
3295 ## </summary>
3296 ## <param name="domain">
3297 ##      <summary>
3298 ##      Domain allowed access.
3299 ##      </summary>
3300 ## </param>
3301 #
3302 interface(`userdom_use_unpriv_users_fds',`
3303         gen_require(`
3304                 attribute unpriv_userdomain;
3305         ')
3306
3307         allow $1 unpriv_userdomain:fd use;
3308 ')
3309
3310 ########################################
3311 ## <summary>
3312 ##      Do not audit attempts to inherit the file descriptors
3313 ##      from unprivileged user domains.
3314 ## </summary>
3315 ## <desc>
3316 ##      <p>
3317 ##      Do not audit attempts to inherit the file descriptors
3318 ##      from unprivileged user domains. This will supress
3319 ##      SELinux denial messages when the specified domain is denied
3320 ##      the permission to inherit these file descriptors.
3321 ##      </p>
3322 ## </desc>
3323 ## <param name="domain">
3324 ##      <summary>
3325 ##      Domain to not audit.
3326 ##      </summary>
3327 ## </param>
3328 ## <infoflow type="none"/>
3329 #
3330 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3331         gen_require(`
3332                 attribute unpriv_userdomain;
3333         ')
3334
3335         dontaudit $1 unpriv_userdomain:fd use;
3336 ')
3337
3338 ########################################
3339 ## <summary>
3340 ##      Do not audit attempts to use user ptys.
3341 ## </summary>
3342 ## <param name="domain">
3343 ##      <summary>
3344 ##      Domain to not audit.
3345 ##      </summary>
3346 ## </param>
3347 #
3348 interface(`userdom_dontaudit_use_user_ptys',`
3349         gen_require(`
3350                 type user_devpts_t;
3351         ')
3352
3353         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3354 ')
3355
3356 ########################################
3357 ## <summary>
3358 ##      Relabel files to unprivileged user pty types.
3359 ## </summary>
3360 ## <param name="domain">
3361 ##      <summary>
3362 ##      Domain allowed access.
3363 ##      </summary>
3364 ## </param>
3365 #
3366 interface(`userdom_relabelto_user_ptys',`
3367         gen_require(`
3368                 type user_devpts_t;
3369         ')
3370
3371         allow $1 user_devpts_t:chr_file relabelto;
3372 ')
3373
3374 ########################################
3375 ## <summary>
3376 ##      Do not audit attempts to relabel files from
3377 ##      user pty types.
3378 ## </summary>
3379 ## <param name="domain">
3380 ##      <summary>
3381 ##      Domain to not audit.
3382 ##      </summary>
3383 ## </param>
3384 #
3385 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3386         gen_require(`
3387                 type user_devpts_t;
3388         ')
3389
3390         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3391 ')
3392
3393 ########################################
3394 ## <summary>
3395 ##      Write all users files in /tmp
3396 ## </summary>
3397 ## <param name="domain">
3398 ##      <summary>
3399 ##      Domain allowed access.
3400 ##      </summary>
3401 ## </param>
3402 #
3403 interface(`userdom_write_user_tmp_files',`
3404         gen_require(`
3405                 type user_tmp_t;
3406         ')
3407
3408         write_files_pattern($1, user_tmp_t, user_tmp_t)
3409 ')
3410
3411 ########################################
3412 ## <summary>
3413 ##      Do not audit attempts to write users
3414 ##      temporary files.
3415 ## </summary>
3416 ## <param name="domain">
3417 ##      <summary>
3418 ##      Domain to not audit.
3419 ##      </summary>
3420 ## </param>
3421 #
3422 interface(`userdom_dontaudit_write_user_tmp_files',`
3423         gen_require(`
3424                 type user_tmp_t;
3425         ')
3426
3427         dontaudit $1 user_tmp_t:file write;
3428 ')
3429
3430 ########################################
3431 ## <summary>
3432 ##      Do not audit attempts to read/write users
3433 ##      temporary fifo files.
3434 ## </summary>
3435 ## <param name="domain">
3436 ##      <summary>
3437 ##      Domain to not audit.
3438 ##      </summary>
3439 ## </param>
3440 #
3441 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3442         gen_require(`
3443                 type user_tmp_t;
3444         ')
3445
3446         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3447 ')
3448
3449 ########################################
3450 ## <summary>
3451 ##      Do not audit attempts to use user ttys.
3452 ## </summary>
3453 ## <param name="domain">
3454 ##      <summary>
3455 ##      Domain to not audit.
3456 ##      </summary>
3457 ## </param>
3458 #
3459 interface(`userdom_dontaudit_use_user_ttys',`
3460         gen_require(`
3461                 type user_tty_device_t;
3462         ')
3463
3464         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3465 ')
3466
3467 ########################################
3468 ## <summary>
3469 ##      Read the process state of all user domains.
3470 ## </summary>
3471 ## <param name="domain">
3472 ##      <summary>
3473 ##      Domain allowed access.
3474 ##      </summary>
3475 ## </param>
3476 #
3477 interface(`userdom_read_all_users_state',`
3478         gen_require(`
3479                 attribute userdomain;
3480         ')
3481
3482         read_files_pattern($1, userdomain, userdomain)
3483         read_lnk_files_pattern($1,userdomain,userdomain)
3484         kernel_search_proc($1)
3485 ')
3486
3487 ########################################
3488 ## <summary>
3489 ##      Get the attributes of all user domains.
3490 ## </summary>
3491 ## <param name="domain">
3492 ##      <summary>
3493 ##      Domain allowed access.
3494 ##      </summary>
3495 ## </param>
3496 #
3497 interface(`userdom_getattr_all_users',`
3498         gen_require(`
3499                 attribute userdomain;
3500         ')
3501
3502         allow $1 userdomain:process getattr;
3503 ')
3504
3505 ########################################
3506 ## <summary>
3507 ##      Inherit the file descriptors from all user domains
3508 ## </summary>
3509 ## <param name="domain">
3510 ##      <summary>
3511 ##      Domain allowed access.
3512 ##      </summary>
3513 ## </param>
3514 #
3515 interface(`userdom_use_all_users_fds',`
3516         gen_require(`
3517                 attribute userdomain;
3518         ')
3519
3520         allow $1 userdomain:fd use;
3521 ')
3522
3523 ########################################
3524 ## <summary>
3525 ##      Do not audit attempts to inherit the file
3526 ##      descriptors from any user domains.
3527 ## </summary>
3528 ## <param name="domain">
3529 ##      <summary>
3530 ##      Domain to not audit.
3531 ##      </summary>
3532 ## </param>
3533 #
3534 interface(`userdom_dontaudit_use_all_users_fds',`
3535         gen_require(`
3536                 attribute userdomain;
3537         ')
3538
3539         dontaudit $1 userdomain:fd use;
3540 ')
3541
3542 ########################################
3543 ## <summary>
3544 ##      Send general signals to all user domains.
3545 ## </summary>
3546 ## <param name="domain">
3547 ##      <summary>
3548 ##      Domain allowed access.
3549 ##      </summary>
3550 ## </param>
3551 #
3552 interface(`userdom_signal_all_users',`
3553         gen_require(`
3554                 attribute userdomain;
3555         ')
3556
3557         allow $1 userdomain:process signal;
3558 ')
3559
3560 ########################################
3561 ## <summary>
3562 ##      Send kill signals to all user domains.
3563 ## </summary>
3564 ## <param name="domain">
3565 ##      <summary>
3566 ##      Domain allowed access.
3567 ##      </summary>
3568 ## </param>
3569 #
3570 interface(`userdom_kill_all_users',`
3571         gen_require(`
3572                 attribute userdomain;
3573         ')
3574
3575         allow $1 userdomain:process sigkill;
3576 ')
3577
3578 ########################################
3579 ## <summary>
3580 ##      Send a SIGCHLD signal to all user domains.
3581 ## </summary>
3582 ## <param name="domain">
3583 ##      <summary>
3584 ##      Domain allowed access.
3585 ##      </summary>
3586 ## </param>
3587 #
3588 interface(`userdom_sigchld_all_users',`
3589         gen_require(`
3590                 attribute userdomain;
3591         ')
3592
3593         allow $1 userdomain:process sigchld;
3594 ')
3595
3596 ########################################
3597 ## <summary>
3598 ##      Create keys for all user domains.
3599 ## </summary>
3600 ## <param name="domain">
3601 ##      <summary>
3602 ##      Domain allowed access.
3603 ##      </summary>
3604 ## </param>
3605 #
3606 interface(`userdom_create_all_users_keys',`
3607         gen_require(`
3608                 attribute userdomain;
3609         ')
3610
3611         allow $1 userdomain:key create;
3612 ')
3613
3614 ########################################
3615 ## <summary>
3616 ##      Send a dbus message to all user domains.
3617 ## </summary>
3618 ## <param name="domain">
3619 ##      <summary>
3620 ##      Domain allowed access.
3621 ##      </summary>
3622 ## </param>
3623 #
3624 interface(`userdom_dbus_send_all_users',`
3625         gen_require(`
3626                 attribute userdomain;
3627                 class dbus send_msg;
3628         ')
3629
3630         allow $1 userdomain:dbus send_msg;
3631 ')
3632
3633 ########################################
3634 ## <summary>
3635 ##      Allow apps to set rlimits on userdomain
3636 ## </summary>
3637 ## <param name="domain">
3638 ##      <summary>
3639 ##      Domain allowed access.
3640 ##      </summary>
3641 ## </param>
3642 #
3643 interface(`userdom_set_rlimitnh',`
3644         gen_require(`
3645                 attribute userdomain;
3646         ')
3647
3648         allow $1 userdomain:process rlimitinh;
3649 ')
3650
3651 ########################################
3652 ## <summary>
3653 ##      Define this type as a Allow apps to set rlimits on userdomain
3654 ## </summary>
3655 ## <param name="domain">
3656 ##      <summary>
3657 ##      Domain allowed access.
3658 ##      </summary>
3659 ## </param>
3660 ## <param name="userdomain_prefix">
3661 ##      <summary>
3662 ##      The prefix of the user domain (e.g., user
3663 ##      is the prefix for user_t).
3664 ## </summary>
3665 ## </param>
3666 ## <param name="domain">
3667 ##      <summary>
3668 ##      Domain allowed access.
3669 ##      </summary>
3670 ## </param>
3671 #
3672 template(`userdom_unpriv_usertype',`
3673         gen_require(`
3674                 attribute unpriv_userdomain, userdomain;
3675                 attribute $1_usertype;
3676         ')
3677         typeattribute $2  $1_usertype;
3678         typeattribute $2  unpriv_userdomain;
3679         typeattribute $2  userdomain;
3680
3681         ubac_constrained($2)
3682 ')
3683
3684 ########################################
3685 ## <summary>
3686 ##      Connect to users over an unix stream socket.
3687 ## </summary>
3688 ## <param name="domain">
3689 ##      <summary>
3690 ##      Domain allowed access.
3691 ##      </summary>
3692 ## </param>
3693 #
3694 interface(`userdom_stream_connect',`
3695         gen_require(`
3696                 type user_tmp_t;
3697                 attribute userdomain;
3698         ')
3699
3700         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3701 ')
3702
3703 ########################################
3704 ## <summary>
3705 ##      Ptrace user domains.
3706 ## </summary>
3707 ## <param name="domain">
3708 ##      <summary>
3709 ##      Domain allowed access.
3710 ##      </summary>
3711 ## </param>
3712 #
3713 interface(`userdom_ptrace_all_users',`
3714         gen_require(`
3715                 attribute userdomain;
3716         ')
3717
3718         allow $1 userdomain:process ptrace;
3719 ')
3720
3721 ########################################
3722 ## <summary>
3723 ##      dontaudit Search /root
3724 ## </summary>
3725 ## <param name="domain">
3726 ##      <summary>
3727 ##      Domain allowed access.
3728 ##      </summary>
3729 ## </param>
3730 #
3731 interface(`userdom_dontaudit_search_admin_dir',`
3732         gen_require(`
3733                 type admin_home_t;
3734         ')
3735
3736         dontaudit $1 admin_home_t:dir search_dir_perms;
3737 ')
3738
3739 ########################################
3740 ## <summary>
3741 ##      dontaudit list /root
3742 ## </summary>
3743 ## <param name="domain">
3744 ##      <summary>
3745 ##      Domain allowed access.
3746 ##      </summary>
3747 ## </param>
3748 #
3749 interface(`userdom_dontaudit_list_admin_dir',`
3750         gen_require(`
3751                 type admin_home_t;
3752         ')
3753
3754         dontaudit $1 admin_home_t:dir list_dir_perms;
3755 ')
3756
3757 ########################################
3758 ## <summary>
3759 ##      Allow domain to  list /root
3760 ## </summary>
3761 ## <param name="domain">
3762 ##      <summary>
3763 ##      Domain allowed access.
3764 ##      </summary>
3765 ## </param>
3766 #
3767 interface(`userdom_list_admin_dir',`
3768         gen_require(`
3769                 type admin_home_t;
3770         ')
3771
3772         allow $1 admin_home_t:dir list_dir_perms;
3773 ')
3774
3775 ########################################
3776 ## <summary>
3777 ##      Allow Search /root
3778 ## </summary>
3779 ## <param name="domain">
3780 ##      <summary>
3781 ##      Domain allowed access.
3782 ##      </summary>
3783 ## </param>
3784 #
3785 interface(`userdom_search_admin_dir',`
3786         gen_require(`
3787                 type admin_home_t;
3788         ')
3789
3790         allow $1 admin_home_t:dir search_dir_perms;
3791 ')
3792
3793 ########################################
3794 ## <summary>
3795 ##      RW unpriviledged user SysV sempaphores.
3796 ## </summary>
3797 ## <param name="domain">
3798 ##      <summary>
3799 ##      Domain allowed access.
3800 ##      </summary>
3801 ## </param>
3802 #
3803 interface(`userdom_rw_semaphores',`
3804         gen_require(`
3805                 attribute unpriv_userdomain;
3806         ')
3807
3808         allow $1 unpriv_userdomain:sem rw_sem_perms;
3809 ')
3810
3811 ########################################
3812 ## <summary>
3813 ##      Send a message to unpriv users over a unix domain
3814 ##      datagram socket.
3815 ## </summary>
3816 ## <param name="domain">
3817 ##      <summary>
3818 ##      Domain allowed access.
3819 ##      </summary>
3820 ## </param>
3821 #
3822 interface(`userdom_dgram_send',`
3823         gen_require(`
3824                 attribute unpriv_userdomain;
3825         ')
3826
3827         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3828 ')
3829
3830 ######################################
3831 ## <summary>
3832 ##      Send a message to users over a unix domain
3833 ##      datagram socket.
3834 ## </summary>
3835 ## <param name="domain">
3836 ##      <summary>
3837 ##      Domain allowed access.
3838 ##      </summary>
3839 ## </param>
3840 #
3841 interface(`userdom_users_dgram_send',`
3842         gen_require(`
3843                  attribute userdomain;
3844       ')
3845
3846        allow $1 userdomain:unix_dgram_socket sendto;
3847 ')
3848
3849 #######################################
3850 ## <summary>
3851 ##      Allow execmod on files in homedirectory
3852 ## </summary>
3853 ## <param name="domain">
3854 ##      <summary>
3855 ##      Domain allowed access.
3856 ##      </summary>
3857 ## </param>
3858 ## <rolebase/>
3859 #
3860 interface(`userdom_execmod_user_home_files',`
3861         gen_require(`
3862                 type user_home_type;
3863         ')
3864
3865         allow $1 user_home_type:file execmod;
3866 ')
3867
3868 ########################################
3869 ## <summary>
3870 ##      Read admin home files.
3871 ## </summary>
3872 ## <param name="domain">
3873 ##      <summary>
3874 ##      Domain allowed access.
3875 ##      </summary>
3876 ## </param>
3877 ## <rolecap/>
3878 #
3879 interface(`userdom_read_admin_home_files',`
3880         gen_require(`
3881                 type admin_home_t;
3882         ')
3883
3884         read_files_pattern($1, admin_home_t, admin_home_t)
3885 ')
3886
3887 ########################################
3888 ## <summary>
3889 ##      Execute admin home files.
3890 ## </summary>
3891 ## <param name="domain">
3892 ##      <summary>
3893 ##      Domain allowed access.
3894 ##      </summary>
3895 ## </param>
3896 ## <rolecap/>
3897 #
3898 interface(`userdom_exec_admin_home_files',`
3899         gen_require(`
3900                 type admin_home_t;
3901         ')
3902
3903         exec_files_pattern($1, admin_home_t, admin_home_t)
3904 ')
3905
3906 ########################################
3907 ## <summary>
3908 ##      Append files inherited
3909 ##      in the /root directory.
3910 ## </summary>
3911 ## <param name="domain">
3912 ##      <summary>
3913 ##      Domain allowed access.
3914 ##      </summary>
3915 ## </param>
3916 #
3917 interface(`userdom_inherit_append_admin_home_files',`
3918         gen_require(`
3919                 type admin_home_t;
3920         ')
3921
3922         allow $1 admin_home_t:file { getattr append };
3923 ')
3924
3925
3926 #######################################
3927 ## <summary>
3928 ##      Manage all files/directories in the homedir
3929 ## </summary>
3930 ## <param name="userdomain">
3931 ##      <summary>
3932 ##      The user domain
3933 ##      </summary>
3934 ## </param>
3935 ## <rolebase/>
3936 #
3937 interface(`userdom_manage_user_home_content',`
3938         gen_require(`
3939                 type user_home_dir_t, user_home_t;
3940                 attribute user_home_type;
3941         ')
3942
3943         files_list_home($1)
3944         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3945         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3946         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3947         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3948         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3949         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3950
3951 ')
3952
3953
3954 ########################################
3955 ## <summary>
3956 ##      Create objects in a user home directory
3957 ##      with an automatic type transition to
3958 ##      the user home file type.
3959 ## </summary>
3960 ## <param name="domain">
3961 ##      <summary>
3962 ##      Domain allowed access.
3963 ##      </summary>
3964 ## </param>
3965 ## <param name="object_class">
3966 ##      <summary>
3967 ##      The class of the object to be created.
3968 ##      </summary>
3969 ## </param>
3970 #
3971 interface(`userdom_user_home_dir_filetrans_pattern',`
3972         gen_require(`
3973                 type user_home_dir_t, user_home_t;
3974         ')
3975
3976         type_transition $1 user_home_dir_t:$2 user_home_t;
3977 ')
3978
3979 ########################################
3980 ## <summary>
3981 ##      Create objects in the /root directory
3982 ##      with an automatic type transition to
3983 ##      a specified private type.
3984 ## </summary>
3985 ## <param name="domain">
3986 ##      <summary>
3987 ##      Domain allowed access.
3988 ##      </summary>
3989 ## </param>
3990 ## <param name="private_type">
3991 ##      <summary>
3992 ##      The type of the object to create.
3993 ##      </summary>
3994 ## </param>
3995 ## <param name="object_class">
3996 ##      <summary>
3997 ##      The class of the object to be created.
3998 ##      </summary>
3999 ## </param>
4000 #
4001 interface(`userdom_admin_home_dir_filetrans',`
4002         gen_require(`
4003                 type admin_home_t;
4004         ')
4005
4006         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4007 ')
4008
4009 ########################################
4010 ## <summary>
4011 ##      Send signull to unprivileged user domains.
4012 ## </summary>
4013 ## <param name="domain">
4014 ##      <summary>
4015 ##      Domain allowed access.
4016 ##      </summary>
4017 ## </param>
4018 #
4019 interface(`userdom_signull_unpriv_users',`
4020         gen_require(`
4021                 attribute unpriv_userdomain;
4022         ')
4023
4024         allow $1 unpriv_userdomain:process signull;
4025 ')
4026
4027 ########################################
4028 ## <summary>
4029 ##      Write all users files in /tmp
4030 ## </summary>
4031 ## <param name="domain">
4032 ##      <summary>
4033 ##      Domain allowed access.
4034 ##      </summary>
4035 ## </param>
4036 #
4037 interface(`userdom_write_user_tmp_dirs',`
4038         gen_require(`
4039                 type user_tmp_t;
4040         ')
4041
4042         write_files_pattern($1, user_tmp_t, user_tmp_t)
4043 ')
4044
4045 ########################################
4046 ## <summary>
4047 ##      Manage keys for all user domains.
4048 ## </summary>
4049 ## <param name="domain">
4050 ##      <summary>
4051 ##      Domain allowed access.
4052 ##      </summary>
4053 ## </param>
4054 #
4055 interface(`userdom_manage_all_users_keys',`
4056         gen_require(`
4057                 attribute userdomain;
4058         ')
4059
4060         allow $1 userdomain:key manage_key_perms;
4061 ')
4062
4063
4064 ########################################
4065 ## <summary>
4066 ##      Do not audit attempts to read and write
4067 ##      unserdomain stream.
4068 ## </summary>
4069 ## <param name="domain">
4070 ##      <summary>
4071 ##      Domain to not audit.
4072 ##      </summary>
4073 ## </param>
4074 #
4075 interface(`userdom_dontaudit_rw_stream',`
4076         gen_require(`
4077                 attribute userdomain;
4078         ')
4079
4080         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4081 ')
4082
4083 ########################################
4084 ## <summary>
4085 ##      Do not audit attempts to read and write
4086 ##      unserdomain datagram socket.
4087 ## </summary>
4088 ## <param name="domain">
4089 ##      <summary>
4090 ##      Domain to not audit.
4091 ##      </summary>
4092 ## </param>
4093 #
4094 interface(`userdom_dontaudit_rw_dgram_socket',`
4095         gen_require(`
4096                 attribute userdomain;
4097         ')
4098
4099         dontaudit $1 userdomain:unix_dgram_socket { read write };
4100 ')
4101
4102 ########################################
4103 ## <summary>
4104 ##      Append files
4105 ##      in a user home subdirectory.
4106 ## </summary>
4107 ## <param name="domain">
4108 ##      <summary>
4109 ##      Domain allowed access.
4110 ##      </summary>
4111 ## </param>
4112 #
4113 interface(`userdom_append_user_home_content_files',`
4114         gen_require(`
4115                 type user_home_dir_t, user_home_t;
4116         ')
4117
4118         append_files_pattern($1, user_home_t, user_home_t)
4119         allow $1 user_home_dir_t:dir search_dir_perms;
4120         files_search_home($1)
4121 ')
4122
4123 ########################################
4124 ## <summary>
4125 ##      Read files inherited
4126 ##      in a user home subdirectory.
4127 ## </summary>
4128 ## <param name="domain">
4129 ##      <summary>
4130 ##      Domain allowed access.
4131 ##      </summary>
4132 ## </param>
4133 #
4134 interface(`userdom_read_inherited_user_home_content_files',`
4135         gen_require(`
4136                 attribute user_home_type;
4137         ')
4138
4139         allow $1 user_home_type:file { getattr read };
4140 ')
4141
4142 ########################################
4143 ## <summary>
4144 ##      Append files inherited
4145 ##      in a user home subdirectory.
4146 ## </summary>
4147 ## <param name="domain">
4148 ##      <summary>
4149 ##      Domain allowed access.
4150 ##      </summary>
4151 ## </param>
4152 #
4153 interface(`userdom_inherit_append_user_home_content_files',`
4154         gen_require(`
4155                 type user_home_t;
4156         ')
4157
4158         allow $1 user_home_t:file { getattr append };
4159 ')
4160
4161 ########################################
4162 ## <summary>
4163 ##      Append files inherited
4164 ##      in a user tmp files.
4165 ## </summary>
4166 ## <param name="domain">
4167 ##      <summary>
4168 ##      Domain allowed access.
4169 ##      </summary>
4170 ## </param>
4171 #
4172 interface(`userdom_inherit_append_user_tmp_files',`
4173         gen_require(`
4174                 type user_tmp_t;
4175         ')
4176
4177         allow $1 user_tmp_t:file { getattr append };
4178 ')
4179
4180 ######################################
4181 ## <summary>
4182 ##      Read audio files in the users homedir.
4183 ## </summary>
4184 ## <param name="domain">
4185 ##      <summary>
4186 ##      Domain allowed access.
4187 ##      </summary>
4188 ## </param>
4189 ## <rolecap/>
4190 #
4191 interface(`userdom_read_home_audio_files',`
4192         gen_require(`
4193                 type audio_home_t;
4194         ')
4195
4196         userdom_search_user_home_dirs($1)
4197         allow $1 audio_home_t:dir list_dir_perms;
4198         read_files_pattern($1, audio_home_t, audio_home_t)
4199         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4200 ')
4201
4202 ########################################
4203 ## <summary>
4204 ##      Do not audit attempts to write all user home content files.
4205 ## </summary>
4206 ## <param name="domain">
4207 ##      <summary>
4208 ##      Domain to not audit.
4209 ##      </summary>
4210 ## </param>
4211 #
4212 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4213         gen_require(`
4214                 attribute user_home_type;
4215         ')
4216
4217         dontaudit $1 user_home_type:file write_file_perms;
4218 ')
4219
4220 ########################################
4221 ## <summary>
4222 ##      Do not audit attempts to write all user tmp content files.
4223 ## </summary>
4224 ## <param name="domain">
4225 ##      <summary>
4226 ##      Domain to not audit.
4227 ##      </summary>
4228 ## </param>
4229 #
4230 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4231         gen_require(`
4232                 attribute user_tmp_type;
4233         ')
4234
4235         dontaudit $1 user_tmp_type:file write_file_perms;
4236 ')
4237
4238 ########################################
4239 ## <summary>
4240 ##      Manage all user temporary content.
4241 ## </summary>
4242 ## <param name="domain">
4243 ##      <summary>
4244 ##      Domain allowed access.
4245 ##      </summary>
4246 ## </param>
4247 #
4248 interface(`userdom_manage_all_user_tmp_content',`
4249         gen_require(`
4250                 attribute user_tmp_type;
4251         ')
4252
4253         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4254         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4255         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4256         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4257         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4258         files_search_tmp($1)
4259 ')
4260
4261 ########################################
4262 ## <summary>
4263 ##      List all user temporary content.
4264 ## </summary>
4265 ## <param name="domain">
4266 ##      <summary>
4267 ##      Domain allowed access.
4268 ##      </summary>
4269 ## </param>
4270 #
4271 interface(`userdom_list_all_user_tmp_content',`
4272         gen_require(`
4273                 attribute user_tmp_type;
4274         ')
4275
4276         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4277         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4278         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4279         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4280         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4281         files_search_var($1)
4282         files_search_tmp($1)
4283 ')
4284
4285 ########################################
4286 ## <summary>
4287 ##      Manage all user tmpfs content.
4288 ## </summary>
4289 ## <param name="domain">
4290 ##      <summary>
4291 ##      Domain allowed access.
4292 ##      </summary>
4293 ## </param>
4294 #
4295 interface(`userdom_manage_all_user_tmpfs_content',`
4296         gen_require(`
4297                 attribute user_tmpfs_type;
4298         ')
4299
4300         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4301         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4302         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4303         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4304         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4305         fs_search_tmpfs($1)
4306 ')
4307
4308 ########################################
4309 ## <summary>
4310 ##      Delete all user temporary content.
4311 ## </summary>
4312 ## <param name="domain">
4313 ##      <summary>
4314 ##      Domain allowed access.
4315 ##      </summary>
4316 ## </param>
4317 #
4318 interface(`userdom_delete_all_user_tmp_content',`
4319         gen_require(`
4320                 attribute user_tmp_type;
4321         ')
4322
4323         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4324         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4325         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4326         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4327         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4328         # /var/tmp
4329         files_search_var($1)
4330         files_delete_tmp_dir_entry($1)
4331 ')
4332
4333 ########################################
4334 ## <summary>
4335 ##      Read system SSL certificates in the users homedir.
4336 ## </summary>
4337 ## <param name="domain">
4338 ##      <summary>
4339 ##      Domain allowed access.
4340 ##      </summary>
4341 ## </param>
4342 #
4343 interface(`userdom_read_home_certs',`
4344         gen_require(`
4345                 type home_cert_t;
4346         ')
4347
4348         userdom_search_user_home_content($1)
4349         allow $1 home_cert_t:dir list_dir_perms;
4350         read_files_pattern($1, home_cert_t, home_cert_t)
4351         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4352 ')
4353
4354 #######################################
4355 ## <summary>
4356 ##  Dontaudit Write system SSL certificates in the users homedir.
4357 ## </summary>
4358 ## <param name="domain">
4359 ##  <summary>
4360 ##  Domain allowed access.
4361 ##  </summary>
4362 ## </param>
4363 #
4364 interface(`userdom_dontaudit_write_home_certs',`
4365     gen_require(`
4366         type home_cert_t;
4367     ')
4368
4369     dontaudit $1 home_cert_t:file write;
4370 ')
4371
4372 ########################################
4373 ## <summary>
4374 ##      dontaudit Search getatrr /root files
4375 ## </summary>
4376 ## <param name="domain">
4377 ##      <summary>
4378 ##      Domain allowed access.
4379 ##      </summary>
4380 ## </param>
4381 #
4382 interface(`userdom_dontaudit_getattr_admin_home_files',`
4383         gen_require(`
4384                 type admin_home_t;
4385         ')
4386
4387         dontaudit $1 admin_home_t:file getattr;
4388 ')
4389
4390 ########################################
4391 ## <summary>
4392 ##      dontaudit read /root lnk files
4393 ## </summary>
4394 ## <param name="domain">
4395 ##      <summary>
4396 ##      Domain allowed access.
4397 ##      </summary>
4398 ## </param>
4399 #
4400 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4401         gen_require(`
4402                 type admin_home_t;
4403         ')
4404
4405         dontaudit $1 admin_home_t:lnk_file read;
4406 ')
4407
4408 ########################################
4409 ## <summary>
4410 ##      dontaudit read /root files
4411 ## </summary>
4412 ## <param name="domain">
4413 ##      <summary>
4414 ##      Domain allowed access.
4415 ##      </summary>
4416 ## </param>
4417 #
4418 interface(`userdom_dontaudit_read_admin_home_files',`
4419         gen_require(`
4420                 type admin_home_t;
4421         ')
4422
4423         dontaudit $1 admin_home_t:file read_file_perms;
4424 ')
4425
4426 ########################################
4427 ## <summary>
4428 ##      Create, read, write, and delete user
4429 ##      temporary chr files.
4430 ## </summary>
4431 ## <param name="domain">
4432 ##      <summary>
4433 ##      Domain allowed access.
4434 ##      </summary>
4435 ## </param>
4436 #
4437 interface(`userdom_manage_user_tmp_chr_files',`
4438         gen_require(`
4439                 type user_tmp_t;
4440         ')
4441
4442         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4443         files_search_tmp($1)
4444 ')
4445
4446 ########################################
4447 ## <summary>
4448 ##      Create, read, write, and delete user
4449 ##      temporary blk files.
4450 ## </summary>
4451 ## <param name="domain">
4452 ##      <summary>
4453 ##      Domain allowed access.
4454 ##      </summary>
4455 ## </param>
4456 #
4457 interface(`userdom_manage_user_tmp_blk_files',`
4458         gen_require(`
4459                 type user_tmp_t;
4460         ')
4461
4462         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4463         files_search_tmp($1)
4464 ')
4465
4466 ########################################
4467 ## <summary>
4468 ##      Dontaudit attempt to set attributes on  user temporary directories.
4469 ## </summary>
4470 ## <param name="domain">
4471 ##      <summary>
4472 ##      Domain allowed access.
4473 ##      </summary>
4474 ## </param>
4475 #
4476 interface(`userdom_dontaudit_setattr_user_tmp',`
4477         gen_require(`
4478                 type user_tmp_t;
4479         ')
4480
4481         dontaudit $1 user_tmp_t:dir setattr;
4482 ')
4483
4484 ########################################
4485 ## <summary>
4486 ##      Write all inherited users files in /tmp
4487 ## </summary>
4488 ## <param name="domain">
4489 ##      <summary>
4490 ##      Domain allowed access.
4491 ##      </summary>
4492 ## </param>
4493 #
4494 interface(`userdom_write_inherited_user_tmp_files',`
4495         gen_require(`
4496                 type user_tmp_t;
4497         ')
4498
4499         allow $1 user_tmp_t:file write;
4500 ')
4501
4502 ########################################
4503 ## <summary>
4504 ##      Delete all users files in /tmp
4505 ## </summary>
4506 ## <param name="domain">
4507 ##      <summary>
4508 ##      Domain allowed access.
4509 ##      </summary>
4510 ## </param>
4511 #
4512 interface(`userdom_delete_user_tmp_files',`
4513         gen_require(`
4514                 type user_tmp_t;
4515         ')
4516
4517         allow $1 user_tmp_t:file delete_file_perms;
4518 ')
4519
4520 ########################################
4521 ## <summary>
4522 ##      Delete user tmpfs files.
4523 ## </summary>
4524 ## <param name="domain">
4525 ##      <summary>
4526 ##      Domain allowed access.
4527 ##      </summary>
4528 ## </param>
4529 #
4530 interface(`userdom_delete_user_tmpfs_files',`
4531         gen_require(`
4532                 type user_tmpfs_t;
4533         ')
4534
4535         allow $1 user_tmpfs_t:file delete_file_perms;
4536 ')
4537
4538 ########################################
4539 ## <summary>
4540 ##      Read/Write unpriviledged user SysV shared
4541 ##      memory segments.
4542 ## </summary>
4543 ## <param name="domain">
4544 ##      <summary>
4545 ##      Domain allowed access.
4546 ##      </summary>
4547 ## </param>
4548 #
4549 interface(`userdom_rw_unpriv_user_shared_mem',`
4550         gen_require(`
4551                 attribute unpriv_userdomain;
4552         ')
4553
4554         allow $1 unpriv_userdomain:shm rw_shm_perms;
4555 ')
4556
4557 ########################################
4558 ## <summary>
4559 ##      Do not audit attempts to search user
4560 ##      temporary directories.
4561 ## </summary>
4562 ## <param name="domain">
4563 ##      <summary>
4564 ##      Domain to not audit.
4565 ##      </summary>
4566 ## </param>
4567 #
4568 interface(`userdom_dontaudit_search_user_tmp',`
4569         gen_require(`
4570                 type user_tmp_t;
4571         ')
4572
4573         dontaudit $1 user_tmp_t:dir search_dir_perms;
4574 ')
4575
4576 ########################################
4577 ## <summary>
4578 ##      Execute a file in a user home directory
4579 ##      in the specified domain.
4580 ## </summary>
4581 ## <desc>
4582 ##      <p>
4583 ##      Execute a file in a user home directory
4584 ##      in the specified domain.
4585 ##      </p>
4586 ##      <p>
4587 ##      No interprocess communication (signals, pipes,
4588 ##      etc.) is provided by this interface since
4589 ##      the domains are not owned by this module.
4590 ##      </p>
4591 ## </desc>
4592 ## <param name="domain">
4593 ##      <summary>
4594 ##      Domain allowed access.
4595 ##      </summary>
4596 ## </param>
4597 ## <param name="target_domain">
4598 ##      <summary>
4599 ##      The type of the new process.
4600 ##      </summary>
4601 ## </param>
4602 #
4603 interface(`userdom_domtrans_user_home',`
4604         gen_require(`
4605                 type user_home_t;
4606         ')
4607
4608         read_lnk_files_pattern($1, user_home_t, user_home_t)
4609         domain_transition_pattern($1, user_home_t, $2)
4610         type_transition $1 user_home_t:process $2;
4611 ')
4612
4613 ########################################
4614 ## <summary>
4615 ##      Execute a file in a user tmp directory
4616 ##      in the specified domain.
4617 ## </summary>
4618 ## <desc>
4619 ##      <p>
4620 ##      Execute a file in a user tmp directory
4621 ##      in the specified domain.
4622 ##      </p>
4623 ##      <p>
4624 ##      No interprocess communication (signals, pipes,
4625 ##      etc.) is provided by this interface since
4626 ##      the domains are not owned by this module.
4627 ##      </p>
4628 ## </desc>
4629 ## <param name="domain">
4630 ##      <summary>
4631 ##      Domain allowed access.
4632 ##      </summary>
4633 ## </param>
4634 ## <param name="target_domain">
4635 ##      <summary>
4636 ##      The type of the new process.
4637 ##      </summary>
4638 ## </param>
4639 #
4640 interface(`userdom_domtrans_user_tmp',`
4641         gen_require(`
4642                 type user_tmp_t;
4643         ')
4644
4645         files_search_tmp($1)
4646         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4647         domain_transition_pattern($1, user_tmp_t, $2)
4648         type_transition $1 user_tmp_t:process $2;
4649 ')
4650
4651 ########################################
4652 ## <summary>
4653 ##      Do not audit attempts to read all user home content files.
4654 ## </summary>
4655 ## <param name="domain">
4656 ##      <summary>
4657 ##      Domain to not audit.
4658 ##      </summary>
4659 ## </param>
4660 #
4661 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4662         gen_require(`
4663                 attribute user_home_type;
4664         ')
4665
4666         dontaudit $1 user_home_type:file read_file_perms;
4667 ')
4668
4669 ########################################
4670 ## <summary>
4671 ##      Do not audit attempts to read all user tmp content files.
4672 ## </summary>
4673 ## <param name="domain">
4674 ##      <summary>
4675 ##      Domain to not audit.
4676 ##      </summary>
4677 ## </param>
4678 #
4679 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4680         gen_require(`
4681                 attribute user_tmp_type;
4682         ')
4683
4684         dontaudit $1 user_tmp_type:file read_file_perms;
4685 ')
4686