policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 # Allow graphical boot to check battery lifespan
 676                 apm_stream_connect($1_usertype)
 677         ')
 678
 679         optional_policy(`
 680                 canna_stream_connect($1_usertype)
 681         ')
 682
 683         optional_policy(`
 684                 chrome_role($1_r, $1_usertype)
 685         ')
 686
 687         optional_policy(`
 688                 colord_read_lib_files($1_usertype)
 689         ')
 690
 691         optional_policy(`
 692                 dbus_system_bus_client($1_usertype)
 693
 694                 allow $1_usertype $1_usertype:dbus  send_msg;
 695
 696                 optional_policy(`
 697                         avahi_dbus_chat($1_usertype)
 698                 ')
 699
 700                 optional_policy(`
 701                         policykit_dbus_chat($1_usertype)
 702                 ')
 703
 704                 optional_policy(`
 705                         bluetooth_dbus_chat($1_usertype)
 706                 ')
 707
 708                 optional_policy(`
 709                         consolekit_dbus_chat($1_usertype)
 710                         consolekit_read_log($1_usertype)
 711                 ')
 712
 713                 optional_policy(`
 714                         devicekit_dbus_chat($1_usertype)
 715                         devicekit_dbus_chat_power($1_usertype)
 716                         devicekit_dbus_chat_disk($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         evolution_dbus_chat($1_usertype)
 721                         evolution_alarm_dbus_chat($1_usertype)
 722                 ')
 723
 724                 optional_policy(`
 725                         gnome_dbus_chat_gconfdefault($1_usertype)
 726                 ')
 727
 728                 optional_policy(`
 729                         hal_dbus_chat($1_usertype)
 730                 ')
 731
 732                 optional_policy(`
 733                         kde_dbus_chat_backlighthelper($1_usertype)
 734                 ')
 735
 736                 optional_policy(`
 737                         modemmanager_dbus_chat($1_usertype)
 738                 ')
 739
 740                 optional_policy(`
 741                         networkmanager_dbus_chat($1_usertype)
 742                         networkmanager_read_lib_files($1_usertype)
 743                 ')
 744
 745                 optional_policy(`
 746                         vpn_dbus_chat($1_usertype)
 747                 ')
 748         ')
 749
 750         optional_policy(`
 751                 git_session_role($1_r, $1_usertype)
 752         ')
 753
 754         optional_policy(`
 755                 inetd_use_fds($1_usertype)
 756                 inetd_rw_tcp_sockets($1_usertype)
 757         ')
 758
 759         optional_policy(`
 760                 inn_read_config($1_usertype)
 761                 inn_read_news_lib($1_usertype)
 762                 inn_read_news_spool($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 lircd_stream_connect($1_usertype)
 767         ')
 768
 769         optional_policy(`
 770                 locate_read_lib_files($1_usertype)
 771         ')
 772
 773         # for running depmod as part of the kernel packaging process
 774         optional_policy(`
 775                 modutils_read_module_config($1_usertype)
 776         ')
 777
 778         optional_policy(`
 779                 mta_rw_spool($1_usertype)
 780                 mta_manage_queue($1_usertype)
 781                 mta_filetrans_home_content($1_usertype)
 782         ')
 783
 784         optional_policy(`
 785                 nsplugin_role($1_r, $1_usertype)
 786         ')
 787
 788         optional_policy(`
 789                 tunable_policy(`allow_user_mysql_connect',`
 790                         mysql_stream_connect($1_t)
 791                 ')
 792         ')
 793
 794         optional_policy(`
 795                 oident_manage_user_content($1_t)
 796                 oident_relabel_user_content($1_t)
 797         ')
 798
 799         optional_policy(`
 800                 # to allow monitoring of pcmcia status
 801                 pcmcia_read_pid($1_usertype)
 802         ')
 803
 804         optional_policy(`
 805                 pcscd_read_pub_files($1_usertype)
 806                 pcscd_stream_connect($1_usertype)
 807         ')
 808
 809         optional_policy(`
 810                 tunable_policy(`allow_user_postgresql_connect',`
 811                         postgresql_stream_connect($1_usertype)
 812                         postgresql_tcp_connect($1_usertype)
 813                 ')
 814         ')
 815
 816         optional_policy(`
 817                 resmgr_stream_connect($1_usertype)
 818         ')
 819
 820         optional_policy(`
 821                 rpc_dontaudit_getattr_exports($1_usertype)
 822                 rpc_manage_nfs_rw_content($1_usertype)
 823         ')
 824
 825         optional_policy(`
 826                 rpcbind_stream_connect($1_usertype)
 827         ')
 828
 829         optional_policy(`
 830                 samba_stream_connect_winbind($1_usertype)
 831         ')
 832
 833         optional_policy(`
 834                 sandbox_transition($1_usertype, $1_r)
 835         ')
 836
 837         optional_policy(`
 838                 seunshare_role_template($1, $1_r, $1_t)
 839         ')
 840
 841         optional_policy(`
 842                 slrnpull_search_spool($1_usertype)
 843         ')
 844
 845         optional_policy(`
 846                 thumb_role($1_r, $1_usertype)
 847         ')
 848 ')
 849
 850 #######################################
 851 ## <summary>
 852 ##      The template for creating a login user.
 853 ## </summary>
 854 ## <desc>
 855 ##      <p>
 856 ##      This template creates a user domain, types, and
 857 ##      rules for the user's tty, pty, home directories,
 858 ##      tmp, and tmpfs files.
 859 ##      </p>
 860 ## </desc>
 861 ## <param name="userdomain_prefix">
 862 ##      <summary>
 863 ##      The prefix of the user domain (e.g., user
 864 ##      is the prefix for user_t).
 865 ##      </summary>
 866 ## </param>
 867 #
 868 template(`userdom_login_user_template', `
 869         gen_require(`
 870                 class context contains;
 871         ')
 872
 873         userdom_base_user_template($1)
 874
 875         userdom_manage_home_role($1_r, $1_usertype)
 876
 877         userdom_manage_tmp_role($1_r, $1_usertype)
 878         userdom_manage_tmpfs_role($1_r, $1_usertype)
 879
 880         ifelse(`$1',`unconfined',`',`
 881                 gen_tunable(allow_$1_exec_content, true)
 882
 883                 tunable_policy(`allow_$1_exec_content',`
 884                         userdom_exec_user_tmp_files($1_usertype)
 885                         userdom_exec_user_home_content_files($1_usertype)
 886                 ')
 887                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 888                         fs_exec_nfs_files($1_usertype)
 889                 ')
 890
 891                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 892                         fs_exec_cifs_files($1_usertype)
 893                 ')
 894         ')
 895
 896         userdom_change_password_template($1)
 897
 898         ##############################
 899         #
 900         # User domain Local policy
 901         #
 902
 903         allow $1_t self:capability { setgid chown fowner };
 904         dontaudit $1_t self:capability { sys_nice fsetid };
 905
 906         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 907         dontaudit $1_t self:process setrlimit;
 908         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 909
 910         allow $1_t self:context contains;
 911
 912         kernel_dontaudit_read_system_state($1_usertype)
 913         kernel_dontaudit_list_all_proc($1_usertype)
 914
 915         dev_read_sysfs($1_usertype)
 916         dev_read_urand($1_usertype)
 917
 918         domain_use_interactive_fds($1_usertype)
 919         # Command completion can fire hundreds of denials
 920         domain_dontaudit_exec_all_entry_files($1_usertype)
 921
 922         files_dontaudit_list_default($1_usertype)
 923         files_dontaudit_read_default_files($1_usertype)
 924         # Stat lost+found.
 925         files_getattr_lost_found_dirs($1_usertype)
 926
 927         fs_get_all_fs_quotas($1_usertype)
 928         fs_getattr_all_fs($1_usertype)
 929         fs_search_all($1_usertype)
 930         fs_list_inotifyfs($1_usertype)
 931         fs_rw_anon_inodefs_files($1_usertype)
 932
 933         auth_dontaudit_write_login_records($1_t)
 934         auth_rw_cache($1_t)
 935
 936         application_exec_all($1_t)
 937         # The library functions always try to open read-write first,
 938         # then fall back to read-only if it fails.
 939         init_dontaudit_rw_utmp($1_t)
 940
 941         # Stop warnings about access to /dev/console
 942         init_dontaudit_use_fds($1_usertype)
 943         init_dontaudit_use_script_fds($1_usertype)
 944
 945         libs_exec_lib_files($1_usertype)
 946
 947         logging_dontaudit_getattr_all_logs($1_usertype)
 948
 949         # for running TeX programs
 950         miscfiles_read_tetex_data($1_usertype)
 951         miscfiles_exec_tetex_data($1_usertype)
 952
 953         seutil_read_config($1_usertype)
 954
 955         optional_policy(`
 956                 cups_read_config($1_usertype)
 957                 cups_stream_connect($1_usertype)
 958                 cups_stream_connect_ptal($1_usertype)
 959         ')
 960
 961         optional_policy(`
 962                 kerberos_use($1_usertype)
 963                 kerberos_filetrans_home_content($1_usertype)
 964         ')
 965
 966         optional_policy(`
 967                 mta_dontaudit_read_spool_symlinks($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 quota_dontaudit_getattr_db($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 rpm_read_db($1_usertype)
 976                 rpm_dontaudit_manage_db($1_usertype)
 977                 rpm_read_cache($1_usertype)
 978         ')
 979
 980         optional_policy(`
 981                 oddjob_run_mkhomedir($1_t, $1_r)
 982         ')
 983 ')
 984
 985 #######################################
 986 ## <summary>
 987 ##      The template for creating a unprivileged login user.
 988 ## </summary>
 989 ## <desc>
 990 ##      <p>
 991 ##      This template creates a user domain, types, and
 992 ##      rules for the user's tty, pty, home directories,
 993 ##      tmp, and tmpfs files.
 994 ##      </p>
 995 ## </desc>
 996 ## <param name="userdomain_prefix">
 997 ##      <summary>
 998 ##      The prefix of the user domain (e.g., user
 999 ##      is the prefix for user_t).
1000 ##      </summary>
1001 ## </param>
1002 #
1003 template(`userdom_restricted_user_template',`
1004         gen_require(`
1005                 attribute unpriv_userdomain;
1006         ')
1007
1008         userdom_login_user_template($1)
1009
1010         typeattribute $1_t unpriv_userdomain;
1011         domain_interactive_fd($1_t)
1012
1013         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1014         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1015
1016         ##############################
1017         #
1018         # Local policy
1019         #
1020
1021         optional_policy(`
1022                 loadkeys_run($1_t, $1_r)
1023         ')
1024 ')
1025
1026 #######################################
1027 ## <summary>
1028 ##      The template for creating a unprivileged xwindows login user.
1029 ## </summary>
1030 ## <desc>
1031 ##      <p>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ##      </p>
1034 ##      <p>
1035 ##      This template creates a user domain, types, and
1036 ##      rules for the user's tty, pty, home directories,
1037 ##      tmp, and tmpfs files.
1038 ##      </p>
1039 ## </desc>
1040 ## <param name="userdomain_prefix">
1041 ##      <summary>
1042 ##      The prefix of the user domain (e.g., user
1043 ##      is the prefix for user_t).
1044 ##      </summary>
1045 ## </param>
1046 #
1047 template(`userdom_restricted_xwindows_user_template',`
1048
1049         userdom_restricted_user_template($1)
1050
1051         ##############################
1052         #
1053         # Local policy
1054         #
1055
1056         auth_role($1_r, $1_t)
1057         auth_search_pam_console_data($1_usertype)
1058         auth_dontaudit_read_login_records($1_usertype)
1059
1060         dev_read_sound($1_usertype)
1061         dev_write_sound($1_usertype)
1062         # gnome keyring wants to read this.
1063         dev_dontaudit_read_rand($1_usertype)
1064         # temporarily allow since openoffice requires this
1065         dev_read_rand($1_usertype)
1066
1067         dev_read_video_dev($1_usertype)
1068         dev_write_video_dev($1_usertype)
1069         dev_rw_wireless($1_usertype)
1070
1071         libs_dontaudit_setattr_lib_files($1_usertype)
1072
1073         tunable_policy(`user_rw_noexattrfile',`
1074                 dev_rw_usbfs($1_t)
1075                 dev_rw_generic_usb_dev($1_usertype)
1076
1077                 fs_manage_noxattr_fs_files($1_usertype)
1078                 fs_manage_noxattr_fs_dirs($1_usertype)
1079                 fs_manage_dos_dirs($1_usertype)
1080                 fs_manage_dos_files($1_usertype)
1081                 storage_raw_read_removable_device($1_usertype)
1082                 storage_raw_write_removable_device($1_usertype)
1083         ')
1084
1085         logging_send_syslog_msg($1_usertype)
1086         logging_dontaudit_send_audit_msgs($1_t)
1087
1088         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1089         logging_send_audit_msgs($1_t)
1090         selinux_get_enforce_mode($1_t)
1091         seutil_exec_restorecond($1_t)
1092         seutil_read_file_contexts($1_t)
1093         seutil_read_default_contexts($1_t)
1094
1095         xserver_restricted_role($1_r, $1_t)
1096
1097         optional_policy(`
1098                 alsa_read_rw_config($1_usertype)
1099         ')
1100
1101          # cjp: needed by KDE apps
1102          # bug: #682499
1103          optional_policy(`
1104                 gnome_read_usr_config($1_usertype)
1105                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1106                 # cjp: telepathy F15 bugs
1107                 telepathy_role($1_r, $1_t, $1)
1108         ')
1109
1110         optional_policy(`
1111                 dbus_role_template($1, $1_r, $1_usertype)
1112                 dbus_system_bus_client($1_usertype)
1113                 allow $1_usertype $1_usertype:dbus send_msg;
1114
1115                 optional_policy(`
1116                         abrt_dbus_chat($1_usertype)
1117                         abrt_run_helper($1_usertype, $1_r)
1118                 ')
1119
1120                 optional_policy(`
1121                         consolekit_dontaudit_read_log($1_usertype)
1122                         consolekit_dbus_chat($1_usertype)
1123                 ')
1124
1125                 optional_policy(`
1126                         cups_dbus_chat($1_usertype)
1127                         cups_dbus_chat_config($1_usertype)
1128                 ')
1129
1130                 optional_policy(`
1131                         devicekit_dbus_chat($1_usertype)
1132                         devicekit_dbus_chat_disk($1_usertype)
1133                         devicekit_dbus_chat_power($1_usertype)
1134                 ')
1135
1136                 optional_policy(`
1137                         fprintd_dbus_chat($1_t)
1138                 ')
1139         ')
1140
1141         optional_policy(`
1142                 openoffice_role_template($1, $1_r, $1_usertype)
1143         ')
1144
1145         optional_policy(`
1146                 policykit_role($1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 pulseaudio_role($1_r, $1_usertype)
1151                 pulseaudio_filetrans_admin_home_content($1_usertype)
1152                 pulseaudio_filetrans_home_content($1_usertype)
1153         ')
1154
1155         optional_policy(`
1156                 rtkit_scheduled($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 setroubleshoot_dontaudit_stream_connect($1_t)
1161         ')
1162
1163         optional_policy(`
1164                 udev_read_db($1_usertype)
1165         ')
1166
1167         optional_policy(`
1168                 wm_role_template($1, $1_r, $1_t)
1169         ')
1170 ')
1171
1172 #######################################
1173 ## <summary>
1174 ##      The template for creating a unprivileged user roughly
1175 ##      equivalent to a regular linux user.
1176 ## </summary>
1177 ## <desc>
1178 ##      <p>
1179 ##      The template for creating a unprivileged user roughly
1180 ##      equivalent to a regular linux user.
1181 ##      </p>
1182 ##      <p>
1183 ##      This template creates a user domain, types, and
1184 ##      rules for the user's tty, pty, home directories,
1185 ##      tmp, and tmpfs files.
1186 ##      </p>
1187 ## </desc>
1188 ## <param name="userdomain_prefix">
1189 ##      <summary>
1190 ##      The prefix of the user domain (e.g., user
1191 ##      is the prefix for user_t).
1192 ##      </summary>
1193 ## </param>
1194 #
1195 template(`userdom_unpriv_user_template', `
1196
1197         ##############################
1198         #
1199         # Declarations
1200         #
1201
1202         # Inherit rules for ordinary users.
1203         userdom_restricted_xwindows_user_template($1)
1204         userdom_common_user_template($1)
1205
1206         ##############################
1207         #
1208         # Local policy
1209         #
1210
1211         # port access is audited even if dac would not have allowed it, so dontaudit it here
1212 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1213         # Need the following rule to allow users to run vpnc
1214         corenet_tcp_bind_xserver_port($1_t)
1215         corenet_tcp_bind_generic_node($1_usertype)
1216
1217         storage_rw_fuse($1_t)
1218
1219         files_exec_usr_files($1_t)
1220    # cjp: why?
1221         files_read_kernel_symbol_table($1_t)
1222
1223         ifndef(`enable_mls',`
1224                 fs_exec_noxattr($1_t)
1225
1226                 tunable_policy(`user_rw_noexattrfile',`
1227                         fs_manage_noxattr_fs_files($1_t)
1228                         fs_manage_noxattr_fs_dirs($1_t)
1229                         # Write floppies
1230                         storage_raw_read_removable_device($1_t)
1231                         storage_raw_write_removable_device($1_t)
1232                 ',`
1233                         storage_raw_read_removable_device($1_t)
1234                 ')
1235         ')
1236
1237         miscfiles_read_hwdata($1_usertype)
1238
1239         # Allow users to run TCP servers (bind to ports and accept connection from
1240         # the same domain and outside users) disabling this forces FTP passive mode
1241         # and may change other protocols
1242
1243         tunable_policy(`user_share_music',`
1244                 corenet_tcp_bind_daap_port($1_usertype)
1245         ')
1246
1247         tunable_policy(`user_tcp_server',`
1248                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_setrlimit',`
1252                 allow $1_usertype self:process setrlimit;
1253         ')
1254
1255         optional_policy(`
1256                 cdrecord_role($1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 cron_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 games_rw_data($1_usertype)
1265         ')
1266
1267         optional_policy(`
1268                 gpg_role($1_r, $1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gnomeclock_dbus_chat($1_t)
1273         ')
1274
1275         optional_policy(`
1276                 gpm_stream_connect($1_usertype)
1277         ')
1278
1279         optional_policy(`
1280                 execmem_role_template($1, $1_r, $1_t)
1281         ')
1282
1283         optional_policy(`
1284                 java_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 mono_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mount_run_fusermount($1_t, $1_r)
1293                 mount_read_pid_files($1_t)
1294         ')
1295
1296         optional_policy(`
1297                 wine_role_template($1, $1_r, $1_t)
1298         ')
1299
1300         optional_policy(`
1301                 postfix_run_postdrop($1_t, $1_r)
1302                 postfix_search_spool($1_t)
1303         ')
1304
1305         # Run pppd in pppd_t by default for user
1306         optional_policy(`
1307                 ppp_run_cond($1_t, $1_r)
1308         ')
1309
1310         optional_policy(`
1311                 vdagent_getattr_log($1_t)
1312                 vdagent_getattr_exec($1_t)
1313                 vdagent_stream_connect($1_t)
1314         ')
1315 ')
1316
1317 #######################################
1318 ## <summary>
1319 ##      The template for creating an administrative user.
1320 ## </summary>
1321 ## <desc>
1322 ##      <p>
1323 ##      This template creates a user domain, types, and
1324 ##      rules for the user's tty, pty, home directories,
1325 ##      tmp, and tmpfs files.
1326 ##      </p>
1327 ##      <p>
1328 ##      The privileges given to administrative users are:
1329 ##      <ul>
1330 ##              <li>Raw disk access</li>
1331 ##              <li>Set all sysctls</li>
1332 ##              <li>All kernel ring buffer controls</li>
1333 ##              <li>Create, read, write, and delete all files but shadow</li>
1334 ##              <li>Manage source and binary format SELinux policy</li>
1335 ##              <li>Run insmod</li>
1336 ##      </ul>
1337 ##      </p>
1338 ## </desc>
1339 ## <param name="userdomain_prefix">
1340 ##      <summary>
1341 ##      The prefix of the user domain (e.g., sysadm
1342 ##      is the prefix for sysadm_t).
1343 ##      </summary>
1344 ## </param>
1345 #
1346 template(`userdom_admin_user_template',`
1347         gen_require(`
1348                 attribute admindomain;
1349                 class passwd { passwd chfn chsh rootok crontab };
1350         ')
1351
1352         ##############################
1353         #
1354         # Declarations
1355         #
1356
1357         # Inherit rules for ordinary users.
1358         userdom_login_user_template($1)
1359         userdom_common_user_template($1)
1360
1361         domain_obj_id_change_exemption($1_t)
1362         role system_r types $1_t;
1363
1364         typeattribute $1_t admindomain;
1365
1366         ifdef(`direct_sysadm_daemon',`
1367                 domain_system_change_exemption($1_t)
1368         ')
1369
1370         ##############################
1371         #
1372         # $1_t local policy
1373         #
1374
1375         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1376         allow $1_t self:capability2 syslog;
1377         allow $1_t self:process { setexec setfscreate };
1378         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1379         allow $1_t self:tun_socket create;
1380         # Set password information for other users.
1381         allow $1_t self:passwd { passwd chfn chsh };
1382         # Skip authentication when pam_rootok is specified.
1383         allow $1_t self:passwd rootok;
1384
1385         # Manipulate other users crontab.
1386         allow $1_t self:passwd crontab;
1387
1388         kernel_read_software_raid_state($1_t)
1389         kernel_getattr_core_if($1_t)
1390         kernel_getattr_message_if($1_t)
1391         kernel_change_ring_buffer_level($1_t)
1392         kernel_clear_ring_buffer($1_t)
1393         kernel_read_ring_buffer($1_t)
1394         kernel_get_sysvipc_info($1_t)
1395         kernel_rw_all_sysctls($1_t)
1396         # signal unlabeled processes:
1397         kernel_kill_unlabeled($1_t)
1398         kernel_signal_unlabeled($1_t)
1399         kernel_sigstop_unlabeled($1_t)
1400         kernel_signull_unlabeled($1_t)
1401         kernel_sigchld_unlabeled($1_t)
1402         kernel_signal($1_t)
1403
1404         corenet_tcp_bind_generic_port($1_t)
1405         # allow setting up tunnels
1406         corenet_rw_tun_tap_dev($1_t)
1407
1408         dev_getattr_generic_blk_files($1_t)
1409         dev_getattr_generic_chr_files($1_t)
1410         # for lsof
1411         dev_getattr_mtrr_dev($1_t)
1412         # Allow MAKEDEV to work
1413         dev_create_all_blk_files($1_t)
1414         dev_create_all_chr_files($1_t)
1415         dev_delete_all_blk_files($1_t)
1416         dev_delete_all_chr_files($1_t)
1417         dev_rename_all_blk_files($1_t)
1418         dev_rename_all_chr_files($1_t)
1419         dev_create_generic_symlinks($1_t)
1420         dev_rw_generic_usb_dev($1_t)
1421         dev_rw_usbfs($1_t)
1422
1423         domain_setpriority_all_domains($1_t)
1424         domain_read_all_domains_state($1_t)
1425         domain_getattr_all_domains($1_t)
1426         domain_getcap_all_domains($1_t)
1427         domain_dontaudit_ptrace_all_domains($1_t)
1428         # signal all domains:
1429         domain_kill_all_domains($1_t)
1430         domain_signal_all_domains($1_t)
1431         domain_signull_all_domains($1_t)
1432         domain_sigstop_all_domains($1_t)
1433         domain_sigstop_all_domains($1_t)
1434         domain_sigchld_all_domains($1_t)
1435         # for lsof
1436         domain_getattr_all_sockets($1_t)
1437         domain_dontaudit_getattr_all_sockets($1_t)
1438
1439         files_exec_usr_src_files($1_t)
1440
1441         fs_getattr_all_fs($1_t)
1442         fs_getattr_all_files($1_t)
1443         fs_list_all($1_t)
1444         fs_set_all_quotas($1_t)
1445         fs_exec_noxattr($1_t)
1446
1447         storage_raw_read_removable_device($1_t)
1448         storage_raw_write_removable_device($1_t)
1449         storage_dontaudit_read_fixed_disk($1_t)
1450
1451         term_use_all_inherited_terms($1_t)
1452         term_use_unallocated_ttys($1_t)
1453
1454         auth_getattr_shadow($1_t)
1455         # Manage almost all files
1456         files_manage_non_security_dirs($1_t)
1457         files_manage_non_security_files($1_t)
1458         # Relabel almost all files
1459         files_relabel_non_security_files($1_t)
1460
1461         init_telinit($1_t)
1462
1463         logging_send_syslog_msg($1_t)
1464
1465         optional_policy(`
1466                 modutils_domtrans_insmod($1_t)
1467                 modutils_domtrans_depmod($1_t)
1468         ')
1469
1470         # The following rule is temporary until such time that a complete
1471         # policy management infrastructure is in place so that an administrator
1472         # cannot directly manipulate policy files with arbitrary programs.
1473         seutil_manage_src_policy($1_t)
1474         # Violates the goal of limiting write access to checkpolicy.
1475         # But presently necessary for installing the file_contexts file.
1476         seutil_manage_bin_policy($1_t)
1477
1478         systemd_config_all_services($1_t)
1479
1480         userdom_manage_user_home_content_dirs($1_t)
1481         userdom_manage_user_home_content_files($1_t)
1482         userdom_manage_user_home_content_symlinks($1_t)
1483         userdom_manage_user_home_content_pipes($1_t)
1484         userdom_manage_user_home_content_sockets($1_t)
1485         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1486
1487         tunable_policy(`user_rw_noexattrfile',`
1488                 fs_manage_noxattr_fs_files($1_t)
1489                 fs_manage_noxattr_fs_dirs($1_t)
1490         ',`
1491                 fs_read_noxattr_fs_files($1_t)
1492         ')
1493
1494         optional_policy(`
1495                 postgresql_unconfined($1_t)
1496         ')
1497
1498         optional_policy(`
1499                 userhelper_exec($1_t)
1500         ')
1501 ')
1502
1503 ########################################
1504 ## <summary>
1505 ##      Allow user to run as a secadm
1506 ## </summary>
1507 ## <desc>
1508 ##      <p>
1509 ##      Create objects in a user home directory
1510 ##      with an automatic type transition to
1511 ##      a specified private type.
1512 ##      </p>
1513 ##      <p>
1514 ##      This is a templated interface, and should only
1515 ##      be called from a per-userdomain template.
1516 ##      </p>
1517 ## </desc>
1518 ## <param name="domain">
1519 ##      <summary>
1520 ##      Domain allowed access.
1521 ##      </summary>
1522 ## </param>
1523 ## <param name="role">
1524 ##      <summary>
1525 ##      The role  of the object to create.
1526 ##      </summary>
1527 ## </param>
1528 #
1529 template(`userdom_security_admin_template',`
1530         allow $1 self:capability { dac_read_search dac_override };
1531
1532         corecmd_exec_shell($1)
1533
1534         domain_obj_id_change_exemption($1)
1535
1536         dev_relabel_all_dev_nodes($1)
1537
1538         files_create_boot_flag($1)
1539         files_create_default_dir($1)
1540         files_root_filetrans_default($1, dir)
1541
1542         # Necessary for managing /boot/efi
1543         fs_manage_dos_files($1)
1544
1545         mls_process_read_up($1)
1546         mls_file_read_all_levels($1)
1547         mls_file_upgrade($1)
1548         mls_file_downgrade($1)
1549
1550         selinux_set_enforce_mode($1)
1551         selinux_set_all_booleans($1)
1552         selinux_set_parameters($1)
1553         selinux_read_policy($1)
1554
1555         files_relabel_all_files($1)
1556         auth_relabel_shadow($1)
1557
1558         init_exec($1)
1559
1560         logging_send_syslog_msg($1)
1561         logging_read_audit_log($1)
1562         logging_read_generic_logs($1)
1563         logging_read_audit_config($1)
1564
1565         seutil_manage_bin_policy($1)
1566         seutil_manage_default_contexts($1)
1567         seutil_manage_file_contexts($1)
1568         seutil_manage_module_store($1)
1569         seutil_manage_config($1)
1570         seutil_run_checkpolicy($1,$2)
1571         seutil_run_loadpolicy($1,$2)
1572         seutil_run_semanage($1,$2)
1573         seutil_run_setsebool($1,$2)
1574         seutil_run_setfiles($1, $2)
1575
1576         seutil_manage_bin_policy($1)
1577     seutil_manage_default_contexts($1)
1578     seutil_manage_file_contexts($1)
1579     seutil_manage_module_store($1)
1580     seutil_manage_config($1)
1581
1582         optional_policy(`
1583                 aide_run($1,$2)
1584         ')
1585
1586         optional_policy(`
1587                 consoletype_exec($1)
1588         ')
1589
1590         optional_policy(`
1591                 dmesg_exec($1)
1592         ')
1593
1594         optional_policy(`
1595                 ipsec_run_setkey($1,$2)
1596         ')
1597
1598         optional_policy(`
1599                 netlabel_run_mgmt($1,$2)
1600         ')
1601
1602         optional_policy(`
1603                 samhain_run($1, $2)
1604         ')
1605 ')
1606
1607 ########################################
1608 ## <summary>
1609 ##      Make the specified type usable in a
1610 ##      user home directory.
1611 ## </summary>
1612 ## <param name="type">
1613 ##      <summary>
1614 ##      Type to be used as a file in the
1615 ##      user home directory.
1616 ##      </summary>
1617 ## </param>
1618 #
1619 interface(`userdom_user_home_content',`
1620         gen_require(`
1621                 type user_home_t;
1622                 attribute user_home_type;
1623         ')
1624
1625         allow $1 user_home_t:filesystem associate;
1626         files_type($1)
1627         ubac_constrained($1)
1628
1629         files_poly_member($1)
1630         typeattribute $1  user_home_type;
1631 ')
1632
1633 ########################################
1634 ## <summary>
1635 ##      Make the specified type usable in a
1636 ##      generic temporary directory.
1637 ## </summary>
1638 ## <param name="type">
1639 ##      <summary>
1640 ##      Type to be used as a file in the
1641 ##      generic temporary directory.
1642 ##      </summary>
1643 ## </param>
1644 #
1645 interface(`userdom_user_tmp_content',`
1646         gen_require(`
1647                 attribute user_tmp_type;
1648         ')
1649
1650         typeattribute $1 user_tmp_type;
1651
1652         files_tmp_file($1)
1653         ubac_constrained($1)
1654 ')
1655
1656 ########################################
1657 ## <summary>
1658 ##      Make the specified type usable in a
1659 ##      generic tmpfs_t directory.
1660 ## </summary>
1661 ## <param name="type">
1662 ##      <summary>
1663 ##      Type to be used as a file in the
1664 ##      generic temporary directory.
1665 ##      </summary>
1666 ## </param>
1667 #
1668 interface(`userdom_user_tmpfs_content',`
1669         gen_require(`
1670                 attribute user_tmpfs_type;
1671         ')
1672
1673         typeattribute $1 user_tmpfs_type;
1674
1675         files_tmpfs_file($1)
1676         ubac_constrained($1)
1677 ')
1678
1679 ########################################
1680 ## <summary>
1681 ##      Allow domain to attach to TUN devices created by administrative users.
1682 ## </summary>
1683 ## <param name="domain">
1684 ##      <summary>
1685 ##      Domain allowed access.
1686 ##      </summary>
1687 ## </param>
1688 #
1689 interface(`userdom_attach_admin_tun_iface',`
1690         gen_require(`
1691                 attribute admindomain;
1692         ')
1693
1694         allow $1 admindomain:tun_socket relabelfrom;
1695         allow $1 self:tun_socket relabelto;
1696 ')
1697
1698 ########################################
1699 ## <summary>
1700 ##      Set the attributes of a user pty.
1701 ## </summary>
1702 ## <param name="domain">
1703 ##      <summary>
1704 ##      Domain allowed access.
1705 ##      </summary>
1706 ## </param>
1707 #
1708 interface(`userdom_setattr_user_ptys',`
1709         gen_require(`
1710                 type user_devpts_t;
1711         ')
1712
1713         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1714 ')
1715
1716 ########################################
1717 ## <summary>
1718 ##      Create a user pty.
1719 ## </summary>
1720 ## <param name="domain">
1721 ##      <summary>
1722 ##      Domain allowed access.
1723 ##      </summary>
1724 ## </param>
1725 #
1726 interface(`userdom_create_user_pty',`
1727         gen_require(`
1728                 type user_devpts_t;
1729         ')
1730
1731         term_create_pty($1, user_devpts_t)
1732 ')
1733
1734 ########################################
1735 ## <summary>
1736 ##      Get the attributes of user home directories.
1737 ## </summary>
1738 ## <param name="domain">
1739 ##      <summary>
1740 ##      Domain allowed access.
1741 ##      </summary>
1742 ## </param>
1743 #
1744 interface(`userdom_getattr_user_home_dirs',`
1745         gen_require(`
1746                 type user_home_dir_t;
1747         ')
1748
1749         allow $1 user_home_dir_t:dir getattr_dir_perms;
1750         files_search_home($1)
1751 ')
1752
1753 ########################################
1754 ## <summary>
1755 ##      Do not audit attempts to get the attributes of user home directories.
1756 ## </summary>
1757 ## <param name="domain">
1758 ##      <summary>
1759 ##      Domain to not audit.
1760 ##      </summary>
1761 ## </param>
1762 #
1763 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1764         gen_require(`
1765                 type user_home_dir_t;
1766         ')
1767
1768         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1769 ')
1770
1771 ########################################
1772 ## <summary>
1773 ##      Search user home directories.
1774 ## </summary>
1775 ## <param name="domain">
1776 ##      <summary>
1777 ##      Domain allowed access.
1778 ##      </summary>
1779 ## </param>
1780 #
1781 interface(`userdom_search_user_home_dirs',`
1782         gen_require(`
1783                 type user_home_dir_t;
1784         ')
1785
1786         allow $1 user_home_dir_t:dir search_dir_perms;
1787         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1788         files_search_home($1)
1789 ')
1790
1791 ########################################
1792 ## <summary>
1793 ##      Do not audit attempts to search user home directories.
1794 ## </summary>
1795 ## <desc>
1796 ##      <p>
1797 ##      Do not audit attempts to search user home directories.
1798 ##      This will supress SELinux denial messages when the specified
1799 ##      domain is denied the permission to search these directories.
1800 ##      </p>
1801 ## </desc>
1802 ## <param name="domain">
1803 ##      <summary>
1804 ##      Domain to not audit.
1805 ##      </summary>
1806 ## </param>
1807 ## <infoflow type="none"/>
1808 #
1809 interface(`userdom_dontaudit_search_user_home_dirs',`
1810         gen_require(`
1811                 type user_home_dir_t;
1812         ')
1813
1814         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1815 ')
1816
1817 ########################################
1818 ## <summary>
1819 ##      List user home directories.
1820 ## </summary>
1821 ## <param name="domain">
1822 ##      <summary>
1823 ##      Domain allowed access.
1824 ##      </summary>
1825 ## </param>
1826 #
1827 interface(`userdom_list_user_home_dirs',`
1828         gen_require(`
1829                 type user_home_dir_t;
1830         ')
1831
1832         allow $1 user_home_dir_t:dir list_dir_perms;
1833         files_search_home($1)
1834
1835         tunable_policy(`use_nfs_home_dirs',`
1836                 fs_list_nfs($1)
1837         ')
1838
1839         tunable_policy(`use_samba_home_dirs',`
1840                 fs_list_cifs($1)
1841         ')
1842 ')
1843
1844 ########################################
1845 ## <summary>
1846 ##      Do not audit attempts to list user home subdirectories.
1847 ## </summary>
1848 ## <param name="domain">
1849 ##      <summary>
1850 ##      Domain to not audit.
1851 ##      </summary>
1852 ## </param>
1853 #
1854 interface(`userdom_dontaudit_list_user_home_dirs',`
1855         gen_require(`
1856                 type user_home_dir_t;
1857                 type user_home_t;
1858         ')
1859
1860         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1861         dontaudit $1 user_home_t:dir list_dir_perms;
1862 ')
1863
1864 ########################################
1865 ## <summary>
1866 ##      Create user home directories.
1867 ## </summary>
1868 ## <param name="domain">
1869 ##      <summary>
1870 ##      Domain allowed access.
1871 ##      </summary>
1872 ## </param>
1873 #
1874 interface(`userdom_create_user_home_dirs',`
1875         gen_require(`
1876                 type user_home_dir_t;
1877         ')
1878
1879         allow $1 user_home_dir_t:dir create_dir_perms;
1880 ')
1881
1882 ########################################
1883 ## <summary>
1884 ##      Create user home directories.
1885 ## </summary>
1886 ## <param name="domain">
1887 ##      <summary>
1888 ##      Domain allowed access.
1889 ##      </summary>
1890 ## </param>
1891 #
1892 interface(`userdom_manage_user_home_dirs',`
1893         gen_require(`
1894                 type user_home_dir_t;
1895         ')
1896
1897         allow $1 user_home_dir_t:dir manage_dir_perms;
1898 ')
1899
1900 ########################################
1901 ## <summary>
1902 ##      Relabel to user home directories.
1903 ## </summary>
1904 ## <param name="domain">
1905 ##      <summary>
1906 ##      Domain allowed access.
1907 ##      </summary>
1908 ## </param>
1909 #
1910 interface(`userdom_relabelto_user_home_dirs',`
1911         gen_require(`
1912                 type user_home_dir_t;
1913         ')
1914
1915         allow $1 user_home_dir_t:dir relabelto;
1916 ')
1917
1918
1919 ########################################
1920 ## <summary>
1921 ##      Relabel to user home files.
1922 ## </summary>
1923 ## <param name="domain">
1924 ##      <summary>
1925 ##      Domain allowed access.
1926 ##      </summary>
1927 ## </param>
1928 #
1929 interface(`userdom_relabelto_user_home_files',`
1930         gen_require(`
1931                 type user_home_t;
1932         ')
1933
1934         allow $1 user_home_t:file relabelto;
1935 ')
1936 ########################################
1937 ## <summary>
1938 ##      Relabel user home files.
1939 ## </summary>
1940 ## <param name="domain">
1941 ##      <summary>
1942 ##      Domain allowed access.
1943 ##      </summary>
1944 ## </param>
1945 #
1946 interface(`userdom_relabel_user_home_files',`
1947         gen_require(`
1948                 type user_home_t;
1949         ')
1950
1951         allow $1 user_home_t:file relabel_file_perms;
1952 ')
1953
1954 ########################################
1955 ## <summary>
1956 ##      Create directories in the home dir root with
1957 ##      the user home directory type.
1958 ## </summary>
1959 ## <param name="domain">
1960 ##      <summary>
1961 ##      Domain allowed access.
1962 ##      </summary>
1963 ## </param>
1964 #
1965 interface(`userdom_home_filetrans_user_home_dir',`
1966         gen_require(`
1967                 type user_home_dir_t;
1968         ')
1969
1970         files_home_filetrans($1, user_home_dir_t, dir)
1971 ')
1972
1973 ########################################
1974 ## <summary>
1975 ##      Do a domain transition to the specified
1976 ##      domain when executing a program in the
1977 ##      user home directory.
1978 ## </summary>
1979 ## <desc>
1980 ##      <p>
1981 ##      Do a domain transition to the specified
1982 ##      domain when executing a program in the
1983 ##      user home directory.
1984 ##      </p>
1985 ##      <p>
1986 ##      No interprocess communication (signals, pipes,
1987 ##      etc.) is provided by this interface since
1988 ##      the domains are not owned by this module.
1989 ##      </p>
1990 ## </desc>
1991 ## <param name="source_domain">
1992 ##      <summary>
1993 ##      Domain allowed to transition.
1994 ##      </summary>
1995 ## </param>
1996 ## <param name="target_domain">
1997 ##      <summary>
1998 ##      Domain to transition to.
1999 ##      </summary>
2000 ## </param>
2001 #
2002 interface(`userdom_user_home_domtrans',`
2003         gen_require(`
2004                 type user_home_dir_t, user_home_t;
2005         ')
2006
2007         domain_auto_trans($1, user_home_t, $2)
2008         allow $1 user_home_dir_t:dir search_dir_perms;
2009         files_search_home($1)
2010 ')
2011
2012 ########################################
2013 ## <summary>
2014 ##      Do not audit attempts to search user home content directories.
2015 ## </summary>
2016 ## <param name="domain">
2017 ##      <summary>
2018 ##      Domain to not audit.
2019 ##      </summary>
2020 ## </param>
2021 #
2022 interface(`userdom_dontaudit_search_user_home_content',`
2023         gen_require(`
2024                 type user_home_t;
2025         ')
2026
2027         dontaudit $1 user_home_t:dir search_dir_perms;
2028         fs_dontaudit_list_nfs($1)
2029         fs_dontaudit_list_cifs($1)
2030 ')
2031
2032 ########################################
2033 ## <summary>
2034 ##      List contents of users home directory.
2035 ## </summary>
2036 ## <param name="domain">
2037 ##      <summary>
2038 ##      Domain allowed access.
2039 ##      </summary>
2040 ## </param>
2041 #
2042 interface(`userdom_list_user_home_content',`
2043         gen_require(`
2044                 type user_home_dir_t;
2045                 attribute user_home_type;
2046         ')
2047
2048         files_list_home($1)
2049         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2050 ')
2051
2052 ########################################
2053 ## <summary>
2054 ##      Create, read, write, and delete directories
2055 ##      in a user home subdirectory.
2056 ## </summary>
2057 ## <param name="domain">
2058 ##      <summary>
2059 ##      Domain allowed access.
2060 ##      </summary>
2061 ## </param>
2062 #
2063 interface(`userdom_manage_user_home_content_dirs',`
2064         gen_require(`
2065                 type user_home_dir_t, user_home_t;
2066         ')
2067
2068         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2069         files_search_home($1)
2070 ')
2071
2072 ########################################
2073 ## <summary>
2074 ##      Delete directories in a user home subdirectory.
2075 ## </summary>
2076 ## <param name="domain">
2077 ##      <summary>
2078 ##      Domain allowed access.
2079 ##      </summary>
2080 ## </param>
2081 #
2082 interface(`userdom_delete_user_home_content_dirs',`
2083         gen_require(`
2084                 type user_home_t;
2085         ')
2086
2087         allow $1 user_home_t:dir delete_dir_perms;
2088 ')
2089
2090 ########################################
2091 ## <summary>
2092 ##      Delete all directories in a user home subdirectory.
2093 ## </summary>
2094 ## <param name="domain">
2095 ##      <summary>
2096 ##      Domain allowed access.
2097 ##      </summary>
2098 ## </param>
2099 #
2100 interface(`userdom_delete_all_user_home_content_dirs',`
2101         gen_require(`
2102                 attribute user_home_type;
2103         ')
2104
2105         allow $1 user_home_type:dir delete_dir_perms;
2106 ')
2107
2108 ########################################
2109 ## <summary>
2110 ##      Set the attributes of user home files.
2111 ## </summary>
2112 ## <param name="domain">
2113 ##      <summary>
2114 ##      Domain allowed access.
2115 ##      </summary>
2116 ## </param>
2117 ## <rolecap/>
2118 #
2119 interface(`userdom_setattr_user_home_content_files',`
2120         gen_require(`
2121                 type user_home_t;
2122         ')
2123
2124         allow $1 user_home_t:file setattr;
2125 ')
2126
2127 ########################################
2128 ## <summary>
2129 ##      Do not audit attempts to set the
2130 ##      attributes of user home files.
2131 ## </summary>
2132 ## <param name="domain">
2133 ##      <summary>
2134 ##      Domain to not audit.
2135 ##      </summary>
2136 ## </param>
2137 #
2138 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2139         gen_require(`
2140                 type user_home_t;
2141         ')
2142
2143         dontaudit $1 user_home_t:file setattr_file_perms;
2144 ')
2145
2146 ########################################
2147 ## <summary>
2148 ##      Set the attributes of all user home directories.
2149 ## </summary>
2150 ## <param name="domain">
2151 ##      <summary>
2152 ##      Domain allowed access.
2153 ##      </summary>
2154 ## </param>
2155 ## <rolecap/>
2156 #
2157 interface(`userdom_setattr_all_user_home_content_dirs',`
2158         gen_require(`
2159                 attribute user_home_type;
2160         ')
2161
2162         allow $1 user_home_type:dir setattr_dir_perms;
2163 ')
2164
2165 ########################################
2166 ## <summary>
2167 ##      Mmap user home files.
2168 ## </summary>
2169 ## <param name="domain">
2170 ##      <summary>
2171 ##      Domain allowed access.
2172 ##      </summary>
2173 ## </param>
2174 #
2175 interface(`userdom_mmap_user_home_content_files',`
2176         gen_require(`
2177                 type user_home_dir_t, user_home_t;
2178         ')
2179
2180         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2181         files_search_home($1)
2182 ')
2183
2184 ########################################
2185 ## <summary>
2186 ##      Read user home files.
2187 ## </summary>
2188 ## <param name="domain">
2189 ##      <summary>
2190 ##      Domain allowed access.
2191 ##      </summary>
2192 ## </param>
2193 #
2194 interface(`userdom_read_user_home_content_files',`
2195         gen_require(`
2196                 type user_home_dir_t, user_home_t;
2197         ')
2198
2199         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2200         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2201         files_search_home($1)
2202 ')
2203
2204 ########################################
2205 ## <summary>
2206 ##      Do not audit attempts to getattr user home files.
2207 ## </summary>
2208 ## <param name="domain">
2209 ##      <summary>
2210 ##      Domain to not audit.
2211 ##      </summary>
2212 ## </param>
2213 #
2214 interface(`userdom_dontaudit_getattr_user_home_content',`
2215         gen_require(`
2216                 attribute user_home_type;
2217         ')
2218
2219         dontaudit $1 user_home_type:dir getattr;
2220         dontaudit $1 user_home_type:file getattr;
2221 ')
2222
2223 ########################################
2224 ## <summary>
2225 ##      Do not audit attempts to read user home files.
2226 ## </summary>
2227 ## <param name="domain">
2228 ##      <summary>
2229 ##      Domain to not audit.
2230 ##      </summary>
2231 ## </param>
2232 #
2233 interface(`userdom_dontaudit_read_user_home_content_files',`
2234         gen_require(`
2235                 attribute user_home_type;
2236                 type user_home_dir_t;
2237         ')
2238
2239         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2240         dontaudit $1 user_home_type:dir list_dir_perms;
2241         dontaudit $1 user_home_type:file read_file_perms;
2242         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2243 ')
2244
2245 ########################################
2246 ## <summary>
2247 ##      Do not audit attempts to append user home files.
2248 ## </summary>
2249 ## <param name="domain">
2250 ##      <summary>
2251 ##      Domain to not audit.
2252 ##      </summary>
2253 ## </param>
2254 #
2255 interface(`userdom_dontaudit_append_user_home_content_files',`
2256         gen_require(`
2257                 type user_home_t;
2258         ')
2259
2260         dontaudit $1 user_home_t:file append_file_perms;
2261 ')
2262
2263 ########################################
2264 ## <summary>
2265 ##      Do not audit attempts to write user home files.
2266 ## </summary>
2267 ## <param name="domain">
2268 ##      <summary>
2269 ##      Domain to not audit.
2270 ##      </summary>
2271 ## </param>
2272 #
2273 interface(`userdom_dontaudit_write_user_home_content_files',`
2274         gen_require(`
2275                 type user_home_t;
2276         ')
2277
2278         dontaudit $1 user_home_t:file write_file_perms;
2279 ')
2280
2281 ########################################
2282 ## <summary>
2283 ##      Delete files in a user home subdirectory.
2284 ## </summary>
2285 ## <param name="domain">
2286 ##      <summary>
2287 ##      Domain allowed access.
2288 ##      </summary>
2289 ## </param>
2290 #
2291 interface(`userdom_delete_user_home_content_files',`
2292         gen_require(`
2293                 type user_home_t;
2294         ')
2295
2296         allow $1 user_home_t:file delete_file_perms;
2297 ')
2298
2299 ########################################
2300 ## <summary>
2301 ##      Delete all files in a user home subdirectory.
2302 ## </summary>
2303 ## <param name="domain">
2304 ##      <summary>
2305 ##      Domain allowed access.
2306 ##      </summary>
2307 ## </param>
2308 #
2309 interface(`userdom_delete_all_user_home_content_files',`
2310         gen_require(`
2311                 attribute user_home_type;
2312         ')
2313
2314         allow $1 user_home_type:file delete_file_perms;
2315 ')
2316
2317 ########################################
2318 ## <summary>
2319 ##      Delete sock files in a user home subdirectory.
2320 ## </summary>
2321 ## <param name="domain">
2322 ##      <summary>
2323 ##      Domain allowed access.
2324 ##      </summary>
2325 ## </param>
2326 #
2327 interface(`userdom_delete_user_home_content_sock_files',`
2328         gen_require(`
2329                 type user_home_t;
2330         ')
2331
2332         allow $1 user_home_t:sock_file delete_file_perms;
2333 ')
2334
2335 ########################################
2336 ## <summary>
2337 ##      Delete all sock files in a user home subdirectory.
2338 ## </summary>
2339 ## <param name="domain">
2340 ##      <summary>
2341 ##      Domain allowed access.
2342 ##      </summary>
2343 ## </param>
2344 #
2345 interface(`userdom_delete_all_user_home_content_sock_files',`
2346         gen_require(`
2347                 attribute user_home_type;
2348         ')
2349
2350         allow $1 user_home_type:sock_file delete_file_perms;
2351 ')
2352
2353 ########################################
2354 ## <summary>
2355 ##      Do not audit attempts to write user home files.
2356 ## </summary>
2357 ## <param name="domain">
2358 ##      <summary>
2359 ##      Domain to not audit.
2360 ##      </summary>
2361 ## </param>
2362 #
2363 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2364         gen_require(`
2365                 type user_home_t;
2366         ')
2367
2368         dontaudit $1 user_home_t:file relabel_file_perms;
2369 ')
2370
2371 ########################################
2372 ## <summary>
2373 ##      Read user home subdirectory symbolic links.
2374 ## </summary>
2375 ## <param name="domain">
2376 ##      <summary>
2377 ##      Domain allowed access.
2378 ##      </summary>
2379 ## </param>
2380 #
2381 interface(`userdom_read_user_home_content_symlinks',`
2382         gen_require(`
2383                 type user_home_dir_t, user_home_t;
2384         ')
2385
2386         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2387 ')
2388
2389 ########################################
2390 ## <summary>
2391 ##      Execute user home files.
2392 ## </summary>
2393 ## <param name="domain">
2394 ##      <summary>
2395 ##      Domain allowed access.
2396 ##      </summary>
2397 ## </param>
2398 ## <rolecap/>
2399 #
2400 interface(`userdom_exec_user_home_content_files',`
2401         gen_require(`
2402                 type user_home_dir_t;
2403                 attribute user_home_type;
2404         ')
2405
2406         files_search_home($1)
2407         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2408         dontaudit $1 user_home_type:sock_file execute;
2409         ')
2410
2411 ########################################
2412 ## <summary>
2413 ##      Do not audit attempts to execute user home files.
2414 ## </summary>
2415 ## <param name="domain">
2416 ##      <summary>
2417 ##      Domain to not audit.
2418 ##      </summary>
2419 ## </param>
2420 #
2421 interface(`userdom_dontaudit_exec_user_home_content_files',`
2422         gen_require(`
2423                 type user_home_t;
2424         ')
2425
2426         dontaudit $1 user_home_t:file exec_file_perms;
2427 ')
2428
2429 ########################################
2430 ## <summary>
2431 ##      Create, read, write, and delete files
2432 ##      in a user home subdirectory.
2433 ## </summary>
2434 ## <param name="domain">
2435 ##      <summary>
2436 ##      Domain allowed access.
2437 ##      </summary>
2438 ## </param>
2439 #
2440 interface(`userdom_manage_user_home_content_files',`
2441         gen_require(`
2442                 type user_home_dir_t, user_home_t;
2443         ')
2444
2445         manage_files_pattern($1, user_home_t, user_home_t)
2446         allow $1 user_home_dir_t:dir search_dir_perms;
2447         files_search_home($1)
2448 ')
2449
2450 ########################################
2451 ## <summary>
2452 ##      Do not audit attempts to create, read, write, and delete directories
2453 ##      in a user home subdirectory.
2454 ## </summary>
2455 ## <param name="domain">
2456 ##      <summary>
2457 ##      Domain to not audit.
2458 ##      </summary>
2459 ## </param>
2460 #
2461 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2462         gen_require(`
2463                 type user_home_dir_t, user_home_t;
2464         ')
2465
2466         dontaudit $1 user_home_t:dir manage_dir_perms;
2467 ')
2468
2469 ########################################
2470 ## <summary>
2471 ##      Create, read, write, and delete symbolic links
2472 ##      in a user home subdirectory.
2473 ## </summary>
2474 ## <param name="domain">
2475 ##      <summary>
2476 ##      Domain allowed access.
2477 ##      </summary>
2478 ## </param>
2479 #
2480 interface(`userdom_manage_user_home_content_symlinks',`
2481         gen_require(`
2482                 type user_home_dir_t, user_home_t;
2483         ')
2484
2485         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2486         allow $1 user_home_dir_t:dir search_dir_perms;
2487         files_search_home($1)
2488 ')
2489
2490 ########################################
2491 ## <summary>
2492 ##      Delete symbolic links in a user home directory.
2493 ## </summary>
2494 ## <param name="domain">
2495 ##      <summary>
2496 ##      Domain allowed access.
2497 ##      </summary>
2498 ## </param>
2499 #
2500 interface(`userdom_delete_user_home_content_symlinks',`
2501         gen_require(`
2502                 type user_home_t;
2503         ')
2504
2505         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2506 ')
2507
2508 ########################################
2509 ## <summary>
2510 ##      Delete all symbolic links in a user home directory.
2511 ## </summary>
2512 ## <param name="domain">
2513 ##      <summary>
2514 ##      Domain allowed access.
2515 ##      </summary>
2516 ## </param>
2517 #
2518 interface(`userdom_delete_all_user_home_content_symlinks',`
2519         gen_require(`
2520                 attribute user_home_type;
2521         ')
2522
2523         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2524 ')
2525
2526 ########################################
2527 ## <summary>
2528 ##      Create, read, write, and delete named pipes
2529 ##      in a user home subdirectory.
2530 ## </summary>
2531 ## <param name="domain">
2532 ##      <summary>
2533 ##      Domain allowed access.
2534 ##      </summary>
2535 ## </param>
2536 #
2537 interface(`userdom_manage_user_home_content_pipes',`
2538         gen_require(`
2539                 type user_home_dir_t, user_home_t;
2540         ')
2541
2542         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2543         allow $1 user_home_dir_t:dir search_dir_perms;
2544         files_search_home($1)
2545 ')
2546
2547 ########################################
2548 ## <summary>
2549 ##      Create, read, write, and delete named sockets
2550 ##      in a user home subdirectory.
2551 ## </summary>
2552 ## <param name="domain">
2553 ##      <summary>
2554 ##      Domain allowed access.
2555 ##      </summary>
2556 ## </param>
2557 #
2558 interface(`userdom_manage_user_home_content_sockets',`
2559         gen_require(`
2560                 type user_home_dir_t, user_home_t;
2561         ')
2562
2563         allow $1 user_home_dir_t:dir search_dir_perms;
2564         manage_sock_files_pattern($1, user_home_t, user_home_t)
2565         files_search_home($1)
2566 ')
2567
2568 ########################################
2569 ## <summary>
2570 ##      Create objects in a user home directory
2571 ##      with an automatic type transition to
2572 ##      a specified private type.
2573 ## </summary>
2574 ## <param name="domain">
2575 ##      <summary>
2576 ##      Domain allowed access.
2577 ##      </summary>
2578 ## </param>
2579 ## <param name="private_type">
2580 ##      <summary>
2581 ##      The type of the object to create.
2582 ##      </summary>
2583 ## </param>
2584 ## <param name="object_class">
2585 ##      <summary>
2586 ##      The class of the object to be created.
2587 ##      </summary>
2588 ## </param>
2589 #
2590 interface(`userdom_user_home_dir_filetrans',`
2591         gen_require(`
2592                 type user_home_dir_t;
2593         ')
2594
2595         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2596         files_search_home($1)
2597 ')
2598
2599 ########################################
2600 ## <summary>
2601 ##      Create objects in a user home directory
2602 ##      with an automatic type transition to
2603 ##      a specified private type.
2604 ## </summary>
2605 ## <param name="domain">
2606 ##      <summary>
2607 ##      Domain allowed access.
2608 ##      </summary>
2609 ## </param>
2610 ## <param name="private_type">
2611 ##      <summary>
2612 ##      The type of the object to create.
2613 ##      </summary>
2614 ## </param>
2615 ## <param name="object_class">
2616 ##      <summary>
2617 ##      The class of the object to be created.
2618 ##      </summary>
2619 ## </param>
2620 #
2621 interface(`userdom_user_home_content_filetrans',`
2622         gen_require(`
2623                 type user_home_dir_t, user_home_t;
2624         ')
2625
2626         filetrans_pattern($1, user_home_t, $2, $3, $4)
2627         allow $1 user_home_dir_t:dir search_dir_perms;
2628         files_search_home($1)
2629 ')
2630
2631 ########################################
2632 ## <summary>
2633 ##      Create objects in a user home directory
2634 ##      with an automatic type transition to
2635 ##      the user home file type.
2636 ## </summary>
2637 ## <param name="domain">
2638 ##      <summary>
2639 ##      Domain allowed access.
2640 ##      </summary>
2641 ## </param>
2642 ## <param name="object_class">
2643 ##      <summary>
2644 ##      The class of the object to be created.
2645 ##      </summary>
2646 ## </param>
2647 #
2648 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2649         gen_require(`
2650                 type user_home_dir_t, user_home_t;
2651         ')
2652
2653         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2654         files_search_home($1)
2655 ')
2656
2657 ########################################
2658 ## <summary>
2659 ##      Write to user temporary named sockets.
2660 ## </summary>
2661 ## <param name="domain">
2662 ##      <summary>
2663 ##      Domain allowed access.
2664 ##      </summary>
2665 ## </param>
2666 #
2667 interface(`userdom_write_user_tmp_sockets',`
2668         gen_require(`
2669                 type user_tmp_t;
2670         ')
2671
2672         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2673         files_search_tmp($1)
2674 ')
2675
2676 ########################################
2677 ## <summary>
2678 ##      List user temporary directories.
2679 ## </summary>
2680 ## <param name="domain">
2681 ##      <summary>
2682 ##      Domain allowed access.
2683 ##      </summary>
2684 ## </param>
2685 #
2686 interface(`userdom_list_user_tmp',`
2687         gen_require(`
2688                 type user_tmp_t;
2689         ')
2690
2691         allow $1 user_tmp_t:dir list_dir_perms;
2692         files_search_tmp($1)
2693 ')
2694
2695 ########################################
2696 ## <summary>
2697 ##      Do not audit attempts to list user
2698 ##      temporary directories.
2699 ## </summary>
2700 ## <param name="domain">
2701 ##      <summary>
2702 ##      Domain to not audit.
2703 ##      </summary>
2704 ## </param>
2705 #
2706 interface(`userdom_dontaudit_list_user_tmp',`
2707         gen_require(`
2708                 type user_tmp_t;
2709         ')
2710
2711         dontaudit $1 user_tmp_t:dir list_dir_perms;
2712 ')
2713
2714 ########################################
2715 ## <summary>
2716 ##      Do not audit attempts to manage users
2717 ##      temporary directories.
2718 ## </summary>
2719 ## <param name="domain">
2720 ##      <summary>
2721 ##      Domain to not audit.
2722 ##      </summary>
2723 ## </param>
2724 #
2725 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2726         gen_require(`
2727                 type user_tmp_t;
2728         ')
2729
2730         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2731 ')
2732
2733 ########################################
2734 ## <summary>
2735 ##      Read user temporary files.
2736 ## </summary>
2737 ## <param name="domain">
2738 ##      <summary>
2739 ##      Domain allowed access.
2740 ##      </summary>
2741 ## </param>
2742 #
2743 interface(`userdom_read_user_tmp_files',`
2744         gen_require(`
2745                 type user_tmp_t;
2746         ')
2747
2748         read_files_pattern($1, user_tmp_t, user_tmp_t)
2749         allow $1 user_tmp_t:dir list_dir_perms;
2750         files_search_tmp($1)
2751 ')
2752
2753 ########################################
2754 ## <summary>
2755 ##      Do not audit attempts to read users
2756 ##      temporary files.
2757 ## </summary>
2758 ## <param name="domain">
2759 ##      <summary>
2760 ##      Domain to not audit.
2761 ##      </summary>
2762 ## </param>
2763 #
2764 interface(`userdom_dontaudit_read_user_tmp_files',`
2765         gen_require(`
2766                 type user_tmp_t;
2767         ')
2768
2769         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2770 ')
2771
2772 ########################################
2773 ## <summary>
2774 ##      Do not audit attempts to append users
2775 ##      temporary files.
2776 ## </summary>
2777 ## <param name="domain">
2778 ##      <summary>
2779 ##      Domain to not audit.
2780 ##      </summary>
2781 ## </param>
2782 #
2783 interface(`userdom_dontaudit_append_user_tmp_files',`
2784         gen_require(`
2785                 type user_tmp_t;
2786         ')
2787
2788         dontaudit $1 user_tmp_t:file append_file_perms;
2789 ')
2790
2791 ########################################
2792 ## <summary>
2793 ##      Read and write user temporary files.
2794 ## </summary>
2795 ## <param name="domain">
2796 ##      <summary>
2797 ##      Domain allowed access.
2798 ##      </summary>
2799 ## </param>
2800 #
2801 interface(`userdom_rw_user_tmp_files',`
2802         gen_require(`
2803                 type user_tmp_t;
2804         ')
2805
2806         allow $1 user_tmp_t:dir list_dir_perms;
2807         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2808         files_search_tmp($1)
2809 ')
2810
2811 ########################################
2812 ## <summary>
2813 ##      Do not audit attempts to manage users
2814 ##      temporary files.
2815 ## </summary>
2816 ## <param name="domain">
2817 ##      <summary>
2818 ##      Domain to not audit.
2819 ##      </summary>
2820 ## </param>
2821 #
2822 interface(`userdom_dontaudit_manage_user_tmp_files',`
2823         gen_require(`
2824                 type user_tmp_t;
2825         ')
2826
2827         dontaudit $1 user_tmp_t:file manage_file_perms;
2828 ')
2829
2830 ########################################
2831 ## <summary>
2832 ##      Read user temporary symbolic links.
2833 ## </summary>
2834 ## <param name="domain">
2835 ##      <summary>
2836 ##      Domain allowed access.
2837 ##      </summary>
2838 ## </param>
2839 #
2840 interface(`userdom_read_user_tmp_symlinks',`
2841         gen_require(`
2842                 type user_tmp_t;
2843         ')
2844
2845         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2846         allow $1 user_tmp_t:dir list_dir_perms;
2847         files_search_tmp($1)
2848 ')
2849
2850 ########################################
2851 ## <summary>
2852 ##      Create, read, write, and delete user
2853 ##      temporary directories.
2854 ## </summary>
2855 ## <param name="domain">
2856 ##      <summary>
2857 ##      Domain allowed access.
2858 ##      </summary>
2859 ## </param>
2860 #
2861 interface(`userdom_manage_user_tmp_dirs',`
2862         gen_require(`
2863                 type user_tmp_t;
2864         ')
2865
2866         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2867         files_search_tmp($1)
2868 ')
2869
2870 ########################################
2871 ## <summary>
2872 ##      Create, read, write, and delete user
2873 ##      temporary files.
2874 ## </summary>
2875 ## <param name="domain">
2876 ##      <summary>
2877 ##      Domain allowed access.
2878 ##      </summary>
2879 ## </param>
2880 #
2881 interface(`userdom_manage_user_tmp_files',`
2882         gen_require(`
2883                 type user_tmp_t;
2884         ')
2885
2886         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2887         files_search_tmp($1)
2888 ')
2889
2890 ########################################
2891 ## <summary>
2892 ##      Create, read, write, and delete user
2893 ##      temporary symbolic links.
2894 ## </summary>
2895 ## <param name="domain">
2896 ##      <summary>
2897 ##      Domain allowed access.
2898 ##      </summary>
2899 ## </param>
2900 #
2901 interface(`userdom_manage_user_tmp_symlinks',`
2902         gen_require(`
2903                 type user_tmp_t;
2904         ')
2905
2906         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2907         files_search_tmp($1)
2908 ')
2909
2910 ########################################
2911 ## <summary>
2912 ##      Create, read, write, and delete user
2913 ##      temporary named pipes.
2914 ## </summary>
2915 ## <param name="domain">
2916 ##      <summary>
2917 ##      Domain allowed access.
2918 ##      </summary>
2919 ## </param>
2920 #
2921 interface(`userdom_manage_user_tmp_pipes',`
2922         gen_require(`
2923                 type user_tmp_t;
2924         ')
2925
2926         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2927         files_search_tmp($1)
2928 ')
2929
2930 ########################################
2931 ## <summary>
2932 ##      Create, read, write, and delete user
2933 ##      temporary named sockets.
2934 ## </summary>
2935 ## <param name="domain">
2936 ##      <summary>
2937 ##      Domain allowed access.
2938 ##      </summary>
2939 ## </param>
2940 #
2941 interface(`userdom_manage_user_tmp_sockets',`
2942         gen_require(`
2943                 type user_tmp_t;
2944         ')
2945
2946         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2947         files_search_tmp($1)
2948 ')
2949
2950 ########################################
2951 ## <summary>
2952 ##      Create objects in a user temporary directory
2953 ##      with an automatic type transition to
2954 ##      a specified private type.
2955 ## </summary>
2956 ## <param name="domain">
2957 ##      <summary>
2958 ##      Domain allowed access.
2959 ##      </summary>
2960 ## </param>
2961 ## <param name="private_type">
2962 ##      <summary>
2963 ##      The type of the object to create.
2964 ##      </summary>
2965 ## </param>
2966 ## <param name="object_class">
2967 ##      <summary>
2968 ##      The class of the object to be created.
2969 ##      </summary>
2970 ## </param>
2971 #
2972 interface(`userdom_user_tmp_filetrans',`
2973         gen_require(`
2974                 type user_tmp_t;
2975         ')
2976
2977         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2978         files_search_tmp($1)
2979 ')
2980
2981 ########################################
2982 ## <summary>
2983 ##      Create objects in the temporary directory
2984 ##      with an automatic type transition to
2985 ##      the user temporary type.
2986 ## </summary>
2987 ## <param name="domain">
2988 ##      <summary>
2989 ##      Domain allowed access.
2990 ##      </summary>
2991 ## </param>
2992 ## <param name="object_class">
2993 ##      <summary>
2994 ##      The class of the object to be created.
2995 ##      </summary>
2996 ## </param>
2997 #
2998 interface(`userdom_tmp_filetrans_user_tmp',`
2999         gen_require(`
3000                 type user_tmp_t;
3001         ')
3002
3003         files_tmp_filetrans($1, user_tmp_t, $2)
3004 ')
3005
3006 ########################################
3007 ## <summary>
3008 ##      Read user tmpfs files.
3009 ## </summary>
3010 ## <param name="domain">
3011 ##      <summary>
3012 ##      Domain allowed access.
3013 ##      </summary>
3014 ## </param>
3015 #
3016 interface(`userdom_read_user_tmpfs_files',`
3017         gen_require(`
3018                 type user_tmpfs_t;
3019         ')
3020
3021         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3022         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3023         allow $1 user_tmpfs_t:dir list_dir_perms;
3024         fs_search_tmpfs($1)
3025 ')
3026
3027 ########################################
3028 ## <summary>
3029 ##      Read/Write user tmpfs files.
3030 ## </summary>
3031 ## <param name="domain">
3032 ##      <summary>
3033 ##      Domain allowed access.
3034 ##      </summary>
3035 ## </param>
3036 #
3037 interface(`userdom_rw_user_tmpfs_files',`
3038         gen_require(`
3039                 type user_tmpfs_t;
3040         ')
3041
3042         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3043         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3044         allow $1 user_tmpfs_t:dir list_dir_perms;
3045         fs_search_tmpfs($1)
3046 ')
3047
3048 ########################################
3049 ## <summary>
3050 ##      Get the attributes of a user domain tty.
3051 ## </summary>
3052 ## <param name="domain">
3053 ##      <summary>
3054 ##      Domain allowed access.
3055 ##      </summary>
3056 ## </param>
3057 #
3058 interface(`userdom_getattr_user_ttys',`
3059         gen_require(`
3060                 type user_tty_device_t;
3061         ')
3062
3063         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3064 ')
3065
3066 ########################################
3067 ## <summary>
3068 ##      Do not audit attempts to get the attributes of a user domain tty.
3069 ## </summary>
3070 ## <param name="domain">
3071 ##      <summary>
3072 ##      Domain to not audit.
3073 ##      </summary>
3074 ## </param>
3075 #
3076 interface(`userdom_dontaudit_getattr_user_ttys',`
3077         gen_require(`
3078                 type user_tty_device_t;
3079         ')
3080
3081         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3082 ')
3083
3084 ########################################
3085 ## <summary>
3086 ##      Set the attributes of a user domain tty.
3087 ## </summary>
3088 ## <param name="domain">
3089 ##      <summary>
3090 ##      Domain allowed access.
3091 ##      </summary>
3092 ## </param>
3093 #
3094 interface(`userdom_setattr_user_ttys',`
3095         gen_require(`
3096                 type user_tty_device_t;
3097         ')
3098
3099         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3100 ')
3101
3102 ########################################
3103 ## <summary>
3104 ##      Do not audit attempts to set the attributes of a user domain tty.
3105 ## </summary>
3106 ## <param name="domain">
3107 ##      <summary>
3108 ##      Domain to not audit.
3109 ##      </summary>
3110 ## </param>
3111 #
3112 interface(`userdom_dontaudit_setattr_user_ttys',`
3113         gen_require(`
3114                 type user_tty_device_t;
3115         ')
3116
3117         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3118 ')
3119
3120 ########################################
3121 ## <summary>
3122 ##      Read and write a user domain tty.
3123 ## </summary>
3124 ## <param name="domain">
3125 ##      <summary>
3126 ##      Domain allowed access.
3127 ##      </summary>
3128 ## </param>
3129 #
3130 interface(`userdom_use_user_ttys',`
3131         gen_require(`
3132                 type user_tty_device_t;
3133         ')
3134
3135         allow $1 user_tty_device_t:chr_file rw_term_perms;
3136 ')
3137
3138 ########################################
3139 ## <summary>
3140 ##      Read and write a inherited user domain tty.
3141 ## </summary>
3142 ## <param name="domain">
3143 ##      <summary>
3144 ##      Domain allowed access.
3145 ##      </summary>
3146 ## </param>
3147 #
3148 interface(`userdom_use_inherited_user_ttys',`
3149         gen_require(`
3150                 type user_tty_device_t;
3151         ')
3152
3153         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3154 ')
3155
3156 ########################################
3157 ## <summary>
3158 ##      Read and write a user domain pty.
3159 ## </summary>
3160 ## <param name="domain">
3161 ##      <summary>
3162 ##      Domain allowed access.
3163 ##      </summary>
3164 ## </param>
3165 #
3166 interface(`userdom_use_user_ptys',`
3167         gen_require(`
3168                 type user_devpts_t;
3169         ')
3170
3171         allow $1 user_devpts_t:chr_file rw_term_perms;
3172 ')
3173
3174 ########################################
3175 ## <summary>
3176 ##      Read and write a inherited user domain pty.
3177 ## </summary>
3178 ## <param name="domain">
3179 ##      <summary>
3180 ##      Domain allowed access.
3181 ##      </summary>
3182 ## </param>
3183 #
3184 interface(`userdom_use_inherited_user_ptys',`
3185         gen_require(`
3186                 type user_devpts_t;
3187         ')
3188
3189         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3190 ')
3191
3192 ########################################
3193 ## <summary>
3194 ##      Read and write a inherited user TTYs and PTYs.
3195 ## </summary>
3196 ## <desc>
3197 ##      <p>
3198 ##      Allow the specified domain to read and write inherited user
3199 ##      TTYs and PTYs. This will allow the domain to
3200 ##      interact with the user via the terminal. Typically
3201 ##      all interactive applications will require this
3202 ##      access.
3203 ##      </p>
3204 ## </desc>
3205 ## <param name="domain">
3206 ##      <summary>
3207 ##      Domain allowed access.
3208 ##      </summary>
3209 ## </param>
3210 ## <infoflow type="both" weight="10"/>
3211 #
3212 interface(`userdom_use_inherited_user_terminals',`
3213         gen_require(`
3214                 type user_tty_device_t, user_devpts_t;
3215         ')
3216
3217         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3218         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3219 ')
3220
3221 #######################################
3222 ## <summary>
3223 ##  Allow attempts to read and write
3224 ##  a user domain tty and pty.
3225 ## </summary>
3226 ## <param name="domain">
3227 ##  <summary>
3228 ##  Domain to not audit.
3229 ##  </summary>
3230 ## </param>
3231 #
3232 interface(`userdom_use_user_terminals',`
3233     gen_require(`
3234         type user_tty_device_t, user_devpts_t;
3235     ')
3236
3237     allow $1 user_tty_device_t:chr_file rw_term_perms;
3238     allow $1 user_devpts_t:chr_file rw_term_perms;
3239 ')
3240
3241 ########################################
3242 ## <summary>
3243 ##      Do not audit attempts to read and write
3244 ##      a user domain tty and pty.
3245 ## </summary>
3246 ## <param name="domain">
3247 ##      <summary>
3248 ##      Domain to not audit.
3249 ##      </summary>
3250 ## </param>
3251 #
3252 interface(`userdom_dontaudit_use_user_terminals',`
3253         gen_require(`
3254                 type user_tty_device_t, user_devpts_t;
3255         ')
3256
3257         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3258         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3259 ')
3260
3261
3262 ########################################
3263 ## <summary>
3264 ##      Get attributes of user domain tty and pty.
3265 ## </summary>
3266 ## <param name="domain">
3267 ##      <summary>
3268 ##      Domain allowed access.
3269 ##      </summary>
3270 ## </param>
3271 #
3272 interface(`userdom_getattr_user_terminals',`
3273         gen_require(`
3274                 type user_tty_device_t, user_devpts_t;
3275         ')
3276
3277         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3278 ')
3279
3280 ########################################
3281 ## <summary>
3282 ##      Execute a shell in all user domains.  This
3283 ##      is an explicit transition, requiring the
3284 ##      caller to use setexeccon().
3285 ## </summary>
3286 ## <param name="domain">
3287 ##      <summary>
3288 ##      Domain allowed to transition.
3289 ##      </summary>
3290 ## </param>
3291 #
3292 interface(`userdom_spec_domtrans_all_users',`
3293         gen_require(`
3294                 attribute userdomain;
3295         ')
3296
3297         corecmd_shell_spec_domtrans($1, userdomain)
3298         allow userdomain $1:fd use;
3299         allow userdomain $1:fifo_file rw_file_perms;
3300         allow userdomain $1:process sigchld;
3301 ')
3302
3303 ########################################
3304 ## <summary>
3305 ##      Execute an Xserver session in all unprivileged user domains.  This
3306 ##      is an explicit transition, requiring the
3307 ##      caller to use setexeccon().
3308 ## </summary>
3309 ## <param name="domain">
3310 ##      <summary>
3311 ##      Domain allowed to transition.
3312 ##      </summary>
3313 ## </param>
3314 #
3315 interface(`userdom_xsession_spec_domtrans_all_users',`
3316         gen_require(`
3317                 attribute userdomain;
3318         ')
3319
3320         xserver_xsession_spec_domtrans($1, userdomain)
3321         allow userdomain $1:fd use;
3322         allow userdomain $1:fifo_file rw_file_perms;
3323         allow userdomain $1:process sigchld;
3324 ')
3325
3326 ########################################
3327 ## <summary>
3328 ##      Execute a shell in all unprivileged user domains.  This
3329 ##      is an explicit transition, requiring the
3330 ##      caller to use setexeccon().
3331 ## </summary>
3332 ## <param name="domain">
3333 ##      <summary>
3334 ##      Domain allowed to transition.
3335 ##      </summary>
3336 ## </param>
3337 #
3338 interface(`userdom_spec_domtrans_unpriv_users',`
3339         gen_require(`
3340                 attribute unpriv_userdomain;
3341         ')
3342
3343         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3344         allow unpriv_userdomain $1:fd use;
3345         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3346         allow unpriv_userdomain $1:process sigchld;
3347 ')
3348
3349 #####################################
3350 ## <summary>
3351 ##  Allow domain dyntrans to unpriv userdomain.
3352 ## </summary>
3353 ## <param name="domain">
3354 ##  <summary>
3355 ##  Domain allowed access.
3356 ##  </summary>
3357 ## </param>
3358 #
3359 interface(`userdom_dyntransition_unpriv_users',`
3360     gen_require(`
3361         attribute unpriv_userdomain;
3362     ')
3363
3364     allow $1 unpriv_userdomain:process dyntransition;
3365 ')
3366
3367 ########################################
3368 ## <summary>
3369 ##      Execute an Xserver session in all unprivileged user domains.  This
3370 ##      is an explicit transition, requiring the
3371 ##      caller to use setexeccon().
3372 ## </summary>
3373 ## <param name="domain">
3374 ##      <summary>
3375 ##      Domain allowed to transition.
3376 ##      </summary>
3377 ## </param>
3378 #
3379 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3380         gen_require(`
3381                 attribute unpriv_userdomain;
3382         ')
3383
3384         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3385         allow unpriv_userdomain $1:fd use;
3386         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3387         allow unpriv_userdomain $1:process sigchld;
3388 ')
3389
3390 ########################################
3391 ## <summary>
3392 ##      Manage unpriviledged user SysV sempaphores.
3393 ## </summary>
3394 ## <param name="domain">
3395 ##      <summary>
3396 ##      Domain allowed access.
3397 ##      </summary>
3398 ## </param>
3399 #
3400 interface(`userdom_manage_unpriv_user_semaphores',`
3401         gen_require(`
3402                 attribute unpriv_userdomain;
3403         ')
3404
3405         allow $1 unpriv_userdomain:sem create_sem_perms;
3406 ')
3407
3408 ########################################
3409 ## <summary>
3410 ##      Manage unpriviledged user SysV shared
3411 ##      memory segments.
3412 ## </summary>
3413 ## <param name="domain">
3414 ##      <summary>
3415 ##      Domain allowed access.
3416 ##      </summary>
3417 ## </param>
3418 #
3419 interface(`userdom_manage_unpriv_user_shared_mem',`
3420         gen_require(`
3421                 attribute unpriv_userdomain;
3422         ')
3423
3424         allow $1 unpriv_userdomain:shm create_shm_perms;
3425 ')
3426
3427 ########################################
3428 ## <summary>
3429 ##      Execute bin_t in the unprivileged user domains. This
3430 ##      is an explicit transition, requiring the
3431 ##      caller to use setexeccon().
3432 ## </summary>
3433 ## <param name="domain">
3434 ##      <summary>
3435 ##      Domain allowed to transition.
3436 ##      </summary>
3437 ## </param>
3438 #
3439 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3440         gen_require(`
3441                 attribute unpriv_userdomain;
3442         ')
3443
3444         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3445         allow unpriv_userdomain $1:fd use;
3446         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3447         allow unpriv_userdomain $1:process sigchld;
3448 ')
3449
3450 ########################################
3451 ## <summary>
3452 ##      Execute all entrypoint files in unprivileged user
3453 ##      domains. This is an explicit transition, requiring the
3454 ##      caller to use setexeccon().
3455 ## </summary>
3456 ## <param name="domain">
3457 ##      <summary>
3458 ##      Domain allowed access.
3459 ##      </summary>
3460 ## </param>
3461 #
3462 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3463         gen_require(`
3464                 attribute unpriv_userdomain;
3465         ')
3466
3467         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3468         allow unpriv_userdomain $1:fd use;
3469         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3470         allow unpriv_userdomain $1:process sigchld;
3471 ')
3472
3473 ########################################
3474 ## <summary>
3475 ##      Search users home directories.
3476 ## </summary>
3477 ## <param name="domain">
3478 ##      <summary>
3479 ##      Domain allowed access.
3480 ##      </summary>
3481 ## </param>
3482 #
3483 interface(`userdom_search_user_home_content',`
3484         gen_require(`
3485                 type user_home_dir_t;
3486                 attribute user_home_type;
3487         ')
3488
3489         files_list_home($1)
3490         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3491         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3492 ')
3493
3494 ########################################
3495 ## <summary>
3496 ##      Send general signals to unprivileged user domains.
3497 ## </summary>
3498 ## <param name="domain">
3499 ##      <summary>
3500 ##      Domain allowed access.
3501 ##      </summary>
3502 ## </param>
3503 #
3504 interface(`userdom_signal_unpriv_users',`
3505         gen_require(`
3506                 attribute unpriv_userdomain;
3507         ')
3508
3509         allow $1 unpriv_userdomain:process signal;
3510 ')
3511
3512 ########################################
3513 ## <summary>
3514 ##      Inherit the file descriptors from unprivileged user domains.
3515 ## </summary>
3516 ## <param name="domain">
3517 ##      <summary>
3518 ##      Domain allowed access.
3519 ##      </summary>
3520 ## </param>
3521 #
3522 interface(`userdom_use_unpriv_users_fds',`
3523         gen_require(`
3524                 attribute unpriv_userdomain;
3525         ')
3526
3527         allow $1 unpriv_userdomain:fd use;
3528 ')
3529
3530 ########################################
3531 ## <summary>
3532 ##      Do not audit attempts to inherit the file descriptors
3533 ##      from unprivileged user domains.
3534 ## </summary>
3535 ## <desc>
3536 ##      <p>
3537 ##      Do not audit attempts to inherit the file descriptors
3538 ##      from unprivileged user domains. This will supress
3539 ##      SELinux denial messages when the specified domain is denied
3540 ##      the permission to inherit these file descriptors.
3541 ##      </p>
3542 ## </desc>
3543 ## <param name="domain">
3544 ##      <summary>
3545 ##      Domain to not audit.
3546 ##      </summary>
3547 ## </param>
3548 ## <infoflow type="none"/>
3549 #
3550 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3551         gen_require(`
3552                 attribute unpriv_userdomain;
3553         ')
3554
3555         dontaudit $1 unpriv_userdomain:fd use;
3556 ')
3557
3558 ########################################
3559 ## <summary>
3560 ##      Do not audit attempts to use user ptys.
3561 ## </summary>
3562 ## <param name="domain">
3563 ##      <summary>
3564 ##      Domain to not audit.
3565 ##      </summary>
3566 ## </param>
3567 #
3568 interface(`userdom_dontaudit_use_user_ptys',`
3569         gen_require(`
3570                 type user_devpts_t;
3571         ')
3572
3573         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3574 ')
3575
3576 ########################################
3577 ## <summary>
3578 ##      Relabel files to unprivileged user pty types.
3579 ## </summary>
3580 ## <param name="domain">
3581 ##      <summary>
3582 ##      Domain allowed access.
3583 ##      </summary>
3584 ## </param>
3585 #
3586 interface(`userdom_relabelto_user_ptys',`
3587         gen_require(`
3588                 type user_devpts_t;
3589         ')
3590
3591         allow $1 user_devpts_t:chr_file relabelto;
3592 ')
3593
3594 ########################################
3595 ## <summary>
3596 ##      Do not audit attempts to relabel files from
3597 ##      user pty types.
3598 ## </summary>
3599 ## <param name="domain">
3600 ##      <summary>
3601 ##      Domain to not audit.
3602 ##      </summary>
3603 ## </param>
3604 #
3605 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3606         gen_require(`
3607                 type user_devpts_t;
3608         ')
3609
3610         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3611 ')
3612
3613 ########################################
3614 ## <summary>
3615 ##      Write all users files in /tmp
3616 ## </summary>
3617 ## <param name="domain">
3618 ##      <summary>
3619 ##      Domain allowed access.
3620 ##      </summary>
3621 ## </param>
3622 #
3623 interface(`userdom_write_user_tmp_files',`
3624         gen_require(`
3625                 type user_tmp_t;
3626         ')
3627
3628         write_files_pattern($1, user_tmp_t, user_tmp_t)
3629 ')
3630
3631 ########################################
3632 ## <summary>
3633 ##      Do not audit attempts to write users
3634 ##      temporary files.
3635 ## </summary>
3636 ## <param name="domain">
3637 ##      <summary>
3638 ##      Domain to not audit.
3639 ##      </summary>
3640 ## </param>
3641 #
3642 interface(`userdom_dontaudit_write_user_tmp_files',`
3643         gen_require(`
3644                 type user_tmp_t;
3645         ')
3646
3647         dontaudit $1 user_tmp_t:file write;
3648 ')
3649
3650 ########################################
3651 ## <summary>
3652 ##      Do not audit attempts to read/write users
3653 ##      temporary fifo files.
3654 ## </summary>
3655 ## <param name="domain">
3656 ##      <summary>
3657 ##      Domain to not audit.
3658 ##      </summary>
3659 ## </param>
3660 #
3661 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3662         gen_require(`
3663                 type user_tmp_t;
3664         ')
3665
3666         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3667 ')
3668
3669 ########################################
3670 ## <summary>
3671 ##      Do not audit attempts to use user ttys.
3672 ## </summary>
3673 ## <param name="domain">
3674 ##      <summary>
3675 ##      Domain to not audit.
3676 ##      </summary>
3677 ## </param>
3678 #
3679 interface(`userdom_dontaudit_use_user_ttys',`
3680         gen_require(`
3681                 type user_tty_device_t;
3682         ')
3683
3684         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3685 ')
3686
3687 ########################################
3688 ## <summary>
3689 ##      Read the process state of all user domains.
3690 ## </summary>
3691 ## <param name="domain">
3692 ##      <summary>
3693 ##      Domain allowed access.
3694 ##      </summary>
3695 ## </param>
3696 #
3697 interface(`userdom_read_all_users_state',`
3698         gen_require(`
3699                 attribute userdomain;
3700         ')
3701
3702         read_files_pattern($1, userdomain, userdomain)
3703         read_lnk_files_pattern($1,userdomain,userdomain)
3704         kernel_search_proc($1)
3705 ')
3706
3707 ########################################
3708 ## <summary>
3709 ##      Get the attributes of all user domains.
3710 ## </summary>
3711 ## <param name="domain">
3712 ##      <summary>
3713 ##      Domain allowed access.
3714 ##      </summary>
3715 ## </param>
3716 #
3717 interface(`userdom_getattr_all_users',`
3718         gen_require(`
3719                 attribute userdomain;
3720         ')
3721
3722         allow $1 userdomain:process getattr;
3723 ')
3724
3725 ########################################
3726 ## <summary>
3727 ##      Inherit the file descriptors from all user domains
3728 ## </summary>
3729 ## <param name="domain">
3730 ##      <summary>
3731 ##      Domain allowed access.
3732 ##      </summary>
3733 ## </param>
3734 #
3735 interface(`userdom_use_all_users_fds',`
3736         gen_require(`
3737                 attribute userdomain;
3738         ')
3739
3740         allow $1 userdomain:fd use;
3741 ')
3742
3743 ########################################
3744 ## <summary>
3745 ##      Do not audit attempts to inherit the file
3746 ##      descriptors from any user domains.
3747 ## </summary>
3748 ## <param name="domain">
3749 ##      <summary>
3750 ##      Domain to not audit.
3751 ##      </summary>
3752 ## </param>
3753 #
3754 interface(`userdom_dontaudit_use_all_users_fds',`
3755         gen_require(`
3756                 attribute userdomain;
3757         ')
3758
3759         dontaudit $1 userdomain:fd use;
3760 ')
3761
3762 ########################################
3763 ## <summary>
3764 ##      Send general signals to all user domains.
3765 ## </summary>
3766 ## <param name="domain">
3767 ##      <summary>
3768 ##      Domain allowed access.
3769 ##      </summary>
3770 ## </param>
3771 #
3772 interface(`userdom_signal_all_users',`
3773         gen_require(`
3774                 attribute userdomain;
3775         ')
3776
3777         allow $1 userdomain:process signal;
3778 ')
3779
3780 ########################################
3781 ## <summary>
3782 ##      Send kill signals to all user domains.
3783 ## </summary>
3784 ## <param name="domain">
3785 ##      <summary>
3786 ##      Domain allowed access.
3787 ##      </summary>
3788 ## </param>
3789 #
3790 interface(`userdom_kill_all_users',`
3791         gen_require(`
3792                 attribute userdomain;
3793         ')
3794
3795         allow $1 userdomain:process sigkill;
3796 ')
3797
3798 ########################################
3799 ## <summary>
3800 ##      Send a SIGCHLD signal to all user domains.
3801 ## </summary>
3802 ## <param name="domain">
3803 ##      <summary>
3804 ##      Domain allowed access.
3805 ##      </summary>
3806 ## </param>
3807 #
3808 interface(`userdom_sigchld_all_users',`
3809         gen_require(`
3810                 attribute userdomain;
3811         ')
3812
3813         allow $1 userdomain:process sigchld;
3814 ')
3815
3816 ########################################
3817 ## <summary>
3818 ##      Read keys for all user domains.
3819 ## </summary>
3820 ## <param name="domain">
3821 ##      <summary>
3822 ##      Domain allowed access.
3823 ##      </summary>
3824 ## </param>
3825 #
3826 interface(`userdom_read_all_users_keys',`
3827         gen_require(`
3828                 attribute userdomain;
3829         ')
3830
3831         allow $1 userdomain:key read;
3832 ')
3833
3834 ########################################
3835 ## <summary>
3836 ##      Create keys for all user domains.
3837 ## </summary>
3838 ## <param name="domain">
3839 ##      <summary>
3840 ##      Domain allowed access.
3841 ##      </summary>
3842 ## </param>
3843 #
3844 interface(`userdom_create_all_users_keys',`
3845         gen_require(`
3846                 attribute userdomain;
3847         ')
3848
3849         allow $1 userdomain:key create;
3850 ')
3851
3852 ########################################
3853 ## <summary>
3854 ##      Send a dbus message to all user domains.
3855 ## </summary>
3856 ## <param name="domain">
3857 ##      <summary>
3858 ##      Domain allowed access.
3859 ##      </summary>
3860 ## </param>
3861 #
3862 interface(`userdom_dbus_send_all_users',`
3863         gen_require(`
3864                 attribute userdomain;
3865                 class dbus send_msg;
3866         ')
3867
3868         allow $1 userdomain:dbus send_msg;
3869 ')
3870
3871 ########################################
3872 ## <summary>
3873 ##      Allow apps to set rlimits on userdomain
3874 ## </summary>
3875 ## <param name="domain">
3876 ##      <summary>
3877 ##      Domain allowed access.
3878 ##      </summary>
3879 ## </param>
3880 #
3881 interface(`userdom_set_rlimitnh',`
3882         gen_require(`
3883                 attribute userdomain;
3884         ')
3885
3886         allow $1 userdomain:process rlimitinh;
3887 ')
3888
3889 ########################################
3890 ## <summary>
3891 ##      Define this type as a Allow apps to set rlimits on userdomain
3892 ## </summary>
3893 ## <param name="domain">
3894 ##      <summary>
3895 ##      Domain allowed access.
3896 ##      </summary>
3897 ## </param>
3898 ## <param name="userdomain_prefix">
3899 ##      <summary>
3900 ##      The prefix of the user domain (e.g., user
3901 ##      is the prefix for user_t).
3902 ## </summary>
3903 ## </param>
3904 ## <param name="domain">
3905 ##      <summary>
3906 ##      Domain allowed access.
3907 ##      </summary>
3908 ## </param>
3909 #
3910 template(`userdom_unpriv_usertype',`
3911         gen_require(`
3912                 attribute unpriv_userdomain, userdomain;
3913                 attribute $1_usertype;
3914         ')
3915         typeattribute $2  $1_usertype;
3916         typeattribute $2  unpriv_userdomain;
3917         typeattribute $2  userdomain;
3918
3919         auth_use_nsswitch($2)
3920         ubac_constrained($2)
3921 ')
3922
3923 ########################################
3924 ## <summary>
3925 ##      Connect to users over an unix stream socket.
3926 ## </summary>
3927 ## <param name="domain">
3928 ##      <summary>
3929 ##      Domain allowed access.
3930 ##      </summary>
3931 ## </param>
3932 #
3933 interface(`userdom_stream_connect',`
3934         gen_require(`
3935                 type user_tmp_t;
3936                 attribute userdomain;
3937         ')
3938
3939         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3940 ')
3941
3942 ########################################
3943 ## <summary>
3944 ##      Ptrace user domains.
3945 ## </summary>
3946 ## <param name="domain">
3947 ##      <summary>
3948 ##      Domain allowed access.
3949 ##      </summary>
3950 ## </param>
3951 #
3952 interface(`userdom_ptrace_all_users',`
3953         gen_require(`
3954                 attribute userdomain;
3955         ')
3956
3957         allow $1 userdomain:process ptrace;
3958 ')
3959
3960 ########################################
3961 ## <summary>
3962 ##      dontaudit Search /root
3963 ## </summary>
3964 ## <param name="domain">
3965 ##      <summary>
3966 ##      Domain to not audit.
3967 ##      </summary>
3968 ## </param>
3969 #
3970 interface(`userdom_dontaudit_search_admin_dir',`
3971         gen_require(`
3972                 type admin_home_t;
3973         ')
3974
3975         dontaudit $1 admin_home_t:dir search_dir_perms;
3976 ')
3977
3978 ########################################
3979 ## <summary>
3980 ##      dontaudit list /root
3981 ## </summary>
3982 ## <param name="domain">
3983 ##      <summary>
3984 ##      Domain to not audit.
3985 ##      </summary>
3986 ## </param>
3987 #
3988 interface(`userdom_dontaudit_list_admin_dir',`
3989         gen_require(`
3990                 type admin_home_t;
3991         ')
3992
3993         dontaudit $1 admin_home_t:dir list_dir_perms;
3994 ')
3995
3996 ########################################
3997 ## <summary>
3998 ##      Allow domain to  list /root
3999 ## </summary>
4000 ## <param name="domain">
4001 ##      <summary>
4002 ##      Domain allowed access.
4003 ##      </summary>
4004 ## </param>
4005 #
4006 interface(`userdom_list_admin_dir',`
4007         gen_require(`
4008                 type admin_home_t;
4009         ')
4010
4011         allow $1 admin_home_t:dir list_dir_perms;
4012 ')
4013
4014 ########################################
4015 ## <summary>
4016 ##      Allow Search /root
4017 ## </summary>
4018 ## <param name="domain">
4019 ##      <summary>
4020 ##      Domain allowed access.
4021 ##      </summary>
4022 ## </param>
4023 #
4024 interface(`userdom_search_admin_dir',`
4025         gen_require(`
4026                 type admin_home_t;
4027         ')
4028
4029         allow $1 admin_home_t:dir search_dir_perms;
4030 ')
4031
4032 ########################################
4033 ## <summary>
4034 ##      RW unpriviledged user SysV sempaphores.
4035 ## </summary>
4036 ## <param name="domain">
4037 ##      <summary>
4038 ##      Domain allowed access.
4039 ##      </summary>
4040 ## </param>
4041 #
4042 interface(`userdom_rw_semaphores',`
4043         gen_require(`
4044                 attribute unpriv_userdomain;
4045         ')
4046
4047         allow $1 unpriv_userdomain:sem rw_sem_perms;
4048 ')
4049
4050 ########################################
4051 ## <summary>
4052 ##      Send a message to unpriv users over a unix domain
4053 ##      datagram socket.
4054 ## </summary>
4055 ## <param name="domain">
4056 ##      <summary>
4057 ##      Domain allowed access.
4058 ##      </summary>
4059 ## </param>
4060 #
4061 interface(`userdom_dgram_send',`
4062         gen_require(`
4063                 attribute unpriv_userdomain;
4064         ')
4065
4066         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4067 ')
4068
4069 ######################################
4070 ## <summary>
4071 ##      Send a message to users over a unix domain
4072 ##      datagram socket.
4073 ## </summary>
4074 ## <param name="domain">
4075 ##      <summary>
4076 ##      Domain allowed access.
4077 ##      </summary>
4078 ## </param>
4079 #
4080 interface(`userdom_users_dgram_send',`
4081         gen_require(`
4082                  attribute userdomain;
4083       ')
4084
4085        allow $1 userdomain:unix_dgram_socket sendto;
4086 ')
4087
4088 #######################################
4089 ## <summary>
4090 ##      Allow execmod on files in homedirectory
4091 ## </summary>
4092 ## <param name="domain">
4093 ##      <summary>
4094 ##      Domain allowed access.
4095 ##      </summary>
4096 ## </param>
4097 ## <rolebase/>
4098 #
4099 interface(`userdom_execmod_user_home_files',`
4100         gen_require(`
4101                 type user_home_type;
4102         ')
4103
4104         allow $1 user_home_type:file execmod;
4105 ')
4106
4107 ########################################
4108 ## <summary>
4109 ##      Read admin home files.
4110 ## </summary>
4111 ## <param name="domain">
4112 ##      <summary>
4113 ##      Domain allowed access.
4114 ##      </summary>
4115 ## </param>
4116 ## <rolecap/>
4117 #
4118 interface(`userdom_read_admin_home_files',`
4119         gen_require(`
4120                 type admin_home_t;
4121         ')
4122
4123         read_files_pattern($1, admin_home_t, admin_home_t)
4124 ')
4125
4126 ########################################
4127 ## <summary>
4128 ##      Execute admin home files.
4129 ## </summary>
4130 ## <param name="domain">
4131 ##      <summary>
4132 ##      Domain allowed access.
4133 ##      </summary>
4134 ## </param>
4135 ## <rolecap/>
4136 #
4137 interface(`userdom_exec_admin_home_files',`
4138         gen_require(`
4139                 type admin_home_t;
4140         ')
4141
4142         exec_files_pattern($1, admin_home_t, admin_home_t)
4143 ')
4144
4145 ########################################
4146 ## <summary>
4147 ##      Append files inherited
4148 ##      in the /root directory.
4149 ## </summary>
4150 ## <param name="domain">
4151 ##      <summary>
4152 ##      Domain allowed access.
4153 ##      </summary>
4154 ## </param>
4155 #
4156 interface(`userdom_inherit_append_admin_home_files',`
4157         gen_require(`
4158                 type admin_home_t;
4159         ')
4160
4161         allow $1 admin_home_t:file { getattr append };
4162 ')
4163
4164
4165 #######################################
4166 ## <summary>
4167 ##      Manage all files/directories in the homedir
4168 ## </summary>
4169 ## <param name="userdomain">
4170 ##      <summary>
4171 ##      The user domain
4172 ##      </summary>
4173 ## </param>
4174 ## <rolebase/>
4175 #
4176 interface(`userdom_manage_user_home_content',`
4177         gen_require(`
4178                 type user_home_dir_t, user_home_t;
4179                 attribute user_home_type;
4180         ')
4181
4182         files_list_home($1)
4183         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4184         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4185         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4186         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4187         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4188         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4189
4190 ')
4191
4192
4193 ########################################
4194 ## <summary>
4195 ##      Create objects in a user home directory
4196 ##      with an automatic type transition to
4197 ##      the user home file type.
4198 ## </summary>
4199 ## <param name="domain">
4200 ##      <summary>
4201 ##      Domain allowed access.
4202 ##      </summary>
4203 ## </param>
4204 ## <param name="object_class">
4205 ##      <summary>
4206 ##      The class of the object to be created.
4207 ##      </summary>
4208 ## </param>
4209 #
4210 interface(`userdom_user_home_dir_filetrans_pattern',`
4211         gen_require(`
4212                 type user_home_dir_t, user_home_t;
4213         ')
4214
4215         type_transition $1 user_home_dir_t:$2 user_home_t;
4216 ')
4217
4218 ########################################
4219 ## <summary>
4220 ##      Create objects in the /root directory
4221 ##      with an automatic type transition to
4222 ##      a specified private type.
4223 ## </summary>
4224 ## <param name="domain">
4225 ##      <summary>
4226 ##      Domain allowed access.
4227 ##      </summary>
4228 ## </param>
4229 ## <param name="private_type">
4230 ##      <summary>
4231 ##      The type of the object to create.
4232 ##      </summary>
4233 ## </param>
4234 ## <param name="object_class">
4235 ##      <summary>
4236 ##      The class of the object to be created.
4237 ##      </summary>
4238 ## </param>
4239 #
4240 interface(`userdom_admin_home_dir_filetrans',`
4241         gen_require(`
4242                 type admin_home_t;
4243         ')
4244
4245         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4246 ')
4247
4248 ########################################
4249 ## <summary>
4250 ##      Send signull to unprivileged user domains.
4251 ## </summary>
4252 ## <param name="domain">
4253 ##      <summary>
4254 ##      Domain allowed access.
4255 ##      </summary>
4256 ## </param>
4257 #
4258 interface(`userdom_signull_unpriv_users',`
4259         gen_require(`
4260                 attribute unpriv_userdomain;
4261         ')
4262
4263         allow $1 unpriv_userdomain:process signull;
4264 ')
4265
4266 ########################################
4267 ## <summary>
4268 ##      Write all users files in /tmp
4269 ## </summary>
4270 ## <param name="domain">
4271 ##      <summary>
4272 ##      Domain allowed access.
4273 ##      </summary>
4274 ## </param>
4275 #
4276 interface(`userdom_write_user_tmp_dirs',`
4277         gen_require(`
4278                 type user_tmp_t;
4279         ')
4280
4281         write_files_pattern($1, user_tmp_t, user_tmp_t)
4282 ')
4283
4284 ########################################
4285 ## <summary>
4286 ##      Manage keys for all user domains.
4287 ## </summary>
4288 ## <param name="domain">
4289 ##      <summary>
4290 ##      Domain allowed access.
4291 ##      </summary>
4292 ## </param>
4293 #
4294 interface(`userdom_manage_all_users_keys',`
4295         gen_require(`
4296                 attribute userdomain;
4297         ')
4298
4299         allow $1 userdomain:key manage_key_perms;
4300 ')
4301
4302
4303 ########################################
4304 ## <summary>
4305 ##      Do not audit attempts to read and write
4306 ##      unserdomain stream.
4307 ## </summary>
4308 ## <param name="domain">
4309 ##      <summary>
4310 ##      Domain to not audit.
4311 ##      </summary>
4312 ## </param>
4313 #
4314 interface(`userdom_dontaudit_rw_stream',`
4315         gen_require(`
4316                 attribute userdomain;
4317         ')
4318
4319         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4320 ')
4321
4322 ########################################
4323 ## <summary>
4324 ##      Do not audit attempts to read and write
4325 ##      unserdomain datagram socket.
4326 ## </summary>
4327 ## <param name="domain">
4328 ##      <summary>
4329 ##      Domain to not audit.
4330 ##      </summary>
4331 ## </param>
4332 #
4333 interface(`userdom_dontaudit_rw_dgram_socket',`
4334         gen_require(`
4335                 attribute userdomain;
4336         ')
4337
4338         dontaudit $1 userdomain:unix_dgram_socket { read write };
4339 ')
4340
4341 ########################################
4342 ## <summary>
4343 ##      Append files
4344 ##      in a user home subdirectory.
4345 ## </summary>
4346 ## <param name="domain">
4347 ##      <summary>
4348 ##      Domain allowed access.
4349 ##      </summary>
4350 ## </param>
4351 #
4352 interface(`userdom_append_user_home_content_files',`
4353         gen_require(`
4354                 type user_home_dir_t, user_home_t;
4355         ')
4356
4357         append_files_pattern($1, user_home_t, user_home_t)
4358         allow $1 user_home_dir_t:dir search_dir_perms;
4359         files_search_home($1)
4360 ')
4361
4362 ########################################
4363 ## <summary>
4364 ##      Read files inherited
4365 ##      in a user home subdirectory.
4366 ## </summary>
4367 ## <param name="domain">
4368 ##      <summary>
4369 ##      Domain allowed access.
4370 ##      </summary>
4371 ## </param>
4372 #
4373 interface(`userdom_read_inherited_user_home_content_files',`
4374         gen_require(`
4375                 attribute user_home_type;
4376         ')
4377
4378         allow $1 user_home_type:file { getattr read };
4379 ')
4380
4381 ########################################
4382 ## <summary>
4383 ##      Append files inherited
4384 ##      in a user home subdirectory.
4385 ## </summary>
4386 ## <param name="domain">
4387 ##      <summary>
4388 ##      Domain allowed access.
4389 ##      </summary>
4390 ## </param>
4391 #
4392 interface(`userdom_inherit_append_user_home_content_files',`
4393         gen_require(`
4394                 type user_home_t;
4395         ')
4396
4397         allow $1 user_home_t:file { getattr append };
4398 ')
4399
4400 ########################################
4401 ## <summary>
4402 ##      Append files inherited
4403 ##      in a user tmp files.
4404 ## </summary>
4405 ## <param name="domain">
4406 ##      <summary>
4407 ##      Domain allowed access.
4408 ##      </summary>
4409 ## </param>
4410 #
4411 interface(`userdom_inherit_append_user_tmp_files',`
4412         gen_require(`
4413                 type user_tmp_t;
4414         ')
4415
4416         allow $1 user_tmp_t:file { getattr append };
4417 ')
4418
4419 ######################################
4420 ## <summary>
4421 ##      Read audio files in the users homedir.
4422 ## </summary>
4423 ## <param name="domain">
4424 ##      <summary>
4425 ##      Domain allowed access.
4426 ##      </summary>
4427 ## </param>
4428 ## <rolecap/>
4429 #
4430 interface(`userdom_read_home_audio_files',`
4431         gen_require(`
4432                 type audio_home_t;
4433         ')
4434
4435         userdom_search_user_home_dirs($1)
4436         allow $1 audio_home_t:dir list_dir_perms;
4437         read_files_pattern($1, audio_home_t, audio_home_t)
4438         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4439 ')
4440
4441 ########################################
4442 ## <summary>
4443 ##      Do not audit attempts to write all user home content files.
4444 ## </summary>
4445 ## <param name="domain">
4446 ##      <summary>
4447 ##      Domain to not audit.
4448 ##      </summary>
4449 ## </param>
4450 #
4451 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4452         gen_require(`
4453                 attribute user_home_type;
4454         ')
4455
4456         dontaudit $1 user_home_type:file write_file_perms;
4457 ')
4458
4459 ########################################
4460 ## <summary>
4461 ##      Do not audit attempts to write all user tmp content files.
4462 ## </summary>
4463 ## <param name="domain">
4464 ##      <summary>
4465 ##      Domain to not audit.
4466 ##      </summary>
4467 ## </param>
4468 #
4469 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4470         gen_require(`
4471                 attribute user_tmp_type;
4472         ')
4473
4474         dontaudit $1 user_tmp_type:file write_file_perms;
4475 ')
4476
4477 ########################################
4478 ## <summary>
4479 ##      Manage all user temporary content.
4480 ## </summary>
4481 ## <param name="domain">
4482 ##      <summary>
4483 ##      Domain allowed access.
4484 ##      </summary>
4485 ## </param>
4486 #
4487 interface(`userdom_manage_all_user_tmp_content',`
4488         gen_require(`
4489                 attribute user_tmp_type;
4490         ')
4491
4492         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4493         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4494         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4495         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4496         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4497         files_search_tmp($1)
4498 ')
4499
4500 ########################################
4501 ## <summary>
4502 ##      List all user temporary content.
4503 ## </summary>
4504 ## <param name="domain">
4505 ##      <summary>
4506 ##      Domain allowed access.
4507 ##      </summary>
4508 ## </param>
4509 #
4510 interface(`userdom_list_all_user_tmp_content',`
4511         gen_require(`
4512                 attribute user_tmp_type;
4513         ')
4514
4515         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4516         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4517         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4518         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4519         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4520         files_search_var($1)
4521         files_search_tmp($1)
4522 ')
4523
4524 ########################################
4525 ## <summary>
4526 ##      Manage all user tmpfs content.
4527 ## </summary>
4528 ## <param name="domain">
4529 ##      <summary>
4530 ##      Domain allowed access.
4531 ##      </summary>
4532 ## </param>
4533 #
4534 interface(`userdom_manage_all_user_tmpfs_content',`
4535         gen_require(`
4536                 attribute user_tmpfs_type;
4537         ')
4538
4539         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4540         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4541         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4542         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4543         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4544         fs_search_tmpfs($1)
4545 ')
4546
4547 ########################################
4548 ## <summary>
4549 ##      Delete all user temporary content.
4550 ## </summary>
4551 ## <param name="domain">
4552 ##      <summary>
4553 ##      Domain allowed access.
4554 ##      </summary>
4555 ## </param>
4556 #
4557 interface(`userdom_delete_all_user_tmp_content',`
4558         gen_require(`
4559                 attribute user_tmp_type;
4560         ')
4561
4562         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4563         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4564         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4565         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4566         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4567         # /var/tmp
4568         files_search_var($1)
4569         files_delete_tmp_dir_entry($1)
4570 ')
4571
4572 ########################################
4573 ## <summary>
4574 ##      Read system SSL certificates in the users homedir.
4575 ## </summary>
4576 ## <param name="domain">
4577 ##      <summary>
4578 ##      Domain allowed access.
4579 ##      </summary>
4580 ## </param>
4581 #
4582 interface(`userdom_read_home_certs',`
4583         gen_require(`
4584                 type home_cert_t;
4585         ')
4586
4587         userdom_search_user_home_content($1)
4588         allow $1 home_cert_t:dir list_dir_perms;
4589         read_files_pattern($1, home_cert_t, home_cert_t)
4590         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4591 ')
4592
4593 #######################################
4594 ## <summary>
4595 ##  Dontaudit Write system SSL certificates in the users homedir.
4596 ## </summary>
4597 ## <param name="domain">
4598 ##  <summary>
4599 ##      Domain to not audit.
4600 ##  </summary>
4601 ## </param>
4602 #
4603 interface(`userdom_dontaudit_write_home_certs',`
4604     gen_require(`
4605         type home_cert_t;
4606     ')
4607
4608     dontaudit $1 home_cert_t:file write;
4609 ')
4610
4611 ########################################
4612 ## <summary>
4613 ##      dontaudit Search getatrr /root files
4614 ## </summary>
4615 ## <param name="domain">
4616 ##      <summary>
4617 ##      Domain to not audit.
4618 ##      </summary>
4619 ## </param>
4620 #
4621 interface(`userdom_dontaudit_getattr_admin_home_files',`
4622         gen_require(`
4623                 type admin_home_t;
4624         ')
4625
4626         dontaudit $1 admin_home_t:file getattr;
4627 ')
4628
4629 ########################################
4630 ## <summary>
4631 ##      dontaudit read /root lnk files
4632 ## </summary>
4633 ## <param name="domain">
4634 ##      <summary>
4635 ##      Domain to not audit.
4636 ##      </summary>
4637 ## </param>
4638 #
4639 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4640         gen_require(`
4641                 type admin_home_t;
4642         ')
4643
4644         dontaudit $1 admin_home_t:lnk_file read;
4645 ')
4646
4647 ########################################
4648 ## <summary>
4649 ##      dontaudit read /root files
4650 ## </summary>
4651 ## <param name="domain">
4652 ##      <summary>
4653 ##      Domain to not audit.
4654 ##      </summary>
4655 ## </param>
4656 #
4657 interface(`userdom_dontaudit_read_admin_home_files',`
4658         gen_require(`
4659                 type admin_home_t;
4660         ')
4661
4662         dontaudit $1 admin_home_t:file read_file_perms;
4663 ')
4664
4665 ########################################
4666 ## <summary>
4667 ##      Create, read, write, and delete user
4668 ##      temporary chr files.
4669 ## </summary>
4670 ## <param name="domain">
4671 ##      <summary>
4672 ##      Domain allowed access.
4673 ##      </summary>
4674 ## </param>
4675 #
4676 interface(`userdom_manage_user_tmp_chr_files',`
4677         gen_require(`
4678                 type user_tmp_t;
4679         ')
4680
4681         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4682         files_search_tmp($1)
4683 ')
4684
4685 ########################################
4686 ## <summary>
4687 ##      Create, read, write, and delete user
4688 ##      temporary blk files.
4689 ## </summary>
4690 ## <param name="domain">
4691 ##      <summary>
4692 ##      Domain allowed access.
4693 ##      </summary>
4694 ## </param>
4695 #
4696 interface(`userdom_manage_user_tmp_blk_files',`
4697         gen_require(`
4698                 type user_tmp_t;
4699         ')
4700
4701         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4702         files_search_tmp($1)
4703 ')
4704
4705 ########################################
4706 ## <summary>
4707 ##      Dontaudit attempt to set attributes on  user temporary directories.
4708 ## </summary>
4709 ## <param name="domain">
4710 ##      <summary>
4711 ##      Domain to not audit.
4712 ##      </summary>
4713 ## </param>
4714 #
4715 interface(`userdom_dontaudit_setattr_user_tmp',`
4716         gen_require(`
4717                 type user_tmp_t;
4718         ')
4719
4720         dontaudit $1 user_tmp_t:dir setattr;
4721 ')
4722
4723 ########################################
4724 ## <summary>
4725 ##      Write all inherited users files in /tmp
4726 ## </summary>
4727 ## <param name="domain">
4728 ##      <summary>
4729 ##      Domain allowed access.
4730 ##      </summary>
4731 ## </param>
4732 #
4733 interface(`userdom_write_inherited_user_tmp_files',`
4734         gen_require(`
4735                 type user_tmp_t;
4736         ')
4737
4738         allow $1 user_tmp_t:file write;
4739 ')
4740
4741 ########################################
4742 ## <summary>
4743 ##      Delete all users files in /tmp
4744 ## </summary>
4745 ## <param name="domain">
4746 ##      <summary>
4747 ##      Domain allowed access.
4748 ##      </summary>
4749 ## </param>
4750 #
4751 interface(`userdom_delete_user_tmp_files',`
4752         gen_require(`
4753                 type user_tmp_t;
4754         ')
4755
4756         allow $1 user_tmp_t:file delete_file_perms;
4757 ')
4758
4759 ########################################
4760 ## <summary>
4761 ##      Delete user tmpfs files.
4762 ## </summary>
4763 ## <param name="domain">
4764 ##      <summary>
4765 ##      Domain allowed access.
4766 ##      </summary>
4767 ## </param>
4768 #
4769 interface(`userdom_delete_user_tmpfs_files',`
4770         gen_require(`
4771                 type user_tmpfs_t;
4772         ')
4773
4774         allow $1 user_tmpfs_t:file delete_file_perms;
4775 ')
4776
4777 ########################################
4778 ## <summary>
4779 ##      Read/Write unpriviledged user SysV shared
4780 ##      memory segments.
4781 ## </summary>
4782 ## <param name="domain">
4783 ##      <summary>
4784 ##      Domain allowed access.
4785 ##      </summary>
4786 ## </param>
4787 #
4788 interface(`userdom_rw_unpriv_user_shared_mem',`
4789         gen_require(`
4790                 attribute unpriv_userdomain;
4791         ')
4792
4793         allow $1 unpriv_userdomain:shm rw_shm_perms;
4794 ')
4795
4796 ########################################
4797 ## <summary>
4798 ##      Do not audit attempts to search user
4799 ##      temporary directories.
4800 ## </summary>
4801 ## <param name="domain">
4802 ##      <summary>
4803 ##      Domain to not audit.
4804 ##      </summary>
4805 ## </param>
4806 #
4807 interface(`userdom_dontaudit_search_user_tmp',`
4808         gen_require(`
4809                 type user_tmp_t;
4810         ')
4811
4812         dontaudit $1 user_tmp_t:dir search_dir_perms;
4813 ')
4814
4815 ########################################
4816 ## <summary>
4817 ##      Execute a file in a user home directory
4818 ##      in the specified domain.
4819 ## </summary>
4820 ## <desc>
4821 ##      <p>
4822 ##      Execute a file in a user home directory
4823 ##      in the specified domain.
4824 ##      </p>
4825 ##      <p>
4826 ##      No interprocess communication (signals, pipes,
4827 ##      etc.) is provided by this interface since
4828 ##      the domains are not owned by this module.
4829 ##      </p>
4830 ## </desc>
4831 ## <param name="domain">
4832 ##      <summary>
4833 ##      Domain allowed access.
4834 ##      </summary>
4835 ## </param>
4836 ## <param name="target_domain">
4837 ##      <summary>
4838 ##      The type of the new process.
4839 ##      </summary>
4840 ## </param>
4841 #
4842 interface(`userdom_domtrans_user_home',`
4843         gen_require(`
4844                 type user_home_t;
4845         ')
4846
4847         read_lnk_files_pattern($1, user_home_t, user_home_t)
4848         domain_transition_pattern($1, user_home_t, $2)
4849         type_transition $1 user_home_t:process $2;
4850 ')
4851
4852 ########################################
4853 ## <summary>
4854 ##      Execute a file in a user tmp directory
4855 ##      in the specified domain.
4856 ## </summary>
4857 ## <desc>
4858 ##      <p>
4859 ##      Execute a file in a user tmp directory
4860 ##      in the specified domain.
4861 ##      </p>
4862 ##      <p>
4863 ##      No interprocess communication (signals, pipes,
4864 ##      etc.) is provided by this interface since
4865 ##      the domains are not owned by this module.
4866 ##      </p>
4867 ## </desc>
4868 ## <param name="domain">
4869 ##      <summary>
4870 ##      Domain allowed access.
4871 ##      </summary>
4872 ## </param>
4873 ## <param name="target_domain">
4874 ##      <summary>
4875 ##      The type of the new process.
4876 ##      </summary>
4877 ## </param>
4878 #
4879 interface(`userdom_domtrans_user_tmp',`
4880         gen_require(`
4881                 type user_tmp_t;
4882         ')
4883
4884         files_search_tmp($1)
4885         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4886         domain_transition_pattern($1, user_tmp_t, $2)
4887         type_transition $1 user_tmp_t:process $2;
4888 ')
4889
4890 ########################################
4891 ## <summary>
4892 ##      Do not audit attempts to read all user home content files.
4893 ## </summary>
4894 ## <param name="domain">
4895 ##      <summary>
4896 ##      Domain to not audit.
4897 ##      </summary>
4898 ## </param>
4899 #
4900 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4901         gen_require(`
4902                 attribute user_home_type;
4903         ')
4904
4905         dontaudit $1 user_home_type:file read_file_perms;
4906 ')
4907
4908 ########################################
4909 ## <summary>
4910 ##      Do not audit attempts to read all user tmp content files.
4911 ## </summary>
4912 ## <param name="domain">
4913 ##      <summary>
4914 ##      Domain to not audit.
4915 ##      </summary>
4916 ## </param>
4917 #
4918 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4919         gen_require(`
4920                 attribute user_tmp_type;
4921         ')
4922
4923         dontaudit $1 user_tmp_type:file read_file_perms;
4924 ')
4925
4926 #######################################
4927 ## <summary>
4928 ## Read and write unpriviledged user SysV sempaphores.
4929 ## </summary>
4930 ## <param name="domain">
4931 ## <summary>
4932 ## Domain allowed access.
4933 ## </summary>
4934 ## </param>
4935 #
4936 interface(`userdom_rw_unpriv_user_semaphores',`
4937    gen_require(`
4938        attribute unpriv_userdomain;
4939    ')
4940
4941    allow $1 unpriv_userdomain:sem rw_sem_perms;
4942 ')