policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658
 659         init_read_utmp($1_usertype)
 660
 661         seutil_read_file_contexts($1_usertype)
 662         seutil_read_default_contexts($1_usertype)
 663         seutil_run_newrole($1_t,$1_r)
 664         seutil_exec_checkpolicy($1_t)
 665         seutil_exec_setfiles($1_usertype)
 666         # for when the network connection is killed
 667         # this is needed when a login role can change
 668         # to this one.
 669         seutil_dontaudit_signal_newrole($1_t)
 670
 671         tunable_policy(`user_direct_mouse',`
 672                 dev_read_mouse($1_usertype)
 673         ')
 674
 675         tunable_policy(`user_ttyfile_stat',`
 676                 term_getattr_all_ttys($1_t)
 677         ')
 678
 679         optional_policy(`
 680                 # Allow graphical boot to check battery lifespan
 681                 apm_stream_connect($1_usertype)
 682         ')
 683
 684         optional_policy(`
 685                 canna_stream_connect($1_usertype)
 686         ')
 687
 688         optional_policy(`
 689                 chrome_role($1_r, $1_usertype)
 690         ')
 691
 692         optional_policy(`
 693                 colord_read_lib_files($1_usertype)
 694         ')
 695
 696         optional_policy(`
 697                 dbus_system_bus_client($1_usertype)
 698
 699                 allow $1_usertype $1_usertype:dbus  send_msg;
 700
 701                 optional_policy(`
 702                         avahi_dbus_chat($1_usertype)
 703                 ')
 704
 705                 optional_policy(`
 706                         policykit_dbus_chat($1_usertype)
 707                 ')
 708
 709                 optional_policy(`
 710                         bluetooth_dbus_chat($1_usertype)
 711                 ')
 712
 713                 optional_policy(`
 714                         consolekit_dbus_chat($1_usertype)
 715                         consolekit_read_log($1_usertype)
 716                 ')
 717
 718                 optional_policy(`
 719                         devicekit_dbus_chat($1_usertype)
 720                         devicekit_dbus_chat_power($1_usertype)
 721                         devicekit_dbus_chat_disk($1_usertype)
 722                 ')
 723
 724                 optional_policy(`
 725                         evolution_dbus_chat($1_usertype)
 726                         evolution_alarm_dbus_chat($1_usertype)
 727                 ')
 728
 729                 optional_policy(`
 730                         gnome_dbus_chat_gconfdefault($1_usertype)
 731                 ')
 732
 733                 optional_policy(`
 734                         hal_dbus_chat($1_usertype)
 735                 ')
 736
 737                 optional_policy(`
 738                         kde_dbus_chat_backlighthelper($1_usertype)
 739                 ')
 740
 741                 optional_policy(`
 742                         modemmanager_dbus_chat($1_usertype)
 743                 ')
 744
 745                 optional_policy(`
 746                         networkmanager_dbus_chat($1_usertype)
 747                         networkmanager_read_lib_files($1_usertype)
 748                 ')
 749
 750                 optional_policy(`
 751                         vpn_dbus_chat($1_usertype)
 752                 ')
 753         ')
 754
 755         optional_policy(`
 756                 git_session_role($1_r, $1_usertype)
 757         ')
 758
 759         optional_policy(`
 760                 inetd_use_fds($1_usertype)
 761                 inetd_rw_tcp_sockets($1_usertype)
 762         ')
 763
 764         optional_policy(`
 765                 inn_read_config($1_usertype)
 766                 inn_read_news_lib($1_usertype)
 767                 inn_read_news_spool($1_usertype)
 768         ')
 769
 770         optional_policy(`
 771                 lircd_stream_connect($1_usertype)
 772         ')
 773
 774         optional_policy(`
 775                 locate_read_lib_files($1_usertype)
 776         ')
 777
 778         # for running depmod as part of the kernel packaging process
 779         optional_policy(`
 780                 modutils_read_module_config($1_usertype)
 781         ')
 782
 783         optional_policy(`
 784                 mta_rw_spool($1_usertype)
 785                 mta_manage_queue($1_usertype)
 786                 mta_filetrans_home_content($1_usertype)
 787         ')
 788
 789         optional_policy(`
 790                 tunable_policy(`allow_user_mysql_connect',`
 791                         mysql_stream_connect($1_t)
 792                 ')
 793         ')
 794
 795         optional_policy(`
 796                 oident_manage_user_content($1_t)
 797                 oident_relabel_user_content($1_t)
 798         ')
 799
 800         optional_policy(`
 801                 # to allow monitoring of pcmcia status
 802                 pcmcia_read_pid($1_usertype)
 803         ')
 804
 805         optional_policy(`
 806                 pcscd_read_pub_files($1_usertype)
 807                 pcscd_stream_connect($1_usertype)
 808         ')
 809
 810         optional_policy(`
 811                 tunable_policy(`allow_user_postgresql_connect',`
 812                         postgresql_stream_connect($1_usertype)
 813                         postgresql_tcp_connect($1_usertype)
 814                 ')
 815         ')
 816
 817         optional_policy(`
 818                 resmgr_stream_connect($1_usertype)
 819         ')
 820
 821         optional_policy(`
 822                 rpc_dontaudit_getattr_exports($1_usertype)
 823                 rpc_manage_nfs_rw_content($1_usertype)
 824         ')
 825
 826         optional_policy(`
 827                 rpcbind_stream_connect($1_usertype)
 828         ')
 829
 830         optional_policy(`
 831                 samba_stream_connect_winbind($1_usertype)
 832         ')
 833
 834         optional_policy(`
 835                 sandbox_transition($1_usertype, $1_r)
 836         ')
 837
 838         optional_policy(`
 839                 seunshare_role_template($1, $1_r, $1_t)
 840         ')
 841
 842         optional_policy(`
 843                 slrnpull_search_spool($1_usertype)
 844         ')
 845
 846         optional_policy(`
 847                 thumb_role($1_r, $1_usertype)
 848         ')
 849 ')
 850
 851 #######################################
 852 ## <summary>
 853 ##      The template for creating a login user.
 854 ## </summary>
 855 ## <desc>
 856 ##      <p>
 857 ##      This template creates a user domain, types, and
 858 ##      rules for the user's tty, pty, home directories,
 859 ##      tmp, and tmpfs files.
 860 ##      </p>
 861 ## </desc>
 862 ## <param name="userdomain_prefix">
 863 ##      <summary>
 864 ##      The prefix of the user domain (e.g., user
 865 ##      is the prefix for user_t).
 866 ##      </summary>
 867 ## </param>
 868 #
 869 template(`userdom_login_user_template', `
 870         gen_require(`
 871                 class context contains;
 872         ')
 873
 874         userdom_base_user_template($1)
 875
 876         userdom_manage_home_role($1_r, $1_usertype)
 877
 878         userdom_manage_tmp_role($1_r, $1_usertype)
 879         userdom_manage_tmpfs_role($1_r, $1_usertype)
 880
 881         ifelse(`$1',`unconfined',`',`
 882                 gen_tunable(allow_$1_exec_content, true)
 883
 884                 tunable_policy(`allow_$1_exec_content',`
 885                         userdom_exec_user_tmp_files($1_usertype)
 886                         userdom_exec_user_home_content_files($1_usertype)
 887                 ')
 888                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 889                         fs_exec_nfs_files($1_usertype)
 890                 ')
 891
 892                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 893                         fs_exec_cifs_files($1_usertype)
 894                 ')
 895         ')
 896
 897         userdom_change_password_template($1)
 898
 899         ##############################
 900         #
 901         # User domain Local policy
 902         #
 903
 904         allow $1_t self:capability { setgid chown fowner };
 905         dontaudit $1_t self:capability { sys_nice fsetid };
 906
 907         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 908         dontaudit $1_t self:process setrlimit;
 909         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 910
 911         allow $1_t self:context contains;
 912
 913         kernel_dontaudit_read_system_state($1_usertype)
 914         kernel_dontaudit_list_all_proc($1_usertype)
 915
 916         dev_read_sysfs($1_usertype)
 917         dev_read_urand($1_usertype)
 918
 919         domain_use_interactive_fds($1_usertype)
 920         # Command completion can fire hundreds of denials
 921         domain_dontaudit_exec_all_entry_files($1_usertype)
 922
 923         files_dontaudit_list_default($1_usertype)
 924         files_dontaudit_read_default_files($1_usertype)
 925         # Stat lost+found.
 926         files_getattr_lost_found_dirs($1_usertype)
 927
 928         fs_get_all_fs_quotas($1_usertype)
 929         fs_getattr_all_fs($1_usertype)
 930         fs_search_all($1_usertype)
 931         fs_list_inotifyfs($1_usertype)
 932         fs_rw_anon_inodefs_files($1_usertype)
 933
 934         auth_dontaudit_write_login_records($1_t)
 935         auth_rw_cache($1_t)
 936
 937         application_exec_all($1_t)
 938         # The library functions always try to open read-write first,
 939         # then fall back to read-only if it fails.
 940         init_dontaudit_rw_utmp($1_t)
 941
 942         # Stop warnings about access to /dev/console
 943         init_dontaudit_use_fds($1_usertype)
 944         init_dontaudit_use_script_fds($1_usertype)
 945
 946         libs_exec_lib_files($1_usertype)
 947
 948         logging_dontaudit_getattr_all_logs($1_usertype)
 949
 950         # for running TeX programs
 951         miscfiles_read_tetex_data($1_usertype)
 952         miscfiles_exec_tetex_data($1_usertype)
 953
 954         seutil_read_config($1_usertype)
 955
 956         optional_policy(`
 957                 cups_read_config($1_usertype)
 958                 cups_stream_connect($1_usertype)
 959                 cups_stream_connect_ptal($1_usertype)
 960         ')
 961
 962         optional_policy(`
 963                 kerberos_use($1_usertype)
 964                 kerberos_filetrans_home_content($1_usertype)
 965         ')
 966
 967         optional_policy(`
 968                 mta_dontaudit_read_spool_symlinks($1_usertype)
 969         ')
 970
 971         optional_policy(`
 972                 quota_dontaudit_getattr_db($1_usertype)
 973         ')
 974
 975         optional_policy(`
 976                 rpm_read_db($1_usertype)
 977                 rpm_dontaudit_manage_db($1_usertype)
 978                 rpm_read_cache($1_usertype)
 979         ')
 980
 981         optional_policy(`
 982                 oddjob_run_mkhomedir($1_t, $1_r)
 983         ')
 984 ')
 985
 986 #######################################
 987 ## <summary>
 988 ##      The template for creating a unprivileged login user.
 989 ## </summary>
 990 ## <desc>
 991 ##      <p>
 992 ##      This template creates a user domain, types, and
 993 ##      rules for the user's tty, pty, home directories,
 994 ##      tmp, and tmpfs files.
 995 ##      </p>
 996 ## </desc>
 997 ## <param name="userdomain_prefix">
 998 ##      <summary>
 999 ##      The prefix of the user domain (e.g., user
1000 ##      is the prefix for user_t).
1001 ##      </summary>
1002 ## </param>
1003 #
1004 template(`userdom_restricted_user_template',`
1005         gen_require(`
1006                 attribute unpriv_userdomain;
1007         ')
1008
1009         userdom_login_user_template($1)
1010
1011         typeattribute $1_t unpriv_userdomain;
1012         domain_interactive_fd($1_t)
1013
1014         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1015         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1016
1017         ##############################
1018         #
1019         # Local policy
1020         #
1021
1022         optional_policy(`
1023                 loadkeys_run($1_t, $1_r)
1024         ')
1025 ')
1026
1027 #######################################
1028 ## <summary>
1029 ##      The template for creating a unprivileged xwindows login user.
1030 ## </summary>
1031 ## <desc>
1032 ##      <p>
1033 ##      The template for creating a unprivileged xwindows login user.
1034 ##      </p>
1035 ##      <p>
1036 ##      This template creates a user domain, types, and
1037 ##      rules for the user's tty, pty, home directories,
1038 ##      tmp, and tmpfs files.
1039 ##      </p>
1040 ## </desc>
1041 ## <param name="userdomain_prefix">
1042 ##      <summary>
1043 ##      The prefix of the user domain (e.g., user
1044 ##      is the prefix for user_t).
1045 ##      </summary>
1046 ## </param>
1047 #
1048 template(`userdom_restricted_xwindows_user_template',`
1049
1050         userdom_restricted_user_template($1)
1051
1052         ##############################
1053         #
1054         # Local policy
1055         #
1056
1057         auth_role($1_r, $1_t)
1058         auth_search_pam_console_data($1_usertype)
1059         auth_dontaudit_read_login_records($1_usertype)
1060
1061         dev_read_sound($1_usertype)
1062         dev_write_sound($1_usertype)
1063         # gnome keyring wants to read this.
1064         dev_dontaudit_read_rand($1_usertype)
1065         # temporarily allow since openoffice requires this
1066         dev_read_rand($1_usertype)
1067
1068         dev_read_video_dev($1_usertype)
1069         dev_write_video_dev($1_usertype)
1070         dev_rw_wireless($1_usertype)
1071
1072         libs_dontaudit_setattr_lib_files($1_usertype)
1073
1074         tunable_policy(`user_rw_noexattrfile',`
1075                 dev_rw_usbfs($1_t)
1076                 dev_rw_generic_usb_dev($1_usertype)
1077
1078                 fs_manage_noxattr_fs_files($1_usertype)
1079                 fs_manage_noxattr_fs_dirs($1_usertype)
1080                 fs_manage_dos_dirs($1_usertype)
1081                 fs_manage_dos_files($1_usertype)
1082                 storage_raw_read_removable_device($1_usertype)
1083                 storage_raw_write_removable_device($1_usertype)
1084         ')
1085
1086         logging_send_syslog_msg($1_usertype)
1087         logging_dontaudit_send_audit_msgs($1_t)
1088
1089         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1090         logging_send_audit_msgs($1_t)
1091         selinux_get_enforce_mode($1_t)
1092         seutil_exec_restorecond($1_t)
1093         seutil_read_file_contexts($1_t)
1094         seutil_read_default_contexts($1_t)
1095
1096         xserver_restricted_role($1_r, $1_t)
1097
1098         optional_policy(`
1099                 alsa_read_rw_config($1_usertype)
1100         ')
1101
1102          # cjp: needed by KDE apps
1103          # bug: #682499
1104          optional_policy(`
1105                 gnome_read_usr_config($1_usertype)
1106                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1107                 # cjp: telepathy F15 bugs
1108                 telepathy_role($1_r, $1_t, $1)
1109         ')
1110
1111         optional_policy(`
1112                 dbus_role_template($1, $1_r, $1_usertype)
1113                 dbus_system_bus_client($1_usertype)
1114                 allow $1_usertype $1_usertype:dbus send_msg;
1115
1116                 optional_policy(`
1117                         abrt_dbus_chat($1_usertype)
1118                         abrt_run_helper($1_usertype, $1_r)
1119                 ')
1120
1121                 optional_policy(`
1122                         consolekit_dontaudit_read_log($1_usertype)
1123                         consolekit_dbus_chat($1_usertype)
1124                 ')
1125
1126                 optional_policy(`
1127                         cups_dbus_chat($1_usertype)
1128                         cups_dbus_chat_config($1_usertype)
1129                 ')
1130
1131                 optional_policy(`
1132                         devicekit_dbus_chat($1_usertype)
1133                         devicekit_dbus_chat_disk($1_usertype)
1134                         devicekit_dbus_chat_power($1_usertype)
1135                 ')
1136
1137                 optional_policy(`
1138                         fprintd_dbus_chat($1_t)
1139                 ')
1140         ')
1141
1142         optional_policy(`
1143                 policykit_role($1_r, $1_usertype)
1144         ')
1145
1146         optional_policy(`
1147                 pulseaudio_role($1_r, $1_usertype)
1148                 pulseaudio_filetrans_admin_home_content($1_usertype)
1149                 pulseaudio_filetrans_home_content($1_usertype)
1150         ')
1151
1152         optional_policy(`
1153                 rtkit_scheduled($1_usertype)
1154         ')
1155
1156         optional_policy(`
1157                 setroubleshoot_dontaudit_stream_connect($1_t)
1158         ')
1159
1160         optional_policy(`
1161                 udev_read_db($1_usertype)
1162         ')
1163
1164         optional_policy(`
1165                 wm_role_template($1, $1_r, $1_t)
1166         ')
1167 ')
1168
1169 #######################################
1170 ## <summary>
1171 ##      The template for creating a unprivileged user roughly
1172 ##      equivalent to a regular linux user.
1173 ## </summary>
1174 ## <desc>
1175 ##      <p>
1176 ##      The template for creating a unprivileged user roughly
1177 ##      equivalent to a regular linux user.
1178 ##      </p>
1179 ##      <p>
1180 ##      This template creates a user domain, types, and
1181 ##      rules for the user's tty, pty, home directories,
1182 ##      tmp, and tmpfs files.
1183 ##      </p>
1184 ## </desc>
1185 ## <param name="userdomain_prefix">
1186 ##      <summary>
1187 ##      The prefix of the user domain (e.g., user
1188 ##      is the prefix for user_t).
1189 ##      </summary>
1190 ## </param>
1191 #
1192 template(`userdom_unpriv_user_template', `
1193
1194         ##############################
1195         #
1196         # Declarations
1197         #
1198
1199         # Inherit rules for ordinary users.
1200         userdom_restricted_xwindows_user_template($1)
1201         userdom_common_user_template($1)
1202
1203         ##############################
1204         #
1205         # Local policy
1206         #
1207
1208         # port access is audited even if dac would not have allowed it, so dontaudit it here
1209 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1210         # Need the following rule to allow users to run vpnc
1211         corenet_tcp_bind_xserver_port($1_t)
1212         corenet_tcp_bind_generic_node($1_usertype)
1213
1214         storage_rw_fuse($1_t)
1215
1216         files_exec_usr_files($1_t)
1217    # cjp: why?
1218         files_read_kernel_symbol_table($1_t)
1219
1220         ifndef(`enable_mls',`
1221                 fs_exec_noxattr($1_t)
1222
1223                 tunable_policy(`user_rw_noexattrfile',`
1224                         fs_manage_noxattr_fs_files($1_t)
1225                         fs_manage_noxattr_fs_dirs($1_t)
1226                         # Write floppies
1227                         storage_raw_read_removable_device($1_t)
1228                         storage_raw_write_removable_device($1_t)
1229                 ',`
1230                         storage_raw_read_removable_device($1_t)
1231                 ')
1232         ')
1233
1234         miscfiles_read_hwdata($1_usertype)
1235
1236         # Allow users to run TCP servers (bind to ports and accept connection from
1237         # the same domain and outside users) disabling this forces FTP passive mode
1238         # and may change other protocols
1239
1240         tunable_policy(`user_share_music',`
1241                 corenet_tcp_bind_daap_port($1_usertype)
1242         ')
1243
1244         tunable_policy(`user_tcp_server',`
1245                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1246         ')
1247
1248         tunable_policy(`user_setrlimit',`
1249                 allow $1_usertype self:process setrlimit;
1250         ')
1251
1252         optional_policy(`
1253                 cdrecord_role($1_r, $1_t)
1254         ')
1255
1256         optional_policy(`
1257                 cron_role($1_r, $1_t)
1258         ')
1259
1260         optional_policy(`
1261                 games_rw_data($1_usertype)
1262         ')
1263
1264         optional_policy(`
1265                 gpg_role($1_r, $1_usertype)
1266         ')
1267
1268         optional_policy(`
1269                 gnomeclock_dbus_chat($1_t)
1270         ')
1271
1272         optional_policy(`
1273                 gpm_stream_connect($1_usertype)
1274         ')
1275
1276         optional_policy(`
1277                 mount_run_fusermount($1_t, $1_r)
1278                 mount_read_pid_files($1_t)
1279         ')
1280
1281         optional_policy(`
1282                 wine_role_template($1, $1_r, $1_t)
1283         ')
1284
1285         optional_policy(`
1286                 postfix_run_postdrop($1_t, $1_r)
1287                 postfix_search_spool($1_t)
1288         ')
1289
1290         # Run pppd in pppd_t by default for user
1291         optional_policy(`
1292                 ppp_run_cond($1_t, $1_r)
1293         ')
1294
1295         optional_policy(`
1296                 vdagent_getattr_log($1_t)
1297                 vdagent_getattr_exec($1_t)
1298                 vdagent_stream_connect($1_t)
1299         ')
1300 ')
1301
1302 #######################################
1303 ## <summary>
1304 ##      The template for creating an administrative user.
1305 ## </summary>
1306 ## <desc>
1307 ##      <p>
1308 ##      This template creates a user domain, types, and
1309 ##      rules for the user's tty, pty, home directories,
1310 ##      tmp, and tmpfs files.
1311 ##      </p>
1312 ##      <p>
1313 ##      The privileges given to administrative users are:
1314 ##      <ul>
1315 ##              <li>Raw disk access</li>
1316 ##              <li>Set all sysctls</li>
1317 ##              <li>All kernel ring buffer controls</li>
1318 ##              <li>Create, read, write, and delete all files but shadow</li>
1319 ##              <li>Manage source and binary format SELinux policy</li>
1320 ##              <li>Run insmod</li>
1321 ##      </ul>
1322 ##      </p>
1323 ## </desc>
1324 ## <param name="userdomain_prefix">
1325 ##      <summary>
1326 ##      The prefix of the user domain (e.g., sysadm
1327 ##      is the prefix for sysadm_t).
1328 ##      </summary>
1329 ## </param>
1330 #
1331 template(`userdom_admin_user_template',`
1332         gen_require(`
1333                 attribute admindomain;
1334                 class passwd { passwd chfn chsh rootok crontab };
1335         ')
1336
1337         ##############################
1338         #
1339         # Declarations
1340         #
1341
1342         # Inherit rules for ordinary users.
1343         userdom_login_user_template($1)
1344         userdom_common_user_template($1)
1345
1346         domain_obj_id_change_exemption($1_t)
1347         role system_r types $1_t;
1348
1349         typeattribute $1_t admindomain;
1350
1351         ifdef(`direct_sysadm_daemon',`
1352                 domain_system_change_exemption($1_t)
1353         ')
1354
1355         ##############################
1356         #
1357         # $1_t local policy
1358         #
1359
1360         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1361         tunable_policy(`deny_ptrace',`',`
1362                 allow $1_t self:capability sys_ptrace;
1363         ')
1364         allow $1_t self:capability2 syslog;
1365         allow $1_t self:process { setexec setfscreate };
1366         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1367         allow $1_t self:tun_socket create;
1368         # Set password information for other users.
1369         allow $1_t self:passwd { passwd chfn chsh };
1370         # Skip authentication when pam_rootok is specified.
1371         allow $1_t self:passwd rootok;
1372
1373         # Manipulate other users crontab.
1374         allow $1_t self:passwd crontab;
1375
1376         kernel_read_software_raid_state($1_t)
1377         kernel_getattr_core_if($1_t)
1378         kernel_getattr_message_if($1_t)
1379         kernel_change_ring_buffer_level($1_t)
1380         kernel_clear_ring_buffer($1_t)
1381         kernel_read_ring_buffer($1_t)
1382         kernel_get_sysvipc_info($1_t)
1383         kernel_rw_all_sysctls($1_t)
1384         # signal unlabeled processes:
1385         kernel_kill_unlabeled($1_t)
1386         kernel_signal_unlabeled($1_t)
1387         kernel_sigstop_unlabeled($1_t)
1388         kernel_signull_unlabeled($1_t)
1389         kernel_sigchld_unlabeled($1_t)
1390         kernel_signal($1_t)
1391
1392         corenet_tcp_bind_generic_port($1_t)
1393         # allow setting up tunnels
1394         corenet_rw_tun_tap_dev($1_t)
1395
1396         dev_getattr_generic_blk_files($1_t)
1397         dev_getattr_generic_chr_files($1_t)
1398         # for lsof
1399         dev_getattr_mtrr_dev($1_t)
1400         # Allow MAKEDEV to work
1401         dev_create_all_blk_files($1_t)
1402         dev_create_all_chr_files($1_t)
1403         dev_delete_all_blk_files($1_t)
1404         dev_delete_all_chr_files($1_t)
1405         dev_rename_all_blk_files($1_t)
1406         dev_rename_all_chr_files($1_t)
1407         dev_create_generic_symlinks($1_t)
1408         dev_rw_generic_usb_dev($1_t)
1409         dev_rw_usbfs($1_t)
1410
1411         domain_setpriority_all_domains($1_t)
1412         domain_read_all_domains_state($1_t)
1413         domain_getattr_all_domains($1_t)
1414         domain_getcap_all_domains($1_t)
1415         domain_dontaudit_ptrace_all_domains($1_t)
1416         # signal all domains:
1417         domain_kill_all_domains($1_t)
1418         domain_signal_all_domains($1_t)
1419         domain_signull_all_domains($1_t)
1420         domain_sigstop_all_domains($1_t)
1421         domain_sigstop_all_domains($1_t)
1422         domain_sigchld_all_domains($1_t)
1423         # for lsof
1424         domain_getattr_all_sockets($1_t)
1425         domain_dontaudit_getattr_all_sockets($1_t)
1426
1427         files_exec_usr_src_files($1_t)
1428
1429         fs_getattr_all_fs($1_t)
1430         fs_getattr_all_files($1_t)
1431         fs_list_all($1_t)
1432         fs_set_all_quotas($1_t)
1433         fs_exec_noxattr($1_t)
1434
1435         storage_raw_read_removable_device($1_t)
1436         storage_raw_write_removable_device($1_t)
1437         storage_dontaudit_read_fixed_disk($1_t)
1438
1439         term_use_all_inherited_terms($1_t)
1440         term_use_unallocated_ttys($1_t)
1441
1442         auth_getattr_shadow($1_t)
1443         # Manage almost all files
1444         files_manage_non_security_dirs($1_t)
1445         files_manage_non_security_files($1_t)
1446         # Relabel almost all files
1447         files_relabel_non_security_files($1_t)
1448
1449         init_telinit($1_t)
1450
1451         logging_send_syslog_msg($1_t)
1452
1453         optional_policy(`
1454                 modutils_domtrans_insmod($1_t)
1455                 modutils_domtrans_depmod($1_t)
1456         ')
1457
1458         # The following rule is temporary until such time that a complete
1459         # policy management infrastructure is in place so that an administrator
1460         # cannot directly manipulate policy files with arbitrary programs.
1461         seutil_manage_src_policy($1_t)
1462         # Violates the goal of limiting write access to checkpolicy.
1463         # But presently necessary for installing the file_contexts file.
1464         seutil_manage_bin_policy($1_t)
1465
1466         systemd_config_all_services($1_t)
1467
1468         userdom_manage_user_home_content_dirs($1_t)
1469         userdom_manage_user_home_content_files($1_t)
1470         userdom_manage_user_home_content_symlinks($1_t)
1471         userdom_manage_user_home_content_pipes($1_t)
1472         userdom_manage_user_home_content_sockets($1_t)
1473         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1474
1475         tunable_policy(`user_rw_noexattrfile',`
1476                 fs_manage_noxattr_fs_files($1_t)
1477                 fs_manage_noxattr_fs_dirs($1_t)
1478         ',`
1479                 fs_read_noxattr_fs_files($1_t)
1480         ')
1481
1482         optional_policy(`
1483                 postgresql_unconfined($1_t)
1484         ')
1485
1486         optional_policy(`
1487                 userhelper_exec($1_t)
1488         ')
1489 ')
1490
1491 ########################################
1492 ## <summary>
1493 ##      Allow user to run as a secadm
1494 ## </summary>
1495 ## <desc>
1496 ##      <p>
1497 ##      Create objects in a user home directory
1498 ##      with an automatic type transition to
1499 ##      a specified private type.
1500 ##      </p>
1501 ##      <p>
1502 ##      This is a templated interface, and should only
1503 ##      be called from a per-userdomain template.
1504 ##      </p>
1505 ## </desc>
1506 ## <param name="domain">
1507 ##      <summary>
1508 ##      Domain allowed access.
1509 ##      </summary>
1510 ## </param>
1511 ## <param name="role">
1512 ##      <summary>
1513 ##      The role  of the object to create.
1514 ##      </summary>
1515 ## </param>
1516 #
1517 template(`userdom_security_admin_template',`
1518         allow $1 self:capability { dac_read_search dac_override };
1519
1520         corecmd_exec_shell($1)
1521
1522         domain_obj_id_change_exemption($1)
1523
1524         dev_relabel_all_dev_nodes($1)
1525
1526         files_create_boot_flag($1)
1527         files_create_default_dir($1)
1528         files_root_filetrans_default($1, dir)
1529
1530         # Necessary for managing /boot/efi
1531         fs_manage_dos_files($1)
1532
1533         mls_process_read_up($1)
1534         mls_file_read_all_levels($1)
1535         mls_file_upgrade($1)
1536         mls_file_downgrade($1)
1537
1538         selinux_set_enforce_mode($1)
1539         selinux_set_all_booleans($1)
1540         selinux_set_parameters($1)
1541         selinux_read_policy($1)
1542
1543         files_relabel_all_files($1)
1544         auth_relabel_shadow($1)
1545
1546         init_exec($1)
1547
1548         logging_send_syslog_msg($1)
1549         logging_read_audit_log($1)
1550         logging_read_generic_logs($1)
1551         logging_read_audit_config($1)
1552
1553         seutil_manage_bin_policy($1)
1554         seutil_manage_default_contexts($1)
1555         seutil_manage_file_contexts($1)
1556         seutil_manage_module_store($1)
1557         seutil_manage_config($1)
1558         seutil_run_checkpolicy($1,$2)
1559         seutil_run_loadpolicy($1,$2)
1560         seutil_run_semanage($1,$2)
1561         seutil_run_setsebool($1,$2)
1562         seutil_run_setfiles($1, $2)
1563
1564         seutil_manage_bin_policy($1)
1565     seutil_manage_default_contexts($1)
1566     seutil_manage_file_contexts($1)
1567     seutil_manage_module_store($1)
1568     seutil_manage_config($1)
1569
1570         optional_policy(`
1571                 aide_run($1,$2)
1572         ')
1573
1574         optional_policy(`
1575                 consoletype_exec($1)
1576         ')
1577
1578         optional_policy(`
1579                 dmesg_exec($1)
1580         ')
1581
1582         optional_policy(`
1583                 ipsec_run_setkey($1,$2)
1584         ')
1585
1586         optional_policy(`
1587                 netlabel_run_mgmt($1,$2)
1588         ')
1589
1590         optional_policy(`
1591                 samhain_run($1, $2)
1592         ')
1593 ')
1594
1595 ########################################
1596 ## <summary>
1597 ##      Make the specified type usable in a
1598 ##      user home directory.
1599 ## </summary>
1600 ## <param name="type">
1601 ##      <summary>
1602 ##      Type to be used as a file in the
1603 ##      user home directory.
1604 ##      </summary>
1605 ## </param>
1606 #
1607 interface(`userdom_user_home_content',`
1608         gen_require(`
1609                 type user_home_t;
1610                 attribute user_home_type;
1611         ')
1612
1613         allow $1 user_home_t:filesystem associate;
1614         files_type($1)
1615         ubac_constrained($1)
1616
1617         files_poly_member($1)
1618         typeattribute $1  user_home_type;
1619 ')
1620
1621 ########################################
1622 ## <summary>
1623 ##      Make the specified type usable in a
1624 ##      generic temporary directory.
1625 ## </summary>
1626 ## <param name="type">
1627 ##      <summary>
1628 ##      Type to be used as a file in the
1629 ##      generic temporary directory.
1630 ##      </summary>
1631 ## </param>
1632 #
1633 interface(`userdom_user_tmp_content',`
1634         gen_require(`
1635                 attribute user_tmp_type;
1636         ')
1637
1638         typeattribute $1 user_tmp_type;
1639
1640         files_tmp_file($1)
1641         ubac_constrained($1)
1642 ')
1643
1644 ########################################
1645 ## <summary>
1646 ##      Make the specified type usable in a
1647 ##      generic tmpfs_t directory.
1648 ## </summary>
1649 ## <param name="type">
1650 ##      <summary>
1651 ##      Type to be used as a file in the
1652 ##      generic temporary directory.
1653 ##      </summary>
1654 ## </param>
1655 #
1656 interface(`userdom_user_tmpfs_content',`
1657         gen_require(`
1658                 attribute user_tmpfs_type;
1659         ')
1660
1661         typeattribute $1 user_tmpfs_type;
1662
1663         files_tmpfs_file($1)
1664         ubac_constrained($1)
1665 ')
1666
1667 ########################################
1668 ## <summary>
1669 ##      Allow domain to attach to TUN devices created by administrative users.
1670 ## </summary>
1671 ## <param name="domain">
1672 ##      <summary>
1673 ##      Domain allowed access.
1674 ##      </summary>
1675 ## </param>
1676 #
1677 interface(`userdom_attach_admin_tun_iface',`
1678         gen_require(`
1679                 attribute admindomain;
1680         ')
1681
1682         allow $1 admindomain:tun_socket relabelfrom;
1683         allow $1 self:tun_socket relabelto;
1684 ')
1685
1686 ########################################
1687 ## <summary>
1688 ##      Set the attributes of a user pty.
1689 ## </summary>
1690 ## <param name="domain">
1691 ##      <summary>
1692 ##      Domain allowed access.
1693 ##      </summary>
1694 ## </param>
1695 #
1696 interface(`userdom_setattr_user_ptys',`
1697         gen_require(`
1698                 type user_devpts_t;
1699         ')
1700
1701         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1702 ')
1703
1704 ########################################
1705 ## <summary>
1706 ##      Create a user pty.
1707 ## </summary>
1708 ## <param name="domain">
1709 ##      <summary>
1710 ##      Domain allowed access.
1711 ##      </summary>
1712 ## </param>
1713 #
1714 interface(`userdom_create_user_pty',`
1715         gen_require(`
1716                 type user_devpts_t;
1717         ')
1718
1719         term_create_pty($1, user_devpts_t)
1720 ')
1721
1722 ########################################
1723 ## <summary>
1724 ##      Get the attributes of user home directories.
1725 ## </summary>
1726 ## <param name="domain">
1727 ##      <summary>
1728 ##      Domain allowed access.
1729 ##      </summary>
1730 ## </param>
1731 #
1732 interface(`userdom_getattr_user_home_dirs',`
1733         gen_require(`
1734                 type user_home_dir_t;
1735         ')
1736
1737         allow $1 user_home_dir_t:dir getattr_dir_perms;
1738         files_search_home($1)
1739 ')
1740
1741 ########################################
1742 ## <summary>
1743 ##      Do not audit attempts to get the attributes of user home directories.
1744 ## </summary>
1745 ## <param name="domain">
1746 ##      <summary>
1747 ##      Domain to not audit.
1748 ##      </summary>
1749 ## </param>
1750 #
1751 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1752         gen_require(`
1753                 type user_home_dir_t;
1754         ')
1755
1756         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1757 ')
1758
1759 ########################################
1760 ## <summary>
1761 ##      Search user home directories.
1762 ## </summary>
1763 ## <param name="domain">
1764 ##      <summary>
1765 ##      Domain allowed access.
1766 ##      </summary>
1767 ## </param>
1768 #
1769 interface(`userdom_search_user_home_dirs',`
1770         gen_require(`
1771                 type user_home_dir_t;
1772         ')
1773
1774         allow $1 user_home_dir_t:dir search_dir_perms;
1775         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1776         files_search_home($1)
1777 ')
1778
1779 ########################################
1780 ## <summary>
1781 ##      Do not audit attempts to search user home directories.
1782 ## </summary>
1783 ## <desc>
1784 ##      <p>
1785 ##      Do not audit attempts to search user home directories.
1786 ##      This will supress SELinux denial messages when the specified
1787 ##      domain is denied the permission to search these directories.
1788 ##      </p>
1789 ## </desc>
1790 ## <param name="domain">
1791 ##      <summary>
1792 ##      Domain to not audit.
1793 ##      </summary>
1794 ## </param>
1795 ## <infoflow type="none"/>
1796 #
1797 interface(`userdom_dontaudit_search_user_home_dirs',`
1798         gen_require(`
1799                 type user_home_dir_t;
1800         ')
1801
1802         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1803 ')
1804
1805 ########################################
1806 ## <summary>
1807 ##      List user home directories.
1808 ## </summary>
1809 ## <param name="domain">
1810 ##      <summary>
1811 ##      Domain allowed access.
1812 ##      </summary>
1813 ## </param>
1814 #
1815 interface(`userdom_list_user_home_dirs',`
1816         gen_require(`
1817                 type user_home_dir_t;
1818         ')
1819
1820         allow $1 user_home_dir_t:dir list_dir_perms;
1821         files_search_home($1)
1822
1823         tunable_policy(`use_nfs_home_dirs',`
1824                 fs_list_nfs($1)
1825         ')
1826
1827         tunable_policy(`use_samba_home_dirs',`
1828                 fs_list_cifs($1)
1829         ')
1830 ')
1831
1832 ########################################
1833 ## <summary>
1834 ##      Do not audit attempts to list user home subdirectories.
1835 ## </summary>
1836 ## <param name="domain">
1837 ##      <summary>
1838 ##      Domain to not audit.
1839 ##      </summary>
1840 ## </param>
1841 #
1842 interface(`userdom_dontaudit_list_user_home_dirs',`
1843         gen_require(`
1844                 type user_home_dir_t;
1845                 type user_home_t;
1846         ')
1847
1848         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1849         dontaudit $1 user_home_t:dir list_dir_perms;
1850 ')
1851
1852 ########################################
1853 ## <summary>
1854 ##      Create user home directories.
1855 ## </summary>
1856 ## <param name="domain">
1857 ##      <summary>
1858 ##      Domain allowed access.
1859 ##      </summary>
1860 ## </param>
1861 #
1862 interface(`userdom_create_user_home_dirs',`
1863         gen_require(`
1864                 type user_home_dir_t;
1865         ')
1866
1867         allow $1 user_home_dir_t:dir create_dir_perms;
1868 ')
1869
1870 ########################################
1871 ## <summary>
1872 ##      Create user home directories.
1873 ## </summary>
1874 ## <param name="domain">
1875 ##      <summary>
1876 ##      Domain allowed access.
1877 ##      </summary>
1878 ## </param>
1879 #
1880 interface(`userdom_manage_user_home_dirs',`
1881         gen_require(`
1882                 type user_home_dir_t;
1883         ')
1884
1885         allow $1 user_home_dir_t:dir manage_dir_perms;
1886 ')
1887
1888 ########################################
1889 ## <summary>
1890 ##      Relabel to user home directories.
1891 ## </summary>
1892 ## <param name="domain">
1893 ##      <summary>
1894 ##      Domain allowed access.
1895 ##      </summary>
1896 ## </param>
1897 #
1898 interface(`userdom_relabelto_user_home_dirs',`
1899         gen_require(`
1900                 type user_home_dir_t;
1901         ')
1902
1903         allow $1 user_home_dir_t:dir relabelto;
1904 ')
1905
1906
1907 ########################################
1908 ## <summary>
1909 ##      Relabel to user home files.
1910 ## </summary>
1911 ## <param name="domain">
1912 ##      <summary>
1913 ##      Domain allowed access.
1914 ##      </summary>
1915 ## </param>
1916 #
1917 interface(`userdom_relabelto_user_home_files',`
1918         gen_require(`
1919                 type user_home_t;
1920         ')
1921
1922         allow $1 user_home_t:file relabelto;
1923 ')
1924 ########################################
1925 ## <summary>
1926 ##      Relabel user home files.
1927 ## </summary>
1928 ## <param name="domain">
1929 ##      <summary>
1930 ##      Domain allowed access.
1931 ##      </summary>
1932 ## </param>
1933 #
1934 interface(`userdom_relabel_user_home_files',`
1935         gen_require(`
1936                 type user_home_t;
1937         ')
1938
1939         allow $1 user_home_t:file relabel_file_perms;
1940 ')
1941
1942 ########################################
1943 ## <summary>
1944 ##      Create directories in the home dir root with
1945 ##      the user home directory type.
1946 ## </summary>
1947 ## <param name="domain">
1948 ##      <summary>
1949 ##      Domain allowed access.
1950 ##      </summary>
1951 ## </param>
1952 #
1953 interface(`userdom_home_filetrans_user_home_dir',`
1954         gen_require(`
1955                 type user_home_dir_t;
1956         ')
1957
1958         files_home_filetrans($1, user_home_dir_t, dir)
1959 ')
1960
1961 ########################################
1962 ## <summary>
1963 ##      Do a domain transition to the specified
1964 ##      domain when executing a program in the
1965 ##      user home directory.
1966 ## </summary>
1967 ## <desc>
1968 ##      <p>
1969 ##      Do a domain transition to the specified
1970 ##      domain when executing a program in the
1971 ##      user home directory.
1972 ##      </p>
1973 ##      <p>
1974 ##      No interprocess communication (signals, pipes,
1975 ##      etc.) is provided by this interface since
1976 ##      the domains are not owned by this module.
1977 ##      </p>
1978 ## </desc>
1979 ## <param name="source_domain">
1980 ##      <summary>
1981 ##      Domain allowed to transition.
1982 ##      </summary>
1983 ## </param>
1984 ## <param name="target_domain">
1985 ##      <summary>
1986 ##      Domain to transition to.
1987 ##      </summary>
1988 ## </param>
1989 #
1990 interface(`userdom_user_home_domtrans',`
1991         gen_require(`
1992                 type user_home_dir_t, user_home_t;
1993         ')
1994
1995         domain_auto_trans($1, user_home_t, $2)
1996         allow $1 user_home_dir_t:dir search_dir_perms;
1997         files_search_home($1)
1998 ')
1999
2000 ########################################
2001 ## <summary>
2002 ##      Do not audit attempts to search user home content directories.
2003 ## </summary>
2004 ## <param name="domain">
2005 ##      <summary>
2006 ##      Domain to not audit.
2007 ##      </summary>
2008 ## </param>
2009 #
2010 interface(`userdom_dontaudit_search_user_home_content',`
2011         gen_require(`
2012                 type user_home_t;
2013         ')
2014
2015         dontaudit $1 user_home_t:dir search_dir_perms;
2016         fs_dontaudit_list_nfs($1)
2017         fs_dontaudit_list_cifs($1)
2018 ')
2019
2020 ########################################
2021 ## <summary>
2022 ##      List contents of users home directory.
2023 ## </summary>
2024 ## <param name="domain">
2025 ##      <summary>
2026 ##      Domain allowed access.
2027 ##      </summary>
2028 ## </param>
2029 #
2030 interface(`userdom_list_user_home_content',`
2031         gen_require(`
2032                 type user_home_dir_t;
2033                 attribute user_home_type;
2034         ')
2035
2036         files_list_home($1)
2037         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2038 ')
2039
2040 ########################################
2041 ## <summary>
2042 ##      Create, read, write, and delete directories
2043 ##      in a user home subdirectory.
2044 ## </summary>
2045 ## <param name="domain">
2046 ##      <summary>
2047 ##      Domain allowed access.
2048 ##      </summary>
2049 ## </param>
2050 #
2051 interface(`userdom_manage_user_home_content_dirs',`
2052         gen_require(`
2053                 type user_home_dir_t, user_home_t;
2054         ')
2055
2056         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2057         files_search_home($1)
2058 ')
2059
2060 ########################################
2061 ## <summary>
2062 ##      Delete directories in a user home subdirectory.
2063 ## </summary>
2064 ## <param name="domain">
2065 ##      <summary>
2066 ##      Domain allowed access.
2067 ##      </summary>
2068 ## </param>
2069 #
2070 interface(`userdom_delete_user_home_content_dirs',`
2071         gen_require(`
2072                 type user_home_t;
2073         ')
2074
2075         allow $1 user_home_t:dir delete_dir_perms;
2076 ')
2077
2078 ########################################
2079 ## <summary>
2080 ##      Delete all directories in a user home subdirectory.
2081 ## </summary>
2082 ## <param name="domain">
2083 ##      <summary>
2084 ##      Domain allowed access.
2085 ##      </summary>
2086 ## </param>
2087 #
2088 interface(`userdom_delete_all_user_home_content_dirs',`
2089         gen_require(`
2090                 attribute user_home_type;
2091         ')
2092
2093         allow $1 user_home_type:dir delete_dir_perms;
2094 ')
2095
2096 ########################################
2097 ## <summary>
2098 ##      Set the attributes of user home files.
2099 ## </summary>
2100 ## <param name="domain">
2101 ##      <summary>
2102 ##      Domain allowed access.
2103 ##      </summary>
2104 ## </param>
2105 ## <rolecap/>
2106 #
2107 interface(`userdom_setattr_user_home_content_files',`
2108         gen_require(`
2109                 type user_home_t;
2110         ')
2111
2112         allow $1 user_home_t:file setattr;
2113 ')
2114
2115 ########################################
2116 ## <summary>
2117 ##      Do not audit attempts to set the
2118 ##      attributes of user home files.
2119 ## </summary>
2120 ## <param name="domain">
2121 ##      <summary>
2122 ##      Domain to not audit.
2123 ##      </summary>
2124 ## </param>
2125 #
2126 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2127         gen_require(`
2128                 type user_home_t;
2129         ')
2130
2131         dontaudit $1 user_home_t:file setattr_file_perms;
2132 ')
2133
2134 ########################################
2135 ## <summary>
2136 ##      Set the attributes of all user home directories.
2137 ## </summary>
2138 ## <param name="domain">
2139 ##      <summary>
2140 ##      Domain allowed access.
2141 ##      </summary>
2142 ## </param>
2143 ## <rolecap/>
2144 #
2145 interface(`userdom_setattr_all_user_home_content_dirs',`
2146         gen_require(`
2147                 attribute user_home_type;
2148         ')
2149
2150         allow $1 user_home_type:dir setattr_dir_perms;
2151 ')
2152
2153 ########################################
2154 ## <summary>
2155 ##      Mmap user home files.
2156 ## </summary>
2157 ## <param name="domain">
2158 ##      <summary>
2159 ##      Domain allowed access.
2160 ##      </summary>
2161 ## </param>
2162 #
2163 interface(`userdom_mmap_user_home_content_files',`
2164         gen_require(`
2165                 type user_home_dir_t, user_home_t;
2166         ')
2167
2168         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2169         files_search_home($1)
2170 ')
2171
2172 ########################################
2173 ## <summary>
2174 ##      Read user home files.
2175 ## </summary>
2176 ## <param name="domain">
2177 ##      <summary>
2178 ##      Domain allowed access.
2179 ##      </summary>
2180 ## </param>
2181 #
2182 interface(`userdom_read_user_home_content_files',`
2183         gen_require(`
2184                 type user_home_dir_t, user_home_t;
2185         ')
2186
2187         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2188         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2189         files_search_home($1)
2190 ')
2191
2192 ########################################
2193 ## <summary>
2194 ##      Do not audit attempts to getattr user home files.
2195 ## </summary>
2196 ## <param name="domain">
2197 ##      <summary>
2198 ##      Domain to not audit.
2199 ##      </summary>
2200 ## </param>
2201 #
2202 interface(`userdom_dontaudit_getattr_user_home_content',`
2203         gen_require(`
2204                 attribute user_home_type;
2205         ')
2206
2207         dontaudit $1 user_home_type:dir getattr;
2208         dontaudit $1 user_home_type:file getattr;
2209 ')
2210
2211 ########################################
2212 ## <summary>
2213 ##      Do not audit attempts to read user home files.
2214 ## </summary>
2215 ## <param name="domain">
2216 ##      <summary>
2217 ##      Domain to not audit.
2218 ##      </summary>
2219 ## </param>
2220 #
2221 interface(`userdom_dontaudit_read_user_home_content_files',`
2222         gen_require(`
2223                 attribute user_home_type;
2224                 type user_home_dir_t;
2225         ')
2226
2227         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2228         dontaudit $1 user_home_type:dir list_dir_perms;
2229         dontaudit $1 user_home_type:file read_file_perms;
2230         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2231 ')
2232
2233 ########################################
2234 ## <summary>
2235 ##      Do not audit attempts to append user home files.
2236 ## </summary>
2237 ## <param name="domain">
2238 ##      <summary>
2239 ##      Domain to not audit.
2240 ##      </summary>
2241 ## </param>
2242 #
2243 interface(`userdom_dontaudit_append_user_home_content_files',`
2244         gen_require(`
2245                 type user_home_t;
2246         ')
2247
2248         dontaudit $1 user_home_t:file append_file_perms;
2249 ')
2250
2251 ########################################
2252 ## <summary>
2253 ##      Do not audit attempts to write user home files.
2254 ## </summary>
2255 ## <param name="domain">
2256 ##      <summary>
2257 ##      Domain to not audit.
2258 ##      </summary>
2259 ## </param>
2260 #
2261 interface(`userdom_dontaudit_write_user_home_content_files',`
2262         gen_require(`
2263                 type user_home_t;
2264         ')
2265
2266         dontaudit $1 user_home_t:file write_file_perms;
2267 ')
2268
2269 ########################################
2270 ## <summary>
2271 ##      Delete files in a user home subdirectory.
2272 ## </summary>
2273 ## <param name="domain">
2274 ##      <summary>
2275 ##      Domain allowed access.
2276 ##      </summary>
2277 ## </param>
2278 #
2279 interface(`userdom_delete_user_home_content_files',`
2280         gen_require(`
2281                 type user_home_t;
2282         ')
2283
2284         allow $1 user_home_t:file delete_file_perms;
2285 ')
2286
2287 ########################################
2288 ## <summary>
2289 ##      Delete all files in a user home subdirectory.
2290 ## </summary>
2291 ## <param name="domain">
2292 ##      <summary>
2293 ##      Domain allowed access.
2294 ##      </summary>
2295 ## </param>
2296 #
2297 interface(`userdom_delete_all_user_home_content_files',`
2298         gen_require(`
2299                 attribute user_home_type;
2300         ')
2301
2302         allow $1 user_home_type:file delete_file_perms;
2303 ')
2304
2305 ########################################
2306 ## <summary>
2307 ##      Delete sock files in a user home subdirectory.
2308 ## </summary>
2309 ## <param name="domain">
2310 ##      <summary>
2311 ##      Domain allowed access.
2312 ##      </summary>
2313 ## </param>
2314 #
2315 interface(`userdom_delete_user_home_content_sock_files',`
2316         gen_require(`
2317                 type user_home_t;
2318         ')
2319
2320         allow $1 user_home_t:sock_file delete_file_perms;
2321 ')
2322
2323 ########################################
2324 ## <summary>
2325 ##      Delete all sock files in a user home subdirectory.
2326 ## </summary>
2327 ## <param name="domain">
2328 ##      <summary>
2329 ##      Domain allowed access.
2330 ##      </summary>
2331 ## </param>
2332 #
2333 interface(`userdom_delete_all_user_home_content_sock_files',`
2334         gen_require(`
2335                 attribute user_home_type;
2336         ')
2337
2338         allow $1 user_home_type:sock_file delete_file_perms;
2339 ')
2340
2341 ########################################
2342 ## <summary>
2343 ##      Do not audit attempts to write user home files.
2344 ## </summary>
2345 ## <param name="domain">
2346 ##      <summary>
2347 ##      Domain to not audit.
2348 ##      </summary>
2349 ## </param>
2350 #
2351 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2352         gen_require(`
2353                 type user_home_t;
2354         ')
2355
2356         dontaudit $1 user_home_t:file relabel_file_perms;
2357 ')
2358
2359 ########################################
2360 ## <summary>
2361 ##      Read user home subdirectory symbolic links.
2362 ## </summary>
2363 ## <param name="domain">
2364 ##      <summary>
2365 ##      Domain allowed access.
2366 ##      </summary>
2367 ## </param>
2368 #
2369 interface(`userdom_read_user_home_content_symlinks',`
2370         gen_require(`
2371                 type user_home_dir_t, user_home_t;
2372         ')
2373
2374         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2375 ')
2376
2377 ########################################
2378 ## <summary>
2379 ##      Execute user home files.
2380 ## </summary>
2381 ## <param name="domain">
2382 ##      <summary>
2383 ##      Domain allowed access.
2384 ##      </summary>
2385 ## </param>
2386 ## <rolecap/>
2387 #
2388 interface(`userdom_exec_user_home_content_files',`
2389         gen_require(`
2390                 type user_home_dir_t;
2391                 attribute user_home_type;
2392         ')
2393
2394         files_search_home($1)
2395         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2396         dontaudit $1 user_home_type:sock_file execute;
2397         ')
2398
2399 ########################################
2400 ## <summary>
2401 ##      Do not audit attempts to execute user home files.
2402 ## </summary>
2403 ## <param name="domain">
2404 ##      <summary>
2405 ##      Domain to not audit.
2406 ##      </summary>
2407 ## </param>
2408 #
2409 interface(`userdom_dontaudit_exec_user_home_content_files',`
2410         gen_require(`
2411                 type user_home_t;
2412         ')
2413
2414         dontaudit $1 user_home_t:file exec_file_perms;
2415 ')
2416
2417 ########################################
2418 ## <summary>
2419 ##      Create, read, write, and delete files
2420 ##      in a user home subdirectory.
2421 ## </summary>
2422 ## <param name="domain">
2423 ##      <summary>
2424 ##      Domain allowed access.
2425 ##      </summary>
2426 ## </param>
2427 #
2428 interface(`userdom_manage_user_home_content_files',`
2429         gen_require(`
2430                 type user_home_dir_t, user_home_t;
2431         ')
2432
2433         manage_files_pattern($1, user_home_t, user_home_t)
2434         allow $1 user_home_dir_t:dir search_dir_perms;
2435         files_search_home($1)
2436 ')
2437
2438 ########################################
2439 ## <summary>
2440 ##      Do not audit attempts to create, read, write, and delete directories
2441 ##      in a user home subdirectory.
2442 ## </summary>
2443 ## <param name="domain">
2444 ##      <summary>
2445 ##      Domain to not audit.
2446 ##      </summary>
2447 ## </param>
2448 #
2449 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2450         gen_require(`
2451                 type user_home_dir_t, user_home_t;
2452         ')
2453
2454         dontaudit $1 user_home_t:dir manage_dir_perms;
2455 ')
2456
2457 ########################################
2458 ## <summary>
2459 ##      Create, read, write, and delete symbolic links
2460 ##      in a user home subdirectory.
2461 ## </summary>
2462 ## <param name="domain">
2463 ##      <summary>
2464 ##      Domain allowed access.
2465 ##      </summary>
2466 ## </param>
2467 #
2468 interface(`userdom_manage_user_home_content_symlinks',`
2469         gen_require(`
2470                 type user_home_dir_t, user_home_t;
2471         ')
2472
2473         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2474         allow $1 user_home_dir_t:dir search_dir_perms;
2475         files_search_home($1)
2476 ')
2477
2478 ########################################
2479 ## <summary>
2480 ##      Delete symbolic links in a user home directory.
2481 ## </summary>
2482 ## <param name="domain">
2483 ##      <summary>
2484 ##      Domain allowed access.
2485 ##      </summary>
2486 ## </param>
2487 #
2488 interface(`userdom_delete_user_home_content_symlinks',`
2489         gen_require(`
2490                 type user_home_t;
2491         ')
2492
2493         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2494 ')
2495
2496 ########################################
2497 ## <summary>
2498 ##      Delete all symbolic links in a user home directory.
2499 ## </summary>
2500 ## <param name="domain">
2501 ##      <summary>
2502 ##      Domain allowed access.
2503 ##      </summary>
2504 ## </param>
2505 #
2506 interface(`userdom_delete_all_user_home_content_symlinks',`
2507         gen_require(`
2508                 attribute user_home_type;
2509         ')
2510
2511         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2512 ')
2513
2514 ########################################
2515 ## <summary>
2516 ##      Create, read, write, and delete named pipes
2517 ##      in a user home subdirectory.
2518 ## </summary>
2519 ## <param name="domain">
2520 ##      <summary>
2521 ##      Domain allowed access.
2522 ##      </summary>
2523 ## </param>
2524 #
2525 interface(`userdom_manage_user_home_content_pipes',`
2526         gen_require(`
2527                 type user_home_dir_t, user_home_t;
2528         ')
2529
2530         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2531         allow $1 user_home_dir_t:dir search_dir_perms;
2532         files_search_home($1)
2533 ')
2534
2535 ########################################
2536 ## <summary>
2537 ##      Create, read, write, and delete named sockets
2538 ##      in a user home subdirectory.
2539 ## </summary>
2540 ## <param name="domain">
2541 ##      <summary>
2542 ##      Domain allowed access.
2543 ##      </summary>
2544 ## </param>
2545 #
2546 interface(`userdom_manage_user_home_content_sockets',`
2547         gen_require(`
2548                 type user_home_dir_t, user_home_t;
2549         ')
2550
2551         allow $1 user_home_dir_t:dir search_dir_perms;
2552         manage_sock_files_pattern($1, user_home_t, user_home_t)
2553         files_search_home($1)
2554 ')
2555
2556 ########################################
2557 ## <summary>
2558 ##      Create objects in a user home directory
2559 ##      with an automatic type transition to
2560 ##      a specified private type.
2561 ## </summary>
2562 ## <param name="domain">
2563 ##      <summary>
2564 ##      Domain allowed access.
2565 ##      </summary>
2566 ## </param>
2567 ## <param name="private_type">
2568 ##      <summary>
2569 ##      The type of the object to create.
2570 ##      </summary>
2571 ## </param>
2572 ## <param name="object_class">
2573 ##      <summary>
2574 ##      The class of the object to be created.
2575 ##      </summary>
2576 ## </param>
2577 #
2578 interface(`userdom_user_home_dir_filetrans',`
2579         gen_require(`
2580                 type user_home_dir_t;
2581         ')
2582
2583         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2584         files_search_home($1)
2585 ')
2586
2587 ########################################
2588 ## <summary>
2589 ##      Create objects in a user home directory
2590 ##      with an automatic type transition to
2591 ##      a specified private type.
2592 ## </summary>
2593 ## <param name="domain">
2594 ##      <summary>
2595 ##      Domain allowed access.
2596 ##      </summary>
2597 ## </param>
2598 ## <param name="private_type">
2599 ##      <summary>
2600 ##      The type of the object to create.
2601 ##      </summary>
2602 ## </param>
2603 ## <param name="object_class">
2604 ##      <summary>
2605 ##      The class of the object to be created.
2606 ##      </summary>
2607 ## </param>
2608 #
2609 interface(`userdom_user_home_content_filetrans',`
2610         gen_require(`
2611                 type user_home_dir_t, user_home_t;
2612         ')
2613
2614         filetrans_pattern($1, user_home_t, $2, $3, $4)
2615         allow $1 user_home_dir_t:dir search_dir_perms;
2616         files_search_home($1)
2617 ')
2618
2619 ########################################
2620 ## <summary>
2621 ##      Create objects in a user home directory
2622 ##      with an automatic type transition to
2623 ##      the user home file type.
2624 ## </summary>
2625 ## <param name="domain">
2626 ##      <summary>
2627 ##      Domain allowed access.
2628 ##      </summary>
2629 ## </param>
2630 ## <param name="object_class">
2631 ##      <summary>
2632 ##      The class of the object to be created.
2633 ##      </summary>
2634 ## </param>
2635 #
2636 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2637         gen_require(`
2638                 type user_home_dir_t, user_home_t;
2639         ')
2640
2641         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2642         files_search_home($1)
2643 ')
2644
2645 ########################################
2646 ## <summary>
2647 ##      Write to user temporary named sockets.
2648 ## </summary>
2649 ## <param name="domain">
2650 ##      <summary>
2651 ##      Domain allowed access.
2652 ##      </summary>
2653 ## </param>
2654 #
2655 interface(`userdom_write_user_tmp_sockets',`
2656         gen_require(`
2657                 type user_tmp_t;
2658         ')
2659
2660         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2661         files_search_tmp($1)
2662 ')
2663
2664 ########################################
2665 ## <summary>
2666 ##      List user temporary directories.
2667 ## </summary>
2668 ## <param name="domain">
2669 ##      <summary>
2670 ##      Domain allowed access.
2671 ##      </summary>
2672 ## </param>
2673 #
2674 interface(`userdom_list_user_tmp',`
2675         gen_require(`
2676                 type user_tmp_t;
2677         ')
2678
2679         allow $1 user_tmp_t:dir list_dir_perms;
2680         files_search_tmp($1)
2681 ')
2682
2683 ########################################
2684 ## <summary>
2685 ##      Do not audit attempts to list user
2686 ##      temporary directories.
2687 ## </summary>
2688 ## <param name="domain">
2689 ##      <summary>
2690 ##      Domain to not audit.
2691 ##      </summary>
2692 ## </param>
2693 #
2694 interface(`userdom_dontaudit_list_user_tmp',`
2695         gen_require(`
2696                 type user_tmp_t;
2697         ')
2698
2699         dontaudit $1 user_tmp_t:dir list_dir_perms;
2700 ')
2701
2702 ########################################
2703 ## <summary>
2704 ##      Do not audit attempts to manage users
2705 ##      temporary directories.
2706 ## </summary>
2707 ## <param name="domain">
2708 ##      <summary>
2709 ##      Domain to not audit.
2710 ##      </summary>
2711 ## </param>
2712 #
2713 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2714         gen_require(`
2715                 type user_tmp_t;
2716         ')
2717
2718         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2719 ')
2720
2721 ########################################
2722 ## <summary>
2723 ##      Read user temporary files.
2724 ## </summary>
2725 ## <param name="domain">
2726 ##      <summary>
2727 ##      Domain allowed access.
2728 ##      </summary>
2729 ## </param>
2730 #
2731 interface(`userdom_read_user_tmp_files',`
2732         gen_require(`
2733                 type user_tmp_t;
2734         ')
2735
2736         read_files_pattern($1, user_tmp_t, user_tmp_t)
2737         allow $1 user_tmp_t:dir list_dir_perms;
2738         files_search_tmp($1)
2739 ')
2740
2741 ########################################
2742 ## <summary>
2743 ##      Do not audit attempts to read users
2744 ##      temporary files.
2745 ## </summary>
2746 ## <param name="domain">
2747 ##      <summary>
2748 ##      Domain to not audit.
2749 ##      </summary>
2750 ## </param>
2751 #
2752 interface(`userdom_dontaudit_read_user_tmp_files',`
2753         gen_require(`
2754                 type user_tmp_t;
2755         ')
2756
2757         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2758 ')
2759
2760 ########################################
2761 ## <summary>
2762 ##      Do not audit attempts to append users
2763 ##      temporary files.
2764 ## </summary>
2765 ## <param name="domain">
2766 ##      <summary>
2767 ##      Domain to not audit.
2768 ##      </summary>
2769 ## </param>
2770 #
2771 interface(`userdom_dontaudit_append_user_tmp_files',`
2772         gen_require(`
2773                 type user_tmp_t;
2774         ')
2775
2776         dontaudit $1 user_tmp_t:file append_file_perms;
2777 ')
2778
2779 ########################################
2780 ## <summary>
2781 ##      Read and write user temporary files.
2782 ## </summary>
2783 ## <param name="domain">
2784 ##      <summary>
2785 ##      Domain allowed access.
2786 ##      </summary>
2787 ## </param>
2788 #
2789 interface(`userdom_rw_user_tmp_files',`
2790         gen_require(`
2791                 type user_tmp_t;
2792         ')
2793
2794         allow $1 user_tmp_t:dir list_dir_perms;
2795         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2796         files_search_tmp($1)
2797 ')
2798
2799 ########################################
2800 ## <summary>
2801 ##      Do not audit attempts to manage users
2802 ##      temporary files.
2803 ## </summary>
2804 ## <param name="domain">
2805 ##      <summary>
2806 ##      Domain to not audit.
2807 ##      </summary>
2808 ## </param>
2809 #
2810 interface(`userdom_dontaudit_manage_user_tmp_files',`
2811         gen_require(`
2812                 type user_tmp_t;
2813         ')
2814
2815         dontaudit $1 user_tmp_t:file manage_file_perms;
2816 ')
2817
2818 ########################################
2819 ## <summary>
2820 ##      Read user temporary symbolic links.
2821 ## </summary>
2822 ## <param name="domain">
2823 ##      <summary>
2824 ##      Domain allowed access.
2825 ##      </summary>
2826 ## </param>
2827 #
2828 interface(`userdom_read_user_tmp_symlinks',`
2829         gen_require(`
2830                 type user_tmp_t;
2831         ')
2832
2833         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2834         allow $1 user_tmp_t:dir list_dir_perms;
2835         files_search_tmp($1)
2836 ')
2837
2838 ########################################
2839 ## <summary>
2840 ##      Create, read, write, and delete user
2841 ##      temporary directories.
2842 ## </summary>
2843 ## <param name="domain">
2844 ##      <summary>
2845 ##      Domain allowed access.
2846 ##      </summary>
2847 ## </param>
2848 #
2849 interface(`userdom_manage_user_tmp_dirs',`
2850         gen_require(`
2851                 type user_tmp_t;
2852         ')
2853
2854         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2855         files_search_tmp($1)
2856 ')
2857
2858 ########################################
2859 ## <summary>
2860 ##      Create, read, write, and delete user
2861 ##      temporary files.
2862 ## </summary>
2863 ## <param name="domain">
2864 ##      <summary>
2865 ##      Domain allowed access.
2866 ##      </summary>
2867 ## </param>
2868 #
2869 interface(`userdom_manage_user_tmp_files',`
2870         gen_require(`
2871                 type user_tmp_t;
2872         ')
2873
2874         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2875         files_search_tmp($1)
2876 ')
2877
2878 ########################################
2879 ## <summary>
2880 ##      Create, read, write, and delete user
2881 ##      temporary symbolic links.
2882 ## </summary>
2883 ## <param name="domain">
2884 ##      <summary>
2885 ##      Domain allowed access.
2886 ##      </summary>
2887 ## </param>
2888 #
2889 interface(`userdom_manage_user_tmp_symlinks',`
2890         gen_require(`
2891                 type user_tmp_t;
2892         ')
2893
2894         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2895         files_search_tmp($1)
2896 ')
2897
2898 ########################################
2899 ## <summary>
2900 ##      Create, read, write, and delete user
2901 ##      temporary named pipes.
2902 ## </summary>
2903 ## <param name="domain">
2904 ##      <summary>
2905 ##      Domain allowed access.
2906 ##      </summary>
2907 ## </param>
2908 #
2909 interface(`userdom_manage_user_tmp_pipes',`
2910         gen_require(`
2911                 type user_tmp_t;
2912         ')
2913
2914         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2915         files_search_tmp($1)
2916 ')
2917
2918 ########################################
2919 ## <summary>
2920 ##      Create, read, write, and delete user
2921 ##      temporary named sockets.
2922 ## </summary>
2923 ## <param name="domain">
2924 ##      <summary>
2925 ##      Domain allowed access.
2926 ##      </summary>
2927 ## </param>
2928 #
2929 interface(`userdom_manage_user_tmp_sockets',`
2930         gen_require(`
2931                 type user_tmp_t;
2932         ')
2933
2934         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2935         files_search_tmp($1)
2936 ')
2937
2938 ########################################
2939 ## <summary>
2940 ##      Create objects in a user temporary directory
2941 ##      with an automatic type transition to
2942 ##      a specified private type.
2943 ## </summary>
2944 ## <param name="domain">
2945 ##      <summary>
2946 ##      Domain allowed access.
2947 ##      </summary>
2948 ## </param>
2949 ## <param name="private_type">
2950 ##      <summary>
2951 ##      The type of the object to create.
2952 ##      </summary>
2953 ## </param>
2954 ## <param name="object_class">
2955 ##      <summary>
2956 ##      The class of the object to be created.
2957 ##      </summary>
2958 ## </param>
2959 #
2960 interface(`userdom_user_tmp_filetrans',`
2961         gen_require(`
2962                 type user_tmp_t;
2963         ')
2964
2965         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2966         files_search_tmp($1)
2967 ')
2968
2969 ########################################
2970 ## <summary>
2971 ##      Create objects in the temporary directory
2972 ##      with an automatic type transition to
2973 ##      the user temporary type.
2974 ## </summary>
2975 ## <param name="domain">
2976 ##      <summary>
2977 ##      Domain allowed access.
2978 ##      </summary>
2979 ## </param>
2980 ## <param name="object_class">
2981 ##      <summary>
2982 ##      The class of the object to be created.
2983 ##      </summary>
2984 ## </param>
2985 #
2986 interface(`userdom_tmp_filetrans_user_tmp',`
2987         gen_require(`
2988                 type user_tmp_t;
2989         ')
2990
2991         files_tmp_filetrans($1, user_tmp_t, $2)
2992 ')
2993
2994 #######################################
2995 ## <summary>
2996 ##  Getattr user tmpfs files.
2997 ## </summary>
2998 ## <param name="domain">
2999 ##  <summary>
3000 ##  Domain allowed access.
3001 ##  </summary>
3002 ## </param>
3003 #
3004 interface(`userdom_getattr_user_tmpfs_files',`
3005     gen_require(`
3006         type user_tmpfs_t;
3007     ')
3008
3009     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3010     fs_search_tmpfs($1)
3011 ')
3012
3013 ########################################
3014 ## <summary>
3015 ##      Read user tmpfs files.
3016 ## </summary>
3017 ## <param name="domain">
3018 ##      <summary>
3019 ##      Domain allowed access.
3020 ##      </summary>
3021 ## </param>
3022 #
3023 interface(`userdom_read_user_tmpfs_files',`
3024         gen_require(`
3025                 type user_tmpfs_t;
3026         ')
3027
3028         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3029         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3030         allow $1 user_tmpfs_t:dir list_dir_perms;
3031         fs_search_tmpfs($1)
3032 ')
3033
3034 ########################################
3035 ## <summary>
3036 ##      Read/Write user tmpfs files.
3037 ## </summary>
3038 ## <param name="domain">
3039 ##      <summary>
3040 ##      Domain allowed access.
3041 ##      </summary>
3042 ## </param>
3043 #
3044 interface(`userdom_rw_user_tmpfs_files',`
3045         gen_require(`
3046                 type user_tmpfs_t;
3047         ')
3048
3049         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3050         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3051         allow $1 user_tmpfs_t:dir list_dir_perms;
3052         fs_search_tmpfs($1)
3053 ')
3054
3055 ########################################
3056 ## <summary>
3057 ##      Read/Write inherited user tmpfs files.
3058 ## </summary>
3059 ## <param name="domain">
3060 ##      <summary>
3061 ##      Domain allowed access.
3062 ##      </summary>
3063 ## </param>
3064 #
3065 interface(`userdom_rw_inherited_user_tmpfs_files',`
3066         gen_require(`
3067                 type user_tmpfs_t;
3068         ')
3069
3070         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3071 ')
3072
3073 ########################################
3074 ## <summary>
3075 ##      Execute user tmpfs files.
3076 ## </summary>
3077 ## <param name="domain">
3078 ##      <summary>
3079 ##      Domain allowed access.
3080 ##      </summary>
3081 ## </param>
3082 #
3083 interface(`userdom_execute_user_tmpfs_files',`
3084         gen_require(`
3085                 type user_tmpfs_t;
3086         ')
3087
3088         allow $1 user_tmpfs_t:file execute;
3089 ')
3090
3091 ########################################
3092 ## <summary>
3093 ##      Get the attributes of a user domain tty.
3094 ## </summary>
3095 ## <param name="domain">
3096 ##      <summary>
3097 ##      Domain allowed access.
3098 ##      </summary>
3099 ## </param>
3100 #
3101 interface(`userdom_getattr_user_ttys',`
3102         gen_require(`
3103                 type user_tty_device_t;
3104         ')
3105
3106         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3107 ')
3108
3109 ########################################
3110 ## <summary>
3111 ##      Do not audit attempts to get the attributes of a user domain tty.
3112 ## </summary>
3113 ## <param name="domain">
3114 ##      <summary>
3115 ##      Domain to not audit.
3116 ##      </summary>
3117 ## </param>
3118 #
3119 interface(`userdom_dontaudit_getattr_user_ttys',`
3120         gen_require(`
3121                 type user_tty_device_t;
3122         ')
3123
3124         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3125 ')
3126
3127 ########################################
3128 ## <summary>
3129 ##      Set the attributes of a user domain tty.
3130 ## </summary>
3131 ## <param name="domain">
3132 ##      <summary>
3133 ##      Domain allowed access.
3134 ##      </summary>
3135 ## </param>
3136 #
3137 interface(`userdom_setattr_user_ttys',`
3138         gen_require(`
3139                 type user_tty_device_t;
3140         ')
3141
3142         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3143 ')
3144
3145 ########################################
3146 ## <summary>
3147 ##      Do not audit attempts to set the attributes of a user domain tty.
3148 ## </summary>
3149 ## <param name="domain">
3150 ##      <summary>
3151 ##      Domain to not audit.
3152 ##      </summary>
3153 ## </param>
3154 #
3155 interface(`userdom_dontaudit_setattr_user_ttys',`
3156         gen_require(`
3157                 type user_tty_device_t;
3158         ')
3159
3160         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3161 ')
3162
3163 ########################################
3164 ## <summary>
3165 ##      Read and write a user domain tty.
3166 ## </summary>
3167 ## <param name="domain">
3168 ##      <summary>
3169 ##      Domain allowed access.
3170 ##      </summary>
3171 ## </param>
3172 #
3173 interface(`userdom_use_user_ttys',`
3174         gen_require(`
3175                 type user_tty_device_t;
3176         ')
3177
3178         allow $1 user_tty_device_t:chr_file rw_term_perms;
3179 ')
3180
3181 ########################################
3182 ## <summary>
3183 ##      Read and write a inherited user domain tty.
3184 ## </summary>
3185 ## <param name="domain">
3186 ##      <summary>
3187 ##      Domain allowed access.
3188 ##      </summary>
3189 ## </param>
3190 #
3191 interface(`userdom_use_inherited_user_ttys',`
3192         gen_require(`
3193                 type user_tty_device_t;
3194         ')
3195
3196         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3197 ')
3198
3199 ########################################
3200 ## <summary>
3201 ##      Read and write a user domain pty.
3202 ## </summary>
3203 ## <param name="domain">
3204 ##      <summary>
3205 ##      Domain allowed access.
3206 ##      </summary>
3207 ## </param>
3208 #
3209 interface(`userdom_use_user_ptys',`
3210         gen_require(`
3211                 type user_devpts_t;
3212         ')
3213
3214         allow $1 user_devpts_t:chr_file rw_term_perms;
3215 ')
3216
3217 ########################################
3218 ## <summary>
3219 ##      Read and write a inherited user domain pty.
3220 ## </summary>
3221 ## <param name="domain">
3222 ##      <summary>
3223 ##      Domain allowed access.
3224 ##      </summary>
3225 ## </param>
3226 #
3227 interface(`userdom_use_inherited_user_ptys',`
3228         gen_require(`
3229                 type user_devpts_t;
3230         ')
3231
3232         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3233 ')
3234
3235 ########################################
3236 ## <summary>
3237 ##      Read and write a inherited user TTYs and PTYs.
3238 ## </summary>
3239 ## <desc>
3240 ##      <p>
3241 ##      Allow the specified domain to read and write inherited user
3242 ##      TTYs and PTYs. This will allow the domain to
3243 ##      interact with the user via the terminal. Typically
3244 ##      all interactive applications will require this
3245 ##      access.
3246 ##      </p>
3247 ## </desc>
3248 ## <param name="domain">
3249 ##      <summary>
3250 ##      Domain allowed access.
3251 ##      </summary>
3252 ## </param>
3253 ## <infoflow type="both" weight="10"/>
3254 #
3255 interface(`userdom_use_inherited_user_terminals',`
3256         gen_require(`
3257                 type user_tty_device_t, user_devpts_t;
3258         ')
3259
3260         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3261         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3262 ')
3263
3264 #######################################
3265 ## <summary>
3266 ##  Allow attempts to read and write
3267 ##  a user domain tty and pty.
3268 ## </summary>
3269 ## <param name="domain">
3270 ##  <summary>
3271 ##  Domain to not audit.
3272 ##  </summary>
3273 ## </param>
3274 #
3275 interface(`userdom_use_user_terminals',`
3276     gen_require(`
3277         type user_tty_device_t, user_devpts_t;
3278     ')
3279
3280     allow $1 user_tty_device_t:chr_file rw_term_perms;
3281     allow $1 user_devpts_t:chr_file rw_term_perms;
3282 ')
3283
3284 ########################################
3285 ## <summary>
3286 ##      Do not audit attempts to read and write
3287 ##      a user domain tty and pty.
3288 ## </summary>
3289 ## <param name="domain">
3290 ##      <summary>
3291 ##      Domain to not audit.
3292 ##      </summary>
3293 ## </param>
3294 #
3295 interface(`userdom_dontaudit_use_user_terminals',`
3296         gen_require(`
3297                 type user_tty_device_t, user_devpts_t;
3298         ')
3299
3300         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3301         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3302 ')
3303
3304
3305 ########################################
3306 ## <summary>
3307 ##      Get attributes of user domain tty and pty.
3308 ## </summary>
3309 ## <param name="domain">
3310 ##      <summary>
3311 ##      Domain allowed access.
3312 ##      </summary>
3313 ## </param>
3314 #
3315 interface(`userdom_getattr_user_terminals',`
3316         gen_require(`
3317                 type user_tty_device_t, user_devpts_t;
3318         ')
3319
3320         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3321 ')
3322
3323 ########################################
3324 ## <summary>
3325 ##      Execute a shell in all user domains.  This
3326 ##      is an explicit transition, requiring the
3327 ##      caller to use setexeccon().
3328 ## </summary>
3329 ## <param name="domain">
3330 ##      <summary>
3331 ##      Domain allowed to transition.
3332 ##      </summary>
3333 ## </param>
3334 #
3335 interface(`userdom_spec_domtrans_all_users',`
3336         gen_require(`
3337                 attribute userdomain;
3338         ')
3339
3340         corecmd_shell_spec_domtrans($1, userdomain)
3341         allow userdomain $1:fd use;
3342         allow userdomain $1:fifo_file rw_file_perms;
3343         allow userdomain $1:process sigchld;
3344 ')
3345
3346 ########################################
3347 ## <summary>
3348 ##      Execute an Xserver session in all unprivileged user domains.  This
3349 ##      is an explicit transition, requiring the
3350 ##      caller to use setexeccon().
3351 ## </summary>
3352 ## <param name="domain">
3353 ##      <summary>
3354 ##      Domain allowed to transition.
3355 ##      </summary>
3356 ## </param>
3357 #
3358 interface(`userdom_xsession_spec_domtrans_all_users',`
3359         gen_require(`
3360                 attribute userdomain;
3361         ')
3362
3363         xserver_xsession_spec_domtrans($1, userdomain)
3364         allow userdomain $1:fd use;
3365         allow userdomain $1:fifo_file rw_file_perms;
3366         allow userdomain $1:process sigchld;
3367 ')
3368
3369 ########################################
3370 ## <summary>
3371 ##      Execute a shell in all unprivileged user domains.  This
3372 ##      is an explicit transition, requiring the
3373 ##      caller to use setexeccon().
3374 ## </summary>
3375 ## <param name="domain">
3376 ##      <summary>
3377 ##      Domain allowed to transition.
3378 ##      </summary>
3379 ## </param>
3380 #
3381 interface(`userdom_spec_domtrans_unpriv_users',`
3382         gen_require(`
3383                 attribute unpriv_userdomain;
3384         ')
3385
3386         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3387         allow unpriv_userdomain $1:fd use;
3388         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3389         allow unpriv_userdomain $1:process sigchld;
3390 ')
3391
3392 #####################################
3393 ## <summary>
3394 ##  Allow domain dyntrans to unpriv userdomain.
3395 ## </summary>
3396 ## <param name="domain">
3397 ##  <summary>
3398 ##  Domain allowed access.
3399 ##  </summary>
3400 ## </param>
3401 #
3402 interface(`userdom_dyntransition_unpriv_users',`
3403     gen_require(`
3404         attribute unpriv_userdomain;
3405     ')
3406
3407     allow $1 unpriv_userdomain:process dyntransition;
3408 ')
3409
3410 ########################################
3411 ## <summary>
3412 ##      Execute an Xserver session in all unprivileged user domains.  This
3413 ##      is an explicit transition, requiring the
3414 ##      caller to use setexeccon().
3415 ## </summary>
3416 ## <param name="domain">
3417 ##      <summary>
3418 ##      Domain allowed to transition.
3419 ##      </summary>
3420 ## </param>
3421 #
3422 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3423         gen_require(`
3424                 attribute unpriv_userdomain;
3425         ')
3426
3427         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3428         allow unpriv_userdomain $1:fd use;
3429         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3430         allow unpriv_userdomain $1:process sigchld;
3431 ')
3432
3433 ########################################
3434 ## <summary>
3435 ##      Manage unpriviledged user SysV sempaphores.
3436 ## </summary>
3437 ## <param name="domain">
3438 ##      <summary>
3439 ##      Domain allowed access.
3440 ##      </summary>
3441 ## </param>
3442 #
3443 interface(`userdom_manage_unpriv_user_semaphores',`
3444         gen_require(`
3445                 attribute unpriv_userdomain;
3446         ')
3447
3448         allow $1 unpriv_userdomain:sem create_sem_perms;
3449 ')
3450
3451 ########################################
3452 ## <summary>
3453 ##      Manage unpriviledged user SysV shared
3454 ##      memory segments.
3455 ## </summary>
3456 ## <param name="domain">
3457 ##      <summary>
3458 ##      Domain allowed access.
3459 ##      </summary>
3460 ## </param>
3461 #
3462 interface(`userdom_manage_unpriv_user_shared_mem',`
3463         gen_require(`
3464                 attribute unpriv_userdomain;
3465         ')
3466
3467         allow $1 unpriv_userdomain:shm create_shm_perms;
3468 ')
3469
3470 ########################################
3471 ## <summary>
3472 ##      Execute bin_t in the unprivileged user domains. This
3473 ##      is an explicit transition, requiring the
3474 ##      caller to use setexeccon().
3475 ## </summary>
3476 ## <param name="domain">
3477 ##      <summary>
3478 ##      Domain allowed to transition.
3479 ##      </summary>
3480 ## </param>
3481 #
3482 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3483         gen_require(`
3484                 attribute unpriv_userdomain;
3485         ')
3486
3487         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3488         allow unpriv_userdomain $1:fd use;
3489         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3490         allow unpriv_userdomain $1:process sigchld;
3491 ')
3492
3493 ########################################
3494 ## <summary>
3495 ##      Execute all entrypoint files in unprivileged user
3496 ##      domains. This is an explicit transition, requiring the
3497 ##      caller to use setexeccon().
3498 ## </summary>
3499 ## <param name="domain">
3500 ##      <summary>
3501 ##      Domain allowed access.
3502 ##      </summary>
3503 ## </param>
3504 #
3505 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3506         gen_require(`
3507                 attribute unpriv_userdomain;
3508         ')
3509
3510         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3511         allow unpriv_userdomain $1:fd use;
3512         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3513         allow unpriv_userdomain $1:process sigchld;
3514 ')
3515
3516 ########################################
3517 ## <summary>
3518 ##      Search users home directories.
3519 ## </summary>
3520 ## <param name="domain">
3521 ##      <summary>
3522 ##      Domain allowed access.
3523 ##      </summary>
3524 ## </param>
3525 #
3526 interface(`userdom_search_user_home_content',`
3527         gen_require(`
3528                 type user_home_dir_t;
3529                 attribute user_home_type;
3530         ')
3531
3532         files_list_home($1)
3533         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3534         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3535 ')
3536
3537 ########################################
3538 ## <summary>
3539 ##      Send general signals to unprivileged user domains.
3540 ## </summary>
3541 ## <param name="domain">
3542 ##      <summary>
3543 ##      Domain allowed access.
3544 ##      </summary>
3545 ## </param>
3546 #
3547 interface(`userdom_signal_unpriv_users',`
3548         gen_require(`
3549                 attribute unpriv_userdomain;
3550         ')
3551
3552         allow $1 unpriv_userdomain:process signal;
3553 ')
3554
3555 ########################################
3556 ## <summary>
3557 ##      Inherit the file descriptors from unprivileged user domains.
3558 ## </summary>
3559 ## <param name="domain">
3560 ##      <summary>
3561 ##      Domain allowed access.
3562 ##      </summary>
3563 ## </param>
3564 #
3565 interface(`userdom_use_unpriv_users_fds',`
3566         gen_require(`
3567                 attribute unpriv_userdomain;
3568         ')
3569
3570         allow $1 unpriv_userdomain:fd use;
3571 ')
3572
3573 ########################################
3574 ## <summary>
3575 ##      Do not audit attempts to inherit the file descriptors
3576 ##      from unprivileged user domains.
3577 ## </summary>
3578 ## <desc>
3579 ##      <p>
3580 ##      Do not audit attempts to inherit the file descriptors
3581 ##      from unprivileged user domains. This will supress
3582 ##      SELinux denial messages when the specified domain is denied
3583 ##      the permission to inherit these file descriptors.
3584 ##      </p>
3585 ## </desc>
3586 ## <param name="domain">
3587 ##      <summary>
3588 ##      Domain to not audit.
3589 ##      </summary>
3590 ## </param>
3591 ## <infoflow type="none"/>
3592 #
3593 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3594         gen_require(`
3595                 attribute unpriv_userdomain;
3596         ')
3597
3598         dontaudit $1 unpriv_userdomain:fd use;
3599 ')
3600
3601 ########################################
3602 ## <summary>
3603 ##      Do not audit attempts to use user ptys.
3604 ## </summary>
3605 ## <param name="domain">
3606 ##      <summary>
3607 ##      Domain to not audit.
3608 ##      </summary>
3609 ## </param>
3610 #
3611 interface(`userdom_dontaudit_use_user_ptys',`
3612         gen_require(`
3613                 type user_devpts_t;
3614         ')
3615
3616         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3617 ')
3618
3619 ########################################
3620 ## <summary>
3621 ##      Relabel files to unprivileged user pty types.
3622 ## </summary>
3623 ## <param name="domain">
3624 ##      <summary>
3625 ##      Domain allowed access.
3626 ##      </summary>
3627 ## </param>
3628 #
3629 interface(`userdom_relabelto_user_ptys',`
3630         gen_require(`
3631                 type user_devpts_t;
3632         ')
3633
3634         allow $1 user_devpts_t:chr_file relabelto;
3635 ')
3636
3637 ########################################
3638 ## <summary>
3639 ##      Do not audit attempts to relabel files from
3640 ##      user pty types.
3641 ## </summary>
3642 ## <param name="domain">
3643 ##      <summary>
3644 ##      Domain to not audit.
3645 ##      </summary>
3646 ## </param>
3647 #
3648 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3649         gen_require(`
3650                 type user_devpts_t;
3651         ')
3652
3653         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3654 ')
3655
3656 ########################################
3657 ## <summary>
3658 ##      Write all users files in /tmp
3659 ## </summary>
3660 ## <param name="domain">
3661 ##      <summary>
3662 ##      Domain allowed access.
3663 ##      </summary>
3664 ## </param>
3665 #
3666 interface(`userdom_write_user_tmp_files',`
3667         gen_require(`
3668                 type user_tmp_t;
3669         ')
3670
3671         write_files_pattern($1, user_tmp_t, user_tmp_t)
3672 ')
3673
3674 ########################################
3675 ## <summary>
3676 ##      Do not audit attempts to write users
3677 ##      temporary files.
3678 ## </summary>
3679 ## <param name="domain">
3680 ##      <summary>
3681 ##      Domain to not audit.
3682 ##      </summary>
3683 ## </param>
3684 #
3685 interface(`userdom_dontaudit_write_user_tmp_files',`
3686         gen_require(`
3687                 type user_tmp_t;
3688         ')
3689
3690         dontaudit $1 user_tmp_t:file write;
3691 ')
3692
3693 ########################################
3694 ## <summary>
3695 ##      Do not audit attempts to read/write users
3696 ##      temporary fifo files.
3697 ## </summary>
3698 ## <param name="domain">
3699 ##      <summary>
3700 ##      Domain to not audit.
3701 ##      </summary>
3702 ## </param>
3703 #
3704 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3705         gen_require(`
3706                 type user_tmp_t;
3707         ')
3708
3709         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3710 ')
3711
3712 ########################################
3713 ## <summary>
3714 ##      Do not audit attempts to use user ttys.
3715 ## </summary>
3716 ## <param name="domain">
3717 ##      <summary>
3718 ##      Domain to not audit.
3719 ##      </summary>
3720 ## </param>
3721 #
3722 interface(`userdom_dontaudit_use_user_ttys',`
3723         gen_require(`
3724                 type user_tty_device_t;
3725         ')
3726
3727         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3728 ')
3729
3730 ########################################
3731 ## <summary>
3732 ##      Read the process state of all user domains.
3733 ## </summary>
3734 ## <param name="domain">
3735 ##      <summary>
3736 ##      Domain allowed access.
3737 ##      </summary>
3738 ## </param>
3739 #
3740 interface(`userdom_read_all_users_state',`
3741         gen_require(`
3742                 attribute userdomain;
3743         ')
3744
3745         read_files_pattern($1, userdomain, userdomain)
3746         read_lnk_files_pattern($1,userdomain,userdomain)
3747         kernel_search_proc($1)
3748 ')
3749
3750 ########################################
3751 ## <summary>
3752 ##      Get the attributes of all user domains.
3753 ## </summary>
3754 ## <param name="domain">
3755 ##      <summary>
3756 ##      Domain allowed access.
3757 ##      </summary>
3758 ## </param>
3759 #
3760 interface(`userdom_getattr_all_users',`
3761         gen_require(`
3762                 attribute userdomain;
3763         ')
3764
3765         allow $1 userdomain:process getattr;
3766 ')
3767
3768 ########################################
3769 ## <summary>
3770 ##      Inherit the file descriptors from all user domains
3771 ## </summary>
3772 ## <param name="domain">
3773 ##      <summary>
3774 ##      Domain allowed access.
3775 ##      </summary>
3776 ## </param>
3777 #
3778 interface(`userdom_use_all_users_fds',`
3779         gen_require(`
3780                 attribute userdomain;
3781         ')
3782
3783         allow $1 userdomain:fd use;
3784 ')
3785
3786 ########################################
3787 ## <summary>
3788 ##      Do not audit attempts to inherit the file
3789 ##      descriptors from any user domains.
3790 ## </summary>
3791 ## <param name="domain">
3792 ##      <summary>
3793 ##      Domain to not audit.
3794 ##      </summary>
3795 ## </param>
3796 #
3797 interface(`userdom_dontaudit_use_all_users_fds',`
3798         gen_require(`
3799                 attribute userdomain;
3800         ')
3801
3802         dontaudit $1 userdomain:fd use;
3803 ')
3804
3805 ########################################
3806 ## <summary>
3807 ##      Send general signals to all user domains.
3808 ## </summary>
3809 ## <param name="domain">
3810 ##      <summary>
3811 ##      Domain allowed access.
3812 ##      </summary>
3813 ## </param>
3814 #
3815 interface(`userdom_signal_all_users',`
3816         gen_require(`
3817                 attribute userdomain;
3818         ')
3819
3820         allow $1 userdomain:process signal;
3821 ')
3822
3823 ########################################
3824 ## <summary>
3825 ##      Send kill signals to all user domains.
3826 ## </summary>
3827 ## <param name="domain">
3828 ##      <summary>
3829 ##      Domain allowed access.
3830 ##      </summary>
3831 ## </param>
3832 #
3833 interface(`userdom_kill_all_users',`
3834         gen_require(`
3835                 attribute userdomain;
3836         ')
3837
3838         allow $1 userdomain:process sigkill;
3839 ')
3840
3841 ########################################
3842 ## <summary>
3843 ##      Send a SIGCHLD signal to all user domains.
3844 ## </summary>
3845 ## <param name="domain">
3846 ##      <summary>
3847 ##      Domain allowed access.
3848 ##      </summary>
3849 ## </param>
3850 #
3851 interface(`userdom_sigchld_all_users',`
3852         gen_require(`
3853                 attribute userdomain;
3854         ')
3855
3856         allow $1 userdomain:process sigchld;
3857 ')
3858
3859 ########################################
3860 ## <summary>
3861 ##      Read keys for all user domains.
3862 ## </summary>
3863 ## <param name="domain">
3864 ##      <summary>
3865 ##      Domain allowed access.
3866 ##      </summary>
3867 ## </param>
3868 #
3869 interface(`userdom_read_all_users_keys',`
3870         gen_require(`
3871                 attribute userdomain;
3872         ')
3873
3874         allow $1 userdomain:key read;
3875 ')
3876
3877 ########################################
3878 ## <summary>
3879 ##      Create keys for all user domains.
3880 ## </summary>
3881 ## <param name="domain">
3882 ##      <summary>
3883 ##      Domain allowed access.
3884 ##      </summary>
3885 ## </param>
3886 #
3887 interface(`userdom_create_all_users_keys',`
3888         gen_require(`
3889                 attribute userdomain;
3890         ')
3891
3892         allow $1 userdomain:key create;
3893 ')
3894
3895 ########################################
3896 ## <summary>
3897 ##      Send a dbus message to all user domains.
3898 ## </summary>
3899 ## <param name="domain">
3900 ##      <summary>
3901 ##      Domain allowed access.
3902 ##      </summary>
3903 ## </param>
3904 #
3905 interface(`userdom_dbus_send_all_users',`
3906         gen_require(`
3907                 attribute userdomain;
3908                 class dbus send_msg;
3909         ')
3910
3911         allow $1 userdomain:dbus send_msg;
3912 ')
3913
3914 ########################################
3915 ## <summary>
3916 ##      Allow apps to set rlimits on userdomain
3917 ## </summary>
3918 ## <param name="domain">
3919 ##      <summary>
3920 ##      Domain allowed access.
3921 ##      </summary>
3922 ## </param>
3923 #
3924 interface(`userdom_set_rlimitnh',`
3925         gen_require(`
3926                 attribute userdomain;
3927         ')
3928
3929         allow $1 userdomain:process rlimitinh;
3930 ')
3931
3932 ########################################
3933 ## <summary>
3934 ##      Define this type as a Allow apps to set rlimits on userdomain
3935 ## </summary>
3936 ## <param name="domain">
3937 ##      <summary>
3938 ##      Domain allowed access.
3939 ##      </summary>
3940 ## </param>
3941 ## <param name="userdomain_prefix">
3942 ##      <summary>
3943 ##      The prefix of the user domain (e.g., user
3944 ##      is the prefix for user_t).
3945 ## </summary>
3946 ## </param>
3947 ## <param name="domain">
3948 ##      <summary>
3949 ##      Domain allowed access.
3950 ##      </summary>
3951 ## </param>
3952 #
3953 template(`userdom_unpriv_usertype',`
3954         gen_require(`
3955                 attribute unpriv_userdomain, userdomain;
3956                 attribute $1_usertype;
3957         ')
3958         typeattribute $2  $1_usertype;
3959         typeattribute $2  unpriv_userdomain;
3960         typeattribute $2  userdomain;
3961
3962         auth_use_nsswitch($2)
3963         ubac_constrained($2)
3964 ')
3965
3966 ########################################
3967 ## <summary>
3968 ##      Connect to users over an unix stream socket.
3969 ## </summary>
3970 ## <param name="domain">
3971 ##      <summary>
3972 ##      Domain allowed access.
3973 ##      </summary>
3974 ## </param>
3975 #
3976 interface(`userdom_stream_connect',`
3977         gen_require(`
3978                 type user_tmp_t;
3979                 attribute userdomain;
3980         ')
3981
3982         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3983 ')
3984
3985 ########################################
3986 ## <summary>
3987 ##      Ptrace user domains.
3988 ## </summary>
3989 ## <param name="domain">
3990 ##      <summary>
3991 ##      Domain allowed access.
3992 ##      </summary>
3993 ## </param>
3994 #
3995 interface(`userdom_ptrace_all_users',`
3996         gen_require(`
3997                 attribute userdomain;
3998         ')
3999
4000         tunable_policy(`deny_ptrace',`',`
4001                 allow $1 userdomain:process ptrace;
4002         ')
4003 ')
4004
4005 ########################################
4006 ## <summary>
4007 ##      dontaudit Search /root
4008 ## </summary>
4009 ## <param name="domain">
4010 ##      <summary>
4011 ##      Domain to not audit.
4012 ##      </summary>
4013 ## </param>
4014 #
4015 interface(`userdom_dontaudit_search_admin_dir',`
4016         gen_require(`
4017                 type admin_home_t;
4018         ')
4019
4020         dontaudit $1 admin_home_t:dir search_dir_perms;
4021 ')
4022
4023 ########################################
4024 ## <summary>
4025 ##      dontaudit list /root
4026 ## </summary>
4027 ## <param name="domain">
4028 ##      <summary>
4029 ##      Domain to not audit.
4030 ##      </summary>
4031 ## </param>
4032 #
4033 interface(`userdom_dontaudit_list_admin_dir',`
4034         gen_require(`
4035                 type admin_home_t;
4036         ')
4037
4038         dontaudit $1 admin_home_t:dir list_dir_perms;
4039 ')
4040
4041 ########################################
4042 ## <summary>
4043 ##      Allow domain to  list /root
4044 ## </summary>
4045 ## <param name="domain">
4046 ##      <summary>
4047 ##      Domain allowed access.
4048 ##      </summary>
4049 ## </param>
4050 #
4051 interface(`userdom_list_admin_dir',`
4052         gen_require(`
4053                 type admin_home_t;
4054         ')
4055
4056         allow $1 admin_home_t:dir list_dir_perms;
4057 ')
4058
4059 ########################################
4060 ## <summary>
4061 ##      Allow Search /root
4062 ## </summary>
4063 ## <param name="domain">
4064 ##      <summary>
4065 ##      Domain allowed access.
4066 ##      </summary>
4067 ## </param>
4068 #
4069 interface(`userdom_search_admin_dir',`
4070         gen_require(`
4071                 type admin_home_t;
4072         ')
4073
4074         allow $1 admin_home_t:dir search_dir_perms;
4075 ')
4076
4077 ########################################
4078 ## <summary>
4079 ##      RW unpriviledged user SysV sempaphores.
4080 ## </summary>
4081 ## <param name="domain">
4082 ##      <summary>
4083 ##      Domain allowed access.
4084 ##      </summary>
4085 ## </param>
4086 #
4087 interface(`userdom_rw_semaphores',`
4088         gen_require(`
4089                 attribute unpriv_userdomain;
4090         ')
4091
4092         allow $1 unpriv_userdomain:sem rw_sem_perms;
4093 ')
4094
4095 ########################################
4096 ## <summary>
4097 ##      Send a message to unpriv users over a unix domain
4098 ##      datagram socket.
4099 ## </summary>
4100 ## <param name="domain">
4101 ##      <summary>
4102 ##      Domain allowed access.
4103 ##      </summary>
4104 ## </param>
4105 #
4106 interface(`userdom_dgram_send',`
4107         gen_require(`
4108                 attribute unpriv_userdomain;
4109         ')
4110
4111         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4112 ')
4113
4114 ######################################
4115 ## <summary>
4116 ##      Send a message to users over a unix domain
4117 ##      datagram socket.
4118 ## </summary>
4119 ## <param name="domain">
4120 ##      <summary>
4121 ##      Domain allowed access.
4122 ##      </summary>
4123 ## </param>
4124 #
4125 interface(`userdom_users_dgram_send',`
4126         gen_require(`
4127                  attribute userdomain;
4128       ')
4129
4130        allow $1 userdomain:unix_dgram_socket sendto;
4131 ')
4132
4133 #######################################
4134 ## <summary>
4135 ##      Allow execmod on files in homedirectory
4136 ## </summary>
4137 ## <param name="domain">
4138 ##      <summary>
4139 ##      Domain allowed access.
4140 ##      </summary>
4141 ## </param>
4142 ## <rolebase/>
4143 #
4144 interface(`userdom_execmod_user_home_files',`
4145         gen_require(`
4146                 type user_home_type;
4147         ')
4148
4149         allow $1 user_home_type:file execmod;
4150 ')
4151
4152 ########################################
4153 ## <summary>
4154 ##      Read admin home files.
4155 ## </summary>
4156 ## <param name="domain">
4157 ##      <summary>
4158 ##      Domain allowed access.
4159 ##      </summary>
4160 ## </param>
4161 ## <rolecap/>
4162 #
4163 interface(`userdom_read_admin_home_files',`
4164         gen_require(`
4165                 type admin_home_t;
4166         ')
4167
4168         read_files_pattern($1, admin_home_t, admin_home_t)
4169 ')
4170
4171 ########################################
4172 ## <summary>
4173 ##      Execute admin home files.
4174 ## </summary>
4175 ## <param name="domain">
4176 ##      <summary>
4177 ##      Domain allowed access.
4178 ##      </summary>
4179 ## </param>
4180 ## <rolecap/>
4181 #
4182 interface(`userdom_exec_admin_home_files',`
4183         gen_require(`
4184                 type admin_home_t;
4185         ')
4186
4187         exec_files_pattern($1, admin_home_t, admin_home_t)
4188 ')
4189
4190 ########################################
4191 ## <summary>
4192 ##      Append files inherited
4193 ##      in the /root directory.
4194 ## </summary>
4195 ## <param name="domain">
4196 ##      <summary>
4197 ##      Domain allowed access.
4198 ##      </summary>
4199 ## </param>
4200 #
4201 interface(`userdom_inherit_append_admin_home_files',`
4202         gen_require(`
4203                 type admin_home_t;
4204         ')
4205
4206         allow $1 admin_home_t:file { getattr append };
4207 ')
4208
4209
4210 #######################################
4211 ## <summary>
4212 ##      Manage all files/directories in the homedir
4213 ## </summary>
4214 ## <param name="userdomain">
4215 ##      <summary>
4216 ##      The user domain
4217 ##      </summary>
4218 ## </param>
4219 ## <rolebase/>
4220 #
4221 interface(`userdom_manage_user_home_content',`
4222         gen_require(`
4223                 type user_home_dir_t, user_home_t;
4224                 attribute user_home_type;
4225         ')
4226
4227         files_list_home($1)
4228         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4229         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4230         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4231         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4232         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4233         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4234
4235 ')
4236
4237
4238 ########################################
4239 ## <summary>
4240 ##      Create objects in a user home directory
4241 ##      with an automatic type transition to
4242 ##      the user home file type.
4243 ## </summary>
4244 ## <param name="domain">
4245 ##      <summary>
4246 ##      Domain allowed access.
4247 ##      </summary>
4248 ## </param>
4249 ## <param name="object_class">
4250 ##      <summary>
4251 ##      The class of the object to be created.
4252 ##      </summary>
4253 ## </param>
4254 #
4255 interface(`userdom_user_home_dir_filetrans_pattern',`
4256         gen_require(`
4257                 type user_home_dir_t, user_home_t;
4258         ')
4259
4260         type_transition $1 user_home_dir_t:$2 user_home_t;
4261 ')
4262
4263 ########################################
4264 ## <summary>
4265 ##      Create objects in the /root directory
4266 ##      with an automatic type transition to
4267 ##      a specified private type.
4268 ## </summary>
4269 ## <param name="domain">
4270 ##      <summary>
4271 ##      Domain allowed access.
4272 ##      </summary>
4273 ## </param>
4274 ## <param name="private_type">
4275 ##      <summary>
4276 ##      The type of the object to create.
4277 ##      </summary>
4278 ## </param>
4279 ## <param name="object_class">
4280 ##      <summary>
4281 ##      The class of the object to be created.
4282 ##      </summary>
4283 ## </param>
4284 #
4285 interface(`userdom_admin_home_dir_filetrans',`
4286         gen_require(`
4287                 type admin_home_t;
4288         ')
4289
4290         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4291 ')
4292
4293 ########################################
4294 ## <summary>
4295 ##      Send signull to unprivileged user domains.
4296 ## </summary>
4297 ## <param name="domain">
4298 ##      <summary>
4299 ##      Domain allowed access.
4300 ##      </summary>
4301 ## </param>
4302 #
4303 interface(`userdom_signull_unpriv_users',`
4304         gen_require(`
4305                 attribute unpriv_userdomain;
4306         ')
4307
4308         allow $1 unpriv_userdomain:process signull;
4309 ')
4310
4311 ########################################
4312 ## <summary>
4313 ##      Write all users files in /tmp
4314 ## </summary>
4315 ## <param name="domain">
4316 ##      <summary>
4317 ##      Domain allowed access.
4318 ##      </summary>
4319 ## </param>
4320 #
4321 interface(`userdom_write_user_tmp_dirs',`
4322         gen_require(`
4323                 type user_tmp_t;
4324         ')
4325
4326         write_files_pattern($1, user_tmp_t, user_tmp_t)
4327 ')
4328
4329 ########################################
4330 ## <summary>
4331 ##      Manage keys for all user domains.
4332 ## </summary>
4333 ## <param name="domain">
4334 ##      <summary>
4335 ##      Domain allowed access.
4336 ##      </summary>
4337 ## </param>
4338 #
4339 interface(`userdom_manage_all_users_keys',`
4340         gen_require(`
4341                 attribute userdomain;
4342         ')
4343
4344         allow $1 userdomain:key manage_key_perms;
4345 ')
4346
4347
4348 ########################################
4349 ## <summary>
4350 ##      Do not audit attempts to read and write
4351 ##      unserdomain stream.
4352 ## </summary>
4353 ## <param name="domain">
4354 ##      <summary>
4355 ##      Domain to not audit.
4356 ##      </summary>
4357 ## </param>
4358 #
4359 interface(`userdom_dontaudit_rw_stream',`
4360         gen_require(`
4361                 attribute userdomain;
4362         ')
4363
4364         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4365 ')
4366
4367 ########################################
4368 ## <summary>
4369 ##      Do not audit attempts to read and write
4370 ##      unserdomain datagram socket.
4371 ## </summary>
4372 ## <param name="domain">
4373 ##      <summary>
4374 ##      Domain to not audit.
4375 ##      </summary>
4376 ## </param>
4377 #
4378 interface(`userdom_dontaudit_rw_dgram_socket',`
4379         gen_require(`
4380                 attribute userdomain;
4381         ')
4382
4383         dontaudit $1 userdomain:unix_dgram_socket { read write };
4384 ')
4385
4386 ########################################
4387 ## <summary>
4388 ##      Append files
4389 ##      in a user home subdirectory.
4390 ## </summary>
4391 ## <param name="domain">
4392 ##      <summary>
4393 ##      Domain allowed access.
4394 ##      </summary>
4395 ## </param>
4396 #
4397 interface(`userdom_append_user_home_content_files',`
4398         gen_require(`
4399                 type user_home_dir_t, user_home_t;
4400         ')
4401
4402         append_files_pattern($1, user_home_t, user_home_t)
4403         allow $1 user_home_dir_t:dir search_dir_perms;
4404         files_search_home($1)
4405 ')
4406
4407 ########################################
4408 ## <summary>
4409 ##      Read files inherited
4410 ##      in a user home subdirectory.
4411 ## </summary>
4412 ## <param name="domain">
4413 ##      <summary>
4414 ##      Domain allowed access.
4415 ##      </summary>
4416 ## </param>
4417 #
4418 interface(`userdom_read_inherited_user_home_content_files',`
4419         gen_require(`
4420                 attribute user_home_type;
4421         ')
4422
4423         allow $1 user_home_type:file { getattr read };
4424 ')
4425
4426 ########################################
4427 ## <summary>
4428 ##      Append files inherited
4429 ##      in a user home subdirectory.
4430 ## </summary>
4431 ## <param name="domain">
4432 ##      <summary>
4433 ##      Domain allowed access.
4434 ##      </summary>
4435 ## </param>
4436 #
4437 interface(`userdom_inherit_append_user_home_content_files',`
4438         gen_require(`
4439                 type user_home_t;
4440         ')
4441
4442         allow $1 user_home_t:file { getattr append };
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      Append files inherited
4448 ##      in a user tmp files.
4449 ## </summary>
4450 ## <param name="domain">
4451 ##      <summary>
4452 ##      Domain allowed access.
4453 ##      </summary>
4454 ## </param>
4455 #
4456 interface(`userdom_inherit_append_user_tmp_files',`
4457         gen_require(`
4458                 type user_tmp_t;
4459         ')
4460
4461         allow $1 user_tmp_t:file { getattr append };
4462 ')
4463
4464 ######################################
4465 ## <summary>
4466 ##      Read audio files in the users homedir.
4467 ## </summary>
4468 ## <param name="domain">
4469 ##      <summary>
4470 ##      Domain allowed access.
4471 ##      </summary>
4472 ## </param>
4473 ## <rolecap/>
4474 #
4475 interface(`userdom_read_home_audio_files',`
4476         gen_require(`
4477                 type audio_home_t;
4478         ')
4479
4480         userdom_search_user_home_dirs($1)
4481         allow $1 audio_home_t:dir list_dir_perms;
4482         read_files_pattern($1, audio_home_t, audio_home_t)
4483         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4484 ')
4485
4486 ########################################
4487 ## <summary>
4488 ##      Do not audit attempts to write all user home content files.
4489 ## </summary>
4490 ## <param name="domain">
4491 ##      <summary>
4492 ##      Domain to not audit.
4493 ##      </summary>
4494 ## </param>
4495 #
4496 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4497         gen_require(`
4498                 attribute user_home_type;
4499         ')
4500
4501         dontaudit $1 user_home_type:file write_file_perms;
4502 ')
4503
4504 ########################################
4505 ## <summary>
4506 ##      Do not audit attempts to write all user tmp content files.
4507 ## </summary>
4508 ## <param name="domain">
4509 ##      <summary>
4510 ##      Domain to not audit.
4511 ##      </summary>
4512 ## </param>
4513 #
4514 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4515         gen_require(`
4516                 attribute user_tmp_type;
4517         ')
4518
4519         dontaudit $1 user_tmp_type:file write_file_perms;
4520 ')
4521
4522 ########################################
4523 ## <summary>
4524 ##      Manage all user temporary content.
4525 ## </summary>
4526 ## <param name="domain">
4527 ##      <summary>
4528 ##      Domain allowed access.
4529 ##      </summary>
4530 ## </param>
4531 #
4532 interface(`userdom_manage_all_user_tmp_content',`
4533         gen_require(`
4534                 attribute user_tmp_type;
4535         ')
4536
4537         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4538         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4539         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4540         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4541         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4542         files_search_tmp($1)
4543 ')
4544
4545 ########################################
4546 ## <summary>
4547 ##      List all user temporary content.
4548 ## </summary>
4549 ## <param name="domain">
4550 ##      <summary>
4551 ##      Domain allowed access.
4552 ##      </summary>
4553 ## </param>
4554 #
4555 interface(`userdom_list_all_user_tmp_content',`
4556         gen_require(`
4557                 attribute user_tmp_type;
4558         ')
4559
4560         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4561         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4562         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4563         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4564         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4565         files_search_var($1)
4566         files_search_tmp($1)
4567 ')
4568
4569 ########################################
4570 ## <summary>
4571 ##      Manage all user tmpfs content.
4572 ## </summary>
4573 ## <param name="domain">
4574 ##      <summary>
4575 ##      Domain allowed access.
4576 ##      </summary>
4577 ## </param>
4578 #
4579 interface(`userdom_manage_all_user_tmpfs_content',`
4580         gen_require(`
4581                 attribute user_tmpfs_type;
4582         ')
4583
4584         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4585         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4586         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4587         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4588         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4589         fs_search_tmpfs($1)
4590 ')
4591
4592 ########################################
4593 ## <summary>
4594 ##      Delete all user temporary content.
4595 ## </summary>
4596 ## <param name="domain">
4597 ##      <summary>
4598 ##      Domain allowed access.
4599 ##      </summary>
4600 ## </param>
4601 #
4602 interface(`userdom_delete_all_user_tmp_content',`
4603         gen_require(`
4604                 attribute user_tmp_type;
4605         ')
4606
4607         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4608         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4609         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4610         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4611         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4612         # /var/tmp
4613         files_search_var($1)
4614         files_delete_tmp_dir_entry($1)
4615 ')
4616
4617 ########################################
4618 ## <summary>
4619 ##      Read system SSL certificates in the users homedir.
4620 ## </summary>
4621 ## <param name="domain">
4622 ##      <summary>
4623 ##      Domain allowed access.
4624 ##      </summary>
4625 ## </param>
4626 #
4627 interface(`userdom_read_home_certs',`
4628         gen_require(`
4629                 type home_cert_t;
4630         ')
4631
4632         userdom_search_user_home_content($1)
4633         allow $1 home_cert_t:dir list_dir_perms;
4634         read_files_pattern($1, home_cert_t, home_cert_t)
4635         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4636 ')
4637
4638 ########################################
4639 ## <summary>
4640 ##      Manage system SSL certificates in the users homedir.
4641 ## </summary>
4642 ## <param name="domain">
4643 ##      <summary>
4644 ##      Domain allowed access.
4645 ##      </summary>
4646 ## </param>
4647 #
4648 interface(`userdom_manage_home_certs',`
4649         gen_require(`
4650                 type home_cert_t;
4651         ')
4652
4653         allow $1 home_cert_t:dir list_dir_perms;
4654         manage_files_pattern($1, home_cert_t, home_cert_t)
4655         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4656
4657         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4658         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4659 ')
4660
4661 #######################################
4662 ## <summary>
4663 ##  Dontaudit Write system SSL certificates in the users homedir.
4664 ## </summary>
4665 ## <param name="domain">
4666 ##  <summary>
4667 ##      Domain to not audit.
4668 ##  </summary>
4669 ## </param>
4670 #
4671 interface(`userdom_dontaudit_write_home_certs',`
4672     gen_require(`
4673         type home_cert_t;
4674     ')
4675
4676     dontaudit $1 home_cert_t:file write;
4677 ')
4678
4679 ########################################
4680 ## <summary>
4681 ##      dontaudit Search getatrr /root files
4682 ## </summary>
4683 ## <param name="domain">
4684 ##      <summary>
4685 ##      Domain to not audit.
4686 ##      </summary>
4687 ## </param>
4688 #
4689 interface(`userdom_dontaudit_getattr_admin_home_files',`
4690         gen_require(`
4691                 type admin_home_t;
4692         ')
4693
4694         dontaudit $1 admin_home_t:file getattr;
4695 ')
4696
4697 ########################################
4698 ## <summary>
4699 ##      dontaudit read /root lnk files
4700 ## </summary>
4701 ## <param name="domain">
4702 ##      <summary>
4703 ##      Domain to not audit.
4704 ##      </summary>
4705 ## </param>
4706 #
4707 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4708         gen_require(`
4709                 type admin_home_t;
4710         ')
4711
4712         dontaudit $1 admin_home_t:lnk_file read;
4713 ')
4714
4715 ########################################
4716 ## <summary>
4717 ##      dontaudit read /root files
4718 ## </summary>
4719 ## <param name="domain">
4720 ##      <summary>
4721 ##      Domain to not audit.
4722 ##      </summary>
4723 ## </param>
4724 #
4725 interface(`userdom_dontaudit_read_admin_home_files',`
4726         gen_require(`
4727                 type admin_home_t;
4728         ')
4729
4730         dontaudit $1 admin_home_t:file read_file_perms;
4731 ')
4732
4733 ########################################
4734 ## <summary>
4735 ##      Create, read, write, and delete user
4736 ##      temporary chr files.
4737 ## </summary>
4738 ## <param name="domain">
4739 ##      <summary>
4740 ##      Domain allowed access.
4741 ##      </summary>
4742 ## </param>
4743 #
4744 interface(`userdom_manage_user_tmp_chr_files',`
4745         gen_require(`
4746                 type user_tmp_t;
4747         ')
4748
4749         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4750         files_search_tmp($1)
4751 ')
4752
4753 ########################################
4754 ## <summary>
4755 ##      Create, read, write, and delete user
4756 ##      temporary blk files.
4757 ## </summary>
4758 ## <param name="domain">
4759 ##      <summary>
4760 ##      Domain allowed access.
4761 ##      </summary>
4762 ## </param>
4763 #
4764 interface(`userdom_manage_user_tmp_blk_files',`
4765         gen_require(`
4766                 type user_tmp_t;
4767         ')
4768
4769         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4770         files_search_tmp($1)
4771 ')
4772
4773 ########################################
4774 ## <summary>
4775 ##      Dontaudit attempt to set attributes on  user temporary directories.
4776 ## </summary>
4777 ## <param name="domain">
4778 ##      <summary>
4779 ##      Domain to not audit.
4780 ##      </summary>
4781 ## </param>
4782 #
4783 interface(`userdom_dontaudit_setattr_user_tmp',`
4784         gen_require(`
4785                 type user_tmp_t;
4786         ')
4787
4788         dontaudit $1 user_tmp_t:dir setattr;
4789 ')
4790
4791 ########################################
4792 ## <summary>
4793 ##      Read all inherited users files in /tmp
4794 ## </summary>
4795 ## <param name="domain">
4796 ##      <summary>
4797 ##      Domain allowed access.
4798 ##      </summary>
4799 ## </param>
4800 #
4801 interface(`userdom_read_inherited_user_tmp_files',`
4802         gen_require(`
4803                 type user_tmp_t;
4804         ')
4805
4806         allow $1 user_tmp_t:file read_inherited_file_perms;
4807 ')
4808
4809 ########################################
4810 ## <summary>
4811 ##      Write all inherited users files in /tmp
4812 ## </summary>
4813 ## <param name="domain">
4814 ##      <summary>
4815 ##      Domain allowed access.
4816 ##      </summary>
4817 ## </param>
4818 #
4819 interface(`userdom_write_inherited_user_tmp_files',`
4820         gen_require(`
4821                 type user_tmp_t;
4822         ')
4823
4824         allow $1 user_tmp_t:file write;
4825 ')
4826
4827 ########################################
4828 ## <summary>
4829 ##      Delete all users files in /tmp
4830 ## </summary>
4831 ## <param name="domain">
4832 ##      <summary>
4833 ##      Domain allowed access.
4834 ##      </summary>
4835 ## </param>
4836 #
4837 interface(`userdom_delete_user_tmp_files',`
4838         gen_require(`
4839                 type user_tmp_t;
4840         ')
4841
4842         allow $1 user_tmp_t:file delete_file_perms;
4843 ')
4844
4845 ########################################
4846 ## <summary>
4847 ##      Delete user tmpfs files.
4848 ## </summary>
4849 ## <param name="domain">
4850 ##      <summary>
4851 ##      Domain allowed access.
4852 ##      </summary>
4853 ## </param>
4854 #
4855 interface(`userdom_delete_user_tmpfs_files',`
4856         gen_require(`
4857                 type user_tmpfs_t;
4858         ')
4859
4860         allow $1 user_tmpfs_t:file delete_file_perms;
4861 ')
4862
4863 ########################################
4864 ## <summary>
4865 ##      Read/Write unpriviledged user SysV shared
4866 ##      memory segments.
4867 ## </summary>
4868 ## <param name="domain">
4869 ##      <summary>
4870 ##      Domain allowed access.
4871 ##      </summary>
4872 ## </param>
4873 #
4874 interface(`userdom_rw_unpriv_user_shared_mem',`
4875         gen_require(`
4876                 attribute unpriv_userdomain;
4877         ')
4878
4879         allow $1 unpriv_userdomain:shm rw_shm_perms;
4880 ')
4881
4882 ########################################
4883 ## <summary>
4884 ##      Do not audit attempts to search user
4885 ##      temporary directories.
4886 ## </summary>
4887 ## <param name="domain">
4888 ##      <summary>
4889 ##      Domain to not audit.
4890 ##      </summary>
4891 ## </param>
4892 #
4893 interface(`userdom_dontaudit_search_user_tmp',`
4894         gen_require(`
4895                 type user_tmp_t;
4896         ')
4897
4898         dontaudit $1 user_tmp_t:dir search_dir_perms;
4899 ')
4900
4901 ########################################
4902 ## <summary>
4903 ##      Execute a file in a user home directory
4904 ##      in the specified domain.
4905 ## </summary>
4906 ## <desc>
4907 ##      <p>
4908 ##      Execute a file in a user home directory
4909 ##      in the specified domain.
4910 ##      </p>
4911 ##      <p>
4912 ##      No interprocess communication (signals, pipes,
4913 ##      etc.) is provided by this interface since
4914 ##      the domains are not owned by this module.
4915 ##      </p>
4916 ## </desc>
4917 ## <param name="domain">
4918 ##      <summary>
4919 ##      Domain allowed access.
4920 ##      </summary>
4921 ## </param>
4922 ## <param name="target_domain">
4923 ##      <summary>
4924 ##      The type of the new process.
4925 ##      </summary>
4926 ## </param>
4927 #
4928 interface(`userdom_domtrans_user_home',`
4929         gen_require(`
4930                 type user_home_t;
4931         ')
4932
4933         read_lnk_files_pattern($1, user_home_t, user_home_t)
4934         domain_transition_pattern($1, user_home_t, $2)
4935         type_transition $1 user_home_t:process $2;
4936 ')
4937
4938 ########################################
4939 ## <summary>
4940 ##      Execute a file in a user tmp directory
4941 ##      in the specified domain.
4942 ## </summary>
4943 ## <desc>
4944 ##      <p>
4945 ##      Execute a file in a user tmp directory
4946 ##      in the specified domain.
4947 ##      </p>
4948 ##      <p>
4949 ##      No interprocess communication (signals, pipes,
4950 ##      etc.) is provided by this interface since
4951 ##      the domains are not owned by this module.
4952 ##      </p>
4953 ## </desc>
4954 ## <param name="domain">
4955 ##      <summary>
4956 ##      Domain allowed access.
4957 ##      </summary>
4958 ## </param>
4959 ## <param name="target_domain">
4960 ##      <summary>
4961 ##      The type of the new process.
4962 ##      </summary>
4963 ## </param>
4964 #
4965 interface(`userdom_domtrans_user_tmp',`
4966         gen_require(`
4967                 type user_tmp_t;
4968         ')
4969
4970         files_search_tmp($1)
4971         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4972         domain_transition_pattern($1, user_tmp_t, $2)
4973         type_transition $1 user_tmp_t:process $2;
4974 ')
4975
4976 ########################################
4977 ## <summary>
4978 ##      Do not audit attempts to read all user home content files.
4979 ## </summary>
4980 ## <param name="domain">
4981 ##      <summary>
4982 ##      Domain to not audit.
4983 ##      </summary>
4984 ## </param>
4985 #
4986 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4987         gen_require(`
4988                 attribute user_home_type;
4989         ')
4990
4991         dontaudit $1 user_home_type:file read_file_perms;
4992 ')
4993
4994 ########################################
4995 ## <summary>
4996 ##      Do not audit attempts to read all user tmp content files.
4997 ## </summary>
4998 ## <param name="domain">
4999 ##      <summary>
5000 ##      Domain to not audit.
5001 ##      </summary>
5002 ## </param>
5003 #
5004 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5005         gen_require(`
5006                 attribute user_tmp_type;
5007         ')
5008
5009         dontaudit $1 user_tmp_type:file read_file_perms;
5010 ')
5011
5012 #######################################
5013 ## <summary>
5014 ## Read and write unpriviledged user SysV sempaphores.
5015 ## </summary>
5016 ## <param name="domain">
5017 ## <summary>
5018 ## Domain allowed access.
5019 ## </summary>
5020 ## </param>
5021 #
5022 interface(`userdom_rw_unpriv_user_semaphores',`
5023    gen_require(`
5024        attribute unpriv_userdomain;
5025    ')
5026
5027    allow $1 unpriv_userdomain:sem rw_sem_perms;
5028 ')
5029
5030 ########################################
5031 ## <summary>
5032 ##      Transition to userdom named content
5033 ## </summary>
5034 ## <param name="domain">
5035 ##      <summary>
5036 ##      Domain allowed access.
5037 ##      </summary>
5038 ## </param>
5039 #
5040 interface(`userdom_filetrans_home_content',`
5041         gen_require(`
5042                 type home_bin_t, home_cert_t;
5043                 type audio_home_t;
5044         ')
5045
5046         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5047         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5048         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5049         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5050         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5051         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5052         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5053
5054         #optional_policy(`
5055         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5056         #')
5057 ')
5058
5059 ########################################
5060 ## <summary>
5061 ##      Make the specified type able to read content in user home dirs
5062 ## </summary>
5063 ## <param name="type">
5064 ##      <summary>
5065 ##      Domain allowed access.
5066 ##      </summary>
5067 ## </param>
5068 #
5069 interface(`userdom_home_reader',`
5070         gen_require(`
5071                 attribute userdom_home_reader_type;
5072         ')
5073
5074         typeattribute $1 userdom_home_reader_type;
5075 ')
5076
5077
5078 ########################################
5079 ## <summary>
5080 ##      Make the specified type able to manage content in user home dirs
5081 ## </summary>
5082 ## <param name="type">
5083 ##      <summary>
5084 ##      Domain allowed access.
5085 ##      </summary>
5086 ## </param>
5087 #
5088 interface(`userdom_home_manager',`
5089         gen_require(`
5090                 attribute userdom_home_manager_type;
5091         ')
5092
5093         typeattribute $1 userdom_home_manager_type;
5094 ')
5095