policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 alsa_read_rw_config($1_usertype)
 676                 alsa_manage_home_files($1_t)
 677                 alsa_relabel_home_files($1_t)
 678                 alsa_filetrans_named_content($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 chrome_role($1_r, $1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 colord_read_lib_files($1_usertype)
 696         ')
 697
 698         optional_policy(`
 699                 dbus_system_bus_client($1_usertype)
 700
 701                 allow $1_usertype $1_usertype:dbus  send_msg;
 702
 703                 optional_policy(`
 704                         avahi_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         policykit_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         bluetooth_dbus_chat($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         consolekit_dbus_chat($1_usertype)
 717                         consolekit_read_log($1_usertype)
 718                 ')
 719
 720                 optional_policy(`
 721                         devicekit_dbus_chat($1_usertype)
 722                         devicekit_dbus_chat_power($1_usertype)
 723                         devicekit_dbus_chat_disk($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         evolution_dbus_chat($1_usertype)
 728                         evolution_alarm_dbus_chat($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         gnome_dbus_chat_gconfdefault($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         hal_dbus_chat($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         kde_dbus_chat_backlighthelper($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         modemmanager_dbus_chat($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         networkmanager_dbus_chat($1_usertype)
 749                         networkmanager_read_lib_files($1_usertype)
 750                 ')
 751
 752                 optional_policy(`
 753                         vpn_dbus_chat($1_usertype)
 754                 ')
 755         ')
 756
 757         optional_policy(`
 758                 git_session_role($1_r, $1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inetd_use_fds($1_usertype)
 763                 inetd_rw_tcp_sockets($1_usertype)
 764         ')
 765
 766         optional_policy(`
 767                 inn_read_config($1_usertype)
 768                 inn_read_news_lib($1_usertype)
 769                 inn_read_news_spool($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 lircd_stream_connect($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 locate_read_lib_files($1_usertype)
 778         ')
 779
 780         # for running depmod as part of the kernel packaging process
 781         optional_policy(`
 782                 modutils_read_module_config($1_usertype)
 783         ')
 784
 785         optional_policy(`
 786                 mta_rw_spool($1_usertype)
 787                 mta_manage_queue($1_usertype)
 788                 mta_filetrans_home_content($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 nsplugin_role($1_r, $1_usertype)
 793         ')
 794
 795         optional_policy(`
 796                 tunable_policy(`allow_user_mysql_connect',`
 797                         mysql_stream_connect($1_t)
 798                 ')
 799         ')
 800
 801         optional_policy(`
 802                 oident_manage_user_content($1_t)
 803                 oident_relabel_user_content($1_t)
 804         ')
 805
 806         optional_policy(`
 807                 # to allow monitoring of pcmcia status
 808                 pcmcia_read_pid($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 pcscd_read_pub_files($1_usertype)
 813                 pcscd_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 tunable_policy(`allow_user_postgresql_connect',`
 818                         postgresql_stream_connect($1_usertype)
 819                         postgresql_tcp_connect($1_usertype)
 820                 ')
 821         ')
 822
 823         optional_policy(`
 824                 resmgr_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpc_dontaudit_getattr_exports($1_usertype)
 829                 rpc_manage_nfs_rw_content($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 rpcbind_stream_connect($1_usertype)
 834         ')
 835
 836         optional_policy(`
 837                 samba_stream_connect_winbind($1_usertype)
 838         ')
 839
 840         optional_policy(`
 841                 sandbox_transition($1_usertype, $1_r)
 842         ')
 843
 844         optional_policy(`
 845                 seunshare_role_template($1, $1_r, $1_t)
 846         ')
 847
 848         optional_policy(`
 849                 slrnpull_search_spool($1_usertype)
 850         ')
 851
 852 ')
 853
 854 #######################################
 855 ## <summary>
 856 ##      The template for creating a login user.
 857 ## </summary>
 858 ## <desc>
 859 ##      <p>
 860 ##      This template creates a user domain, types, and
 861 ##      rules for the user's tty, pty, home directories,
 862 ##      tmp, and tmpfs files.
 863 ##      </p>
 864 ## </desc>
 865 ## <param name="userdomain_prefix">
 866 ##      <summary>
 867 ##      The prefix of the user domain (e.g., user
 868 ##      is the prefix for user_t).
 869 ##      </summary>
 870 ## </param>
 871 #
 872 template(`userdom_login_user_template', `
 873         gen_require(`
 874                 class context contains;
 875         ')
 876
 877         userdom_base_user_template($1)
 878
 879         userdom_manage_home_role($1_r, $1_usertype)
 880
 881         userdom_manage_tmp_role($1_r, $1_usertype)
 882         userdom_manage_tmpfs_role($1_r, $1_usertype)
 883
 884         ifelse(`$1',`unconfined',`',`
 885                 gen_tunable(allow_$1_exec_content, true)
 886
 887                 tunable_policy(`allow_$1_exec_content',`
 888                         userdom_exec_user_tmp_files($1_usertype)
 889                         userdom_exec_user_home_content_files($1_usertype)
 890                 ')
 891                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 892                         fs_exec_nfs_files($1_usertype)
 893                 ')
 894
 895                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 896                         fs_exec_cifs_files($1_usertype)
 897                 ')
 898         ')
 899
 900         userdom_change_password_template($1)
 901
 902         ##############################
 903         #
 904         # User domain Local policy
 905         #
 906
 907         allow $1_t self:capability { setgid chown fowner };
 908         dontaudit $1_t self:capability { sys_nice fsetid };
 909
 910         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 911         dontaudit $1_t self:process setrlimit;
 912         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 913
 914         allow $1_t self:context contains;
 915
 916         kernel_dontaudit_read_system_state($1_usertype)
 917         kernel_dontaudit_list_all_proc($1_usertype)
 918
 919         dev_read_sysfs($1_usertype)
 920         dev_read_urand($1_usertype)
 921
 922         domain_use_interactive_fds($1_usertype)
 923         # Command completion can fire hundreds of denials
 924         domain_dontaudit_exec_all_entry_files($1_usertype)
 925
 926         files_dontaudit_list_default($1_usertype)
 927         files_dontaudit_read_default_files($1_usertype)
 928         # Stat lost+found.
 929         files_getattr_lost_found_dirs($1_usertype)
 930
 931         fs_get_all_fs_quotas($1_usertype)
 932         fs_getattr_all_fs($1_usertype)
 933         fs_search_all($1_usertype)
 934         fs_list_inotifyfs($1_usertype)
 935         fs_rw_anon_inodefs_files($1_usertype)
 936
 937         auth_dontaudit_write_login_records($1_t)
 938         auth_rw_cache($1_t)
 939
 940         application_exec_all($1_t)
 941         # The library functions always try to open read-write first,
 942         # then fall back to read-only if it fails.
 943         init_dontaudit_rw_utmp($1_t)
 944
 945         # Stop warnings about access to /dev/console
 946         init_dontaudit_use_fds($1_usertype)
 947         init_dontaudit_use_script_fds($1_usertype)
 948
 949         libs_exec_lib_files($1_usertype)
 950
 951         logging_dontaudit_getattr_all_logs($1_usertype)
 952
 953         # for running TeX programs
 954         miscfiles_read_tetex_data($1_usertype)
 955         miscfiles_exec_tetex_data($1_usertype)
 956
 957         seutil_read_config($1_usertype)
 958
 959         optional_policy(`
 960                 cups_read_config($1_usertype)
 961                 cups_stream_connect($1_usertype)
 962                 cups_stream_connect_ptal($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 kerberos_use($1_usertype)
 967                 kerberos_filetrans_home_content($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 mta_dontaudit_read_spool_symlinks($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 quota_dontaudit_getattr_db($1_usertype)
 976         ')
 977
 978         optional_policy(`
 979                 rpm_read_db($1_usertype)
 980                 rpm_dontaudit_manage_db($1_usertype)
 981                 rpm_read_cache($1_usertype)
 982         ')
 983
 984         optional_policy(`
 985                 oddjob_run_mkhomedir($1_t, $1_r)
 986         ')
 987 ')
 988
 989 #######################################
 990 ## <summary>
 991 ##      The template for creating a unprivileged login user.
 992 ## </summary>
 993 ## <desc>
 994 ##      <p>
 995 ##      This template creates a user domain, types, and
 996 ##      rules for the user's tty, pty, home directories,
 997 ##      tmp, and tmpfs files.
 998 ##      </p>
 999 ## </desc>
1000 ## <param name="userdomain_prefix">
1001 ##      <summary>
1002 ##      The prefix of the user domain (e.g., user
1003 ##      is the prefix for user_t).
1004 ##      </summary>
1005 ## </param>
1006 #
1007 template(`userdom_restricted_user_template',`
1008         gen_require(`
1009                 attribute unpriv_userdomain;
1010         ')
1011
1012         userdom_login_user_template($1)
1013
1014         typeattribute $1_t unpriv_userdomain;
1015         domain_interactive_fd($1_t)
1016
1017         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1018         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1019
1020         ##############################
1021         #
1022         # Local policy
1023         #
1024
1025         optional_policy(`
1026                 loadkeys_run($1_t, $1_r)
1027         ')
1028 ')
1029
1030 #######################################
1031 ## <summary>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ## </summary>
1034 ## <desc>
1035 ##      <p>
1036 ##      The template for creating a unprivileged xwindows login user.
1037 ##      </p>
1038 ##      <p>
1039 ##      This template creates a user domain, types, and
1040 ##      rules for the user's tty, pty, home directories,
1041 ##      tmp, and tmpfs files.
1042 ##      </p>
1043 ## </desc>
1044 ## <param name="userdomain_prefix">
1045 ##      <summary>
1046 ##      The prefix of the user domain (e.g., user
1047 ##      is the prefix for user_t).
1048 ##      </summary>
1049 ## </param>
1050 #
1051 template(`userdom_restricted_xwindows_user_template',`
1052
1053         userdom_restricted_user_template($1)
1054
1055         ##############################
1056         #
1057         # Local policy
1058         #
1059
1060         auth_role($1_r, $1_t)
1061         auth_search_pam_console_data($1_usertype)
1062         auth_dontaudit_read_login_records($1_usertype)
1063
1064         dev_read_sound($1_usertype)
1065         dev_write_sound($1_usertype)
1066         # gnome keyring wants to read this.
1067         dev_dontaudit_read_rand($1_usertype)
1068         # temporarily allow since openoffice requires this
1069         dev_read_rand($1_usertype)
1070
1071         dev_read_video_dev($1_usertype)
1072         dev_write_video_dev($1_usertype)
1073         dev_rw_wireless($1_usertype)
1074
1075         libs_dontaudit_setattr_lib_files($1_usertype)
1076
1077         tunable_policy(`user_rw_noexattrfile',`
1078                 dev_rw_usbfs($1_t)
1079                 dev_rw_generic_usb_dev($1_usertype)
1080
1081                 fs_manage_noxattr_fs_files($1_usertype)
1082                 fs_manage_noxattr_fs_dirs($1_usertype)
1083                 fs_manage_dos_dirs($1_usertype)
1084                 fs_manage_dos_files($1_usertype)
1085                 storage_raw_read_removable_device($1_usertype)
1086                 storage_raw_write_removable_device($1_usertype)
1087         ')
1088
1089         logging_send_syslog_msg($1_usertype)
1090         logging_dontaudit_send_audit_msgs($1_t)
1091
1092         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1093         logging_send_audit_msgs($1_t)
1094         selinux_get_enforce_mode($1_t)
1095         seutil_exec_restorecond($1_t)
1096         seutil_read_file_contexts($1_t)
1097         seutil_read_default_contexts($1_t)
1098
1099         xserver_restricted_role($1_r, $1_t)
1100
1101         optional_policy(`
1102                 alsa_read_rw_config($1_usertype)
1103         ')
1104
1105          # cjp: needed by KDE apps
1106          # bug: #682499
1107          optional_policy(`
1108                 gnome_read_usr_config($1_usertype)
1109                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1110                 # cjp: telepathy F15 bugs
1111                 telepathy_role($1_r, $1_t, $1)
1112         ')
1113
1114         optional_policy(`
1115                 dbus_role_template($1, $1_r, $1_usertype)
1116                 dbus_system_bus_client($1_usertype)
1117                 allow $1_usertype $1_usertype:dbus send_msg;
1118
1119                 optional_policy(`
1120                         abrt_dbus_chat($1_usertype)
1121                         abrt_run_helper($1_usertype, $1_r)
1122                 ')
1123
1124                 optional_policy(`
1125                         consolekit_dontaudit_read_log($1_usertype)
1126                         consolekit_dbus_chat($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         cups_dbus_chat($1_usertype)
1131                         cups_dbus_chat_config($1_usertype)
1132                 ')
1133
1134                 optional_policy(`
1135                         devicekit_dbus_chat($1_usertype)
1136                         devicekit_dbus_chat_disk($1_usertype)
1137                         devicekit_dbus_chat_power($1_usertype)
1138                 ')
1139
1140                 optional_policy(`
1141                         fprintd_dbus_chat($1_t)
1142                 ')
1143         ')
1144
1145         optional_policy(`
1146                 openoffice_role_template($1, $1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 policykit_role($1_r, $1_usertype)
1151         ')
1152
1153         optional_policy(`
1154                 pulseaudio_role($1_r, $1_usertype)
1155                 pulseaudio_filetrans_admin_home_content($1_usertype)
1156                 pulseaudio_filetrans_home_content($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 rtkit_scheduled($1_usertype)
1161         ')
1162
1163         optional_policy(`
1164                 setroubleshoot_dontaudit_stream_connect($1_t)
1165         ')
1166
1167         optional_policy(`
1168                 udev_read_db($1_usertype)
1169         ')
1170
1171         optional_policy(`
1172                 wm_role_template($1, $1_r, $1_t)
1173         ')
1174 ')
1175
1176 #######################################
1177 ## <summary>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ## </summary>
1181 ## <desc>
1182 ##      <p>
1183 ##      The template for creating a unprivileged user roughly
1184 ##      equivalent to a regular linux user.
1185 ##      </p>
1186 ##      <p>
1187 ##      This template creates a user domain, types, and
1188 ##      rules for the user's tty, pty, home directories,
1189 ##      tmp, and tmpfs files.
1190 ##      </p>
1191 ## </desc>
1192 ## <param name="userdomain_prefix">
1193 ##      <summary>
1194 ##      The prefix of the user domain (e.g., user
1195 ##      is the prefix for user_t).
1196 ##      </summary>
1197 ## </param>
1198 #
1199 template(`userdom_unpriv_user_template', `
1200
1201         ##############################
1202         #
1203         # Declarations
1204         #
1205
1206         # Inherit rules for ordinary users.
1207         userdom_restricted_xwindows_user_template($1)
1208         userdom_common_user_template($1)
1209
1210         ##############################
1211         #
1212         # Local policy
1213         #
1214
1215         # port access is audited even if dac would not have allowed it, so dontaudit it here
1216 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1217         # Need the following rule to allow users to run vpnc
1218         corenet_tcp_bind_xserver_port($1_t)
1219         corenet_tcp_bind_generic_node($1_usertype)
1220
1221         storage_rw_fuse($1_t)
1222
1223         files_exec_usr_files($1_t)
1224    # cjp: why?
1225         files_read_kernel_symbol_table($1_t)
1226
1227         ifndef(`enable_mls',`
1228                 fs_exec_noxattr($1_t)
1229
1230                 tunable_policy(`user_rw_noexattrfile',`
1231                         fs_manage_noxattr_fs_files($1_t)
1232                         fs_manage_noxattr_fs_dirs($1_t)
1233                         # Write floppies
1234                         storage_raw_read_removable_device($1_t)
1235                         storage_raw_write_removable_device($1_t)
1236                 ',`
1237                         storage_raw_read_removable_device($1_t)
1238                 ')
1239         ')
1240
1241         miscfiles_read_hwdata($1_usertype)
1242
1243         # Allow users to run TCP servers (bind to ports and accept connection from
1244         # the same domain and outside users) disabling this forces FTP passive mode
1245         # and may change other protocols
1246
1247         tunable_policy(`user_share_music',`
1248                 corenet_tcp_bind_daap_port($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_tcp_server',`
1252                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1253         ')
1254
1255         tunable_policy(`user_setrlimit',`
1256                 allow $1_usertype self:process setrlimit;
1257         ')
1258
1259         optional_policy(`
1260                 cdrecord_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 cron_role($1_r, $1_t)
1265         ')
1266
1267         optional_policy(`
1268                 games_rw_data($1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gpg_role($1_r, $1_usertype)
1273         ')
1274
1275         optional_policy(`
1276                 gnomeclock_dbus_chat($1_t)
1277         ')
1278
1279         optional_policy(`
1280                 gpm_stream_connect($1_usertype)
1281         ')
1282
1283         optional_policy(`
1284                 execmem_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 java_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mono_role_template($1, $1_r, $1_t)
1293         ')
1294
1295         optional_policy(`
1296                 mount_run_fusermount($1_t, $1_r)
1297                 mount_read_pid_files($1_t)
1298         ')
1299
1300         optional_policy(`
1301                 wine_role_template($1, $1_r, $1_t)
1302         ')
1303
1304         optional_policy(`
1305                 postfix_run_postdrop($1_t, $1_r)
1306         ')
1307
1308         # Run pppd in pppd_t by default for user
1309         optional_policy(`
1310                 ppp_run_cond($1_t, $1_r)
1311         ')
1312 ')
1313
1314 #######################################
1315 ## <summary>
1316 ##      The template for creating an administrative user.
1317 ## </summary>
1318 ## <desc>
1319 ##      <p>
1320 ##      This template creates a user domain, types, and
1321 ##      rules for the user's tty, pty, home directories,
1322 ##      tmp, and tmpfs files.
1323 ##      </p>
1324 ##      <p>
1325 ##      The privileges given to administrative users are:
1326 ##      <ul>
1327 ##              <li>Raw disk access</li>
1328 ##              <li>Set all sysctls</li>
1329 ##              <li>All kernel ring buffer controls</li>
1330 ##              <li>Create, read, write, and delete all files but shadow</li>
1331 ##              <li>Manage source and binary format SELinux policy</li>
1332 ##              <li>Run insmod</li>
1333 ##      </ul>
1334 ##      </p>
1335 ## </desc>
1336 ## <param name="userdomain_prefix">
1337 ##      <summary>
1338 ##      The prefix of the user domain (e.g., sysadm
1339 ##      is the prefix for sysadm_t).
1340 ##      </summary>
1341 ## </param>
1342 #
1343 template(`userdom_admin_user_template',`
1344         gen_require(`
1345                 attribute admindomain;
1346                 class passwd { passwd chfn chsh rootok crontab };
1347         ')
1348
1349         ##############################
1350         #
1351         # Declarations
1352         #
1353
1354         # Inherit rules for ordinary users.
1355         userdom_login_user_template($1)
1356         userdom_common_user_template($1)
1357
1358         domain_obj_id_change_exemption($1_t)
1359         role system_r types $1_t;
1360
1361         typeattribute $1_t admindomain;
1362
1363         ifdef(`direct_sysadm_daemon',`
1364                 domain_system_change_exemption($1_t)
1365         ')
1366
1367         ##############################
1368         #
1369         # $1_t local policy
1370         #
1371
1372         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1373         allow $1_t self:capability2 syslog;
1374         allow $1_t self:process { setexec setfscreate };
1375         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1376         allow $1_t self:tun_socket create;
1377         # Set password information for other users.
1378         allow $1_t self:passwd { passwd chfn chsh };
1379         # Skip authentication when pam_rootok is specified.
1380         allow $1_t self:passwd rootok;
1381
1382         # Manipulate other users crontab.
1383         allow $1_t self:passwd crontab;
1384
1385         kernel_read_software_raid_state($1_t)
1386         kernel_getattr_core_if($1_t)
1387         kernel_getattr_message_if($1_t)
1388         kernel_change_ring_buffer_level($1_t)
1389         kernel_clear_ring_buffer($1_t)
1390         kernel_read_ring_buffer($1_t)
1391         kernel_get_sysvipc_info($1_t)
1392         kernel_rw_all_sysctls($1_t)
1393         # signal unlabeled processes:
1394         kernel_kill_unlabeled($1_t)
1395         kernel_signal_unlabeled($1_t)
1396         kernel_sigstop_unlabeled($1_t)
1397         kernel_signull_unlabeled($1_t)
1398         kernel_sigchld_unlabeled($1_t)
1399         kernel_signal($1_t)
1400
1401         corenet_tcp_bind_generic_port($1_t)
1402         # allow setting up tunnels
1403         corenet_rw_tun_tap_dev($1_t)
1404
1405         dev_getattr_generic_blk_files($1_t)
1406         dev_getattr_generic_chr_files($1_t)
1407         # for lsof
1408         dev_getattr_mtrr_dev($1_t)
1409         # Allow MAKEDEV to work
1410         dev_create_all_blk_files($1_t)
1411         dev_create_all_chr_files($1_t)
1412         dev_delete_all_blk_files($1_t)
1413         dev_delete_all_chr_files($1_t)
1414         dev_rename_all_blk_files($1_t)
1415         dev_rename_all_chr_files($1_t)
1416         dev_create_generic_symlinks($1_t)
1417         dev_rw_generic_usb_dev($1_t)
1418         dev_rw_usbfs($1_t)
1419
1420         domain_setpriority_all_domains($1_t)
1421         domain_read_all_domains_state($1_t)
1422         domain_getattr_all_domains($1_t)
1423         domain_getcap_all_domains($1_t)
1424         domain_dontaudit_ptrace_all_domains($1_t)
1425         # signal all domains:
1426         domain_kill_all_domains($1_t)
1427         domain_signal_all_domains($1_t)
1428         domain_signull_all_domains($1_t)
1429         domain_sigstop_all_domains($1_t)
1430         domain_sigstop_all_domains($1_t)
1431         domain_sigchld_all_domains($1_t)
1432         # for lsof
1433         domain_getattr_all_sockets($1_t)
1434         domain_dontaudit_getattr_all_sockets($1_t)
1435
1436         files_exec_usr_src_files($1_t)
1437
1438         fs_getattr_all_fs($1_t)
1439         fs_getattr_all_files($1_t)
1440         fs_list_all($1_t)
1441         fs_set_all_quotas($1_t)
1442         fs_exec_noxattr($1_t)
1443
1444         storage_raw_read_removable_device($1_t)
1445         storage_raw_write_removable_device($1_t)
1446         storage_dontaudit_read_fixed_disk($1_t)
1447
1448         term_use_all_inherited_terms($1_t)
1449         term_use_unallocated_ttys($1_t)
1450
1451         auth_getattr_shadow($1_t)
1452         # Manage almost all files
1453         files_manage_non_security_dirs($1_t)
1454         files_manage_non_security_files($1_t)
1455         # Relabel almost all files
1456         files_relabel_non_security_files($1_t)
1457
1458         init_telinit($1_t)
1459
1460         logging_send_syslog_msg($1_t)
1461
1462         optional_policy(`
1463                 modutils_domtrans_insmod($1_t)
1464                 modutils_domtrans_depmod($1_t)
1465         ')
1466
1467         # The following rule is temporary until such time that a complete
1468         # policy management infrastructure is in place so that an administrator
1469         # cannot directly manipulate policy files with arbitrary programs.
1470         seutil_manage_src_policy($1_t)
1471         # Violates the goal of limiting write access to checkpolicy.
1472         # But presently necessary for installing the file_contexts file.
1473         seutil_manage_bin_policy($1_t)
1474
1475         systemd_config_all_services($1_t)
1476
1477         userdom_manage_user_home_content_dirs($1_t)
1478         userdom_manage_user_home_content_files($1_t)
1479         userdom_manage_user_home_content_symlinks($1_t)
1480         userdom_manage_user_home_content_pipes($1_t)
1481         userdom_manage_user_home_content_sockets($1_t)
1482         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1483
1484         tunable_policy(`user_rw_noexattrfile',`
1485                 fs_manage_noxattr_fs_files($1_t)
1486                 fs_manage_noxattr_fs_dirs($1_t)
1487         ',`
1488                 fs_read_noxattr_fs_files($1_t)
1489         ')
1490
1491         optional_policy(`
1492                 postgresql_unconfined($1_t)
1493         ')
1494
1495         optional_policy(`
1496                 userhelper_exec($1_t)
1497         ')
1498 ')
1499
1500 ########################################
1501 ## <summary>
1502 ##      Allow user to run as a secadm
1503 ## </summary>
1504 ## <desc>
1505 ##      <p>
1506 ##      Create objects in a user home directory
1507 ##      with an automatic type transition to
1508 ##      a specified private type.
1509 ##      </p>
1510 ##      <p>
1511 ##      This is a templated interface, and should only
1512 ##      be called from a per-userdomain template.
1513 ##      </p>
1514 ## </desc>
1515 ## <param name="domain">
1516 ##      <summary>
1517 ##      Domain allowed access.
1518 ##      </summary>
1519 ## </param>
1520 ## <param name="role">
1521 ##      <summary>
1522 ##      The role  of the object to create.
1523 ##      </summary>
1524 ## </param>
1525 #
1526 template(`userdom_security_admin_template',`
1527         allow $1 self:capability { dac_read_search dac_override };
1528
1529         corecmd_exec_shell($1)
1530
1531         domain_obj_id_change_exemption($1)
1532
1533         dev_relabel_all_dev_nodes($1)
1534
1535         files_create_boot_flag($1)
1536         files_create_default_dir($1)
1537         files_root_filetrans_default($1, dir)
1538
1539         # Necessary for managing /boot/efi
1540         fs_manage_dos_files($1)
1541
1542         mls_process_read_up($1)
1543         mls_file_read_all_levels($1)
1544         mls_file_upgrade($1)
1545         mls_file_downgrade($1)
1546
1547         selinux_set_enforce_mode($1)
1548         selinux_set_all_booleans($1)
1549         selinux_set_parameters($1)
1550         selinux_read_policy($1)
1551
1552         files_relabel_all_files($1)
1553         auth_relabel_shadow($1)
1554
1555         init_exec($1)
1556
1557         logging_send_syslog_msg($1)
1558         logging_read_audit_log($1)
1559         logging_read_generic_logs($1)
1560         logging_read_audit_config($1)
1561
1562         seutil_manage_bin_policy($1)
1563         seutil_manage_default_contexts($1)
1564         seutil_manage_file_contexts($1)
1565         seutil_manage_module_store($1)
1566         seutil_manage_config($1)
1567         seutil_run_checkpolicy($1,$2)
1568         seutil_run_loadpolicy($1,$2)
1569         seutil_run_semanage($1,$2)
1570         seutil_run_setsebool($1,$2)
1571         seutil_run_setfiles($1, $2)
1572
1573         seutil_manage_bin_policy($1)
1574     seutil_manage_default_contexts($1)
1575     seutil_manage_file_contexts($1)
1576     seutil_manage_module_store($1)
1577     seutil_manage_config($1)
1578
1579         optional_policy(`
1580                 aide_run($1,$2)
1581         ')
1582
1583         optional_policy(`
1584                 consoletype_exec($1)
1585         ')
1586
1587         optional_policy(`
1588                 dmesg_exec($1)
1589         ')
1590
1591         optional_policy(`
1592                 ipsec_run_setkey($1,$2)
1593         ')
1594
1595         optional_policy(`
1596                 netlabel_run_mgmt($1,$2)
1597         ')
1598
1599         optional_policy(`
1600                 samhain_run($1, $2)
1601         ')
1602 ')
1603
1604 ########################################
1605 ## <summary>
1606 ##      Make the specified type usable in a
1607 ##      user home directory.
1608 ## </summary>
1609 ## <param name="type">
1610 ##      <summary>
1611 ##      Type to be used as a file in the
1612 ##      user home directory.
1613 ##      </summary>
1614 ## </param>
1615 #
1616 interface(`userdom_user_home_content',`
1617         gen_require(`
1618                 type user_home_t;
1619                 attribute user_home_type;
1620         ')
1621
1622         allow $1 user_home_t:filesystem associate;
1623         files_type($1)
1624         ubac_constrained($1)
1625
1626         files_poly_member($1)
1627         typeattribute $1  user_home_type;
1628 ')
1629
1630 ########################################
1631 ## <summary>
1632 ##      Make the specified type usable in a
1633 ##      generic temporary directory.
1634 ## </summary>
1635 ## <param name="type">
1636 ##      <summary>
1637 ##      Type to be used as a file in the
1638 ##      generic temporary directory.
1639 ##      </summary>
1640 ## </param>
1641 #
1642 interface(`userdom_user_tmp_content',`
1643         gen_require(`
1644                 attribute user_tmp_type;
1645         ')
1646
1647         typeattribute $1 user_tmp_type;
1648
1649         files_tmp_file($1)
1650         ubac_constrained($1)
1651 ')
1652
1653 ########################################
1654 ## <summary>
1655 ##      Make the specified type usable in a
1656 ##      generic tmpfs_t directory.
1657 ## </summary>
1658 ## <param name="type">
1659 ##      <summary>
1660 ##      Type to be used as a file in the
1661 ##      generic temporary directory.
1662 ##      </summary>
1663 ## </param>
1664 #
1665 interface(`userdom_user_tmpfs_content',`
1666         gen_require(`
1667                 attribute user_tmpfs_type;
1668         ')
1669
1670         typeattribute $1 user_tmpfs_type;
1671
1672         files_tmpfs_file($1)
1673         ubac_constrained($1)
1674 ')
1675
1676 ########################################
1677 ## <summary>
1678 ##      Allow domain to attach to TUN devices created by administrative users.
1679 ## </summary>
1680 ## <param name="domain">
1681 ##      <summary>
1682 ##      Domain allowed access.
1683 ##      </summary>
1684 ## </param>
1685 #
1686 interface(`userdom_attach_admin_tun_iface',`
1687         gen_require(`
1688                 attribute admindomain;
1689         ')
1690
1691         allow $1 admindomain:tun_socket relabelfrom;
1692         allow $1 self:tun_socket relabelto;
1693 ')
1694
1695 ########################################
1696 ## <summary>
1697 ##      Set the attributes of a user pty.
1698 ## </summary>
1699 ## <param name="domain">
1700 ##      <summary>
1701 ##      Domain allowed access.
1702 ##      </summary>
1703 ## </param>
1704 #
1705 interface(`userdom_setattr_user_ptys',`
1706         gen_require(`
1707                 type user_devpts_t;
1708         ')
1709
1710         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1711 ')
1712
1713 ########################################
1714 ## <summary>
1715 ##      Create a user pty.
1716 ## </summary>
1717 ## <param name="domain">
1718 ##      <summary>
1719 ##      Domain allowed access.
1720 ##      </summary>
1721 ## </param>
1722 #
1723 interface(`userdom_create_user_pty',`
1724         gen_require(`
1725                 type user_devpts_t;
1726         ')
1727
1728         term_create_pty($1, user_devpts_t)
1729 ')
1730
1731 ########################################
1732 ## <summary>
1733 ##      Get the attributes of user home directories.
1734 ## </summary>
1735 ## <param name="domain">
1736 ##      <summary>
1737 ##      Domain allowed access.
1738 ##      </summary>
1739 ## </param>
1740 #
1741 interface(`userdom_getattr_user_home_dirs',`
1742         gen_require(`
1743                 type user_home_dir_t;
1744         ')
1745
1746         allow $1 user_home_dir_t:dir getattr_dir_perms;
1747         files_search_home($1)
1748 ')
1749
1750 ########################################
1751 ## <summary>
1752 ##      Do not audit attempts to get the attributes of user home directories.
1753 ## </summary>
1754 ## <param name="domain">
1755 ##      <summary>
1756 ##      Domain to not audit.
1757 ##      </summary>
1758 ## </param>
1759 #
1760 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1761         gen_require(`
1762                 type user_home_dir_t;
1763         ')
1764
1765         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1766 ')
1767
1768 ########################################
1769 ## <summary>
1770 ##      Search user home directories.
1771 ## </summary>
1772 ## <param name="domain">
1773 ##      <summary>
1774 ##      Domain allowed access.
1775 ##      </summary>
1776 ## </param>
1777 #
1778 interface(`userdom_search_user_home_dirs',`
1779         gen_require(`
1780                 type user_home_dir_t;
1781         ')
1782
1783         allow $1 user_home_dir_t:dir search_dir_perms;
1784         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1785         files_search_home($1)
1786 ')
1787
1788 ########################################
1789 ## <summary>
1790 ##      Do not audit attempts to search user home directories.
1791 ## </summary>
1792 ## <desc>
1793 ##      <p>
1794 ##      Do not audit attempts to search user home directories.
1795 ##      This will supress SELinux denial messages when the specified
1796 ##      domain is denied the permission to search these directories.
1797 ##      </p>
1798 ## </desc>
1799 ## <param name="domain">
1800 ##      <summary>
1801 ##      Domain to not audit.
1802 ##      </summary>
1803 ## </param>
1804 ## <infoflow type="none"/>
1805 #
1806 interface(`userdom_dontaudit_search_user_home_dirs',`
1807         gen_require(`
1808                 type user_home_dir_t;
1809         ')
1810
1811         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1812 ')
1813
1814 ########################################
1815 ## <summary>
1816 ##      List user home directories.
1817 ## </summary>
1818 ## <param name="domain">
1819 ##      <summary>
1820 ##      Domain allowed access.
1821 ##      </summary>
1822 ## </param>
1823 #
1824 interface(`userdom_list_user_home_dirs',`
1825         gen_require(`
1826                 type user_home_dir_t;
1827         ')
1828
1829         allow $1 user_home_dir_t:dir list_dir_perms;
1830         files_search_home($1)
1831
1832         tunable_policy(`use_nfs_home_dirs',`
1833                 fs_list_nfs($1)
1834         ')
1835
1836         tunable_policy(`use_samba_home_dirs',`
1837                 fs_list_cifs($1)
1838         ')
1839 ')
1840
1841 ########################################
1842 ## <summary>
1843 ##      Do not audit attempts to list user home subdirectories.
1844 ## </summary>
1845 ## <param name="domain">
1846 ##      <summary>
1847 ##      Domain to not audit.
1848 ##      </summary>
1849 ## </param>
1850 #
1851 interface(`userdom_dontaudit_list_user_home_dirs',`
1852         gen_require(`
1853                 type user_home_dir_t;
1854                 type user_home_t;
1855         ')
1856
1857         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1858         dontaudit $1 user_home_t:dir list_dir_perms;
1859 ')
1860
1861 ########################################
1862 ## <summary>
1863 ##      Create user home directories.
1864 ## </summary>
1865 ## <param name="domain">
1866 ##      <summary>
1867 ##      Domain allowed access.
1868 ##      </summary>
1869 ## </param>
1870 #
1871 interface(`userdom_create_user_home_dirs',`
1872         gen_require(`
1873                 type user_home_dir_t;
1874         ')
1875
1876         allow $1 user_home_dir_t:dir create_dir_perms;
1877 ')
1878
1879 ########################################
1880 ## <summary>
1881 ##      Create user home directories.
1882 ## </summary>
1883 ## <param name="domain">
1884 ##      <summary>
1885 ##      Domain allowed access.
1886 ##      </summary>
1887 ## </param>
1888 #
1889 interface(`userdom_manage_user_home_dirs',`
1890         gen_require(`
1891                 type user_home_dir_t;
1892         ')
1893
1894         allow $1 user_home_dir_t:dir manage_dir_perms;
1895 ')
1896
1897 ########################################
1898 ## <summary>
1899 ##      Relabel to user home directories.
1900 ## </summary>
1901 ## <param name="domain">
1902 ##      <summary>
1903 ##      Domain allowed access.
1904 ##      </summary>
1905 ## </param>
1906 #
1907 interface(`userdom_relabelto_user_home_dirs',`
1908         gen_require(`
1909                 type user_home_dir_t;
1910         ')
1911
1912         allow $1 user_home_dir_t:dir relabelto;
1913 ')
1914
1915
1916 ########################################
1917 ## <summary>
1918 ##      Relabel to user home files.
1919 ## </summary>
1920 ## <param name="domain">
1921 ##      <summary>
1922 ##      Domain allowed access.
1923 ##      </summary>
1924 ## </param>
1925 #
1926 interface(`userdom_relabelto_user_home_files',`
1927         gen_require(`
1928                 type user_home_t;
1929         ')
1930
1931         allow $1 user_home_t:file relabelto;
1932 ')
1933 ########################################
1934 ## <summary>
1935 ##      Relabel user home files.
1936 ## </summary>
1937 ## <param name="domain">
1938 ##      <summary>
1939 ##      Domain allowed access.
1940 ##      </summary>
1941 ## </param>
1942 #
1943 interface(`userdom_relabel_user_home_files',`
1944         gen_require(`
1945                 type user_home_t;
1946         ')
1947
1948         allow $1 user_home_t:file relabel_file_perms;
1949 ')
1950
1951 ########################################
1952 ## <summary>
1953 ##      Create directories in the home dir root with
1954 ##      the user home directory type.
1955 ## </summary>
1956 ## <param name="domain">
1957 ##      <summary>
1958 ##      Domain allowed access.
1959 ##      </summary>
1960 ## </param>
1961 #
1962 interface(`userdom_home_filetrans_user_home_dir',`
1963         gen_require(`
1964                 type user_home_dir_t;
1965         ')
1966
1967         files_home_filetrans($1, user_home_dir_t, dir)
1968 ')
1969
1970 ########################################
1971 ## <summary>
1972 ##      Do a domain transition to the specified
1973 ##      domain when executing a program in the
1974 ##      user home directory.
1975 ## </summary>
1976 ## <desc>
1977 ##      <p>
1978 ##      Do a domain transition to the specified
1979 ##      domain when executing a program in the
1980 ##      user home directory.
1981 ##      </p>
1982 ##      <p>
1983 ##      No interprocess communication (signals, pipes,
1984 ##      etc.) is provided by this interface since
1985 ##      the domains are not owned by this module.
1986 ##      </p>
1987 ## </desc>
1988 ## <param name="source_domain">
1989 ##      <summary>
1990 ##      Domain allowed to transition.
1991 ##      </summary>
1992 ## </param>
1993 ## <param name="target_domain">
1994 ##      <summary>
1995 ##      Domain to transition to.
1996 ##      </summary>
1997 ## </param>
1998 #
1999 interface(`userdom_user_home_domtrans',`
2000         gen_require(`
2001                 type user_home_dir_t, user_home_t;
2002         ')
2003
2004         domain_auto_trans($1, user_home_t, $2)
2005         allow $1 user_home_dir_t:dir search_dir_perms;
2006         files_search_home($1)
2007 ')
2008
2009 ########################################
2010 ## <summary>
2011 ##      Do not audit attempts to search user home content directories.
2012 ## </summary>
2013 ## <param name="domain">
2014 ##      <summary>
2015 ##      Domain to not audit.
2016 ##      </summary>
2017 ## </param>
2018 #
2019 interface(`userdom_dontaudit_search_user_home_content',`
2020         gen_require(`
2021                 type user_home_t;
2022         ')
2023
2024         dontaudit $1 user_home_t:dir search_dir_perms;
2025         fs_dontaudit_list_nfs($1)
2026         fs_dontaudit_list_cifs($1)
2027 ')
2028
2029 ########################################
2030 ## <summary>
2031 ##      List contents of users home directory.
2032 ## </summary>
2033 ## <param name="domain">
2034 ##      <summary>
2035 ##      Domain allowed access.
2036 ##      </summary>
2037 ## </param>
2038 #
2039 interface(`userdom_list_user_home_content',`
2040         gen_require(`
2041                 type user_home_dir_t;
2042                 attribute user_home_type;
2043         ')
2044
2045         files_list_home($1)
2046         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2047 ')
2048
2049 ########################################
2050 ## <summary>
2051 ##      Create, read, write, and delete directories
2052 ##      in a user home subdirectory.
2053 ## </summary>
2054 ## <param name="domain">
2055 ##      <summary>
2056 ##      Domain allowed access.
2057 ##      </summary>
2058 ## </param>
2059 #
2060 interface(`userdom_manage_user_home_content_dirs',`
2061         gen_require(`
2062                 type user_home_dir_t, user_home_t;
2063         ')
2064
2065         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2066         files_search_home($1)
2067 ')
2068
2069 ########################################
2070 ## <summary>
2071 ##      Delete directories in a user home subdirectory.
2072 ## </summary>
2073 ## <param name="domain">
2074 ##      <summary>
2075 ##      Domain allowed access.
2076 ##      </summary>
2077 ## </param>
2078 #
2079 interface(`userdom_delete_user_home_content_dirs',`
2080         gen_require(`
2081                 type user_home_t;
2082         ')
2083
2084         allow $1 user_home_t:dir delete_dir_perms;
2085 ')
2086
2087 ########################################
2088 ## <summary>
2089 ##      Delete all directories in a user home subdirectory.
2090 ## </summary>
2091 ## <param name="domain">
2092 ##      <summary>
2093 ##      Domain allowed access.
2094 ##      </summary>
2095 ## </param>
2096 #
2097 interface(`userdom_delete_all_user_home_content_dirs',`
2098         gen_require(`
2099                 attribute user_home_type;
2100         ')
2101
2102         allow $1 user_home_type:dir delete_dir_perms;
2103 ')
2104
2105 ########################################
2106 ## <summary>
2107 ##      Set the attributes of user home files.
2108 ## </summary>
2109 ## <param name="domain">
2110 ##      <summary>
2111 ##      Domain allowed access.
2112 ##      </summary>
2113 ## </param>
2114 ## <rolecap/>
2115 #
2116 interface(`userdom_setattr_user_home_content_files',`
2117         gen_require(`
2118                 type user_home_t;
2119         ')
2120
2121         allow $1 user_home_t:file setattr;
2122 ')
2123
2124 ########################################
2125 ## <summary>
2126 ##      Do not audit attempts to set the
2127 ##      attributes of user home files.
2128 ## </summary>
2129 ## <param name="domain">
2130 ##      <summary>
2131 ##      Domain to not audit.
2132 ##      </summary>
2133 ## </param>
2134 #
2135 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2136         gen_require(`
2137                 type user_home_t;
2138         ')
2139
2140         dontaudit $1 user_home_t:file setattr_file_perms;
2141 ')
2142
2143 ########################################
2144 ## <summary>
2145 ##      Set the attributes of all user home directories.
2146 ## </summary>
2147 ## <param name="domain">
2148 ##      <summary>
2149 ##      Domain allowed access.
2150 ##      </summary>
2151 ## </param>
2152 ## <rolecap/>
2153 #
2154 interface(`userdom_setattr_all_user_home_content_dirs',`
2155         gen_require(`
2156                 attribute user_home_type;
2157         ')
2158
2159         allow $1 user_home_type:dir setattr_dir_perms;
2160 ')
2161
2162 ########################################
2163 ## <summary>
2164 ##      Mmap user home files.
2165 ## </summary>
2166 ## <param name="domain">
2167 ##      <summary>
2168 ##      Domain allowed access.
2169 ##      </summary>
2170 ## </param>
2171 #
2172 interface(`userdom_mmap_user_home_content_files',`
2173         gen_require(`
2174                 type user_home_dir_t, user_home_t;
2175         ')
2176
2177         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2178         files_search_home($1)
2179 ')
2180
2181 ########################################
2182 ## <summary>
2183 ##      Read user home files.
2184 ## </summary>
2185 ## <param name="domain">
2186 ##      <summary>
2187 ##      Domain allowed access.
2188 ##      </summary>
2189 ## </param>
2190 #
2191 interface(`userdom_read_user_home_content_files',`
2192         gen_require(`
2193                 type user_home_dir_t, user_home_t;
2194         ')
2195
2196         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2197         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2198         files_search_home($1)
2199 ')
2200
2201 ########################################
2202 ## <summary>
2203 ##      Do not audit attempts to getattr user home files.
2204 ## </summary>
2205 ## <param name="domain">
2206 ##      <summary>
2207 ##      Domain to not audit.
2208 ##      </summary>
2209 ## </param>
2210 #
2211 interface(`userdom_dontaudit_getattr_user_home_content',`
2212         gen_require(`
2213                 attribute user_home_type;
2214         ')
2215
2216         dontaudit $1 user_home_type:dir getattr;
2217         dontaudit $1 user_home_type:file getattr;
2218 ')
2219
2220 ########################################
2221 ## <summary>
2222 ##      Do not audit attempts to read user home files.
2223 ## </summary>
2224 ## <param name="domain">
2225 ##      <summary>
2226 ##      Domain to not audit.
2227 ##      </summary>
2228 ## </param>
2229 #
2230 interface(`userdom_dontaudit_read_user_home_content_files',`
2231         gen_require(`
2232                 attribute user_home_type;
2233                 type user_home_dir_t;
2234         ')
2235
2236         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2237         dontaudit $1 user_home_type:dir list_dir_perms;
2238         dontaudit $1 user_home_type:file read_file_perms;
2239         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2240 ')
2241
2242 ########################################
2243 ## <summary>
2244 ##      Do not audit attempts to append user home files.
2245 ## </summary>
2246 ## <param name="domain">
2247 ##      <summary>
2248 ##      Domain to not audit.
2249 ##      </summary>
2250 ## </param>
2251 #
2252 interface(`userdom_dontaudit_append_user_home_content_files',`
2253         gen_require(`
2254                 type user_home_t;
2255         ')
2256
2257         dontaudit $1 user_home_t:file append_file_perms;
2258 ')
2259
2260 ########################################
2261 ## <summary>
2262 ##      Do not audit attempts to write user home files.
2263 ## </summary>
2264 ## <param name="domain">
2265 ##      <summary>
2266 ##      Domain to not audit.
2267 ##      </summary>
2268 ## </param>
2269 #
2270 interface(`userdom_dontaudit_write_user_home_content_files',`
2271         gen_require(`
2272                 type user_home_t;
2273         ')
2274
2275         dontaudit $1 user_home_t:file write_file_perms;
2276 ')
2277
2278 ########################################
2279 ## <summary>
2280 ##      Delete files in a user home subdirectory.
2281 ## </summary>
2282 ## <param name="domain">
2283 ##      <summary>
2284 ##      Domain allowed access.
2285 ##      </summary>
2286 ## </param>
2287 #
2288 interface(`userdom_delete_user_home_content_files',`
2289         gen_require(`
2290                 type user_home_t;
2291         ')
2292
2293         allow $1 user_home_t:file delete_file_perms;
2294 ')
2295
2296 ########################################
2297 ## <summary>
2298 ##      Delete all files in a user home subdirectory.
2299 ## </summary>
2300 ## <param name="domain">
2301 ##      <summary>
2302 ##      Domain allowed access.
2303 ##      </summary>
2304 ## </param>
2305 #
2306 interface(`userdom_delete_all_user_home_content_files',`
2307         gen_require(`
2308                 attribute user_home_type;
2309         ')
2310
2311         allow $1 user_home_type:file delete_file_perms;
2312 ')
2313
2314 ########################################
2315 ## <summary>
2316 ##      Delete sock files in a user home subdirectory.
2317 ## </summary>
2318 ## <param name="domain">
2319 ##      <summary>
2320 ##      Domain allowed access.
2321 ##      </summary>
2322 ## </param>
2323 #
2324 interface(`userdom_delete_user_home_content_sock_files',`
2325         gen_require(`
2326                 type user_home_t;
2327         ')
2328
2329         allow $1 user_home_t:sock_file delete_file_perms;
2330 ')
2331
2332 ########################################
2333 ## <summary>
2334 ##      Delete all sock files in a user home subdirectory.
2335 ## </summary>
2336 ## <param name="domain">
2337 ##      <summary>
2338 ##      Domain allowed access.
2339 ##      </summary>
2340 ## </param>
2341 #
2342 interface(`userdom_delete_all_user_home_content_sock_files',`
2343         gen_require(`
2344                 attribute user_home_type;
2345         ')
2346
2347         allow $1 user_home_type:sock_file delete_file_perms;
2348 ')
2349
2350 ########################################
2351 ## <summary>
2352 ##      Do not audit attempts to write user home files.
2353 ## </summary>
2354 ## <param name="domain">
2355 ##      <summary>
2356 ##      Domain to not audit.
2357 ##      </summary>
2358 ## </param>
2359 #
2360 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2361         gen_require(`
2362                 type user_home_t;
2363         ')
2364
2365         dontaudit $1 user_home_t:file relabel_file_perms;
2366 ')
2367
2368 ########################################
2369 ## <summary>
2370 ##      Read user home subdirectory symbolic links.
2371 ## </summary>
2372 ## <param name="domain">
2373 ##      <summary>
2374 ##      Domain allowed access.
2375 ##      </summary>
2376 ## </param>
2377 #
2378 interface(`userdom_read_user_home_content_symlinks',`
2379         gen_require(`
2380                 type user_home_dir_t, user_home_t;
2381         ')
2382
2383         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2384 ')
2385
2386 ########################################
2387 ## <summary>
2388 ##      Execute user home files.
2389 ## </summary>
2390 ## <param name="domain">
2391 ##      <summary>
2392 ##      Domain allowed access.
2393 ##      </summary>
2394 ## </param>
2395 ## <rolecap/>
2396 #
2397 interface(`userdom_exec_user_home_content_files',`
2398         gen_require(`
2399                 type user_home_dir_t;
2400                 attribute user_home_type;
2401         ')
2402
2403         files_search_home($1)
2404         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2405         dontaudit $1 user_home_type:sock_file execute;
2406         ')
2407
2408 ########################################
2409 ## <summary>
2410 ##      Do not audit attempts to execute user home files.
2411 ## </summary>
2412 ## <param name="domain">
2413 ##      <summary>
2414 ##      Domain to not audit.
2415 ##      </summary>
2416 ## </param>
2417 #
2418 interface(`userdom_dontaudit_exec_user_home_content_files',`
2419         gen_require(`
2420                 type user_home_t;
2421         ')
2422
2423         dontaudit $1 user_home_t:file exec_file_perms;
2424 ')
2425
2426 ########################################
2427 ## <summary>
2428 ##      Create, read, write, and delete files
2429 ##      in a user home subdirectory.
2430 ## </summary>
2431 ## <param name="domain">
2432 ##      <summary>
2433 ##      Domain allowed access.
2434 ##      </summary>
2435 ## </param>
2436 #
2437 interface(`userdom_manage_user_home_content_files',`
2438         gen_require(`
2439                 type user_home_dir_t, user_home_t;
2440         ')
2441
2442         manage_files_pattern($1, user_home_t, user_home_t)
2443         allow $1 user_home_dir_t:dir search_dir_perms;
2444         files_search_home($1)
2445 ')
2446
2447 ########################################
2448 ## <summary>
2449 ##      Do not audit attempts to create, read, write, and delete directories
2450 ##      in a user home subdirectory.
2451 ## </summary>
2452 ## <param name="domain">
2453 ##      <summary>
2454 ##      Domain to not audit.
2455 ##      </summary>
2456 ## </param>
2457 #
2458 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2459         gen_require(`
2460                 type user_home_dir_t, user_home_t;
2461         ')
2462
2463         dontaudit $1 user_home_t:dir manage_dir_perms;
2464 ')
2465
2466 ########################################
2467 ## <summary>
2468 ##      Create, read, write, and delete symbolic links
2469 ##      in a user home subdirectory.
2470 ## </summary>
2471 ## <param name="domain">
2472 ##      <summary>
2473 ##      Domain allowed access.
2474 ##      </summary>
2475 ## </param>
2476 #
2477 interface(`userdom_manage_user_home_content_symlinks',`
2478         gen_require(`
2479                 type user_home_dir_t, user_home_t;
2480         ')
2481
2482         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2483         allow $1 user_home_dir_t:dir search_dir_perms;
2484         files_search_home($1)
2485 ')
2486
2487 ########################################
2488 ## <summary>
2489 ##      Delete symbolic links in a user home directory.
2490 ## </summary>
2491 ## <param name="domain">
2492 ##      <summary>
2493 ##      Domain allowed access.
2494 ##      </summary>
2495 ## </param>
2496 #
2497 interface(`userdom_delete_user_home_content_symlinks',`
2498         gen_require(`
2499                 type user_home_t;
2500         ')
2501
2502         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2503 ')
2504
2505 ########################################
2506 ## <summary>
2507 ##      Delete all symbolic links in a user home directory.
2508 ## </summary>
2509 ## <param name="domain">
2510 ##      <summary>
2511 ##      Domain allowed access.
2512 ##      </summary>
2513 ## </param>
2514 #
2515 interface(`userdom_delete_all_user_home_content_symlinks',`
2516         gen_require(`
2517                 attribute user_home_type;
2518         ')
2519
2520         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2521 ')
2522
2523 ########################################
2524 ## <summary>
2525 ##      Create, read, write, and delete named pipes
2526 ##      in a user home subdirectory.
2527 ## </summary>
2528 ## <param name="domain">
2529 ##      <summary>
2530 ##      Domain allowed access.
2531 ##      </summary>
2532 ## </param>
2533 #
2534 interface(`userdom_manage_user_home_content_pipes',`
2535         gen_require(`
2536                 type user_home_dir_t, user_home_t;
2537         ')
2538
2539         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2540         allow $1 user_home_dir_t:dir search_dir_perms;
2541         files_search_home($1)
2542 ')
2543
2544 ########################################
2545 ## <summary>
2546 ##      Create, read, write, and delete named sockets
2547 ##      in a user home subdirectory.
2548 ## </summary>
2549 ## <param name="domain">
2550 ##      <summary>
2551 ##      Domain allowed access.
2552 ##      </summary>
2553 ## </param>
2554 #
2555 interface(`userdom_manage_user_home_content_sockets',`
2556         gen_require(`
2557                 type user_home_dir_t, user_home_t;
2558         ')
2559
2560         allow $1 user_home_dir_t:dir search_dir_perms;
2561         manage_sock_files_pattern($1, user_home_t, user_home_t)
2562         files_search_home($1)
2563 ')
2564
2565 ########################################
2566 ## <summary>
2567 ##      Create objects in a user home directory
2568 ##      with an automatic type transition to
2569 ##      a specified private type.
2570 ## </summary>
2571 ## <param name="domain">
2572 ##      <summary>
2573 ##      Domain allowed access.
2574 ##      </summary>
2575 ## </param>
2576 ## <param name="private_type">
2577 ##      <summary>
2578 ##      The type of the object to create.
2579 ##      </summary>
2580 ## </param>
2581 ## <param name="object_class">
2582 ##      <summary>
2583 ##      The class of the object to be created.
2584 ##      </summary>
2585 ## </param>
2586 #
2587 interface(`userdom_user_home_dir_filetrans',`
2588         gen_require(`
2589                 type user_home_dir_t;
2590         ')
2591
2592         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2593         files_search_home($1)
2594 ')
2595
2596 ########################################
2597 ## <summary>
2598 ##      Create objects in a user home directory
2599 ##      with an automatic type transition to
2600 ##      a specified private type.
2601 ## </summary>
2602 ## <param name="domain">
2603 ##      <summary>
2604 ##      Domain allowed access.
2605 ##      </summary>
2606 ## </param>
2607 ## <param name="private_type">
2608 ##      <summary>
2609 ##      The type of the object to create.
2610 ##      </summary>
2611 ## </param>
2612 ## <param name="object_class">
2613 ##      <summary>
2614 ##      The class of the object to be created.
2615 ##      </summary>
2616 ## </param>
2617 #
2618 interface(`userdom_user_home_content_filetrans',`
2619         gen_require(`
2620                 type user_home_dir_t, user_home_t;
2621         ')
2622
2623         filetrans_pattern($1, user_home_t, $2, $3)
2624         allow $1 user_home_dir_t:dir search_dir_perms;
2625         files_search_home($1)
2626 ')
2627
2628 ########################################
2629 ## <summary>
2630 ##      Create objects in a user home directory
2631 ##      with an automatic type transition to
2632 ##      the user home file type.
2633 ## </summary>
2634 ## <param name="domain">
2635 ##      <summary>
2636 ##      Domain allowed access.
2637 ##      </summary>
2638 ## </param>
2639 ## <param name="object_class">
2640 ##      <summary>
2641 ##      The class of the object to be created.
2642 ##      </summary>
2643 ## </param>
2644 #
2645 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2646         gen_require(`
2647                 type user_home_dir_t, user_home_t;
2648         ')
2649
2650         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2651         files_search_home($1)
2652 ')
2653
2654 ########################################
2655 ## <summary>
2656 ##      Write to user temporary named sockets.
2657 ## </summary>
2658 ## <param name="domain">
2659 ##      <summary>
2660 ##      Domain allowed access.
2661 ##      </summary>
2662 ## </param>
2663 #
2664 interface(`userdom_write_user_tmp_sockets',`
2665         gen_require(`
2666                 type user_tmp_t;
2667         ')
2668
2669         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2670         files_search_tmp($1)
2671 ')
2672
2673 ########################################
2674 ## <summary>
2675 ##      List user temporary directories.
2676 ## </summary>
2677 ## <param name="domain">
2678 ##      <summary>
2679 ##      Domain allowed access.
2680 ##      </summary>
2681 ## </param>
2682 #
2683 interface(`userdom_list_user_tmp',`
2684         gen_require(`
2685                 type user_tmp_t;
2686         ')
2687
2688         allow $1 user_tmp_t:dir list_dir_perms;
2689         files_search_tmp($1)
2690 ')
2691
2692 ########################################
2693 ## <summary>
2694 ##      Do not audit attempts to list user
2695 ##      temporary directories.
2696 ## </summary>
2697 ## <param name="domain">
2698 ##      <summary>
2699 ##      Domain to not audit.
2700 ##      </summary>
2701 ## </param>
2702 #
2703 interface(`userdom_dontaudit_list_user_tmp',`
2704         gen_require(`
2705                 type user_tmp_t;
2706         ')
2707
2708         dontaudit $1 user_tmp_t:dir list_dir_perms;
2709 ')
2710
2711 ########################################
2712 ## <summary>
2713 ##      Do not audit attempts to manage users
2714 ##      temporary directories.
2715 ## </summary>
2716 ## <param name="domain">
2717 ##      <summary>
2718 ##      Domain to not audit.
2719 ##      </summary>
2720 ## </param>
2721 #
2722 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2723         gen_require(`
2724                 type user_tmp_t;
2725         ')
2726
2727         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2728 ')
2729
2730 ########################################
2731 ## <summary>
2732 ##      Read user temporary files.
2733 ## </summary>
2734 ## <param name="domain">
2735 ##      <summary>
2736 ##      Domain allowed access.
2737 ##      </summary>
2738 ## </param>
2739 #
2740 interface(`userdom_read_user_tmp_files',`
2741         gen_require(`
2742                 type user_tmp_t;
2743         ')
2744
2745         read_files_pattern($1, user_tmp_t, user_tmp_t)
2746         allow $1 user_tmp_t:dir list_dir_perms;
2747         files_search_tmp($1)
2748 ')
2749
2750 ########################################
2751 ## <summary>
2752 ##      Do not audit attempts to read users
2753 ##      temporary files.
2754 ## </summary>
2755 ## <param name="domain">
2756 ##      <summary>
2757 ##      Domain to not audit.
2758 ##      </summary>
2759 ## </param>
2760 #
2761 interface(`userdom_dontaudit_read_user_tmp_files',`
2762         gen_require(`
2763                 type user_tmp_t;
2764         ')
2765
2766         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2767 ')
2768
2769 ########################################
2770 ## <summary>
2771 ##      Do not audit attempts to append users
2772 ##      temporary files.
2773 ## </summary>
2774 ## <param name="domain">
2775 ##      <summary>
2776 ##      Domain to not audit.
2777 ##      </summary>
2778 ## </param>
2779 #
2780 interface(`userdom_dontaudit_append_user_tmp_files',`
2781         gen_require(`
2782                 type user_tmp_t;
2783         ')
2784
2785         dontaudit $1 user_tmp_t:file append_file_perms;
2786 ')
2787
2788 ########################################
2789 ## <summary>
2790 ##      Read and write user temporary files.
2791 ## </summary>
2792 ## <param name="domain">
2793 ##      <summary>
2794 ##      Domain allowed access.
2795 ##      </summary>
2796 ## </param>
2797 #
2798 interface(`userdom_rw_user_tmp_files',`
2799         gen_require(`
2800                 type user_tmp_t;
2801         ')
2802
2803         allow $1 user_tmp_t:dir list_dir_perms;
2804         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2805         files_search_tmp($1)
2806 ')
2807
2808 ########################################
2809 ## <summary>
2810 ##      Do not audit attempts to manage users
2811 ##      temporary files.
2812 ## </summary>
2813 ## <param name="domain">
2814 ##      <summary>
2815 ##      Domain to not audit.
2816 ##      </summary>
2817 ## </param>
2818 #
2819 interface(`userdom_dontaudit_manage_user_tmp_files',`
2820         gen_require(`
2821                 type user_tmp_t;
2822         ')
2823
2824         dontaudit $1 user_tmp_t:file manage_file_perms;
2825 ')
2826
2827 ########################################
2828 ## <summary>
2829 ##      Read user temporary symbolic links.
2830 ## </summary>
2831 ## <param name="domain">
2832 ##      <summary>
2833 ##      Domain allowed access.
2834 ##      </summary>
2835 ## </param>
2836 #
2837 interface(`userdom_read_user_tmp_symlinks',`
2838         gen_require(`
2839                 type user_tmp_t;
2840         ')
2841
2842         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2843         allow $1 user_tmp_t:dir list_dir_perms;
2844         files_search_tmp($1)
2845 ')
2846
2847 ########################################
2848 ## <summary>
2849 ##      Create, read, write, and delete user
2850 ##      temporary directories.
2851 ## </summary>
2852 ## <param name="domain">
2853 ##      <summary>
2854 ##      Domain allowed access.
2855 ##      </summary>
2856 ## </param>
2857 #
2858 interface(`userdom_manage_user_tmp_dirs',`
2859         gen_require(`
2860                 type user_tmp_t;
2861         ')
2862
2863         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2864         files_search_tmp($1)
2865 ')
2866
2867 ########################################
2868 ## <summary>
2869 ##      Create, read, write, and delete user
2870 ##      temporary files.
2871 ## </summary>
2872 ## <param name="domain">
2873 ##      <summary>
2874 ##      Domain allowed access.
2875 ##      </summary>
2876 ## </param>
2877 #
2878 interface(`userdom_manage_user_tmp_files',`
2879         gen_require(`
2880                 type user_tmp_t;
2881         ')
2882
2883         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2884         files_search_tmp($1)
2885 ')
2886
2887 ########################################
2888 ## <summary>
2889 ##      Create, read, write, and delete user
2890 ##      temporary symbolic links.
2891 ## </summary>
2892 ## <param name="domain">
2893 ##      <summary>
2894 ##      Domain allowed access.
2895 ##      </summary>
2896 ## </param>
2897 #
2898 interface(`userdom_manage_user_tmp_symlinks',`
2899         gen_require(`
2900                 type user_tmp_t;
2901         ')
2902
2903         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2904         files_search_tmp($1)
2905 ')
2906
2907 ########################################
2908 ## <summary>
2909 ##      Create, read, write, and delete user
2910 ##      temporary named pipes.
2911 ## </summary>
2912 ## <param name="domain">
2913 ##      <summary>
2914 ##      Domain allowed access.
2915 ##      </summary>
2916 ## </param>
2917 #
2918 interface(`userdom_manage_user_tmp_pipes',`
2919         gen_require(`
2920                 type user_tmp_t;
2921         ')
2922
2923         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2924         files_search_tmp($1)
2925 ')
2926
2927 ########################################
2928 ## <summary>
2929 ##      Create, read, write, and delete user
2930 ##      temporary named sockets.
2931 ## </summary>
2932 ## <param name="domain">
2933 ##      <summary>
2934 ##      Domain allowed access.
2935 ##      </summary>
2936 ## </param>
2937 #
2938 interface(`userdom_manage_user_tmp_sockets',`
2939         gen_require(`
2940                 type user_tmp_t;
2941         ')
2942
2943         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2944         files_search_tmp($1)
2945 ')
2946
2947 ########################################
2948 ## <summary>
2949 ##      Create objects in a user temporary directory
2950 ##      with an automatic type transition to
2951 ##      a specified private type.
2952 ## </summary>
2953 ## <param name="domain">
2954 ##      <summary>
2955 ##      Domain allowed access.
2956 ##      </summary>
2957 ## </param>
2958 ## <param name="private_type">
2959 ##      <summary>
2960 ##      The type of the object to create.
2961 ##      </summary>
2962 ## </param>
2963 ## <param name="object_class">
2964 ##      <summary>
2965 ##      The class of the object to be created.
2966 ##      </summary>
2967 ## </param>
2968 #
2969 interface(`userdom_user_tmp_filetrans',`
2970         gen_require(`
2971                 type user_tmp_t;
2972         ')
2973
2974         filetrans_pattern($1, user_tmp_t, $2, $3)
2975         files_search_tmp($1)
2976 ')
2977
2978 ########################################
2979 ## <summary>
2980 ##      Create objects in the temporary directory
2981 ##      with an automatic type transition to
2982 ##      the user temporary type.
2983 ## </summary>
2984 ## <param name="domain">
2985 ##      <summary>
2986 ##      Domain allowed access.
2987 ##      </summary>
2988 ## </param>
2989 ## <param name="object_class">
2990 ##      <summary>
2991 ##      The class of the object to be created.
2992 ##      </summary>
2993 ## </param>
2994 #
2995 interface(`userdom_tmp_filetrans_user_tmp',`
2996         gen_require(`
2997                 type user_tmp_t;
2998         ')
2999
3000         files_tmp_filetrans($1, user_tmp_t, $2)
3001 ')
3002
3003 ########################################
3004 ## <summary>
3005 ##      Read user tmpfs files.
3006 ## </summary>
3007 ## <param name="domain">
3008 ##      <summary>
3009 ##      Domain allowed access.
3010 ##      </summary>
3011 ## </param>
3012 #
3013 interface(`userdom_read_user_tmpfs_files',`
3014         gen_require(`
3015                 type user_tmpfs_t;
3016         ')
3017
3018         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3019         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3020         allow $1 user_tmpfs_t:dir list_dir_perms;
3021         fs_search_tmpfs($1)
3022 ')
3023
3024 ########################################
3025 ## <summary>
3026 ##      Read/Write user tmpfs files.
3027 ## </summary>
3028 ## <param name="domain">
3029 ##      <summary>
3030 ##      Domain allowed access.
3031 ##      </summary>
3032 ## </param>
3033 #
3034 interface(`userdom_rw_user_tmpfs_files',`
3035         gen_require(`
3036                 type user_tmpfs_t;
3037         ')
3038
3039         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3040         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3041         allow $1 user_tmpfs_t:dir list_dir_perms;
3042         fs_search_tmpfs($1)
3043 ')
3044
3045 ########################################
3046 ## <summary>
3047 ##      Get the attributes of a user domain tty.
3048 ## </summary>
3049 ## <param name="domain">
3050 ##      <summary>
3051 ##      Domain allowed access.
3052 ##      </summary>
3053 ## </param>
3054 #
3055 interface(`userdom_getattr_user_ttys',`
3056         gen_require(`
3057                 type user_tty_device_t;
3058         ')
3059
3060         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3061 ')
3062
3063 ########################################
3064 ## <summary>
3065 ##      Do not audit attempts to get the attributes of a user domain tty.
3066 ## </summary>
3067 ## <param name="domain">
3068 ##      <summary>
3069 ##      Domain to not audit.
3070 ##      </summary>
3071 ## </param>
3072 #
3073 interface(`userdom_dontaudit_getattr_user_ttys',`
3074         gen_require(`
3075                 type user_tty_device_t;
3076         ')
3077
3078         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3079 ')
3080
3081 ########################################
3082 ## <summary>
3083 ##      Set the attributes of a user domain tty.
3084 ## </summary>
3085 ## <param name="domain">
3086 ##      <summary>
3087 ##      Domain allowed access.
3088 ##      </summary>
3089 ## </param>
3090 #
3091 interface(`userdom_setattr_user_ttys',`
3092         gen_require(`
3093                 type user_tty_device_t;
3094         ')
3095
3096         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3097 ')
3098
3099 ########################################
3100 ## <summary>
3101 ##      Do not audit attempts to set the attributes of a user domain tty.
3102 ## </summary>
3103 ## <param name="domain">
3104 ##      <summary>
3105 ##      Domain to not audit.
3106 ##      </summary>
3107 ## </param>
3108 #
3109 interface(`userdom_dontaudit_setattr_user_ttys',`
3110         gen_require(`
3111                 type user_tty_device_t;
3112         ')
3113
3114         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3115 ')
3116
3117 ########################################
3118 ## <summary>
3119 ##      Read and write a user domain tty.
3120 ## </summary>
3121 ## <param name="domain">
3122 ##      <summary>
3123 ##      Domain allowed access.
3124 ##      </summary>
3125 ## </param>
3126 #
3127 interface(`userdom_use_user_ttys',`
3128         gen_require(`
3129                 type user_tty_device_t;
3130         ')
3131
3132         allow $1 user_tty_device_t:chr_file rw_term_perms;
3133 ')
3134
3135 ########################################
3136 ## <summary>
3137 ##      Read and write a inherited user domain tty.
3138 ## </summary>
3139 ## <param name="domain">
3140 ##      <summary>
3141 ##      Domain allowed access.
3142 ##      </summary>
3143 ## </param>
3144 #
3145 interface(`userdom_use_inherited_user_ttys',`
3146         gen_require(`
3147                 type user_tty_device_t;
3148         ')
3149
3150         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3151 ')
3152
3153 ########################################
3154 ## <summary>
3155 ##      Read and write a user domain pty.
3156 ## </summary>
3157 ## <param name="domain">
3158 ##      <summary>
3159 ##      Domain allowed access.
3160 ##      </summary>
3161 ## </param>
3162 #
3163 interface(`userdom_use_user_ptys',`
3164         gen_require(`
3165                 type user_devpts_t;
3166         ')
3167
3168         allow $1 user_devpts_t:chr_file rw_term_perms;
3169 ')
3170
3171 ########################################
3172 ## <summary>
3173 ##      Read and write a inherited user domain pty.
3174 ## </summary>
3175 ## <param name="domain">
3176 ##      <summary>
3177 ##      Domain allowed access.
3178 ##      </summary>
3179 ## </param>
3180 #
3181 interface(`userdom_use_inherited_user_ptys',`
3182         gen_require(`
3183                 type user_devpts_t;
3184         ')
3185
3186         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3187 ')
3188
3189 ########################################
3190 ## <summary>
3191 ##      Read and write a inherited user TTYs and PTYs.
3192 ## </summary>
3193 ## <desc>
3194 ##      <p>
3195 ##      Allow the specified domain to read and write inherited user
3196 ##      TTYs and PTYs. This will allow the domain to
3197 ##      interact with the user via the terminal. Typically
3198 ##      all interactive applications will require this
3199 ##      access.
3200 ##      </p>
3201 ## </desc>
3202 ## <param name="domain">
3203 ##      <summary>
3204 ##      Domain allowed access.
3205 ##      </summary>
3206 ## </param>
3207 ## <infoflow type="both" weight="10"/>
3208 #
3209 interface(`userdom_use_inherited_user_terminals',`
3210         gen_require(`
3211                 type user_tty_device_t, user_devpts_t;
3212         ')
3213
3214         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3215         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3216 ')
3217
3218 #######################################
3219 ## <summary>
3220 ##  Allow attempts to read and write
3221 ##  a user domain tty and pty.
3222 ## </summary>
3223 ## <param name="domain">
3224 ##  <summary>
3225 ##  Domain to not audit.
3226 ##  </summary>
3227 ## </param>
3228 #
3229 interface(`userdom_use_user_terminals',`
3230     gen_require(`
3231         type user_tty_device_t, user_devpts_t;
3232     ')
3233
3234     allow $1 user_tty_device_t:chr_file rw_term_perms;
3235     allow $1 user_devpts_t:chr_file rw_term_perms;
3236 ')
3237
3238 ########################################
3239 ## <summary>
3240 ##      Do not audit attempts to read and write
3241 ##      a user domain tty and pty.
3242 ## </summary>
3243 ## <param name="domain">
3244 ##      <summary>
3245 ##      Domain to not audit.
3246 ##      </summary>
3247 ## </param>
3248 #
3249 interface(`userdom_dontaudit_use_user_terminals',`
3250         gen_require(`
3251                 type user_tty_device_t, user_devpts_t;
3252         ')
3253
3254         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3255         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3256 ')
3257
3258
3259 ########################################
3260 ## <summary>
3261 ##      Get attributes of user domain tty and pty.
3262 ## </summary>
3263 ## <param name="domain">
3264 ##      <summary>
3265 ##      Domain allowed access.
3266 ##      </summary>
3267 ## </param>
3268 #
3269 interface(`userdom_getattr_user_terminals',`
3270         gen_require(`
3271                 type user_tty_device_t, user_devpts_t;
3272         ')
3273
3274         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3275 ')
3276
3277 ########################################
3278 ## <summary>
3279 ##      Execute a shell in all user domains.  This
3280 ##      is an explicit transition, requiring the
3281 ##      caller to use setexeccon().
3282 ## </summary>
3283 ## <param name="domain">
3284 ##      <summary>
3285 ##      Domain allowed to transition.
3286 ##      </summary>
3287 ## </param>
3288 #
3289 interface(`userdom_spec_domtrans_all_users',`
3290         gen_require(`
3291                 attribute userdomain;
3292         ')
3293
3294         corecmd_shell_spec_domtrans($1, userdomain)
3295         allow userdomain $1:fd use;
3296         allow userdomain $1:fifo_file rw_file_perms;
3297         allow userdomain $1:process sigchld;
3298 ')
3299
3300 ########################################
3301 ## <summary>
3302 ##      Execute an Xserver session in all unprivileged user domains.  This
3303 ##      is an explicit transition, requiring the
3304 ##      caller to use setexeccon().
3305 ## </summary>
3306 ## <param name="domain">
3307 ##      <summary>
3308 ##      Domain allowed to transition.
3309 ##      </summary>
3310 ## </param>
3311 #
3312 interface(`userdom_xsession_spec_domtrans_all_users',`
3313         gen_require(`
3314                 attribute userdomain;
3315         ')
3316
3317         xserver_xsession_spec_domtrans($1, userdomain)
3318         allow userdomain $1:fd use;
3319         allow userdomain $1:fifo_file rw_file_perms;
3320         allow userdomain $1:process sigchld;
3321 ')
3322
3323 ########################################
3324 ## <summary>
3325 ##      Execute a shell in all unprivileged user domains.  This
3326 ##      is an explicit transition, requiring the
3327 ##      caller to use setexeccon().
3328 ## </summary>
3329 ## <param name="domain">
3330 ##      <summary>
3331 ##      Domain allowed to transition.
3332 ##      </summary>
3333 ## </param>
3334 #
3335 interface(`userdom_spec_domtrans_unpriv_users',`
3336         gen_require(`
3337                 attribute unpriv_userdomain;
3338         ')
3339
3340         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3341         allow unpriv_userdomain $1:fd use;
3342         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3343         allow unpriv_userdomain $1:process sigchld;
3344 ')
3345
3346 ########################################
3347 ## <summary>
3348 ##      Execute an Xserver session in all unprivileged user domains.  This
3349 ##      is an explicit transition, requiring the
3350 ##      caller to use setexeccon().
3351 ## </summary>
3352 ## <param name="domain">
3353 ##      <summary>
3354 ##      Domain allowed to transition.
3355 ##      </summary>
3356 ## </param>
3357 #
3358 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3359         gen_require(`
3360                 attribute unpriv_userdomain;
3361         ')
3362
3363         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3364         allow unpriv_userdomain $1:fd use;
3365         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3366         allow unpriv_userdomain $1:process sigchld;
3367 ')
3368
3369 ########################################
3370 ## <summary>
3371 ##      Manage unpriviledged user SysV sempaphores.
3372 ## </summary>
3373 ## <param name="domain">
3374 ##      <summary>
3375 ##      Domain allowed access.
3376 ##      </summary>
3377 ## </param>
3378 #
3379 interface(`userdom_manage_unpriv_user_semaphores',`
3380         gen_require(`
3381                 attribute unpriv_userdomain;
3382         ')
3383
3384         allow $1 unpriv_userdomain:sem create_sem_perms;
3385 ')
3386
3387 ########################################
3388 ## <summary>
3389 ##      Manage unpriviledged user SysV shared
3390 ##      memory segments.
3391 ## </summary>
3392 ## <param name="domain">
3393 ##      <summary>
3394 ##      Domain allowed access.
3395 ##      </summary>
3396 ## </param>
3397 #
3398 interface(`userdom_manage_unpriv_user_shared_mem',`
3399         gen_require(`
3400                 attribute unpriv_userdomain;
3401         ')
3402
3403         allow $1 unpriv_userdomain:shm create_shm_perms;
3404 ')
3405
3406 ########################################
3407 ## <summary>
3408 ##      Execute bin_t in the unprivileged user domains. This
3409 ##      is an explicit transition, requiring the
3410 ##      caller to use setexeccon().
3411 ## </summary>
3412 ## <param name="domain">
3413 ##      <summary>
3414 ##      Domain allowed to transition.
3415 ##      </summary>
3416 ## </param>
3417 #
3418 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3419         gen_require(`
3420                 attribute unpriv_userdomain;
3421         ')
3422
3423         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3424         allow unpriv_userdomain $1:fd use;
3425         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3426         allow unpriv_userdomain $1:process sigchld;
3427 ')
3428
3429 ########################################
3430 ## <summary>
3431 ##      Execute all entrypoint files in unprivileged user
3432 ##      domains. This is an explicit transition, requiring the
3433 ##      caller to use setexeccon().
3434 ## </summary>
3435 ## <param name="domain">
3436 ##      <summary>
3437 ##      Domain allowed access.
3438 ##      </summary>
3439 ## </param>
3440 #
3441 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3442         gen_require(`
3443                 attribute unpriv_userdomain;
3444         ')
3445
3446         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3447         allow unpriv_userdomain $1:fd use;
3448         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3449         allow unpriv_userdomain $1:process sigchld;
3450 ')
3451
3452 ########################################
3453 ## <summary>
3454 ##      Search users home directories.
3455 ## </summary>
3456 ## <param name="domain">
3457 ##      <summary>
3458 ##      Domain allowed access.
3459 ##      </summary>
3460 ## </param>
3461 #
3462 interface(`userdom_search_user_home_content',`
3463         gen_require(`
3464                 type user_home_dir_t;
3465                 attribute user_home_type;
3466         ')
3467
3468         files_list_home($1)
3469         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3470         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3471 ')
3472
3473 ########################################
3474 ## <summary>
3475 ##      Send general signals to unprivileged user domains.
3476 ## </summary>
3477 ## <param name="domain">
3478 ##      <summary>
3479 ##      Domain allowed access.
3480 ##      </summary>
3481 ## </param>
3482 #
3483 interface(`userdom_signal_unpriv_users',`
3484         gen_require(`
3485                 attribute unpriv_userdomain;
3486         ')
3487
3488         allow $1 unpriv_userdomain:process signal;
3489 ')
3490
3491 ########################################
3492 ## <summary>
3493 ##      Inherit the file descriptors from unprivileged user domains.
3494 ## </summary>
3495 ## <param name="domain">
3496 ##      <summary>
3497 ##      Domain allowed access.
3498 ##      </summary>
3499 ## </param>
3500 #
3501 interface(`userdom_use_unpriv_users_fds',`
3502         gen_require(`
3503                 attribute unpriv_userdomain;
3504         ')
3505
3506         allow $1 unpriv_userdomain:fd use;
3507 ')
3508
3509 ########################################
3510 ## <summary>
3511 ##      Do not audit attempts to inherit the file descriptors
3512 ##      from unprivileged user domains.
3513 ## </summary>
3514 ## <desc>
3515 ##      <p>
3516 ##      Do not audit attempts to inherit the file descriptors
3517 ##      from unprivileged user domains. This will supress
3518 ##      SELinux denial messages when the specified domain is denied
3519 ##      the permission to inherit these file descriptors.
3520 ##      </p>
3521 ## </desc>
3522 ## <param name="domain">
3523 ##      <summary>
3524 ##      Domain to not audit.
3525 ##      </summary>
3526 ## </param>
3527 ## <infoflow type="none"/>
3528 #
3529 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3530         gen_require(`
3531                 attribute unpriv_userdomain;
3532         ')
3533
3534         dontaudit $1 unpriv_userdomain:fd use;
3535 ')
3536
3537 ########################################
3538 ## <summary>
3539 ##      Do not audit attempts to use user ptys.
3540 ## </summary>
3541 ## <param name="domain">
3542 ##      <summary>
3543 ##      Domain to not audit.
3544 ##      </summary>
3545 ## </param>
3546 #
3547 interface(`userdom_dontaudit_use_user_ptys',`
3548         gen_require(`
3549                 type user_devpts_t;
3550         ')
3551
3552         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3553 ')
3554
3555 ########################################
3556 ## <summary>
3557 ##      Relabel files to unprivileged user pty types.
3558 ## </summary>
3559 ## <param name="domain">
3560 ##      <summary>
3561 ##      Domain allowed access.
3562 ##      </summary>
3563 ## </param>
3564 #
3565 interface(`userdom_relabelto_user_ptys',`
3566         gen_require(`
3567                 type user_devpts_t;
3568         ')
3569
3570         allow $1 user_devpts_t:chr_file relabelto;
3571 ')
3572
3573 ########################################
3574 ## <summary>
3575 ##      Do not audit attempts to relabel files from
3576 ##      user pty types.
3577 ## </summary>
3578 ## <param name="domain">
3579 ##      <summary>
3580 ##      Domain to not audit.
3581 ##      </summary>
3582 ## </param>
3583 #
3584 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3585         gen_require(`
3586                 type user_devpts_t;
3587         ')
3588
3589         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3590 ')
3591
3592 ########################################
3593 ## <summary>
3594 ##      Write all users files in /tmp
3595 ## </summary>
3596 ## <param name="domain">
3597 ##      <summary>
3598 ##      Domain allowed access.
3599 ##      </summary>
3600 ## </param>
3601 #
3602 interface(`userdom_write_user_tmp_files',`
3603         gen_require(`
3604                 type user_tmp_t;
3605         ')
3606
3607         write_files_pattern($1, user_tmp_t, user_tmp_t)
3608 ')
3609
3610 ########################################
3611 ## <summary>
3612 ##      Do not audit attempts to write users
3613 ##      temporary files.
3614 ## </summary>
3615 ## <param name="domain">
3616 ##      <summary>
3617 ##      Domain to not audit.
3618 ##      </summary>
3619 ## </param>
3620 #
3621 interface(`userdom_dontaudit_write_user_tmp_files',`
3622         gen_require(`
3623                 type user_tmp_t;
3624         ')
3625
3626         dontaudit $1 user_tmp_t:file write;
3627 ')
3628
3629 ########################################
3630 ## <summary>
3631 ##      Do not audit attempts to read/write users
3632 ##      temporary fifo files.
3633 ## </summary>
3634 ## <param name="domain">
3635 ##      <summary>
3636 ##      Domain to not audit.
3637 ##      </summary>
3638 ## </param>
3639 #
3640 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3641         gen_require(`
3642                 type user_tmp_t;
3643         ')
3644
3645         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3646 ')
3647
3648 ########################################
3649 ## <summary>
3650 ##      Do not audit attempts to use user ttys.
3651 ## </summary>
3652 ## <param name="domain">
3653 ##      <summary>
3654 ##      Domain to not audit.
3655 ##      </summary>
3656 ## </param>
3657 #
3658 interface(`userdom_dontaudit_use_user_ttys',`
3659         gen_require(`
3660                 type user_tty_device_t;
3661         ')
3662
3663         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3664 ')
3665
3666 ########################################
3667 ## <summary>
3668 ##      Read the process state of all user domains.
3669 ## </summary>
3670 ## <param name="domain">
3671 ##      <summary>
3672 ##      Domain allowed access.
3673 ##      </summary>
3674 ## </param>
3675 #
3676 interface(`userdom_read_all_users_state',`
3677         gen_require(`
3678                 attribute userdomain;
3679         ')
3680
3681         read_files_pattern($1, userdomain, userdomain)
3682         read_lnk_files_pattern($1,userdomain,userdomain)
3683         kernel_search_proc($1)
3684 ')
3685
3686 ########################################
3687 ## <summary>
3688 ##      Get the attributes of all user domains.
3689 ## </summary>
3690 ## <param name="domain">
3691 ##      <summary>
3692 ##      Domain allowed access.
3693 ##      </summary>
3694 ## </param>
3695 #
3696 interface(`userdom_getattr_all_users',`
3697         gen_require(`
3698                 attribute userdomain;
3699         ')
3700
3701         allow $1 userdomain:process getattr;
3702 ')
3703
3704 ########################################
3705 ## <summary>
3706 ##      Inherit the file descriptors from all user domains
3707 ## </summary>
3708 ## <param name="domain">
3709 ##      <summary>
3710 ##      Domain allowed access.
3711 ##      </summary>
3712 ## </param>
3713 #
3714 interface(`userdom_use_all_users_fds',`
3715         gen_require(`
3716                 attribute userdomain;
3717         ')
3718
3719         allow $1 userdomain:fd use;
3720 ')
3721
3722 ########################################
3723 ## <summary>
3724 ##      Do not audit attempts to inherit the file
3725 ##      descriptors from any user domains.
3726 ## </summary>
3727 ## <param name="domain">
3728 ##      <summary>
3729 ##      Domain to not audit.
3730 ##      </summary>
3731 ## </param>
3732 #
3733 interface(`userdom_dontaudit_use_all_users_fds',`
3734         gen_require(`
3735                 attribute userdomain;
3736         ')
3737
3738         dontaudit $1 userdomain:fd use;
3739 ')
3740
3741 ########################################
3742 ## <summary>
3743 ##      Send general signals to all user domains.
3744 ## </summary>
3745 ## <param name="domain">
3746 ##      <summary>
3747 ##      Domain allowed access.
3748 ##      </summary>
3749 ## </param>
3750 #
3751 interface(`userdom_signal_all_users',`
3752         gen_require(`
3753                 attribute userdomain;
3754         ')
3755
3756         allow $1 userdomain:process signal;
3757 ')
3758
3759 ########################################
3760 ## <summary>
3761 ##      Send kill signals to all user domains.
3762 ## </summary>
3763 ## <param name="domain">
3764 ##      <summary>
3765 ##      Domain allowed access.
3766 ##      </summary>
3767 ## </param>
3768 #
3769 interface(`userdom_kill_all_users',`
3770         gen_require(`
3771                 attribute userdomain;
3772         ')
3773
3774         allow $1 userdomain:process sigkill;
3775 ')
3776
3777 ########################################
3778 ## <summary>
3779 ##      Send a SIGCHLD signal to all user domains.
3780 ## </summary>
3781 ## <param name="domain">
3782 ##      <summary>
3783 ##      Domain allowed access.
3784 ##      </summary>
3785 ## </param>
3786 #
3787 interface(`userdom_sigchld_all_users',`
3788         gen_require(`
3789                 attribute userdomain;
3790         ')
3791
3792         allow $1 userdomain:process sigchld;
3793 ')
3794
3795 ########################################
3796 ## <summary>
3797 ##      Create keys for all user domains.
3798 ## </summary>
3799 ## <param name="domain">
3800 ##      <summary>
3801 ##      Domain allowed access.
3802 ##      </summary>
3803 ## </param>
3804 #
3805 interface(`userdom_create_all_users_keys',`
3806         gen_require(`
3807                 attribute userdomain;
3808         ')
3809
3810         allow $1 userdomain:key create;
3811 ')
3812
3813 ########################################
3814 ## <summary>
3815 ##      Send a dbus message to all user domains.
3816 ## </summary>
3817 ## <param name="domain">
3818 ##      <summary>
3819 ##      Domain allowed access.
3820 ##      </summary>
3821 ## </param>
3822 #
3823 interface(`userdom_dbus_send_all_users',`
3824         gen_require(`
3825                 attribute userdomain;
3826                 class dbus send_msg;
3827         ')
3828
3829         allow $1 userdomain:dbus send_msg;
3830 ')
3831
3832 ########################################
3833 ## <summary>
3834 ##      Allow apps to set rlimits on userdomain
3835 ## </summary>
3836 ## <param name="domain">
3837 ##      <summary>
3838 ##      Domain allowed access.
3839 ##      </summary>
3840 ## </param>
3841 #
3842 interface(`userdom_set_rlimitnh',`
3843         gen_require(`
3844                 attribute userdomain;
3845         ')
3846
3847         allow $1 userdomain:process rlimitinh;
3848 ')
3849
3850 ########################################
3851 ## <summary>
3852 ##      Define this type as a Allow apps to set rlimits on userdomain
3853 ## </summary>
3854 ## <param name="domain">
3855 ##      <summary>
3856 ##      Domain allowed access.
3857 ##      </summary>
3858 ## </param>
3859 ## <param name="userdomain_prefix">
3860 ##      <summary>
3861 ##      The prefix of the user domain (e.g., user
3862 ##      is the prefix for user_t).
3863 ## </summary>
3864 ## </param>
3865 ## <param name="domain">
3866 ##      <summary>
3867 ##      Domain allowed access.
3868 ##      </summary>
3869 ## </param>
3870 #
3871 template(`userdom_unpriv_usertype',`
3872         gen_require(`
3873                 attribute unpriv_userdomain, userdomain;
3874                 attribute $1_usertype;
3875         ')
3876         typeattribute $2  $1_usertype;
3877         typeattribute $2  unpriv_userdomain;
3878         typeattribute $2  userdomain;
3879
3880         auth_use_nsswitch($2)
3881         ubac_constrained($2)
3882 ')
3883
3884 ########################################
3885 ## <summary>
3886 ##      Connect to users over an unix stream socket.
3887 ## </summary>
3888 ## <param name="domain">
3889 ##      <summary>
3890 ##      Domain allowed access.
3891 ##      </summary>
3892 ## </param>
3893 #
3894 interface(`userdom_stream_connect',`
3895         gen_require(`
3896                 type user_tmp_t;
3897                 attribute userdomain;
3898         ')
3899
3900         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3901 ')
3902
3903 ########################################
3904 ## <summary>
3905 ##      Ptrace user domains.
3906 ## </summary>
3907 ## <param name="domain">
3908 ##      <summary>
3909 ##      Domain allowed access.
3910 ##      </summary>
3911 ## </param>
3912 #
3913 interface(`userdom_ptrace_all_users',`
3914         gen_require(`
3915                 attribute userdomain;
3916         ')
3917
3918         allow $1 userdomain:process ptrace;
3919 ')
3920
3921 ########################################
3922 ## <summary>
3923 ##      dontaudit Search /root
3924 ## </summary>
3925 ## <param name="domain">
3926 ##      <summary>
3927 ##      Domain to not audit.
3928 ##      </summary>
3929 ## </param>
3930 #
3931 interface(`userdom_dontaudit_search_admin_dir',`
3932         gen_require(`
3933                 type admin_home_t;
3934         ')
3935
3936         dontaudit $1 admin_home_t:dir search_dir_perms;
3937 ')
3938
3939 ########################################
3940 ## <summary>
3941 ##      dontaudit list /root
3942 ## </summary>
3943 ## <param name="domain">
3944 ##      <summary>
3945 ##      Domain to not audit.
3946 ##      </summary>
3947 ## </param>
3948 #
3949 interface(`userdom_dontaudit_list_admin_dir',`
3950         gen_require(`
3951                 type admin_home_t;
3952         ')
3953
3954         dontaudit $1 admin_home_t:dir list_dir_perms;
3955 ')
3956
3957 ########################################
3958 ## <summary>
3959 ##      Allow domain to  list /root
3960 ## </summary>
3961 ## <param name="domain">
3962 ##      <summary>
3963 ##      Domain allowed access.
3964 ##      </summary>
3965 ## </param>
3966 #
3967 interface(`userdom_list_admin_dir',`
3968         gen_require(`
3969                 type admin_home_t;
3970         ')
3971
3972         allow $1 admin_home_t:dir list_dir_perms;
3973 ')
3974
3975 ########################################
3976 ## <summary>
3977 ##      Allow Search /root
3978 ## </summary>
3979 ## <param name="domain">
3980 ##      <summary>
3981 ##      Domain allowed access.
3982 ##      </summary>
3983 ## </param>
3984 #
3985 interface(`userdom_search_admin_dir',`
3986         gen_require(`
3987                 type admin_home_t;
3988         ')
3989
3990         allow $1 admin_home_t:dir search_dir_perms;
3991 ')
3992
3993 ########################################
3994 ## <summary>
3995 ##      RW unpriviledged user SysV sempaphores.
3996 ## </summary>
3997 ## <param name="domain">
3998 ##      <summary>
3999 ##      Domain allowed access.
4000 ##      </summary>
4001 ## </param>
4002 #
4003 interface(`userdom_rw_semaphores',`
4004         gen_require(`
4005                 attribute unpriv_userdomain;
4006         ')
4007
4008         allow $1 unpriv_userdomain:sem rw_sem_perms;
4009 ')
4010
4011 ########################################
4012 ## <summary>
4013 ##      Send a message to unpriv users over a unix domain
4014 ##      datagram socket.
4015 ## </summary>
4016 ## <param name="domain">
4017 ##      <summary>
4018 ##      Domain allowed access.
4019 ##      </summary>
4020 ## </param>
4021 #
4022 interface(`userdom_dgram_send',`
4023         gen_require(`
4024                 attribute unpriv_userdomain;
4025         ')
4026
4027         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4028 ')
4029
4030 ######################################
4031 ## <summary>
4032 ##      Send a message to users over a unix domain
4033 ##      datagram socket.
4034 ## </summary>
4035 ## <param name="domain">
4036 ##      <summary>
4037 ##      Domain allowed access.
4038 ##      </summary>
4039 ## </param>
4040 #
4041 interface(`userdom_users_dgram_send',`
4042         gen_require(`
4043                  attribute userdomain;
4044       ')
4045
4046        allow $1 userdomain:unix_dgram_socket sendto;
4047 ')
4048
4049 #######################################
4050 ## <summary>
4051 ##      Allow execmod on files in homedirectory
4052 ## </summary>
4053 ## <param name="domain">
4054 ##      <summary>
4055 ##      Domain allowed access.
4056 ##      </summary>
4057 ## </param>
4058 ## <rolebase/>
4059 #
4060 interface(`userdom_execmod_user_home_files',`
4061         gen_require(`
4062                 type user_home_type;
4063         ')
4064
4065         allow $1 user_home_type:file execmod;
4066 ')
4067
4068 ########################################
4069 ## <summary>
4070 ##      Read admin home files.
4071 ## </summary>
4072 ## <param name="domain">
4073 ##      <summary>
4074 ##      Domain allowed access.
4075 ##      </summary>
4076 ## </param>
4077 ## <rolecap/>
4078 #
4079 interface(`userdom_read_admin_home_files',`
4080         gen_require(`
4081                 type admin_home_t;
4082         ')
4083
4084         read_files_pattern($1, admin_home_t, admin_home_t)
4085 ')
4086
4087 ########################################
4088 ## <summary>
4089 ##      Execute admin home files.
4090 ## </summary>
4091 ## <param name="domain">
4092 ##      <summary>
4093 ##      Domain allowed access.
4094 ##      </summary>
4095 ## </param>
4096 ## <rolecap/>
4097 #
4098 interface(`userdom_exec_admin_home_files',`
4099         gen_require(`
4100                 type admin_home_t;
4101         ')
4102
4103         exec_files_pattern($1, admin_home_t, admin_home_t)
4104 ')
4105
4106 ########################################
4107 ## <summary>
4108 ##      Append files inherited
4109 ##      in the /root directory.
4110 ## </summary>
4111 ## <param name="domain">
4112 ##      <summary>
4113 ##      Domain allowed access.
4114 ##      </summary>
4115 ## </param>
4116 #
4117 interface(`userdom_inherit_append_admin_home_files',`
4118         gen_require(`
4119                 type admin_home_t;
4120         ')
4121
4122         allow $1 admin_home_t:file { getattr append };
4123 ')
4124
4125
4126 #######################################
4127 ## <summary>
4128 ##      Manage all files/directories in the homedir
4129 ## </summary>
4130 ## <param name="userdomain">
4131 ##      <summary>
4132 ##      The user domain
4133 ##      </summary>
4134 ## </param>
4135 ## <rolebase/>
4136 #
4137 interface(`userdom_manage_user_home_content',`
4138         gen_require(`
4139                 type user_home_dir_t, user_home_t;
4140                 attribute user_home_type;
4141         ')
4142
4143         files_list_home($1)
4144         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4145         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4146         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4147         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4148         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4149         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4150
4151 ')
4152
4153
4154 ########################################
4155 ## <summary>
4156 ##      Create objects in a user home directory
4157 ##      with an automatic type transition to
4158 ##      the user home file type.
4159 ## </summary>
4160 ## <param name="domain">
4161 ##      <summary>
4162 ##      Domain allowed access.
4163 ##      </summary>
4164 ## </param>
4165 ## <param name="object_class">
4166 ##      <summary>
4167 ##      The class of the object to be created.
4168 ##      </summary>
4169 ## </param>
4170 #
4171 interface(`userdom_user_home_dir_filetrans_pattern',`
4172         gen_require(`
4173                 type user_home_dir_t, user_home_t;
4174         ')
4175
4176         type_transition $1 user_home_dir_t:$2 user_home_t;
4177 ')
4178
4179 ########################################
4180 ## <summary>
4181 ##      Create objects in the /root directory
4182 ##      with an automatic type transition to
4183 ##      a specified private type.
4184 ## </summary>
4185 ## <param name="domain">
4186 ##      <summary>
4187 ##      Domain allowed access.
4188 ##      </summary>
4189 ## </param>
4190 ## <param name="private_type">
4191 ##      <summary>
4192 ##      The type of the object to create.
4193 ##      </summary>
4194 ## </param>
4195 ## <param name="object_class">
4196 ##      <summary>
4197 ##      The class of the object to be created.
4198 ##      </summary>
4199 ## </param>
4200 #
4201 interface(`userdom_admin_home_dir_filetrans',`
4202         gen_require(`
4203                 type admin_home_t;
4204         ')
4205
4206         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4207 ')
4208
4209 ########################################
4210 ## <summary>
4211 ##      Send signull to unprivileged user domains.
4212 ## </summary>
4213 ## <param name="domain">
4214 ##      <summary>
4215 ##      Domain allowed access.
4216 ##      </summary>
4217 ## </param>
4218 #
4219 interface(`userdom_signull_unpriv_users',`
4220         gen_require(`
4221                 attribute unpriv_userdomain;
4222         ')
4223
4224         allow $1 unpriv_userdomain:process signull;
4225 ')
4226
4227 ########################################
4228 ## <summary>
4229 ##      Write all users files in /tmp
4230 ## </summary>
4231 ## <param name="domain">
4232 ##      <summary>
4233 ##      Domain allowed access.
4234 ##      </summary>
4235 ## </param>
4236 #
4237 interface(`userdom_write_user_tmp_dirs',`
4238         gen_require(`
4239                 type user_tmp_t;
4240         ')
4241
4242         write_files_pattern($1, user_tmp_t, user_tmp_t)
4243 ')
4244
4245 ########################################
4246 ## <summary>
4247 ##      Manage keys for all user domains.
4248 ## </summary>
4249 ## <param name="domain">
4250 ##      <summary>
4251 ##      Domain allowed access.
4252 ##      </summary>
4253 ## </param>
4254 #
4255 interface(`userdom_manage_all_users_keys',`
4256         gen_require(`
4257                 attribute userdomain;
4258         ')
4259
4260         allow $1 userdomain:key manage_key_perms;
4261 ')
4262
4263
4264 ########################################
4265 ## <summary>
4266 ##      Do not audit attempts to read and write
4267 ##      unserdomain stream.
4268 ## </summary>
4269 ## <param name="domain">
4270 ##      <summary>
4271 ##      Domain to not audit.
4272 ##      </summary>
4273 ## </param>
4274 #
4275 interface(`userdom_dontaudit_rw_stream',`
4276         gen_require(`
4277                 attribute userdomain;
4278         ')
4279
4280         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4281 ')
4282
4283 ########################################
4284 ## <summary>
4285 ##      Do not audit attempts to read and write
4286 ##      unserdomain datagram socket.
4287 ## </summary>
4288 ## <param name="domain">
4289 ##      <summary>
4290 ##      Domain to not audit.
4291 ##      </summary>
4292 ## </param>
4293 #
4294 interface(`userdom_dontaudit_rw_dgram_socket',`
4295         gen_require(`
4296                 attribute userdomain;
4297         ')
4298
4299         dontaudit $1 userdomain:unix_dgram_socket { read write };
4300 ')
4301
4302 ########################################
4303 ## <summary>
4304 ##      Append files
4305 ##      in a user home subdirectory.
4306 ## </summary>
4307 ## <param name="domain">
4308 ##      <summary>
4309 ##      Domain allowed access.
4310 ##      </summary>
4311 ## </param>
4312 #
4313 interface(`userdom_append_user_home_content_files',`
4314         gen_require(`
4315                 type user_home_dir_t, user_home_t;
4316         ')
4317
4318         append_files_pattern($1, user_home_t, user_home_t)
4319         allow $1 user_home_dir_t:dir search_dir_perms;
4320         files_search_home($1)
4321 ')
4322
4323 ########################################
4324 ## <summary>
4325 ##      Read files inherited
4326 ##      in a user home subdirectory.
4327 ## </summary>
4328 ## <param name="domain">
4329 ##      <summary>
4330 ##      Domain allowed access.
4331 ##      </summary>
4332 ## </param>
4333 #
4334 interface(`userdom_read_inherited_user_home_content_files',`
4335         gen_require(`
4336                 attribute user_home_type;
4337         ')
4338
4339         allow $1 user_home_type:file { getattr read };
4340 ')
4341
4342 ########################################
4343 ## <summary>
4344 ##      Append files inherited
4345 ##      in a user home subdirectory.
4346 ## </summary>
4347 ## <param name="domain">
4348 ##      <summary>
4349 ##      Domain allowed access.
4350 ##      </summary>
4351 ## </param>
4352 #
4353 interface(`userdom_inherit_append_user_home_content_files',`
4354         gen_require(`
4355                 type user_home_t;
4356         ')
4357
4358         allow $1 user_home_t:file { getattr append };
4359 ')
4360
4361 ########################################
4362 ## <summary>
4363 ##      Append files inherited
4364 ##      in a user tmp files.
4365 ## </summary>
4366 ## <param name="domain">
4367 ##      <summary>
4368 ##      Domain allowed access.
4369 ##      </summary>
4370 ## </param>
4371 #
4372 interface(`userdom_inherit_append_user_tmp_files',`
4373         gen_require(`
4374                 type user_tmp_t;
4375         ')
4376
4377         allow $1 user_tmp_t:file { getattr append };
4378 ')
4379
4380 ######################################
4381 ## <summary>
4382 ##      Read audio files in the users homedir.
4383 ## </summary>
4384 ## <param name="domain">
4385 ##      <summary>
4386 ##      Domain allowed access.
4387 ##      </summary>
4388 ## </param>
4389 ## <rolecap/>
4390 #
4391 interface(`userdom_read_home_audio_files',`
4392         gen_require(`
4393                 type audio_home_t;
4394         ')
4395
4396         userdom_search_user_home_dirs($1)
4397         allow $1 audio_home_t:dir list_dir_perms;
4398         read_files_pattern($1, audio_home_t, audio_home_t)
4399         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4400 ')
4401
4402 ########################################
4403 ## <summary>
4404 ##      Do not audit attempts to write all user home content files.
4405 ## </summary>
4406 ## <param name="domain">
4407 ##      <summary>
4408 ##      Domain to not audit.
4409 ##      </summary>
4410 ## </param>
4411 #
4412 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4413         gen_require(`
4414                 attribute user_home_type;
4415         ')
4416
4417         dontaudit $1 user_home_type:file write_file_perms;
4418 ')
4419
4420 ########################################
4421 ## <summary>
4422 ##      Do not audit attempts to write all user tmp content files.
4423 ## </summary>
4424 ## <param name="domain">
4425 ##      <summary>
4426 ##      Domain to not audit.
4427 ##      </summary>
4428 ## </param>
4429 #
4430 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4431         gen_require(`
4432                 attribute user_tmp_type;
4433         ')
4434
4435         dontaudit $1 user_tmp_type:file write_file_perms;
4436 ')
4437
4438 ########################################
4439 ## <summary>
4440 ##      Manage all user temporary content.
4441 ## </summary>
4442 ## <param name="domain">
4443 ##      <summary>
4444 ##      Domain allowed access.
4445 ##      </summary>
4446 ## </param>
4447 #
4448 interface(`userdom_manage_all_user_tmp_content',`
4449         gen_require(`
4450                 attribute user_tmp_type;
4451         ')
4452
4453         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4454         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4455         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4456         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4457         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4458         files_search_tmp($1)
4459 ')
4460
4461 ########################################
4462 ## <summary>
4463 ##      List all user temporary content.
4464 ## </summary>
4465 ## <param name="domain">
4466 ##      <summary>
4467 ##      Domain allowed access.
4468 ##      </summary>
4469 ## </param>
4470 #
4471 interface(`userdom_list_all_user_tmp_content',`
4472         gen_require(`
4473                 attribute user_tmp_type;
4474         ')
4475
4476         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4477         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4478         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4479         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4480         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4481         files_search_var($1)
4482         files_search_tmp($1)
4483 ')
4484
4485 ########################################
4486 ## <summary>
4487 ##      Manage all user tmpfs content.
4488 ## </summary>
4489 ## <param name="domain">
4490 ##      <summary>
4491 ##      Domain allowed access.
4492 ##      </summary>
4493 ## </param>
4494 #
4495 interface(`userdom_manage_all_user_tmpfs_content',`
4496         gen_require(`
4497                 attribute user_tmpfs_type;
4498         ')
4499
4500         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4501         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4502         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4503         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4504         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4505         fs_search_tmpfs($1)
4506 ')
4507
4508 ########################################
4509 ## <summary>
4510 ##      Delete all user temporary content.
4511 ## </summary>
4512 ## <param name="domain">
4513 ##      <summary>
4514 ##      Domain allowed access.
4515 ##      </summary>
4516 ## </param>
4517 #
4518 interface(`userdom_delete_all_user_tmp_content',`
4519         gen_require(`
4520                 attribute user_tmp_type;
4521         ')
4522
4523         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4524         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4525         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4526         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4527         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4528         # /var/tmp
4529         files_search_var($1)
4530         files_delete_tmp_dir_entry($1)
4531 ')
4532
4533 ########################################
4534 ## <summary>
4535 ##      Read system SSL certificates in the users homedir.
4536 ## </summary>
4537 ## <param name="domain">
4538 ##      <summary>
4539 ##      Domain allowed access.
4540 ##      </summary>
4541 ## </param>
4542 #
4543 interface(`userdom_read_home_certs',`
4544         gen_require(`
4545                 type home_cert_t;
4546         ')
4547
4548         userdom_search_user_home_content($1)
4549         allow $1 home_cert_t:dir list_dir_perms;
4550         read_files_pattern($1, home_cert_t, home_cert_t)
4551         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4552 ')
4553
4554 #######################################
4555 ## <summary>
4556 ##  Dontaudit Write system SSL certificates in the users homedir.
4557 ## </summary>
4558 ## <param name="domain">
4559 ##  <summary>
4560 ##      Domain to not audit.
4561 ##  </summary>
4562 ## </param>
4563 #
4564 interface(`userdom_dontaudit_write_home_certs',`
4565     gen_require(`
4566         type home_cert_t;
4567     ')
4568
4569     dontaudit $1 home_cert_t:file write;
4570 ')
4571
4572 ########################################
4573 ## <summary>
4574 ##      dontaudit Search getatrr /root files
4575 ## </summary>
4576 ## <param name="domain">
4577 ##      <summary>
4578 ##      Domain to not audit.
4579 ##      </summary>
4580 ## </param>
4581 #
4582 interface(`userdom_dontaudit_getattr_admin_home_files',`
4583         gen_require(`
4584                 type admin_home_t;
4585         ')
4586
4587         dontaudit $1 admin_home_t:file getattr;
4588 ')
4589
4590 ########################################
4591 ## <summary>
4592 ##      dontaudit read /root lnk files
4593 ## </summary>
4594 ## <param name="domain">
4595 ##      <summary>
4596 ##      Domain to not audit.
4597 ##      </summary>
4598 ## </param>
4599 #
4600 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4601         gen_require(`
4602                 type admin_home_t;
4603         ')
4604
4605         dontaudit $1 admin_home_t:lnk_file read;
4606 ')
4607
4608 ########################################
4609 ## <summary>
4610 ##      dontaudit read /root files
4611 ## </summary>
4612 ## <param name="domain">
4613 ##      <summary>
4614 ##      Domain to not audit.
4615 ##      </summary>
4616 ## </param>
4617 #
4618 interface(`userdom_dontaudit_read_admin_home_files',`
4619         gen_require(`
4620                 type admin_home_t;
4621         ')
4622
4623         dontaudit $1 admin_home_t:file read_file_perms;
4624 ')
4625
4626 ########################################
4627 ## <summary>
4628 ##      Create, read, write, and delete user
4629 ##      temporary chr files.
4630 ## </summary>
4631 ## <param name="domain">
4632 ##      <summary>
4633 ##      Domain allowed access.
4634 ##      </summary>
4635 ## </param>
4636 #
4637 interface(`userdom_manage_user_tmp_chr_files',`
4638         gen_require(`
4639                 type user_tmp_t;
4640         ')
4641
4642         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4643         files_search_tmp($1)
4644 ')
4645
4646 ########################################
4647 ## <summary>
4648 ##      Create, read, write, and delete user
4649 ##      temporary blk files.
4650 ## </summary>
4651 ## <param name="domain">
4652 ##      <summary>
4653 ##      Domain allowed access.
4654 ##      </summary>
4655 ## </param>
4656 #
4657 interface(`userdom_manage_user_tmp_blk_files',`
4658         gen_require(`
4659                 type user_tmp_t;
4660         ')
4661
4662         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4663         files_search_tmp($1)
4664 ')
4665
4666 ########################################
4667 ## <summary>
4668 ##      Dontaudit attempt to set attributes on  user temporary directories.
4669 ## </summary>
4670 ## <param name="domain">
4671 ##      <summary>
4672 ##      Domain to not audit.
4673 ##      </summary>
4674 ## </param>
4675 #
4676 interface(`userdom_dontaudit_setattr_user_tmp',`
4677         gen_require(`
4678                 type user_tmp_t;
4679         ')
4680
4681         dontaudit $1 user_tmp_t:dir setattr;
4682 ')
4683
4684 ########################################
4685 ## <summary>
4686 ##      Write all inherited users files in /tmp
4687 ## </summary>
4688 ## <param name="domain">
4689 ##      <summary>
4690 ##      Domain allowed access.
4691 ##      </summary>
4692 ## </param>
4693 #
4694 interface(`userdom_write_inherited_user_tmp_files',`
4695         gen_require(`
4696                 type user_tmp_t;
4697         ')
4698
4699         allow $1 user_tmp_t:file write;
4700 ')
4701
4702 ########################################
4703 ## <summary>
4704 ##      Delete all users files in /tmp
4705 ## </summary>
4706 ## <param name="domain">
4707 ##      <summary>
4708 ##      Domain allowed access.
4709 ##      </summary>
4710 ## </param>
4711 #
4712 interface(`userdom_delete_user_tmp_files',`
4713         gen_require(`
4714                 type user_tmp_t;
4715         ')
4716
4717         allow $1 user_tmp_t:file delete_file_perms;
4718 ')
4719
4720 ########################################
4721 ## <summary>
4722 ##      Delete user tmpfs files.
4723 ## </summary>
4724 ## <param name="domain">
4725 ##      <summary>
4726 ##      Domain allowed access.
4727 ##      </summary>
4728 ## </param>
4729 #
4730 interface(`userdom_delete_user_tmpfs_files',`
4731         gen_require(`
4732                 type user_tmpfs_t;
4733         ')
4734
4735         allow $1 user_tmpfs_t:file delete_file_perms;
4736 ')
4737
4738 ########################################
4739 ## <summary>
4740 ##      Read/Write unpriviledged user SysV shared
4741 ##      memory segments.
4742 ## </summary>
4743 ## <param name="domain">
4744 ##      <summary>
4745 ##      Domain allowed access.
4746 ##      </summary>
4747 ## </param>
4748 #
4749 interface(`userdom_rw_unpriv_user_shared_mem',`
4750         gen_require(`
4751                 attribute unpriv_userdomain;
4752         ')
4753
4754         allow $1 unpriv_userdomain:shm rw_shm_perms;
4755 ')
4756
4757 ########################################
4758 ## <summary>
4759 ##      Do not audit attempts to search user
4760 ##      temporary directories.
4761 ## </summary>
4762 ## <param name="domain">
4763 ##      <summary>
4764 ##      Domain to not audit.
4765 ##      </summary>
4766 ## </param>
4767 #
4768 interface(`userdom_dontaudit_search_user_tmp',`
4769         gen_require(`
4770                 type user_tmp_t;
4771         ')
4772
4773         dontaudit $1 user_tmp_t:dir search_dir_perms;
4774 ')
4775
4776 ########################################
4777 ## <summary>
4778 ##      Execute a file in a user home directory
4779 ##      in the specified domain.
4780 ## </summary>
4781 ## <desc>
4782 ##      <p>
4783 ##      Execute a file in a user home directory
4784 ##      in the specified domain.
4785 ##      </p>
4786 ##      <p>
4787 ##      No interprocess communication (signals, pipes,
4788 ##      etc.) is provided by this interface since
4789 ##      the domains are not owned by this module.
4790 ##      </p>
4791 ## </desc>
4792 ## <param name="domain">
4793 ##      <summary>
4794 ##      Domain allowed access.
4795 ##      </summary>
4796 ## </param>
4797 ## <param name="target_domain">
4798 ##      <summary>
4799 ##      The type of the new process.
4800 ##      </summary>
4801 ## </param>
4802 #
4803 interface(`userdom_domtrans_user_home',`
4804         gen_require(`
4805                 type user_home_t;
4806         ')
4807
4808         read_lnk_files_pattern($1, user_home_t, user_home_t)
4809         domain_transition_pattern($1, user_home_t, $2)
4810         type_transition $1 user_home_t:process $2;
4811 ')
4812
4813 ########################################
4814 ## <summary>
4815 ##      Execute a file in a user tmp directory
4816 ##      in the specified domain.
4817 ## </summary>
4818 ## <desc>
4819 ##      <p>
4820 ##      Execute a file in a user tmp directory
4821 ##      in the specified domain.
4822 ##      </p>
4823 ##      <p>
4824 ##      No interprocess communication (signals, pipes,
4825 ##      etc.) is provided by this interface since
4826 ##      the domains are not owned by this module.
4827 ##      </p>
4828 ## </desc>
4829 ## <param name="domain">
4830 ##      <summary>
4831 ##      Domain allowed access.
4832 ##      </summary>
4833 ## </param>
4834 ## <param name="target_domain">
4835 ##      <summary>
4836 ##      The type of the new process.
4837 ##      </summary>
4838 ## </param>
4839 #
4840 interface(`userdom_domtrans_user_tmp',`
4841         gen_require(`
4842                 type user_tmp_t;
4843         ')
4844
4845         files_search_tmp($1)
4846         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4847         domain_transition_pattern($1, user_tmp_t, $2)
4848         type_transition $1 user_tmp_t:process $2;
4849 ')
4850
4851 ########################################
4852 ## <summary>
4853 ##      Do not audit attempts to read all user home content files.
4854 ## </summary>
4855 ## <param name="domain">
4856 ##      <summary>
4857 ##      Domain to not audit.
4858 ##      </summary>
4859 ## </param>
4860 #
4861 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4862         gen_require(`
4863                 attribute user_home_type;
4864         ')
4865
4866         dontaudit $1 user_home_type:file read_file_perms;
4867 ')
4868
4869 ########################################
4870 ## <summary>
4871 ##      Do not audit attempts to read all user tmp content files.
4872 ## </summary>
4873 ## <param name="domain">
4874 ##      <summary>
4875 ##      Domain to not audit.
4876 ##      </summary>
4877 ## </param>
4878 #
4879 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4880         gen_require(`
4881                 attribute user_tmp_type;
4882         ')
4883
4884         dontaudit $1 user_tmp_type:file read_file_perms;
4885 ')
4886
4887 #######################################
4888 ## <summary>
4889 ## Read and write unpriviledged user SysV sempaphores.
4890 ## </summary>
4891 ## <param name="domain">
4892 ## <summary>
4893 ## Domain allowed access.
4894 ## </summary>
4895 ## </param>
4896 #
4897 interface(`userdom_rw_unpriv_user_semaphores',`
4898    gen_require(`
4899        attribute unpriv_userdomain;
4900    ')
4901
4902    allow $1 unpriv_userdomain:sem rw_sem_perms;
4903 ')