policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658
 659         init_read_utmp($1_usertype)
 660
 661         seutil_read_file_contexts($1_usertype)
 662         seutil_read_default_contexts($1_usertype)
 663         seutil_run_newrole($1_t,$1_r)
 664         seutil_exec_checkpolicy($1_t)
 665         seutil_exec_setfiles($1_usertype)
 666         # for when the network connection is killed
 667         # this is needed when a login role can change
 668         # to this one.
 669         seutil_dontaudit_signal_newrole($1_t)
 670
 671         tunable_policy(`user_direct_mouse',`
 672                 dev_read_mouse($1_usertype)
 673         ')
 674
 675         tunable_policy(`user_ttyfile_stat',`
 676                 term_getattr_all_ttys($1_t)
 677         ')
 678
 679         optional_policy(`
 680                 # Allow graphical boot to check battery lifespan
 681                 apm_stream_connect($1_usertype)
 682         ')
 683
 684         optional_policy(`
 685                 canna_stream_connect($1_usertype)
 686         ')
 687
 688         optional_policy(`
 689                 chrome_role($1_r, $1_usertype)
 690         ')
 691
 692         optional_policy(`
 693                 colord_read_lib_files($1_usertype)
 694         ')
 695
 696         optional_policy(`
 697                 dbus_system_bus_client($1_usertype)
 698
 699                 allow $1_usertype $1_usertype:dbus  send_msg;
 700
 701                 optional_policy(`
 702                         avahi_dbus_chat($1_usertype)
 703                 ')
 704
 705                 optional_policy(`
 706                         policykit_dbus_chat($1_usertype)
 707                 ')
 708
 709                 optional_policy(`
 710                         bluetooth_dbus_chat($1_usertype)
 711                 ')
 712
 713                 optional_policy(`
 714                         consolekit_dbus_chat($1_usertype)
 715                         consolekit_read_log($1_usertype)
 716                 ')
 717
 718                 optional_policy(`
 719                         devicekit_dbus_chat($1_usertype)
 720                         devicekit_dbus_chat_power($1_usertype)
 721                         devicekit_dbus_chat_disk($1_usertype)
 722                 ')
 723
 724                 optional_policy(`
 725                         evolution_dbus_chat($1_usertype)
 726                         evolution_alarm_dbus_chat($1_usertype)
 727                 ')
 728
 729                 optional_policy(`
 730                         gnome_dbus_chat_gconfdefault($1_usertype)
 731                 ')
 732
 733                 optional_policy(`
 734                         hal_dbus_chat($1_usertype)
 735                 ')
 736
 737                 optional_policy(`
 738                         kde_dbus_chat_backlighthelper($1_usertype)
 739                 ')
 740
 741                 optional_policy(`
 742                         modemmanager_dbus_chat($1_usertype)
 743                 ')
 744
 745                 optional_policy(`
 746                         networkmanager_dbus_chat($1_usertype)
 747                         networkmanager_read_lib_files($1_usertype)
 748                 ')
 749
 750                 optional_policy(`
 751                         vpn_dbus_chat($1_usertype)
 752                 ')
 753         ')
 754
 755         optional_policy(`
 756                 git_session_role($1_r, $1_usertype)
 757         ')
 758
 759         optional_policy(`
 760                 inetd_use_fds($1_usertype)
 761                 inetd_rw_tcp_sockets($1_usertype)
 762         ')
 763
 764         optional_policy(`
 765                 inn_read_config($1_usertype)
 766                 inn_read_news_lib($1_usertype)
 767                 inn_read_news_spool($1_usertype)
 768         ')
 769
 770         optional_policy(`
 771                 lircd_stream_connect($1_usertype)
 772         ')
 773
 774         optional_policy(`
 775                 locate_read_lib_files($1_usertype)
 776         ')
 777
 778         # for running depmod as part of the kernel packaging process
 779         optional_policy(`
 780                 modutils_read_module_config($1_usertype)
 781         ')
 782
 783         optional_policy(`
 784                 mta_rw_spool($1_usertype)
 785                 mta_manage_queue($1_usertype)
 786                 mta_filetrans_home_content($1_usertype)
 787         ')
 788
 789         optional_policy(`
 790                 nsplugin_role($1_r, $1_usertype)
 791         ')
 792
 793         optional_policy(`
 794                 tunable_policy(`allow_user_mysql_connect',`
 795                         mysql_stream_connect($1_t)
 796                 ')
 797         ')
 798
 799         optional_policy(`
 800                 oident_manage_user_content($1_t)
 801                 oident_relabel_user_content($1_t)
 802         ')
 803
 804         optional_policy(`
 805                 # to allow monitoring of pcmcia status
 806                 pcmcia_read_pid($1_usertype)
 807         ')
 808
 809         optional_policy(`
 810                 pcscd_read_pub_files($1_usertype)
 811                 pcscd_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 tunable_policy(`allow_user_postgresql_connect',`
 816                         postgresql_stream_connect($1_usertype)
 817                         postgresql_tcp_connect($1_usertype)
 818                 ')
 819         ')
 820
 821         optional_policy(`
 822                 resmgr_stream_connect($1_usertype)
 823         ')
 824
 825         optional_policy(`
 826                 rpc_dontaudit_getattr_exports($1_usertype)
 827                 rpc_manage_nfs_rw_content($1_usertype)
 828         ')
 829
 830         optional_policy(`
 831                 rpcbind_stream_connect($1_usertype)
 832         ')
 833
 834         optional_policy(`
 835                 samba_stream_connect_winbind($1_usertype)
 836         ')
 837
 838         optional_policy(`
 839                 sandbox_transition($1_usertype, $1_r)
 840         ')
 841
 842         optional_policy(`
 843                 seunshare_role_template($1, $1_r, $1_t)
 844         ')
 845
 846         optional_policy(`
 847                 slrnpull_search_spool($1_usertype)
 848         ')
 849
 850         optional_policy(`
 851                 thumb_role($1_r, $1_usertype)
 852         ')
 853 ')
 854
 855 #######################################
 856 ## <summary>
 857 ##      The template for creating a login user.
 858 ## </summary>
 859 ## <desc>
 860 ##      <p>
 861 ##      This template creates a user domain, types, and
 862 ##      rules for the user's tty, pty, home directories,
 863 ##      tmp, and tmpfs files.
 864 ##      </p>
 865 ## </desc>
 866 ## <param name="userdomain_prefix">
 867 ##      <summary>
 868 ##      The prefix of the user domain (e.g., user
 869 ##      is the prefix for user_t).
 870 ##      </summary>
 871 ## </param>
 872 #
 873 template(`userdom_login_user_template', `
 874         gen_require(`
 875                 class context contains;
 876         ')
 877
 878         userdom_base_user_template($1)
 879
 880         userdom_manage_home_role($1_r, $1_usertype)
 881
 882         userdom_manage_tmp_role($1_r, $1_usertype)
 883         userdom_manage_tmpfs_role($1_r, $1_usertype)
 884
 885         ifelse(`$1',`unconfined',`',`
 886                 gen_tunable(allow_$1_exec_content, true)
 887
 888                 tunable_policy(`allow_$1_exec_content',`
 889                         userdom_exec_user_tmp_files($1_usertype)
 890                         userdom_exec_user_home_content_files($1_usertype)
 891                 ')
 892                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 893                         fs_exec_nfs_files($1_usertype)
 894                 ')
 895
 896                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 897                         fs_exec_cifs_files($1_usertype)
 898                 ')
 899         ')
 900
 901         userdom_change_password_template($1)
 902
 903         ##############################
 904         #
 905         # User domain Local policy
 906         #
 907
 908         allow $1_t self:capability { setgid chown fowner };
 909         dontaudit $1_t self:capability { sys_nice fsetid };
 910
 911         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 912         dontaudit $1_t self:process setrlimit;
 913         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 914
 915         allow $1_t self:context contains;
 916
 917         kernel_dontaudit_read_system_state($1_usertype)
 918         kernel_dontaudit_list_all_proc($1_usertype)
 919
 920         dev_read_sysfs($1_usertype)
 921         dev_read_urand($1_usertype)
 922
 923         domain_use_interactive_fds($1_usertype)
 924         # Command completion can fire hundreds of denials
 925         domain_dontaudit_exec_all_entry_files($1_usertype)
 926
 927         files_dontaudit_list_default($1_usertype)
 928         files_dontaudit_read_default_files($1_usertype)
 929         # Stat lost+found.
 930         files_getattr_lost_found_dirs($1_usertype)
 931
 932         fs_get_all_fs_quotas($1_usertype)
 933         fs_getattr_all_fs($1_usertype)
 934         fs_search_all($1_usertype)
 935         fs_list_inotifyfs($1_usertype)
 936         fs_rw_anon_inodefs_files($1_usertype)
 937
 938         auth_dontaudit_write_login_records($1_t)
 939         auth_rw_cache($1_t)
 940
 941         application_exec_all($1_t)
 942         # The library functions always try to open read-write first,
 943         # then fall back to read-only if it fails.
 944         init_dontaudit_rw_utmp($1_t)
 945
 946         # Stop warnings about access to /dev/console
 947         init_dontaudit_use_fds($1_usertype)
 948         init_dontaudit_use_script_fds($1_usertype)
 949
 950         libs_exec_lib_files($1_usertype)
 951
 952         logging_dontaudit_getattr_all_logs($1_usertype)
 953
 954         # for running TeX programs
 955         miscfiles_read_tetex_data($1_usertype)
 956         miscfiles_exec_tetex_data($1_usertype)
 957
 958         seutil_read_config($1_usertype)
 959
 960         optional_policy(`
 961                 cups_read_config($1_usertype)
 962                 cups_stream_connect($1_usertype)
 963                 cups_stream_connect_ptal($1_usertype)
 964         ')
 965
 966         optional_policy(`
 967                 kerberos_use($1_usertype)
 968                 kerberos_filetrans_home_content($1_usertype)
 969         ')
 970
 971         optional_policy(`
 972                 mta_dontaudit_read_spool_symlinks($1_usertype)
 973         ')
 974
 975         optional_policy(`
 976                 quota_dontaudit_getattr_db($1_usertype)
 977         ')
 978
 979         optional_policy(`
 980                 rpm_read_db($1_usertype)
 981                 rpm_dontaudit_manage_db($1_usertype)
 982                 rpm_read_cache($1_usertype)
 983         ')
 984
 985         optional_policy(`
 986                 oddjob_run_mkhomedir($1_t, $1_r)
 987         ')
 988 ')
 989
 990 #######################################
 991 ## <summary>
 992 ##      The template for creating a unprivileged login user.
 993 ## </summary>
 994 ## <desc>
 995 ##      <p>
 996 ##      This template creates a user domain, types, and
 997 ##      rules for the user's tty, pty, home directories,
 998 ##      tmp, and tmpfs files.
 999 ##      </p>
1000 ## </desc>
1001 ## <param name="userdomain_prefix">
1002 ##      <summary>
1003 ##      The prefix of the user domain (e.g., user
1004 ##      is the prefix for user_t).
1005 ##      </summary>
1006 ## </param>
1007 #
1008 template(`userdom_restricted_user_template',`
1009         gen_require(`
1010                 attribute unpriv_userdomain;
1011         ')
1012
1013         userdom_login_user_template($1)
1014
1015         typeattribute $1_t unpriv_userdomain;
1016         domain_interactive_fd($1_t)
1017
1018         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1019         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1020
1021         ##############################
1022         #
1023         # Local policy
1024         #
1025
1026         optional_policy(`
1027                 loadkeys_run($1_t, $1_r)
1028         ')
1029 ')
1030
1031 #######################################
1032 ## <summary>
1033 ##      The template for creating a unprivileged xwindows login user.
1034 ## </summary>
1035 ## <desc>
1036 ##      <p>
1037 ##      The template for creating a unprivileged xwindows login user.
1038 ##      </p>
1039 ##      <p>
1040 ##      This template creates a user domain, types, and
1041 ##      rules for the user's tty, pty, home directories,
1042 ##      tmp, and tmpfs files.
1043 ##      </p>
1044 ## </desc>
1045 ## <param name="userdomain_prefix">
1046 ##      <summary>
1047 ##      The prefix of the user domain (e.g., user
1048 ##      is the prefix for user_t).
1049 ##      </summary>
1050 ## </param>
1051 #
1052 template(`userdom_restricted_xwindows_user_template',`
1053
1054         userdom_restricted_user_template($1)
1055
1056         ##############################
1057         #
1058         # Local policy
1059         #
1060
1061         auth_role($1_r, $1_t)
1062         auth_search_pam_console_data($1_usertype)
1063         auth_dontaudit_read_login_records($1_usertype)
1064
1065         dev_read_sound($1_usertype)
1066         dev_write_sound($1_usertype)
1067         # gnome keyring wants to read this.
1068         dev_dontaudit_read_rand($1_usertype)
1069         # temporarily allow since openoffice requires this
1070         dev_read_rand($1_usertype)
1071
1072         dev_read_video_dev($1_usertype)
1073         dev_write_video_dev($1_usertype)
1074         dev_rw_wireless($1_usertype)
1075
1076         libs_dontaudit_setattr_lib_files($1_usertype)
1077
1078         tunable_policy(`user_rw_noexattrfile',`
1079                 dev_rw_usbfs($1_t)
1080                 dev_rw_generic_usb_dev($1_usertype)
1081
1082                 fs_manage_noxattr_fs_files($1_usertype)
1083                 fs_manage_noxattr_fs_dirs($1_usertype)
1084                 fs_manage_dos_dirs($1_usertype)
1085                 fs_manage_dos_files($1_usertype)
1086                 storage_raw_read_removable_device($1_usertype)
1087                 storage_raw_write_removable_device($1_usertype)
1088         ')
1089
1090         logging_send_syslog_msg($1_usertype)
1091         logging_dontaudit_send_audit_msgs($1_t)
1092
1093         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1094         logging_send_audit_msgs($1_t)
1095         selinux_get_enforce_mode($1_t)
1096         seutil_exec_restorecond($1_t)
1097         seutil_read_file_contexts($1_t)
1098         seutil_read_default_contexts($1_t)
1099
1100         xserver_restricted_role($1_r, $1_t)
1101
1102         optional_policy(`
1103                 alsa_read_rw_config($1_usertype)
1104         ')
1105
1106          # cjp: needed by KDE apps
1107          # bug: #682499
1108          optional_policy(`
1109                 gnome_read_usr_config($1_usertype)
1110                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1111                 # cjp: telepathy F15 bugs
1112                 telepathy_role($1_r, $1_t, $1)
1113         ')
1114
1115         optional_policy(`
1116                 dbus_role_template($1, $1_r, $1_usertype)
1117                 dbus_system_bus_client($1_usertype)
1118                 allow $1_usertype $1_usertype:dbus send_msg;
1119
1120                 optional_policy(`
1121                         abrt_dbus_chat($1_usertype)
1122                         abrt_run_helper($1_usertype, $1_r)
1123                 ')
1124
1125                 optional_policy(`
1126                         consolekit_dontaudit_read_log($1_usertype)
1127                         consolekit_dbus_chat($1_usertype)
1128                 ')
1129
1130                 optional_policy(`
1131                         cups_dbus_chat($1_usertype)
1132                         cups_dbus_chat_config($1_usertype)
1133                 ')
1134
1135                 optional_policy(`
1136                         devicekit_dbus_chat($1_usertype)
1137                         devicekit_dbus_chat_disk($1_usertype)
1138                         devicekit_dbus_chat_power($1_usertype)
1139                 ')
1140
1141                 optional_policy(`
1142                         fprintd_dbus_chat($1_t)
1143                 ')
1144         ')
1145
1146         optional_policy(`
1147                 openoffice_role_template($1, $1_r, $1_usertype)
1148         ')
1149
1150         optional_policy(`
1151                 policykit_role($1_r, $1_usertype)
1152         ')
1153
1154         optional_policy(`
1155                 pulseaudio_role($1_r, $1_usertype)
1156                 pulseaudio_filetrans_admin_home_content($1_usertype)
1157                 pulseaudio_filetrans_home_content($1_usertype)
1158         ')
1159
1160         optional_policy(`
1161                 rtkit_scheduled($1_usertype)
1162         ')
1163
1164         optional_policy(`
1165                 setroubleshoot_dontaudit_stream_connect($1_t)
1166         ')
1167
1168         optional_policy(`
1169                 udev_read_db($1_usertype)
1170         ')
1171
1172         optional_policy(`
1173                 wm_role_template($1, $1_r, $1_t)
1174         ')
1175 ')
1176
1177 #######################################
1178 ## <summary>
1179 ##      The template for creating a unprivileged user roughly
1180 ##      equivalent to a regular linux user.
1181 ## </summary>
1182 ## <desc>
1183 ##      <p>
1184 ##      The template for creating a unprivileged user roughly
1185 ##      equivalent to a regular linux user.
1186 ##      </p>
1187 ##      <p>
1188 ##      This template creates a user domain, types, and
1189 ##      rules for the user's tty, pty, home directories,
1190 ##      tmp, and tmpfs files.
1191 ##      </p>
1192 ## </desc>
1193 ## <param name="userdomain_prefix">
1194 ##      <summary>
1195 ##      The prefix of the user domain (e.g., user
1196 ##      is the prefix for user_t).
1197 ##      </summary>
1198 ## </param>
1199 #
1200 template(`userdom_unpriv_user_template', `
1201
1202         ##############################
1203         #
1204         # Declarations
1205         #
1206
1207         # Inherit rules for ordinary users.
1208         userdom_restricted_xwindows_user_template($1)
1209         userdom_common_user_template($1)
1210
1211         ##############################
1212         #
1213         # Local policy
1214         #
1215
1216         # port access is audited even if dac would not have allowed it, so dontaudit it here
1217 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1218         # Need the following rule to allow users to run vpnc
1219         corenet_tcp_bind_xserver_port($1_t)
1220         corenet_tcp_bind_generic_node($1_usertype)
1221
1222         storage_rw_fuse($1_t)
1223
1224         files_exec_usr_files($1_t)
1225    # cjp: why?
1226         files_read_kernel_symbol_table($1_t)
1227
1228         ifndef(`enable_mls',`
1229                 fs_exec_noxattr($1_t)
1230
1231                 tunable_policy(`user_rw_noexattrfile',`
1232                         fs_manage_noxattr_fs_files($1_t)
1233                         fs_manage_noxattr_fs_dirs($1_t)
1234                         # Write floppies
1235                         storage_raw_read_removable_device($1_t)
1236                         storage_raw_write_removable_device($1_t)
1237                 ',`
1238                         storage_raw_read_removable_device($1_t)
1239                 ')
1240         ')
1241
1242         miscfiles_read_hwdata($1_usertype)
1243
1244         # Allow users to run TCP servers (bind to ports and accept connection from
1245         # the same domain and outside users) disabling this forces FTP passive mode
1246         # and may change other protocols
1247
1248         tunable_policy(`user_share_music',`
1249                 corenet_tcp_bind_daap_port($1_usertype)
1250         ')
1251
1252         tunable_policy(`user_tcp_server',`
1253                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1254         ')
1255
1256         tunable_policy(`user_setrlimit',`
1257                 allow $1_usertype self:process setrlimit;
1258         ')
1259
1260         optional_policy(`
1261                 cdrecord_role($1_r, $1_t)
1262         ')
1263
1264         optional_policy(`
1265                 cron_role($1_r, $1_t)
1266         ')
1267
1268         optional_policy(`
1269                 games_rw_data($1_usertype)
1270         ')
1271
1272         optional_policy(`
1273                 gpg_role($1_r, $1_usertype)
1274         ')
1275
1276         optional_policy(`
1277                 gnomeclock_dbus_chat($1_t)
1278         ')
1279
1280         optional_policy(`
1281                 gpm_stream_connect($1_usertype)
1282         ')
1283
1284         optional_policy(`
1285                 execmem_role_template($1, $1_r, $1_t)
1286         ')
1287
1288         optional_policy(`
1289                 java_role_template($1, $1_r, $1_t)
1290         ')
1291
1292         optional_policy(`
1293                 mono_role_template($1, $1_r, $1_t)
1294         ')
1295
1296         optional_policy(`
1297                 mount_run_fusermount($1_t, $1_r)
1298                 mount_read_pid_files($1_t)
1299         ')
1300
1301         optional_policy(`
1302                 wine_role_template($1, $1_r, $1_t)
1303         ')
1304
1305         optional_policy(`
1306                 postfix_run_postdrop($1_t, $1_r)
1307                 postfix_search_spool($1_t)
1308         ')
1309
1310         # Run pppd in pppd_t by default for user
1311         optional_policy(`
1312                 ppp_run_cond($1_t, $1_r)
1313         ')
1314
1315         optional_policy(`
1316                 vdagent_getattr_log($1_t)
1317                 vdagent_getattr_exec($1_t)
1318                 vdagent_stream_connect($1_t)
1319         ')
1320 ')
1321
1322 #######################################
1323 ## <summary>
1324 ##      The template for creating an administrative user.
1325 ## </summary>
1326 ## <desc>
1327 ##      <p>
1328 ##      This template creates a user domain, types, and
1329 ##      rules for the user's tty, pty, home directories,
1330 ##      tmp, and tmpfs files.
1331 ##      </p>
1332 ##      <p>
1333 ##      The privileges given to administrative users are:
1334 ##      <ul>
1335 ##              <li>Raw disk access</li>
1336 ##              <li>Set all sysctls</li>
1337 ##              <li>All kernel ring buffer controls</li>
1338 ##              <li>Create, read, write, and delete all files but shadow</li>
1339 ##              <li>Manage source and binary format SELinux policy</li>
1340 ##              <li>Run insmod</li>
1341 ##      </ul>
1342 ##      </p>
1343 ## </desc>
1344 ## <param name="userdomain_prefix">
1345 ##      <summary>
1346 ##      The prefix of the user domain (e.g., sysadm
1347 ##      is the prefix for sysadm_t).
1348 ##      </summary>
1349 ## </param>
1350 #
1351 template(`userdom_admin_user_template',`
1352         gen_require(`
1353                 attribute admindomain;
1354                 class passwd { passwd chfn chsh rootok crontab };
1355         ')
1356
1357         ##############################
1358         #
1359         # Declarations
1360         #
1361
1362         # Inherit rules for ordinary users.
1363         userdom_login_user_template($1)
1364         userdom_common_user_template($1)
1365
1366         domain_obj_id_change_exemption($1_t)
1367         role system_r types $1_t;
1368
1369         typeattribute $1_t admindomain;
1370
1371         ifdef(`direct_sysadm_daemon',`
1372                 domain_system_change_exemption($1_t)
1373         ')
1374
1375         ##############################
1376         #
1377         # $1_t local policy
1378         #
1379
1380         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1381         tunable_policy(`deny_ptrace',`',`
1382                 allow $1_t self:capability sys_ptrace;
1383         ')
1384         allow $1_t self:capability2 syslog;
1385         allow $1_t self:process { setexec setfscreate };
1386         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1387         allow $1_t self:tun_socket create;
1388         # Set password information for other users.
1389         allow $1_t self:passwd { passwd chfn chsh };
1390         # Skip authentication when pam_rootok is specified.
1391         allow $1_t self:passwd rootok;
1392
1393         # Manipulate other users crontab.
1394         allow $1_t self:passwd crontab;
1395
1396         kernel_read_software_raid_state($1_t)
1397         kernel_getattr_core_if($1_t)
1398         kernel_getattr_message_if($1_t)
1399         kernel_change_ring_buffer_level($1_t)
1400         kernel_clear_ring_buffer($1_t)
1401         kernel_read_ring_buffer($1_t)
1402         kernel_get_sysvipc_info($1_t)
1403         kernel_rw_all_sysctls($1_t)
1404         # signal unlabeled processes:
1405         kernel_kill_unlabeled($1_t)
1406         kernel_signal_unlabeled($1_t)
1407         kernel_sigstop_unlabeled($1_t)
1408         kernel_signull_unlabeled($1_t)
1409         kernel_sigchld_unlabeled($1_t)
1410         kernel_signal($1_t)
1411
1412         corenet_tcp_bind_generic_port($1_t)
1413         # allow setting up tunnels
1414         corenet_rw_tun_tap_dev($1_t)
1415
1416         dev_getattr_generic_blk_files($1_t)
1417         dev_getattr_generic_chr_files($1_t)
1418         # for lsof
1419         dev_getattr_mtrr_dev($1_t)
1420         # Allow MAKEDEV to work
1421         dev_create_all_blk_files($1_t)
1422         dev_create_all_chr_files($1_t)
1423         dev_delete_all_blk_files($1_t)
1424         dev_delete_all_chr_files($1_t)
1425         dev_rename_all_blk_files($1_t)
1426         dev_rename_all_chr_files($1_t)
1427         dev_create_generic_symlinks($1_t)
1428         dev_rw_generic_usb_dev($1_t)
1429         dev_rw_usbfs($1_t)
1430
1431         domain_setpriority_all_domains($1_t)
1432         domain_read_all_domains_state($1_t)
1433         domain_getattr_all_domains($1_t)
1434         domain_getcap_all_domains($1_t)
1435         domain_dontaudit_ptrace_all_domains($1_t)
1436         # signal all domains:
1437         domain_kill_all_domains($1_t)
1438         domain_signal_all_domains($1_t)
1439         domain_signull_all_domains($1_t)
1440         domain_sigstop_all_domains($1_t)
1441         domain_sigstop_all_domains($1_t)
1442         domain_sigchld_all_domains($1_t)
1443         # for lsof
1444         domain_getattr_all_sockets($1_t)
1445         domain_dontaudit_getattr_all_sockets($1_t)
1446
1447         files_exec_usr_src_files($1_t)
1448
1449         fs_getattr_all_fs($1_t)
1450         fs_getattr_all_files($1_t)
1451         fs_list_all($1_t)
1452         fs_set_all_quotas($1_t)
1453         fs_exec_noxattr($1_t)
1454
1455         storage_raw_read_removable_device($1_t)
1456         storage_raw_write_removable_device($1_t)
1457         storage_dontaudit_read_fixed_disk($1_t)
1458
1459         term_use_all_inherited_terms($1_t)
1460         term_use_unallocated_ttys($1_t)
1461
1462         auth_getattr_shadow($1_t)
1463         # Manage almost all files
1464         files_manage_non_security_dirs($1_t)
1465         files_manage_non_security_files($1_t)
1466         # Relabel almost all files
1467         files_relabel_non_security_files($1_t)
1468
1469         init_telinit($1_t)
1470
1471         logging_send_syslog_msg($1_t)
1472
1473         optional_policy(`
1474                 modutils_domtrans_insmod($1_t)
1475                 modutils_domtrans_depmod($1_t)
1476         ')
1477
1478         # The following rule is temporary until such time that a complete
1479         # policy management infrastructure is in place so that an administrator
1480         # cannot directly manipulate policy files with arbitrary programs.
1481         seutil_manage_src_policy($1_t)
1482         # Violates the goal of limiting write access to checkpolicy.
1483         # But presently necessary for installing the file_contexts file.
1484         seutil_manage_bin_policy($1_t)
1485
1486         systemd_config_all_services($1_t)
1487
1488         userdom_manage_user_home_content_dirs($1_t)
1489         userdom_manage_user_home_content_files($1_t)
1490         userdom_manage_user_home_content_symlinks($1_t)
1491         userdom_manage_user_home_content_pipes($1_t)
1492         userdom_manage_user_home_content_sockets($1_t)
1493         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1494
1495         tunable_policy(`user_rw_noexattrfile',`
1496                 fs_manage_noxattr_fs_files($1_t)
1497                 fs_manage_noxattr_fs_dirs($1_t)
1498         ',`
1499                 fs_read_noxattr_fs_files($1_t)
1500         ')
1501
1502         optional_policy(`
1503                 postgresql_unconfined($1_t)
1504         ')
1505
1506         optional_policy(`
1507                 userhelper_exec($1_t)
1508         ')
1509 ')
1510
1511 ########################################
1512 ## <summary>
1513 ##      Allow user to run as a secadm
1514 ## </summary>
1515 ## <desc>
1516 ##      <p>
1517 ##      Create objects in a user home directory
1518 ##      with an automatic type transition to
1519 ##      a specified private type.
1520 ##      </p>
1521 ##      <p>
1522 ##      This is a templated interface, and should only
1523 ##      be called from a per-userdomain template.
1524 ##      </p>
1525 ## </desc>
1526 ## <param name="domain">
1527 ##      <summary>
1528 ##      Domain allowed access.
1529 ##      </summary>
1530 ## </param>
1531 ## <param name="role">
1532 ##      <summary>
1533 ##      The role  of the object to create.
1534 ##      </summary>
1535 ## </param>
1536 #
1537 template(`userdom_security_admin_template',`
1538         allow $1 self:capability { dac_read_search dac_override };
1539
1540         corecmd_exec_shell($1)
1541
1542         domain_obj_id_change_exemption($1)
1543
1544         dev_relabel_all_dev_nodes($1)
1545
1546         files_create_boot_flag($1)
1547         files_create_default_dir($1)
1548         files_root_filetrans_default($1, dir)
1549
1550         # Necessary for managing /boot/efi
1551         fs_manage_dos_files($1)
1552
1553         mls_process_read_up($1)
1554         mls_file_read_all_levels($1)
1555         mls_file_upgrade($1)
1556         mls_file_downgrade($1)
1557
1558         selinux_set_enforce_mode($1)
1559         selinux_set_all_booleans($1)
1560         selinux_set_parameters($1)
1561         selinux_read_policy($1)
1562
1563         files_relabel_all_files($1)
1564         auth_relabel_shadow($1)
1565
1566         init_exec($1)
1567
1568         logging_send_syslog_msg($1)
1569         logging_read_audit_log($1)
1570         logging_read_generic_logs($1)
1571         logging_read_audit_config($1)
1572
1573         seutil_manage_bin_policy($1)
1574         seutil_manage_default_contexts($1)
1575         seutil_manage_file_contexts($1)
1576         seutil_manage_module_store($1)
1577         seutil_manage_config($1)
1578         seutil_run_checkpolicy($1,$2)
1579         seutil_run_loadpolicy($1,$2)
1580         seutil_run_semanage($1,$2)
1581         seutil_run_setsebool($1,$2)
1582         seutil_run_setfiles($1, $2)
1583
1584         seutil_manage_bin_policy($1)
1585     seutil_manage_default_contexts($1)
1586     seutil_manage_file_contexts($1)
1587     seutil_manage_module_store($1)
1588     seutil_manage_config($1)
1589
1590         optional_policy(`
1591                 aide_run($1,$2)
1592         ')
1593
1594         optional_policy(`
1595                 consoletype_exec($1)
1596         ')
1597
1598         optional_policy(`
1599                 dmesg_exec($1)
1600         ')
1601
1602         optional_policy(`
1603                 ipsec_run_setkey($1,$2)
1604         ')
1605
1606         optional_policy(`
1607                 netlabel_run_mgmt($1,$2)
1608         ')
1609
1610         optional_policy(`
1611                 samhain_run($1, $2)
1612         ')
1613 ')
1614
1615 ########################################
1616 ## <summary>
1617 ##      Make the specified type usable in a
1618 ##      user home directory.
1619 ## </summary>
1620 ## <param name="type">
1621 ##      <summary>
1622 ##      Type to be used as a file in the
1623 ##      user home directory.
1624 ##      </summary>
1625 ## </param>
1626 #
1627 interface(`userdom_user_home_content',`
1628         gen_require(`
1629                 type user_home_t;
1630                 attribute user_home_type;
1631         ')
1632
1633         allow $1 user_home_t:filesystem associate;
1634         files_type($1)
1635         ubac_constrained($1)
1636
1637         files_poly_member($1)
1638         typeattribute $1  user_home_type;
1639 ')
1640
1641 ########################################
1642 ## <summary>
1643 ##      Make the specified type usable in a
1644 ##      generic temporary directory.
1645 ## </summary>
1646 ## <param name="type">
1647 ##      <summary>
1648 ##      Type to be used as a file in the
1649 ##      generic temporary directory.
1650 ##      </summary>
1651 ## </param>
1652 #
1653 interface(`userdom_user_tmp_content',`
1654         gen_require(`
1655                 attribute user_tmp_type;
1656         ')
1657
1658         typeattribute $1 user_tmp_type;
1659
1660         files_tmp_file($1)
1661         ubac_constrained($1)
1662 ')
1663
1664 ########################################
1665 ## <summary>
1666 ##      Make the specified type usable in a
1667 ##      generic tmpfs_t directory.
1668 ## </summary>
1669 ## <param name="type">
1670 ##      <summary>
1671 ##      Type to be used as a file in the
1672 ##      generic temporary directory.
1673 ##      </summary>
1674 ## </param>
1675 #
1676 interface(`userdom_user_tmpfs_content',`
1677         gen_require(`
1678                 attribute user_tmpfs_type;
1679         ')
1680
1681         typeattribute $1 user_tmpfs_type;
1682
1683         files_tmpfs_file($1)
1684         ubac_constrained($1)
1685 ')
1686
1687 ########################################
1688 ## <summary>
1689 ##      Allow domain to attach to TUN devices created by administrative users.
1690 ## </summary>
1691 ## <param name="domain">
1692 ##      <summary>
1693 ##      Domain allowed access.
1694 ##      </summary>
1695 ## </param>
1696 #
1697 interface(`userdom_attach_admin_tun_iface',`
1698         gen_require(`
1699                 attribute admindomain;
1700         ')
1701
1702         allow $1 admindomain:tun_socket relabelfrom;
1703         allow $1 self:tun_socket relabelto;
1704 ')
1705
1706 ########################################
1707 ## <summary>
1708 ##      Set the attributes of a user pty.
1709 ## </summary>
1710 ## <param name="domain">
1711 ##      <summary>
1712 ##      Domain allowed access.
1713 ##      </summary>
1714 ## </param>
1715 #
1716 interface(`userdom_setattr_user_ptys',`
1717         gen_require(`
1718                 type user_devpts_t;
1719         ')
1720
1721         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1722 ')
1723
1724 ########################################
1725 ## <summary>
1726 ##      Create a user pty.
1727 ## </summary>
1728 ## <param name="domain">
1729 ##      <summary>
1730 ##      Domain allowed access.
1731 ##      </summary>
1732 ## </param>
1733 #
1734 interface(`userdom_create_user_pty',`
1735         gen_require(`
1736                 type user_devpts_t;
1737         ')
1738
1739         term_create_pty($1, user_devpts_t)
1740 ')
1741
1742 ########################################
1743 ## <summary>
1744 ##      Get the attributes of user home directories.
1745 ## </summary>
1746 ## <param name="domain">
1747 ##      <summary>
1748 ##      Domain allowed access.
1749 ##      </summary>
1750 ## </param>
1751 #
1752 interface(`userdom_getattr_user_home_dirs',`
1753         gen_require(`
1754                 type user_home_dir_t;
1755         ')
1756
1757         allow $1 user_home_dir_t:dir getattr_dir_perms;
1758         files_search_home($1)
1759 ')
1760
1761 ########################################
1762 ## <summary>
1763 ##      Do not audit attempts to get the attributes of user home directories.
1764 ## </summary>
1765 ## <param name="domain">
1766 ##      <summary>
1767 ##      Domain to not audit.
1768 ##      </summary>
1769 ## </param>
1770 #
1771 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1772         gen_require(`
1773                 type user_home_dir_t;
1774         ')
1775
1776         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1777 ')
1778
1779 ########################################
1780 ## <summary>
1781 ##      Search user home directories.
1782 ## </summary>
1783 ## <param name="domain">
1784 ##      <summary>
1785 ##      Domain allowed access.
1786 ##      </summary>
1787 ## </param>
1788 #
1789 interface(`userdom_search_user_home_dirs',`
1790         gen_require(`
1791                 type user_home_dir_t;
1792         ')
1793
1794         allow $1 user_home_dir_t:dir search_dir_perms;
1795         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1796         files_search_home($1)
1797 ')
1798
1799 ########################################
1800 ## <summary>
1801 ##      Do not audit attempts to search user home directories.
1802 ## </summary>
1803 ## <desc>
1804 ##      <p>
1805 ##      Do not audit attempts to search user home directories.
1806 ##      This will supress SELinux denial messages when the specified
1807 ##      domain is denied the permission to search these directories.
1808 ##      </p>
1809 ## </desc>
1810 ## <param name="domain">
1811 ##      <summary>
1812 ##      Domain to not audit.
1813 ##      </summary>
1814 ## </param>
1815 ## <infoflow type="none"/>
1816 #
1817 interface(`userdom_dontaudit_search_user_home_dirs',`
1818         gen_require(`
1819                 type user_home_dir_t;
1820         ')
1821
1822         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1823 ')
1824
1825 ########################################
1826 ## <summary>
1827 ##      List user home directories.
1828 ## </summary>
1829 ## <param name="domain">
1830 ##      <summary>
1831 ##      Domain allowed access.
1832 ##      </summary>
1833 ## </param>
1834 #
1835 interface(`userdom_list_user_home_dirs',`
1836         gen_require(`
1837                 type user_home_dir_t;
1838         ')
1839
1840         allow $1 user_home_dir_t:dir list_dir_perms;
1841         files_search_home($1)
1842
1843         tunable_policy(`use_nfs_home_dirs',`
1844                 fs_list_nfs($1)
1845         ')
1846
1847         tunable_policy(`use_samba_home_dirs',`
1848                 fs_list_cifs($1)
1849         ')
1850 ')
1851
1852 ########################################
1853 ## <summary>
1854 ##      Do not audit attempts to list user home subdirectories.
1855 ## </summary>
1856 ## <param name="domain">
1857 ##      <summary>
1858 ##      Domain to not audit.
1859 ##      </summary>
1860 ## </param>
1861 #
1862 interface(`userdom_dontaudit_list_user_home_dirs',`
1863         gen_require(`
1864                 type user_home_dir_t;
1865                 type user_home_t;
1866         ')
1867
1868         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1869         dontaudit $1 user_home_t:dir list_dir_perms;
1870 ')
1871
1872 ########################################
1873 ## <summary>
1874 ##      Create user home directories.
1875 ## </summary>
1876 ## <param name="domain">
1877 ##      <summary>
1878 ##      Domain allowed access.
1879 ##      </summary>
1880 ## </param>
1881 #
1882 interface(`userdom_create_user_home_dirs',`
1883         gen_require(`
1884                 type user_home_dir_t;
1885         ')
1886
1887         allow $1 user_home_dir_t:dir create_dir_perms;
1888 ')
1889
1890 ########################################
1891 ## <summary>
1892 ##      Create user home directories.
1893 ## </summary>
1894 ## <param name="domain">
1895 ##      <summary>
1896 ##      Domain allowed access.
1897 ##      </summary>
1898 ## </param>
1899 #
1900 interface(`userdom_manage_user_home_dirs',`
1901         gen_require(`
1902                 type user_home_dir_t;
1903         ')
1904
1905         allow $1 user_home_dir_t:dir manage_dir_perms;
1906 ')
1907
1908 ########################################
1909 ## <summary>
1910 ##      Relabel to user home directories.
1911 ## </summary>
1912 ## <param name="domain">
1913 ##      <summary>
1914 ##      Domain allowed access.
1915 ##      </summary>
1916 ## </param>
1917 #
1918 interface(`userdom_relabelto_user_home_dirs',`
1919         gen_require(`
1920                 type user_home_dir_t;
1921         ')
1922
1923         allow $1 user_home_dir_t:dir relabelto;
1924 ')
1925
1926
1927 ########################################
1928 ## <summary>
1929 ##      Relabel to user home files.
1930 ## </summary>
1931 ## <param name="domain">
1932 ##      <summary>
1933 ##      Domain allowed access.
1934 ##      </summary>
1935 ## </param>
1936 #
1937 interface(`userdom_relabelto_user_home_files',`
1938         gen_require(`
1939                 type user_home_t;
1940         ')
1941
1942         allow $1 user_home_t:file relabelto;
1943 ')
1944 ########################################
1945 ## <summary>
1946 ##      Relabel user home files.
1947 ## </summary>
1948 ## <param name="domain">
1949 ##      <summary>
1950 ##      Domain allowed access.
1951 ##      </summary>
1952 ## </param>
1953 #
1954 interface(`userdom_relabel_user_home_files',`
1955         gen_require(`
1956                 type user_home_t;
1957         ')
1958
1959         allow $1 user_home_t:file relabel_file_perms;
1960 ')
1961
1962 ########################################
1963 ## <summary>
1964 ##      Create directories in the home dir root with
1965 ##      the user home directory type.
1966 ## </summary>
1967 ## <param name="domain">
1968 ##      <summary>
1969 ##      Domain allowed access.
1970 ##      </summary>
1971 ## </param>
1972 #
1973 interface(`userdom_home_filetrans_user_home_dir',`
1974         gen_require(`
1975                 type user_home_dir_t;
1976         ')
1977
1978         files_home_filetrans($1, user_home_dir_t, dir)
1979 ')
1980
1981 ########################################
1982 ## <summary>
1983 ##      Do a domain transition to the specified
1984 ##      domain when executing a program in the
1985 ##      user home directory.
1986 ## </summary>
1987 ## <desc>
1988 ##      <p>
1989 ##      Do a domain transition to the specified
1990 ##      domain when executing a program in the
1991 ##      user home directory.
1992 ##      </p>
1993 ##      <p>
1994 ##      No interprocess communication (signals, pipes,
1995 ##      etc.) is provided by this interface since
1996 ##      the domains are not owned by this module.
1997 ##      </p>
1998 ## </desc>
1999 ## <param name="source_domain">
2000 ##      <summary>
2001 ##      Domain allowed to transition.
2002 ##      </summary>
2003 ## </param>
2004 ## <param name="target_domain">
2005 ##      <summary>
2006 ##      Domain to transition to.
2007 ##      </summary>
2008 ## </param>
2009 #
2010 interface(`userdom_user_home_domtrans',`
2011         gen_require(`
2012                 type user_home_dir_t, user_home_t;
2013         ')
2014
2015         domain_auto_trans($1, user_home_t, $2)
2016         allow $1 user_home_dir_t:dir search_dir_perms;
2017         files_search_home($1)
2018 ')
2019
2020 ########################################
2021 ## <summary>
2022 ##      Do not audit attempts to search user home content directories.
2023 ## </summary>
2024 ## <param name="domain">
2025 ##      <summary>
2026 ##      Domain to not audit.
2027 ##      </summary>
2028 ## </param>
2029 #
2030 interface(`userdom_dontaudit_search_user_home_content',`
2031         gen_require(`
2032                 type user_home_t;
2033         ')
2034
2035         dontaudit $1 user_home_t:dir search_dir_perms;
2036         fs_dontaudit_list_nfs($1)
2037         fs_dontaudit_list_cifs($1)
2038 ')
2039
2040 ########################################
2041 ## <summary>
2042 ##      List contents of users home directory.
2043 ## </summary>
2044 ## <param name="domain">
2045 ##      <summary>
2046 ##      Domain allowed access.
2047 ##      </summary>
2048 ## </param>
2049 #
2050 interface(`userdom_list_user_home_content',`
2051         gen_require(`
2052                 type user_home_dir_t;
2053                 attribute user_home_type;
2054         ')
2055
2056         files_list_home($1)
2057         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2058 ')
2059
2060 ########################################
2061 ## <summary>
2062 ##      Create, read, write, and delete directories
2063 ##      in a user home subdirectory.
2064 ## </summary>
2065 ## <param name="domain">
2066 ##      <summary>
2067 ##      Domain allowed access.
2068 ##      </summary>
2069 ## </param>
2070 #
2071 interface(`userdom_manage_user_home_content_dirs',`
2072         gen_require(`
2073                 type user_home_dir_t, user_home_t;
2074         ')
2075
2076         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2077         files_search_home($1)
2078 ')
2079
2080 ########################################
2081 ## <summary>
2082 ##      Delete directories in a user home subdirectory.
2083 ## </summary>
2084 ## <param name="domain">
2085 ##      <summary>
2086 ##      Domain allowed access.
2087 ##      </summary>
2088 ## </param>
2089 #
2090 interface(`userdom_delete_user_home_content_dirs',`
2091         gen_require(`
2092                 type user_home_t;
2093         ')
2094
2095         allow $1 user_home_t:dir delete_dir_perms;
2096 ')
2097
2098 ########################################
2099 ## <summary>
2100 ##      Delete all directories in a user home subdirectory.
2101 ## </summary>
2102 ## <param name="domain">
2103 ##      <summary>
2104 ##      Domain allowed access.
2105 ##      </summary>
2106 ## </param>
2107 #
2108 interface(`userdom_delete_all_user_home_content_dirs',`
2109         gen_require(`
2110                 attribute user_home_type;
2111         ')
2112
2113         allow $1 user_home_type:dir delete_dir_perms;
2114 ')
2115
2116 ########################################
2117 ## <summary>
2118 ##      Set the attributes of user home files.
2119 ## </summary>
2120 ## <param name="domain">
2121 ##      <summary>
2122 ##      Domain allowed access.
2123 ##      </summary>
2124 ## </param>
2125 ## <rolecap/>
2126 #
2127 interface(`userdom_setattr_user_home_content_files',`
2128         gen_require(`
2129                 type user_home_t;
2130         ')
2131
2132         allow $1 user_home_t:file setattr;
2133 ')
2134
2135 ########################################
2136 ## <summary>
2137 ##      Do not audit attempts to set the
2138 ##      attributes of user home files.
2139 ## </summary>
2140 ## <param name="domain">
2141 ##      <summary>
2142 ##      Domain to not audit.
2143 ##      </summary>
2144 ## </param>
2145 #
2146 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2147         gen_require(`
2148                 type user_home_t;
2149         ')
2150
2151         dontaudit $1 user_home_t:file setattr_file_perms;
2152 ')
2153
2154 ########################################
2155 ## <summary>
2156 ##      Set the attributes of all user home directories.
2157 ## </summary>
2158 ## <param name="domain">
2159 ##      <summary>
2160 ##      Domain allowed access.
2161 ##      </summary>
2162 ## </param>
2163 ## <rolecap/>
2164 #
2165 interface(`userdom_setattr_all_user_home_content_dirs',`
2166         gen_require(`
2167                 attribute user_home_type;
2168         ')
2169
2170         allow $1 user_home_type:dir setattr_dir_perms;
2171 ')
2172
2173 ########################################
2174 ## <summary>
2175 ##      Mmap user home files.
2176 ## </summary>
2177 ## <param name="domain">
2178 ##      <summary>
2179 ##      Domain allowed access.
2180 ##      </summary>
2181 ## </param>
2182 #
2183 interface(`userdom_mmap_user_home_content_files',`
2184         gen_require(`
2185                 type user_home_dir_t, user_home_t;
2186         ')
2187
2188         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2189         files_search_home($1)
2190 ')
2191
2192 ########################################
2193 ## <summary>
2194 ##      Read user home files.
2195 ## </summary>
2196 ## <param name="domain">
2197 ##      <summary>
2198 ##      Domain allowed access.
2199 ##      </summary>
2200 ## </param>
2201 #
2202 interface(`userdom_read_user_home_content_files',`
2203         gen_require(`
2204                 type user_home_dir_t, user_home_t;
2205         ')
2206
2207         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2208         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2209         files_search_home($1)
2210 ')
2211
2212 ########################################
2213 ## <summary>
2214 ##      Do not audit attempts to getattr user home files.
2215 ## </summary>
2216 ## <param name="domain">
2217 ##      <summary>
2218 ##      Domain to not audit.
2219 ##      </summary>
2220 ## </param>
2221 #
2222 interface(`userdom_dontaudit_getattr_user_home_content',`
2223         gen_require(`
2224                 attribute user_home_type;
2225         ')
2226
2227         dontaudit $1 user_home_type:dir getattr;
2228         dontaudit $1 user_home_type:file getattr;
2229 ')
2230
2231 ########################################
2232 ## <summary>
2233 ##      Do not audit attempts to read user home files.
2234 ## </summary>
2235 ## <param name="domain">
2236 ##      <summary>
2237 ##      Domain to not audit.
2238 ##      </summary>
2239 ## </param>
2240 #
2241 interface(`userdom_dontaudit_read_user_home_content_files',`
2242         gen_require(`
2243                 attribute user_home_type;
2244                 type user_home_dir_t;
2245         ')
2246
2247         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2248         dontaudit $1 user_home_type:dir list_dir_perms;
2249         dontaudit $1 user_home_type:file read_file_perms;
2250         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2251 ')
2252
2253 ########################################
2254 ## <summary>
2255 ##      Do not audit attempts to append user home files.
2256 ## </summary>
2257 ## <param name="domain">
2258 ##      <summary>
2259 ##      Domain to not audit.
2260 ##      </summary>
2261 ## </param>
2262 #
2263 interface(`userdom_dontaudit_append_user_home_content_files',`
2264         gen_require(`
2265                 type user_home_t;
2266         ')
2267
2268         dontaudit $1 user_home_t:file append_file_perms;
2269 ')
2270
2271 ########################################
2272 ## <summary>
2273 ##      Do not audit attempts to write user home files.
2274 ## </summary>
2275 ## <param name="domain">
2276 ##      <summary>
2277 ##      Domain to not audit.
2278 ##      </summary>
2279 ## </param>
2280 #
2281 interface(`userdom_dontaudit_write_user_home_content_files',`
2282         gen_require(`
2283                 type user_home_t;
2284         ')
2285
2286         dontaudit $1 user_home_t:file write_file_perms;
2287 ')
2288
2289 ########################################
2290 ## <summary>
2291 ##      Delete files in a user home subdirectory.
2292 ## </summary>
2293 ## <param name="domain">
2294 ##      <summary>
2295 ##      Domain allowed access.
2296 ##      </summary>
2297 ## </param>
2298 #
2299 interface(`userdom_delete_user_home_content_files',`
2300         gen_require(`
2301                 type user_home_t;
2302         ')
2303
2304         allow $1 user_home_t:file delete_file_perms;
2305 ')
2306
2307 ########################################
2308 ## <summary>
2309 ##      Delete all files in a user home subdirectory.
2310 ## </summary>
2311 ## <param name="domain">
2312 ##      <summary>
2313 ##      Domain allowed access.
2314 ##      </summary>
2315 ## </param>
2316 #
2317 interface(`userdom_delete_all_user_home_content_files',`
2318         gen_require(`
2319                 attribute user_home_type;
2320         ')
2321
2322         allow $1 user_home_type:file delete_file_perms;
2323 ')
2324
2325 ########################################
2326 ## <summary>
2327 ##      Delete sock files in a user home subdirectory.
2328 ## </summary>
2329 ## <param name="domain">
2330 ##      <summary>
2331 ##      Domain allowed access.
2332 ##      </summary>
2333 ## </param>
2334 #
2335 interface(`userdom_delete_user_home_content_sock_files',`
2336         gen_require(`
2337                 type user_home_t;
2338         ')
2339
2340         allow $1 user_home_t:sock_file delete_file_perms;
2341 ')
2342
2343 ########################################
2344 ## <summary>
2345 ##      Delete all sock files in a user home subdirectory.
2346 ## </summary>
2347 ## <param name="domain">
2348 ##      <summary>
2349 ##      Domain allowed access.
2350 ##      </summary>
2351 ## </param>
2352 #
2353 interface(`userdom_delete_all_user_home_content_sock_files',`
2354         gen_require(`
2355                 attribute user_home_type;
2356         ')
2357
2358         allow $1 user_home_type:sock_file delete_file_perms;
2359 ')
2360
2361 ########################################
2362 ## <summary>
2363 ##      Do not audit attempts to write user home files.
2364 ## </summary>
2365 ## <param name="domain">
2366 ##      <summary>
2367 ##      Domain to not audit.
2368 ##      </summary>
2369 ## </param>
2370 #
2371 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2372         gen_require(`
2373                 type user_home_t;
2374         ')
2375
2376         dontaudit $1 user_home_t:file relabel_file_perms;
2377 ')
2378
2379 ########################################
2380 ## <summary>
2381 ##      Read user home subdirectory symbolic links.
2382 ## </summary>
2383 ## <param name="domain">
2384 ##      <summary>
2385 ##      Domain allowed access.
2386 ##      </summary>
2387 ## </param>
2388 #
2389 interface(`userdom_read_user_home_content_symlinks',`
2390         gen_require(`
2391                 type user_home_dir_t, user_home_t;
2392         ')
2393
2394         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2395 ')
2396
2397 ########################################
2398 ## <summary>
2399 ##      Execute user home files.
2400 ## </summary>
2401 ## <param name="domain">
2402 ##      <summary>
2403 ##      Domain allowed access.
2404 ##      </summary>
2405 ## </param>
2406 ## <rolecap/>
2407 #
2408 interface(`userdom_exec_user_home_content_files',`
2409         gen_require(`
2410                 type user_home_dir_t;
2411                 attribute user_home_type;
2412         ')
2413
2414         files_search_home($1)
2415         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2416         dontaudit $1 user_home_type:sock_file execute;
2417         ')
2418
2419 ########################################
2420 ## <summary>
2421 ##      Do not audit attempts to execute user home files.
2422 ## </summary>
2423 ## <param name="domain">
2424 ##      <summary>
2425 ##      Domain to not audit.
2426 ##      </summary>
2427 ## </param>
2428 #
2429 interface(`userdom_dontaudit_exec_user_home_content_files',`
2430         gen_require(`
2431                 type user_home_t;
2432         ')
2433
2434         dontaudit $1 user_home_t:file exec_file_perms;
2435 ')
2436
2437 ########################################
2438 ## <summary>
2439 ##      Create, read, write, and delete files
2440 ##      in a user home subdirectory.
2441 ## </summary>
2442 ## <param name="domain">
2443 ##      <summary>
2444 ##      Domain allowed access.
2445 ##      </summary>
2446 ## </param>
2447 #
2448 interface(`userdom_manage_user_home_content_files',`
2449         gen_require(`
2450                 type user_home_dir_t, user_home_t;
2451         ')
2452
2453         manage_files_pattern($1, user_home_t, user_home_t)
2454         allow $1 user_home_dir_t:dir search_dir_perms;
2455         files_search_home($1)
2456 ')
2457
2458 ########################################
2459 ## <summary>
2460 ##      Do not audit attempts to create, read, write, and delete directories
2461 ##      in a user home subdirectory.
2462 ## </summary>
2463 ## <param name="domain">
2464 ##      <summary>
2465 ##      Domain to not audit.
2466 ##      </summary>
2467 ## </param>
2468 #
2469 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2470         gen_require(`
2471                 type user_home_dir_t, user_home_t;
2472         ')
2473
2474         dontaudit $1 user_home_t:dir manage_dir_perms;
2475 ')
2476
2477 ########################################
2478 ## <summary>
2479 ##      Create, read, write, and delete symbolic links
2480 ##      in a user home subdirectory.
2481 ## </summary>
2482 ## <param name="domain">
2483 ##      <summary>
2484 ##      Domain allowed access.
2485 ##      </summary>
2486 ## </param>
2487 #
2488 interface(`userdom_manage_user_home_content_symlinks',`
2489         gen_require(`
2490                 type user_home_dir_t, user_home_t;
2491         ')
2492
2493         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2494         allow $1 user_home_dir_t:dir search_dir_perms;
2495         files_search_home($1)
2496 ')
2497
2498 ########################################
2499 ## <summary>
2500 ##      Delete symbolic links in a user home directory.
2501 ## </summary>
2502 ## <param name="domain">
2503 ##      <summary>
2504 ##      Domain allowed access.
2505 ##      </summary>
2506 ## </param>
2507 #
2508 interface(`userdom_delete_user_home_content_symlinks',`
2509         gen_require(`
2510                 type user_home_t;
2511         ')
2512
2513         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2514 ')
2515
2516 ########################################
2517 ## <summary>
2518 ##      Delete all symbolic links in a user home directory.
2519 ## </summary>
2520 ## <param name="domain">
2521 ##      <summary>
2522 ##      Domain allowed access.
2523 ##      </summary>
2524 ## </param>
2525 #
2526 interface(`userdom_delete_all_user_home_content_symlinks',`
2527         gen_require(`
2528                 attribute user_home_type;
2529         ')
2530
2531         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2532 ')
2533
2534 ########################################
2535 ## <summary>
2536 ##      Create, read, write, and delete named pipes
2537 ##      in a user home subdirectory.
2538 ## </summary>
2539 ## <param name="domain">
2540 ##      <summary>
2541 ##      Domain allowed access.
2542 ##      </summary>
2543 ## </param>
2544 #
2545 interface(`userdom_manage_user_home_content_pipes',`
2546         gen_require(`
2547                 type user_home_dir_t, user_home_t;
2548         ')
2549
2550         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2551         allow $1 user_home_dir_t:dir search_dir_perms;
2552         files_search_home($1)
2553 ')
2554
2555 ########################################
2556 ## <summary>
2557 ##      Create, read, write, and delete named sockets
2558 ##      in a user home subdirectory.
2559 ## </summary>
2560 ## <param name="domain">
2561 ##      <summary>
2562 ##      Domain allowed access.
2563 ##      </summary>
2564 ## </param>
2565 #
2566 interface(`userdom_manage_user_home_content_sockets',`
2567         gen_require(`
2568                 type user_home_dir_t, user_home_t;
2569         ')
2570
2571         allow $1 user_home_dir_t:dir search_dir_perms;
2572         manage_sock_files_pattern($1, user_home_t, user_home_t)
2573         files_search_home($1)
2574 ')
2575
2576 ########################################
2577 ## <summary>
2578 ##      Create objects in a user home directory
2579 ##      with an automatic type transition to
2580 ##      a specified private type.
2581 ## </summary>
2582 ## <param name="domain">
2583 ##      <summary>
2584 ##      Domain allowed access.
2585 ##      </summary>
2586 ## </param>
2587 ## <param name="private_type">
2588 ##      <summary>
2589 ##      The type of the object to create.
2590 ##      </summary>
2591 ## </param>
2592 ## <param name="object_class">
2593 ##      <summary>
2594 ##      The class of the object to be created.
2595 ##      </summary>
2596 ## </param>
2597 #
2598 interface(`userdom_user_home_dir_filetrans',`
2599         gen_require(`
2600                 type user_home_dir_t;
2601         ')
2602
2603         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2604         files_search_home($1)
2605 ')
2606
2607 ########################################
2608 ## <summary>
2609 ##      Create objects in a user home directory
2610 ##      with an automatic type transition to
2611 ##      a specified private type.
2612 ## </summary>
2613 ## <param name="domain">
2614 ##      <summary>
2615 ##      Domain allowed access.
2616 ##      </summary>
2617 ## </param>
2618 ## <param name="private_type">
2619 ##      <summary>
2620 ##      The type of the object to create.
2621 ##      </summary>
2622 ## </param>
2623 ## <param name="object_class">
2624 ##      <summary>
2625 ##      The class of the object to be created.
2626 ##      </summary>
2627 ## </param>
2628 #
2629 interface(`userdom_user_home_content_filetrans',`
2630         gen_require(`
2631                 type user_home_dir_t, user_home_t;
2632         ')
2633
2634         filetrans_pattern($1, user_home_t, $2, $3, $4)
2635         allow $1 user_home_dir_t:dir search_dir_perms;
2636         files_search_home($1)
2637 ')
2638
2639 ########################################
2640 ## <summary>
2641 ##      Create objects in a user home directory
2642 ##      with an automatic type transition to
2643 ##      the user home file type.
2644 ## </summary>
2645 ## <param name="domain">
2646 ##      <summary>
2647 ##      Domain allowed access.
2648 ##      </summary>
2649 ## </param>
2650 ## <param name="object_class">
2651 ##      <summary>
2652 ##      The class of the object to be created.
2653 ##      </summary>
2654 ## </param>
2655 #
2656 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2657         gen_require(`
2658                 type user_home_dir_t, user_home_t;
2659         ')
2660
2661         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2662         files_search_home($1)
2663 ')
2664
2665 ########################################
2666 ## <summary>
2667 ##      Write to user temporary named sockets.
2668 ## </summary>
2669 ## <param name="domain">
2670 ##      <summary>
2671 ##      Domain allowed access.
2672 ##      </summary>
2673 ## </param>
2674 #
2675 interface(`userdom_write_user_tmp_sockets',`
2676         gen_require(`
2677                 type user_tmp_t;
2678         ')
2679
2680         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2681         files_search_tmp($1)
2682 ')
2683
2684 ########################################
2685 ## <summary>
2686 ##      List user temporary directories.
2687 ## </summary>
2688 ## <param name="domain">
2689 ##      <summary>
2690 ##      Domain allowed access.
2691 ##      </summary>
2692 ## </param>
2693 #
2694 interface(`userdom_list_user_tmp',`
2695         gen_require(`
2696                 type user_tmp_t;
2697         ')
2698
2699         allow $1 user_tmp_t:dir list_dir_perms;
2700         files_search_tmp($1)
2701 ')
2702
2703 ########################################
2704 ## <summary>
2705 ##      Do not audit attempts to list user
2706 ##      temporary directories.
2707 ## </summary>
2708 ## <param name="domain">
2709 ##      <summary>
2710 ##      Domain to not audit.
2711 ##      </summary>
2712 ## </param>
2713 #
2714 interface(`userdom_dontaudit_list_user_tmp',`
2715         gen_require(`
2716                 type user_tmp_t;
2717         ')
2718
2719         dontaudit $1 user_tmp_t:dir list_dir_perms;
2720 ')
2721
2722 ########################################
2723 ## <summary>
2724 ##      Do not audit attempts to manage users
2725 ##      temporary directories.
2726 ## </summary>
2727 ## <param name="domain">
2728 ##      <summary>
2729 ##      Domain to not audit.
2730 ##      </summary>
2731 ## </param>
2732 #
2733 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2734         gen_require(`
2735                 type user_tmp_t;
2736         ')
2737
2738         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2739 ')
2740
2741 ########################################
2742 ## <summary>
2743 ##      Read user temporary files.
2744 ## </summary>
2745 ## <param name="domain">
2746 ##      <summary>
2747 ##      Domain allowed access.
2748 ##      </summary>
2749 ## </param>
2750 #
2751 interface(`userdom_read_user_tmp_files',`
2752         gen_require(`
2753                 type user_tmp_t;
2754         ')
2755
2756         read_files_pattern($1, user_tmp_t, user_tmp_t)
2757         allow $1 user_tmp_t:dir list_dir_perms;
2758         files_search_tmp($1)
2759 ')
2760
2761 ########################################
2762 ## <summary>
2763 ##      Do not audit attempts to read users
2764 ##      temporary files.
2765 ## </summary>
2766 ## <param name="domain">
2767 ##      <summary>
2768 ##      Domain to not audit.
2769 ##      </summary>
2770 ## </param>
2771 #
2772 interface(`userdom_dontaudit_read_user_tmp_files',`
2773         gen_require(`
2774                 type user_tmp_t;
2775         ')
2776
2777         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2778 ')
2779
2780 ########################################
2781 ## <summary>
2782 ##      Do not audit attempts to append users
2783 ##      temporary files.
2784 ## </summary>
2785 ## <param name="domain">
2786 ##      <summary>
2787 ##      Domain to not audit.
2788 ##      </summary>
2789 ## </param>
2790 #
2791 interface(`userdom_dontaudit_append_user_tmp_files',`
2792         gen_require(`
2793                 type user_tmp_t;
2794         ')
2795
2796         dontaudit $1 user_tmp_t:file append_file_perms;
2797 ')
2798
2799 ########################################
2800 ## <summary>
2801 ##      Read and write user temporary files.
2802 ## </summary>
2803 ## <param name="domain">
2804 ##      <summary>
2805 ##      Domain allowed access.
2806 ##      </summary>
2807 ## </param>
2808 #
2809 interface(`userdom_rw_user_tmp_files',`
2810         gen_require(`
2811                 type user_tmp_t;
2812         ')
2813
2814         allow $1 user_tmp_t:dir list_dir_perms;
2815         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2816         files_search_tmp($1)
2817 ')
2818
2819 ########################################
2820 ## <summary>
2821 ##      Do not audit attempts to manage users
2822 ##      temporary files.
2823 ## </summary>
2824 ## <param name="domain">
2825 ##      <summary>
2826 ##      Domain to not audit.
2827 ##      </summary>
2828 ## </param>
2829 #
2830 interface(`userdom_dontaudit_manage_user_tmp_files',`
2831         gen_require(`
2832                 type user_tmp_t;
2833         ')
2834
2835         dontaudit $1 user_tmp_t:file manage_file_perms;
2836 ')
2837
2838 ########################################
2839 ## <summary>
2840 ##      Read user temporary symbolic links.
2841 ## </summary>
2842 ## <param name="domain">
2843 ##      <summary>
2844 ##      Domain allowed access.
2845 ##      </summary>
2846 ## </param>
2847 #
2848 interface(`userdom_read_user_tmp_symlinks',`
2849         gen_require(`
2850                 type user_tmp_t;
2851         ')
2852
2853         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2854         allow $1 user_tmp_t:dir list_dir_perms;
2855         files_search_tmp($1)
2856 ')
2857
2858 ########################################
2859 ## <summary>
2860 ##      Create, read, write, and delete user
2861 ##      temporary directories.
2862 ## </summary>
2863 ## <param name="domain">
2864 ##      <summary>
2865 ##      Domain allowed access.
2866 ##      </summary>
2867 ## </param>
2868 #
2869 interface(`userdom_manage_user_tmp_dirs',`
2870         gen_require(`
2871                 type user_tmp_t;
2872         ')
2873
2874         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2875         files_search_tmp($1)
2876 ')
2877
2878 ########################################
2879 ## <summary>
2880 ##      Create, read, write, and delete user
2881 ##      temporary files.
2882 ## </summary>
2883 ## <param name="domain">
2884 ##      <summary>
2885 ##      Domain allowed access.
2886 ##      </summary>
2887 ## </param>
2888 #
2889 interface(`userdom_manage_user_tmp_files',`
2890         gen_require(`
2891                 type user_tmp_t;
2892         ')
2893
2894         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2895         files_search_tmp($1)
2896 ')
2897
2898 ########################################
2899 ## <summary>
2900 ##      Create, read, write, and delete user
2901 ##      temporary symbolic links.
2902 ## </summary>
2903 ## <param name="domain">
2904 ##      <summary>
2905 ##      Domain allowed access.
2906 ##      </summary>
2907 ## </param>
2908 #
2909 interface(`userdom_manage_user_tmp_symlinks',`
2910         gen_require(`
2911                 type user_tmp_t;
2912         ')
2913
2914         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2915         files_search_tmp($1)
2916 ')
2917
2918 ########################################
2919 ## <summary>
2920 ##      Create, read, write, and delete user
2921 ##      temporary named pipes.
2922 ## </summary>
2923 ## <param name="domain">
2924 ##      <summary>
2925 ##      Domain allowed access.
2926 ##      </summary>
2927 ## </param>
2928 #
2929 interface(`userdom_manage_user_tmp_pipes',`
2930         gen_require(`
2931                 type user_tmp_t;
2932         ')
2933
2934         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2935         files_search_tmp($1)
2936 ')
2937
2938 ########################################
2939 ## <summary>
2940 ##      Create, read, write, and delete user
2941 ##      temporary named sockets.
2942 ## </summary>
2943 ## <param name="domain">
2944 ##      <summary>
2945 ##      Domain allowed access.
2946 ##      </summary>
2947 ## </param>
2948 #
2949 interface(`userdom_manage_user_tmp_sockets',`
2950         gen_require(`
2951                 type user_tmp_t;
2952         ')
2953
2954         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2955         files_search_tmp($1)
2956 ')
2957
2958 ########################################
2959 ## <summary>
2960 ##      Create objects in a user temporary directory
2961 ##      with an automatic type transition to
2962 ##      a specified private type.
2963 ## </summary>
2964 ## <param name="domain">
2965 ##      <summary>
2966 ##      Domain allowed access.
2967 ##      </summary>
2968 ## </param>
2969 ## <param name="private_type">
2970 ##      <summary>
2971 ##      The type of the object to create.
2972 ##      </summary>
2973 ## </param>
2974 ## <param name="object_class">
2975 ##      <summary>
2976 ##      The class of the object to be created.
2977 ##      </summary>
2978 ## </param>
2979 #
2980 interface(`userdom_user_tmp_filetrans',`
2981         gen_require(`
2982                 type user_tmp_t;
2983         ')
2984
2985         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2986         files_search_tmp($1)
2987 ')
2988
2989 ########################################
2990 ## <summary>
2991 ##      Create objects in the temporary directory
2992 ##      with an automatic type transition to
2993 ##      the user temporary type.
2994 ## </summary>
2995 ## <param name="domain">
2996 ##      <summary>
2997 ##      Domain allowed access.
2998 ##      </summary>
2999 ## </param>
3000 ## <param name="object_class">
3001 ##      <summary>
3002 ##      The class of the object to be created.
3003 ##      </summary>
3004 ## </param>
3005 #
3006 interface(`userdom_tmp_filetrans_user_tmp',`
3007         gen_require(`
3008                 type user_tmp_t;
3009         ')
3010
3011         files_tmp_filetrans($1, user_tmp_t, $2)
3012 ')
3013
3014 #######################################
3015 ## <summary>
3016 ##  Getattr user tmpfs files.
3017 ## </summary>
3018 ## <param name="domain">
3019 ##  <summary>
3020 ##  Domain allowed access.
3021 ##  </summary>
3022 ## </param>
3023 #
3024 interface(`userdom_getattr_user_tmpfs_files',`
3025     gen_require(`
3026         type user_tmpfs_t;
3027     ')
3028
3029     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3030     fs_search_tmpfs($1)
3031 ')
3032
3033 ########################################
3034 ## <summary>
3035 ##      Read user tmpfs files.
3036 ## </summary>
3037 ## <param name="domain">
3038 ##      <summary>
3039 ##      Domain allowed access.
3040 ##      </summary>
3041 ## </param>
3042 #
3043 interface(`userdom_read_user_tmpfs_files',`
3044         gen_require(`
3045                 type user_tmpfs_t;
3046         ')
3047
3048         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3049         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3050         allow $1 user_tmpfs_t:dir list_dir_perms;
3051         fs_search_tmpfs($1)
3052 ')
3053
3054 ########################################
3055 ## <summary>
3056 ##      Read/Write user tmpfs files.
3057 ## </summary>
3058 ## <param name="domain">
3059 ##      <summary>
3060 ##      Domain allowed access.
3061 ##      </summary>
3062 ## </param>
3063 #
3064 interface(`userdom_rw_user_tmpfs_files',`
3065         gen_require(`
3066                 type user_tmpfs_t;
3067         ')
3068
3069         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3070         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3071         allow $1 user_tmpfs_t:dir list_dir_perms;
3072         fs_search_tmpfs($1)
3073 ')
3074
3075 ########################################
3076 ## <summary>
3077 ##      Read/Write inherited user tmpfs files.
3078 ## </summary>
3079 ## <param name="domain">
3080 ##      <summary>
3081 ##      Domain allowed access.
3082 ##      </summary>
3083 ## </param>
3084 #
3085 interface(`userdom_rw_inherited_user_tmpfs_files',`
3086         gen_require(`
3087                 type user_tmpfs_t;
3088         ')
3089
3090         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3091 ')
3092
3093 ########################################
3094 ## <summary>
3095 ##      Execute user tmpfs files.
3096 ## </summary>
3097 ## <param name="domain">
3098 ##      <summary>
3099 ##      Domain allowed access.
3100 ##      </summary>
3101 ## </param>
3102 #
3103 interface(`userdom_execute_user_tmpfs_files',`
3104         gen_require(`
3105                 type user_tmpfs_t;
3106         ')
3107
3108         allow $1 user_tmpfs_t:file execute;
3109 ')
3110
3111 ########################################
3112 ## <summary>
3113 ##      Get the attributes of a user domain tty.
3114 ## </summary>
3115 ## <param name="domain">
3116 ##      <summary>
3117 ##      Domain allowed access.
3118 ##      </summary>
3119 ## </param>
3120 #
3121 interface(`userdom_getattr_user_ttys',`
3122         gen_require(`
3123                 type user_tty_device_t;
3124         ')
3125
3126         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3127 ')
3128
3129 ########################################
3130 ## <summary>
3131 ##      Do not audit attempts to get the attributes of a user domain tty.
3132 ## </summary>
3133 ## <param name="domain">
3134 ##      <summary>
3135 ##      Domain to not audit.
3136 ##      </summary>
3137 ## </param>
3138 #
3139 interface(`userdom_dontaudit_getattr_user_ttys',`
3140         gen_require(`
3141                 type user_tty_device_t;
3142         ')
3143
3144         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3145 ')
3146
3147 ########################################
3148 ## <summary>
3149 ##      Set the attributes of a user domain tty.
3150 ## </summary>
3151 ## <param name="domain">
3152 ##      <summary>
3153 ##      Domain allowed access.
3154 ##      </summary>
3155 ## </param>
3156 #
3157 interface(`userdom_setattr_user_ttys',`
3158         gen_require(`
3159                 type user_tty_device_t;
3160         ')
3161
3162         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3163 ')
3164
3165 ########################################
3166 ## <summary>
3167 ##      Do not audit attempts to set the attributes of a user domain tty.
3168 ## </summary>
3169 ## <param name="domain">
3170 ##      <summary>
3171 ##      Domain to not audit.
3172 ##      </summary>
3173 ## </param>
3174 #
3175 interface(`userdom_dontaudit_setattr_user_ttys',`
3176         gen_require(`
3177                 type user_tty_device_t;
3178         ')
3179
3180         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3181 ')
3182
3183 ########################################
3184 ## <summary>
3185 ##      Read and write a user domain tty.
3186 ## </summary>
3187 ## <param name="domain">
3188 ##      <summary>
3189 ##      Domain allowed access.
3190 ##      </summary>
3191 ## </param>
3192 #
3193 interface(`userdom_use_user_ttys',`
3194         gen_require(`
3195                 type user_tty_device_t;
3196         ')
3197
3198         allow $1 user_tty_device_t:chr_file rw_term_perms;
3199 ')
3200
3201 ########################################
3202 ## <summary>
3203 ##      Read and write a inherited user domain tty.
3204 ## </summary>
3205 ## <param name="domain">
3206 ##      <summary>
3207 ##      Domain allowed access.
3208 ##      </summary>
3209 ## </param>
3210 #
3211 interface(`userdom_use_inherited_user_ttys',`
3212         gen_require(`
3213                 type user_tty_device_t;
3214         ')
3215
3216         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3217 ')
3218
3219 ########################################
3220 ## <summary>
3221 ##      Read and write a user domain pty.
3222 ## </summary>
3223 ## <param name="domain">
3224 ##      <summary>
3225 ##      Domain allowed access.
3226 ##      </summary>
3227 ## </param>
3228 #
3229 interface(`userdom_use_user_ptys',`
3230         gen_require(`
3231                 type user_devpts_t;
3232         ')
3233
3234         allow $1 user_devpts_t:chr_file rw_term_perms;
3235 ')
3236
3237 ########################################
3238 ## <summary>
3239 ##      Read and write a inherited user domain pty.
3240 ## </summary>
3241 ## <param name="domain">
3242 ##      <summary>
3243 ##      Domain allowed access.
3244 ##      </summary>
3245 ## </param>
3246 #
3247 interface(`userdom_use_inherited_user_ptys',`
3248         gen_require(`
3249                 type user_devpts_t;
3250         ')
3251
3252         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3253 ')
3254
3255 ########################################
3256 ## <summary>
3257 ##      Read and write a inherited user TTYs and PTYs.
3258 ## </summary>
3259 ## <desc>
3260 ##      <p>
3261 ##      Allow the specified domain to read and write inherited user
3262 ##      TTYs and PTYs. This will allow the domain to
3263 ##      interact with the user via the terminal. Typically
3264 ##      all interactive applications will require this
3265 ##      access.
3266 ##      </p>
3267 ## </desc>
3268 ## <param name="domain">
3269 ##      <summary>
3270 ##      Domain allowed access.
3271 ##      </summary>
3272 ## </param>
3273 ## <infoflow type="both" weight="10"/>
3274 #
3275 interface(`userdom_use_inherited_user_terminals',`
3276         gen_require(`
3277                 type user_tty_device_t, user_devpts_t;
3278         ')
3279
3280         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3281         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3282 ')
3283
3284 #######################################
3285 ## <summary>
3286 ##  Allow attempts to read and write
3287 ##  a user domain tty and pty.
3288 ## </summary>
3289 ## <param name="domain">
3290 ##  <summary>
3291 ##  Domain to not audit.
3292 ##  </summary>
3293 ## </param>
3294 #
3295 interface(`userdom_use_user_terminals',`
3296     gen_require(`
3297         type user_tty_device_t, user_devpts_t;
3298     ')
3299
3300     allow $1 user_tty_device_t:chr_file rw_term_perms;
3301     allow $1 user_devpts_t:chr_file rw_term_perms;
3302 ')
3303
3304 ########################################
3305 ## <summary>
3306 ##      Do not audit attempts to read and write
3307 ##      a user domain tty and pty.
3308 ## </summary>
3309 ## <param name="domain">
3310 ##      <summary>
3311 ##      Domain to not audit.
3312 ##      </summary>
3313 ## </param>
3314 #
3315 interface(`userdom_dontaudit_use_user_terminals',`
3316         gen_require(`
3317                 type user_tty_device_t, user_devpts_t;
3318         ')
3319
3320         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3321         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3322 ')
3323
3324
3325 ########################################
3326 ## <summary>
3327 ##      Get attributes of user domain tty and pty.
3328 ## </summary>
3329 ## <param name="domain">
3330 ##      <summary>
3331 ##      Domain allowed access.
3332 ##      </summary>
3333 ## </param>
3334 #
3335 interface(`userdom_getattr_user_terminals',`
3336         gen_require(`
3337                 type user_tty_device_t, user_devpts_t;
3338         ')
3339
3340         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3341 ')
3342
3343 ########################################
3344 ## <summary>
3345 ##      Execute a shell in all user domains.  This
3346 ##      is an explicit transition, requiring the
3347 ##      caller to use setexeccon().
3348 ## </summary>
3349 ## <param name="domain">
3350 ##      <summary>
3351 ##      Domain allowed to transition.
3352 ##      </summary>
3353 ## </param>
3354 #
3355 interface(`userdom_spec_domtrans_all_users',`
3356         gen_require(`
3357                 attribute userdomain;
3358         ')
3359
3360         corecmd_shell_spec_domtrans($1, userdomain)
3361         allow userdomain $1:fd use;
3362         allow userdomain $1:fifo_file rw_file_perms;
3363         allow userdomain $1:process sigchld;
3364 ')
3365
3366 ########################################
3367 ## <summary>
3368 ##      Execute an Xserver session in all unprivileged user domains.  This
3369 ##      is an explicit transition, requiring the
3370 ##      caller to use setexeccon().
3371 ## </summary>
3372 ## <param name="domain">
3373 ##      <summary>
3374 ##      Domain allowed to transition.
3375 ##      </summary>
3376 ## </param>
3377 #
3378 interface(`userdom_xsession_spec_domtrans_all_users',`
3379         gen_require(`
3380                 attribute userdomain;
3381         ')
3382
3383         xserver_xsession_spec_domtrans($1, userdomain)
3384         allow userdomain $1:fd use;
3385         allow userdomain $1:fifo_file rw_file_perms;
3386         allow userdomain $1:process sigchld;
3387 ')
3388
3389 ########################################
3390 ## <summary>
3391 ##      Execute a shell in all unprivileged user domains.  This
3392 ##      is an explicit transition, requiring the
3393 ##      caller to use setexeccon().
3394 ## </summary>
3395 ## <param name="domain">
3396 ##      <summary>
3397 ##      Domain allowed to transition.
3398 ##      </summary>
3399 ## </param>
3400 #
3401 interface(`userdom_spec_domtrans_unpriv_users',`
3402         gen_require(`
3403                 attribute unpriv_userdomain;
3404         ')
3405
3406         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3407         allow unpriv_userdomain $1:fd use;
3408         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3409         allow unpriv_userdomain $1:process sigchld;
3410 ')
3411
3412 #####################################
3413 ## <summary>
3414 ##  Allow domain dyntrans to unpriv userdomain.
3415 ## </summary>
3416 ## <param name="domain">
3417 ##  <summary>
3418 ##  Domain allowed access.
3419 ##  </summary>
3420 ## </param>
3421 #
3422 interface(`userdom_dyntransition_unpriv_users',`
3423     gen_require(`
3424         attribute unpriv_userdomain;
3425     ')
3426
3427     allow $1 unpriv_userdomain:process dyntransition;
3428 ')
3429
3430 ########################################
3431 ## <summary>
3432 ##      Execute an Xserver session in all unprivileged user domains.  This
3433 ##      is an explicit transition, requiring the
3434 ##      caller to use setexeccon().
3435 ## </summary>
3436 ## <param name="domain">
3437 ##      <summary>
3438 ##      Domain allowed to transition.
3439 ##      </summary>
3440 ## </param>
3441 #
3442 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3443         gen_require(`
3444                 attribute unpriv_userdomain;
3445         ')
3446
3447         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3448         allow unpriv_userdomain $1:fd use;
3449         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3450         allow unpriv_userdomain $1:process sigchld;
3451 ')
3452
3453 ########################################
3454 ## <summary>
3455 ##      Manage unpriviledged user SysV sempaphores.
3456 ## </summary>
3457 ## <param name="domain">
3458 ##      <summary>
3459 ##      Domain allowed access.
3460 ##      </summary>
3461 ## </param>
3462 #
3463 interface(`userdom_manage_unpriv_user_semaphores',`
3464         gen_require(`
3465                 attribute unpriv_userdomain;
3466         ')
3467
3468         allow $1 unpriv_userdomain:sem create_sem_perms;
3469 ')
3470
3471 ########################################
3472 ## <summary>
3473 ##      Manage unpriviledged user SysV shared
3474 ##      memory segments.
3475 ## </summary>
3476 ## <param name="domain">
3477 ##      <summary>
3478 ##      Domain allowed access.
3479 ##      </summary>
3480 ## </param>
3481 #
3482 interface(`userdom_manage_unpriv_user_shared_mem',`
3483         gen_require(`
3484                 attribute unpriv_userdomain;
3485         ')
3486
3487         allow $1 unpriv_userdomain:shm create_shm_perms;
3488 ')
3489
3490 ########################################
3491 ## <summary>
3492 ##      Execute bin_t in the unprivileged user domains. This
3493 ##      is an explicit transition, requiring the
3494 ##      caller to use setexeccon().
3495 ## </summary>
3496 ## <param name="domain">
3497 ##      <summary>
3498 ##      Domain allowed to transition.
3499 ##      </summary>
3500 ## </param>
3501 #
3502 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3503         gen_require(`
3504                 attribute unpriv_userdomain;
3505         ')
3506
3507         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3508         allow unpriv_userdomain $1:fd use;
3509         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3510         allow unpriv_userdomain $1:process sigchld;
3511 ')
3512
3513 ########################################
3514 ## <summary>
3515 ##      Execute all entrypoint files in unprivileged user
3516 ##      domains. This is an explicit transition, requiring the
3517 ##      caller to use setexeccon().
3518 ## </summary>
3519 ## <param name="domain">
3520 ##      <summary>
3521 ##      Domain allowed access.
3522 ##      </summary>
3523 ## </param>
3524 #
3525 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3526         gen_require(`
3527                 attribute unpriv_userdomain;
3528         ')
3529
3530         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3531         allow unpriv_userdomain $1:fd use;
3532         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3533         allow unpriv_userdomain $1:process sigchld;
3534 ')
3535
3536 ########################################
3537 ## <summary>
3538 ##      Search users home directories.
3539 ## </summary>
3540 ## <param name="domain">
3541 ##      <summary>
3542 ##      Domain allowed access.
3543 ##      </summary>
3544 ## </param>
3545 #
3546 interface(`userdom_search_user_home_content',`
3547         gen_require(`
3548                 type user_home_dir_t;
3549                 attribute user_home_type;
3550         ')
3551
3552         files_list_home($1)
3553         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3554         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3555 ')
3556
3557 ########################################
3558 ## <summary>
3559 ##      Send general signals to unprivileged user domains.
3560 ## </summary>
3561 ## <param name="domain">
3562 ##      <summary>
3563 ##      Domain allowed access.
3564 ##      </summary>
3565 ## </param>
3566 #
3567 interface(`userdom_signal_unpriv_users',`
3568         gen_require(`
3569                 attribute unpriv_userdomain;
3570         ')
3571
3572         allow $1 unpriv_userdomain:process signal;
3573 ')
3574
3575 ########################################
3576 ## <summary>
3577 ##      Inherit the file descriptors from unprivileged user domains.
3578 ## </summary>
3579 ## <param name="domain">
3580 ##      <summary>
3581 ##      Domain allowed access.
3582 ##      </summary>
3583 ## </param>
3584 #
3585 interface(`userdom_use_unpriv_users_fds',`
3586         gen_require(`
3587                 attribute unpriv_userdomain;
3588         ')
3589
3590         allow $1 unpriv_userdomain:fd use;
3591 ')
3592
3593 ########################################
3594 ## <summary>
3595 ##      Do not audit attempts to inherit the file descriptors
3596 ##      from unprivileged user domains.
3597 ## </summary>
3598 ## <desc>
3599 ##      <p>
3600 ##      Do not audit attempts to inherit the file descriptors
3601 ##      from unprivileged user domains. This will supress
3602 ##      SELinux denial messages when the specified domain is denied
3603 ##      the permission to inherit these file descriptors.
3604 ##      </p>
3605 ## </desc>
3606 ## <param name="domain">
3607 ##      <summary>
3608 ##      Domain to not audit.
3609 ##      </summary>
3610 ## </param>
3611 ## <infoflow type="none"/>
3612 #
3613 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3614         gen_require(`
3615                 attribute unpriv_userdomain;
3616         ')
3617
3618         dontaudit $1 unpriv_userdomain:fd use;
3619 ')
3620
3621 ########################################
3622 ## <summary>
3623 ##      Do not audit attempts to use user ptys.
3624 ## </summary>
3625 ## <param name="domain">
3626 ##      <summary>
3627 ##      Domain to not audit.
3628 ##      </summary>
3629 ## </param>
3630 #
3631 interface(`userdom_dontaudit_use_user_ptys',`
3632         gen_require(`
3633                 type user_devpts_t;
3634         ')
3635
3636         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3637 ')
3638
3639 ########################################
3640 ## <summary>
3641 ##      Relabel files to unprivileged user pty types.
3642 ## </summary>
3643 ## <param name="domain">
3644 ##      <summary>
3645 ##      Domain allowed access.
3646 ##      </summary>
3647 ## </param>
3648 #
3649 interface(`userdom_relabelto_user_ptys',`
3650         gen_require(`
3651                 type user_devpts_t;
3652         ')
3653
3654         allow $1 user_devpts_t:chr_file relabelto;
3655 ')
3656
3657 ########################################
3658 ## <summary>
3659 ##      Do not audit attempts to relabel files from
3660 ##      user pty types.
3661 ## </summary>
3662 ## <param name="domain">
3663 ##      <summary>
3664 ##      Domain to not audit.
3665 ##      </summary>
3666 ## </param>
3667 #
3668 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3669         gen_require(`
3670                 type user_devpts_t;
3671         ')
3672
3673         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3674 ')
3675
3676 ########################################
3677 ## <summary>
3678 ##      Write all users files in /tmp
3679 ## </summary>
3680 ## <param name="domain">
3681 ##      <summary>
3682 ##      Domain allowed access.
3683 ##      </summary>
3684 ## </param>
3685 #
3686 interface(`userdom_write_user_tmp_files',`
3687         gen_require(`
3688                 type user_tmp_t;
3689         ')
3690
3691         write_files_pattern($1, user_tmp_t, user_tmp_t)
3692 ')
3693
3694 ########################################
3695 ## <summary>
3696 ##      Do not audit attempts to write users
3697 ##      temporary files.
3698 ## </summary>
3699 ## <param name="domain">
3700 ##      <summary>
3701 ##      Domain to not audit.
3702 ##      </summary>
3703 ## </param>
3704 #
3705 interface(`userdom_dontaudit_write_user_tmp_files',`
3706         gen_require(`
3707                 type user_tmp_t;
3708         ')
3709
3710         dontaudit $1 user_tmp_t:file write;
3711 ')
3712
3713 ########################################
3714 ## <summary>
3715 ##      Do not audit attempts to read/write users
3716 ##      temporary fifo files.
3717 ## </summary>
3718 ## <param name="domain">
3719 ##      <summary>
3720 ##      Domain to not audit.
3721 ##      </summary>
3722 ## </param>
3723 #
3724 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3725         gen_require(`
3726                 type user_tmp_t;
3727         ')
3728
3729         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3730 ')
3731
3732 ########################################
3733 ## <summary>
3734 ##      Do not audit attempts to use user ttys.
3735 ## </summary>
3736 ## <param name="domain">
3737 ##      <summary>
3738 ##      Domain to not audit.
3739 ##      </summary>
3740 ## </param>
3741 #
3742 interface(`userdom_dontaudit_use_user_ttys',`
3743         gen_require(`
3744                 type user_tty_device_t;
3745         ')
3746
3747         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3748 ')
3749
3750 ########################################
3751 ## <summary>
3752 ##      Read the process state of all user domains.
3753 ## </summary>
3754 ## <param name="domain">
3755 ##      <summary>
3756 ##      Domain allowed access.
3757 ##      </summary>
3758 ## </param>
3759 #
3760 interface(`userdom_read_all_users_state',`
3761         gen_require(`
3762                 attribute userdomain;
3763         ')
3764
3765         read_files_pattern($1, userdomain, userdomain)
3766         read_lnk_files_pattern($1,userdomain,userdomain)
3767         kernel_search_proc($1)
3768 ')
3769
3770 ########################################
3771 ## <summary>
3772 ##      Get the attributes of all user domains.
3773 ## </summary>
3774 ## <param name="domain">
3775 ##      <summary>
3776 ##      Domain allowed access.
3777 ##      </summary>
3778 ## </param>
3779 #
3780 interface(`userdom_getattr_all_users',`
3781         gen_require(`
3782                 attribute userdomain;
3783         ')
3784
3785         allow $1 userdomain:process getattr;
3786 ')
3787
3788 ########################################
3789 ## <summary>
3790 ##      Inherit the file descriptors from all user domains
3791 ## </summary>
3792 ## <param name="domain">
3793 ##      <summary>
3794 ##      Domain allowed access.
3795 ##      </summary>
3796 ## </param>
3797 #
3798 interface(`userdom_use_all_users_fds',`
3799         gen_require(`
3800                 attribute userdomain;
3801         ')
3802
3803         allow $1 userdomain:fd use;
3804 ')
3805
3806 ########################################
3807 ## <summary>
3808 ##      Do not audit attempts to inherit the file
3809 ##      descriptors from any user domains.
3810 ## </summary>
3811 ## <param name="domain">
3812 ##      <summary>
3813 ##      Domain to not audit.
3814 ##      </summary>
3815 ## </param>
3816 #
3817 interface(`userdom_dontaudit_use_all_users_fds',`
3818         gen_require(`
3819                 attribute userdomain;
3820         ')
3821
3822         dontaudit $1 userdomain:fd use;
3823 ')
3824
3825 ########################################
3826 ## <summary>
3827 ##      Send general signals to all user domains.
3828 ## </summary>
3829 ## <param name="domain">
3830 ##      <summary>
3831 ##      Domain allowed access.
3832 ##      </summary>
3833 ## </param>
3834 #
3835 interface(`userdom_signal_all_users',`
3836         gen_require(`
3837                 attribute userdomain;
3838         ')
3839
3840         allow $1 userdomain:process signal;
3841 ')
3842
3843 ########################################
3844 ## <summary>
3845 ##      Send kill signals to all user domains.
3846 ## </summary>
3847 ## <param name="domain">
3848 ##      <summary>
3849 ##      Domain allowed access.
3850 ##      </summary>
3851 ## </param>
3852 #
3853 interface(`userdom_kill_all_users',`
3854         gen_require(`
3855                 attribute userdomain;
3856         ')
3857
3858         allow $1 userdomain:process sigkill;
3859 ')
3860
3861 ########################################
3862 ## <summary>
3863 ##      Send a SIGCHLD signal to all user domains.
3864 ## </summary>
3865 ## <param name="domain">
3866 ##      <summary>
3867 ##      Domain allowed access.
3868 ##      </summary>
3869 ## </param>
3870 #
3871 interface(`userdom_sigchld_all_users',`
3872         gen_require(`
3873                 attribute userdomain;
3874         ')
3875
3876         allow $1 userdomain:process sigchld;
3877 ')
3878
3879 ########################################
3880 ## <summary>
3881 ##      Read keys for all user domains.
3882 ## </summary>
3883 ## <param name="domain">
3884 ##      <summary>
3885 ##      Domain allowed access.
3886 ##      </summary>
3887 ## </param>
3888 #
3889 interface(`userdom_read_all_users_keys',`
3890         gen_require(`
3891                 attribute userdomain;
3892         ')
3893
3894         allow $1 userdomain:key read;
3895 ')
3896
3897 ########################################
3898 ## <summary>
3899 ##      Create keys for all user domains.
3900 ## </summary>
3901 ## <param name="domain">
3902 ##      <summary>
3903 ##      Domain allowed access.
3904 ##      </summary>
3905 ## </param>
3906 #
3907 interface(`userdom_create_all_users_keys',`
3908         gen_require(`
3909                 attribute userdomain;
3910         ')
3911
3912         allow $1 userdomain:key create;
3913 ')
3914
3915 ########################################
3916 ## <summary>
3917 ##      Send a dbus message to all user domains.
3918 ## </summary>
3919 ## <param name="domain">
3920 ##      <summary>
3921 ##      Domain allowed access.
3922 ##      </summary>
3923 ## </param>
3924 #
3925 interface(`userdom_dbus_send_all_users',`
3926         gen_require(`
3927                 attribute userdomain;
3928                 class dbus send_msg;
3929         ')
3930
3931         allow $1 userdomain:dbus send_msg;
3932 ')
3933
3934 ########################################
3935 ## <summary>
3936 ##      Allow apps to set rlimits on userdomain
3937 ## </summary>
3938 ## <param name="domain">
3939 ##      <summary>
3940 ##      Domain allowed access.
3941 ##      </summary>
3942 ## </param>
3943 #
3944 interface(`userdom_set_rlimitnh',`
3945         gen_require(`
3946                 attribute userdomain;
3947         ')
3948
3949         allow $1 userdomain:process rlimitinh;
3950 ')
3951
3952 ########################################
3953 ## <summary>
3954 ##      Define this type as a Allow apps to set rlimits on userdomain
3955 ## </summary>
3956 ## <param name="domain">
3957 ##      <summary>
3958 ##      Domain allowed access.
3959 ##      </summary>
3960 ## </param>
3961 ## <param name="userdomain_prefix">
3962 ##      <summary>
3963 ##      The prefix of the user domain (e.g., user
3964 ##      is the prefix for user_t).
3965 ## </summary>
3966 ## </param>
3967 ## <param name="domain">
3968 ##      <summary>
3969 ##      Domain allowed access.
3970 ##      </summary>
3971 ## </param>
3972 #
3973 template(`userdom_unpriv_usertype',`
3974         gen_require(`
3975                 attribute unpriv_userdomain, userdomain;
3976                 attribute $1_usertype;
3977         ')
3978         typeattribute $2  $1_usertype;
3979         typeattribute $2  unpriv_userdomain;
3980         typeattribute $2  userdomain;
3981
3982         auth_use_nsswitch($2)
3983         ubac_constrained($2)
3984 ')
3985
3986 ########################################
3987 ## <summary>
3988 ##      Connect to users over an unix stream socket.
3989 ## </summary>
3990 ## <param name="domain">
3991 ##      <summary>
3992 ##      Domain allowed access.
3993 ##      </summary>
3994 ## </param>
3995 #
3996 interface(`userdom_stream_connect',`
3997         gen_require(`
3998                 type user_tmp_t;
3999                 attribute userdomain;
4000         ')
4001
4002         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
4003 ')
4004
4005 ########################################
4006 ## <summary>
4007 ##      Ptrace user domains.
4008 ## </summary>
4009 ## <param name="domain">
4010 ##      <summary>
4011 ##      Domain allowed access.
4012 ##      </summary>
4013 ## </param>
4014 #
4015 interface(`userdom_ptrace_all_users',`
4016         gen_require(`
4017                 attribute userdomain;
4018         ')
4019
4020         tunable_policy(`deny_ptrace',`',`
4021                 allow $1 userdomain:process ptrace;
4022         ')
4023 ')
4024
4025 ########################################
4026 ## <summary>
4027 ##      dontaudit Search /root
4028 ## </summary>
4029 ## <param name="domain">
4030 ##      <summary>
4031 ##      Domain to not audit.
4032 ##      </summary>
4033 ## </param>
4034 #
4035 interface(`userdom_dontaudit_search_admin_dir',`
4036         gen_require(`
4037                 type admin_home_t;
4038         ')
4039
4040         dontaudit $1 admin_home_t:dir search_dir_perms;
4041 ')
4042
4043 ########################################
4044 ## <summary>
4045 ##      dontaudit list /root
4046 ## </summary>
4047 ## <param name="domain">
4048 ##      <summary>
4049 ##      Domain to not audit.
4050 ##      </summary>
4051 ## </param>
4052 #
4053 interface(`userdom_dontaudit_list_admin_dir',`
4054         gen_require(`
4055                 type admin_home_t;
4056         ')
4057
4058         dontaudit $1 admin_home_t:dir list_dir_perms;
4059 ')
4060
4061 ########################################
4062 ## <summary>
4063 ##      Allow domain to  list /root
4064 ## </summary>
4065 ## <param name="domain">
4066 ##      <summary>
4067 ##      Domain allowed access.
4068 ##      </summary>
4069 ## </param>
4070 #
4071 interface(`userdom_list_admin_dir',`
4072         gen_require(`
4073                 type admin_home_t;
4074         ')
4075
4076         allow $1 admin_home_t:dir list_dir_perms;
4077 ')
4078
4079 ########################################
4080 ## <summary>
4081 ##      Allow Search /root
4082 ## </summary>
4083 ## <param name="domain">
4084 ##      <summary>
4085 ##      Domain allowed access.
4086 ##      </summary>
4087 ## </param>
4088 #
4089 interface(`userdom_search_admin_dir',`
4090         gen_require(`
4091                 type admin_home_t;
4092         ')
4093
4094         allow $1 admin_home_t:dir search_dir_perms;
4095 ')
4096
4097 ########################################
4098 ## <summary>
4099 ##      RW unpriviledged user SysV sempaphores.
4100 ## </summary>
4101 ## <param name="domain">
4102 ##      <summary>
4103 ##      Domain allowed access.
4104 ##      </summary>
4105 ## </param>
4106 #
4107 interface(`userdom_rw_semaphores',`
4108         gen_require(`
4109                 attribute unpriv_userdomain;
4110         ')
4111
4112         allow $1 unpriv_userdomain:sem rw_sem_perms;
4113 ')
4114
4115 ########################################
4116 ## <summary>
4117 ##      Send a message to unpriv users over a unix domain
4118 ##      datagram socket.
4119 ## </summary>
4120 ## <param name="domain">
4121 ##      <summary>
4122 ##      Domain allowed access.
4123 ##      </summary>
4124 ## </param>
4125 #
4126 interface(`userdom_dgram_send',`
4127         gen_require(`
4128                 attribute unpriv_userdomain;
4129         ')
4130
4131         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4132 ')
4133
4134 ######################################
4135 ## <summary>
4136 ##      Send a message to users over a unix domain
4137 ##      datagram socket.
4138 ## </summary>
4139 ## <param name="domain">
4140 ##      <summary>
4141 ##      Domain allowed access.
4142 ##      </summary>
4143 ## </param>
4144 #
4145 interface(`userdom_users_dgram_send',`
4146         gen_require(`
4147                  attribute userdomain;
4148       ')
4149
4150        allow $1 userdomain:unix_dgram_socket sendto;
4151 ')
4152
4153 #######################################
4154 ## <summary>
4155 ##      Allow execmod on files in homedirectory
4156 ## </summary>
4157 ## <param name="domain">
4158 ##      <summary>
4159 ##      Domain allowed access.
4160 ##      </summary>
4161 ## </param>
4162 ## <rolebase/>
4163 #
4164 interface(`userdom_execmod_user_home_files',`
4165         gen_require(`
4166                 type user_home_type;
4167         ')
4168
4169         allow $1 user_home_type:file execmod;
4170 ')
4171
4172 ########################################
4173 ## <summary>
4174 ##      Read admin home files.
4175 ## </summary>
4176 ## <param name="domain">
4177 ##      <summary>
4178 ##      Domain allowed access.
4179 ##      </summary>
4180 ## </param>
4181 ## <rolecap/>
4182 #
4183 interface(`userdom_read_admin_home_files',`
4184         gen_require(`
4185                 type admin_home_t;
4186         ')
4187
4188         read_files_pattern($1, admin_home_t, admin_home_t)
4189 ')
4190
4191 ########################################
4192 ## <summary>
4193 ##      Execute admin home files.
4194 ## </summary>
4195 ## <param name="domain">
4196 ##      <summary>
4197 ##      Domain allowed access.
4198 ##      </summary>
4199 ## </param>
4200 ## <rolecap/>
4201 #
4202 interface(`userdom_exec_admin_home_files',`
4203         gen_require(`
4204                 type admin_home_t;
4205         ')
4206
4207         exec_files_pattern($1, admin_home_t, admin_home_t)
4208 ')
4209
4210 ########################################
4211 ## <summary>
4212 ##      Append files inherited
4213 ##      in the /root directory.
4214 ## </summary>
4215 ## <param name="domain">
4216 ##      <summary>
4217 ##      Domain allowed access.
4218 ##      </summary>
4219 ## </param>
4220 #
4221 interface(`userdom_inherit_append_admin_home_files',`
4222         gen_require(`
4223                 type admin_home_t;
4224         ')
4225
4226         allow $1 admin_home_t:file { getattr append };
4227 ')
4228
4229
4230 #######################################
4231 ## <summary>
4232 ##      Manage all files/directories in the homedir
4233 ## </summary>
4234 ## <param name="userdomain">
4235 ##      <summary>
4236 ##      The user domain
4237 ##      </summary>
4238 ## </param>
4239 ## <rolebase/>
4240 #
4241 interface(`userdom_manage_user_home_content',`
4242         gen_require(`
4243                 type user_home_dir_t, user_home_t;
4244                 attribute user_home_type;
4245         ')
4246
4247         files_list_home($1)
4248         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4249         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4250         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4251         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4252         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4253         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4254
4255 ')
4256
4257
4258 ########################################
4259 ## <summary>
4260 ##      Create objects in a user home directory
4261 ##      with an automatic type transition to
4262 ##      the user home file type.
4263 ## </summary>
4264 ## <param name="domain">
4265 ##      <summary>
4266 ##      Domain allowed access.
4267 ##      </summary>
4268 ## </param>
4269 ## <param name="object_class">
4270 ##      <summary>
4271 ##      The class of the object to be created.
4272 ##      </summary>
4273 ## </param>
4274 #
4275 interface(`userdom_user_home_dir_filetrans_pattern',`
4276         gen_require(`
4277                 type user_home_dir_t, user_home_t;
4278         ')
4279
4280         type_transition $1 user_home_dir_t:$2 user_home_t;
4281 ')
4282
4283 ########################################
4284 ## <summary>
4285 ##      Create objects in the /root directory
4286 ##      with an automatic type transition to
4287 ##      a specified private type.
4288 ## </summary>
4289 ## <param name="domain">
4290 ##      <summary>
4291 ##      Domain allowed access.
4292 ##      </summary>
4293 ## </param>
4294 ## <param name="private_type">
4295 ##      <summary>
4296 ##      The type of the object to create.
4297 ##      </summary>
4298 ## </param>
4299 ## <param name="object_class">
4300 ##      <summary>
4301 ##      The class of the object to be created.
4302 ##      </summary>
4303 ## </param>
4304 #
4305 interface(`userdom_admin_home_dir_filetrans',`
4306         gen_require(`
4307                 type admin_home_t;
4308         ')
4309
4310         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4311 ')
4312
4313 ########################################
4314 ## <summary>
4315 ##      Send signull to unprivileged user domains.
4316 ## </summary>
4317 ## <param name="domain">
4318 ##      <summary>
4319 ##      Domain allowed access.
4320 ##      </summary>
4321 ## </param>
4322 #
4323 interface(`userdom_signull_unpriv_users',`
4324         gen_require(`
4325                 attribute unpriv_userdomain;
4326         ')
4327
4328         allow $1 unpriv_userdomain:process signull;
4329 ')
4330
4331 ########################################
4332 ## <summary>
4333 ##      Write all users files in /tmp
4334 ## </summary>
4335 ## <param name="domain">
4336 ##      <summary>
4337 ##      Domain allowed access.
4338 ##      </summary>
4339 ## </param>
4340 #
4341 interface(`userdom_write_user_tmp_dirs',`
4342         gen_require(`
4343                 type user_tmp_t;
4344         ')
4345
4346         write_files_pattern($1, user_tmp_t, user_tmp_t)
4347 ')
4348
4349 ########################################
4350 ## <summary>
4351 ##      Manage keys for all user domains.
4352 ## </summary>
4353 ## <param name="domain">
4354 ##      <summary>
4355 ##      Domain allowed access.
4356 ##      </summary>
4357 ## </param>
4358 #
4359 interface(`userdom_manage_all_users_keys',`
4360         gen_require(`
4361                 attribute userdomain;
4362         ')
4363
4364         allow $1 userdomain:key manage_key_perms;
4365 ')
4366
4367
4368 ########################################
4369 ## <summary>
4370 ##      Do not audit attempts to read and write
4371 ##      unserdomain stream.
4372 ## </summary>
4373 ## <param name="domain">
4374 ##      <summary>
4375 ##      Domain to not audit.
4376 ##      </summary>
4377 ## </param>
4378 #
4379 interface(`userdom_dontaudit_rw_stream',`
4380         gen_require(`
4381                 attribute userdomain;
4382         ')
4383
4384         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4385 ')
4386
4387 ########################################
4388 ## <summary>
4389 ##      Do not audit attempts to read and write
4390 ##      unserdomain datagram socket.
4391 ## </summary>
4392 ## <param name="domain">
4393 ##      <summary>
4394 ##      Domain to not audit.
4395 ##      </summary>
4396 ## </param>
4397 #
4398 interface(`userdom_dontaudit_rw_dgram_socket',`
4399         gen_require(`
4400                 attribute userdomain;
4401         ')
4402
4403         dontaudit $1 userdomain:unix_dgram_socket { read write };
4404 ')
4405
4406 ########################################
4407 ## <summary>
4408 ##      Append files
4409 ##      in a user home subdirectory.
4410 ## </summary>
4411 ## <param name="domain">
4412 ##      <summary>
4413 ##      Domain allowed access.
4414 ##      </summary>
4415 ## </param>
4416 #
4417 interface(`userdom_append_user_home_content_files',`
4418         gen_require(`
4419                 type user_home_dir_t, user_home_t;
4420         ')
4421
4422         append_files_pattern($1, user_home_t, user_home_t)
4423         allow $1 user_home_dir_t:dir search_dir_perms;
4424         files_search_home($1)
4425 ')
4426
4427 ########################################
4428 ## <summary>
4429 ##      Read files inherited
4430 ##      in a user home subdirectory.
4431 ## </summary>
4432 ## <param name="domain">
4433 ##      <summary>
4434 ##      Domain allowed access.
4435 ##      </summary>
4436 ## </param>
4437 #
4438 interface(`userdom_read_inherited_user_home_content_files',`
4439         gen_require(`
4440                 attribute user_home_type;
4441         ')
4442
4443         allow $1 user_home_type:file { getattr read };
4444 ')
4445
4446 ########################################
4447 ## <summary>
4448 ##      Append files inherited
4449 ##      in a user home subdirectory.
4450 ## </summary>
4451 ## <param name="domain">
4452 ##      <summary>
4453 ##      Domain allowed access.
4454 ##      </summary>
4455 ## </param>
4456 #
4457 interface(`userdom_inherit_append_user_home_content_files',`
4458         gen_require(`
4459                 type user_home_t;
4460         ')
4461
4462         allow $1 user_home_t:file { getattr append };
4463 ')
4464
4465 ########################################
4466 ## <summary>
4467 ##      Append files inherited
4468 ##      in a user tmp files.
4469 ## </summary>
4470 ## <param name="domain">
4471 ##      <summary>
4472 ##      Domain allowed access.
4473 ##      </summary>
4474 ## </param>
4475 #
4476 interface(`userdom_inherit_append_user_tmp_files',`
4477         gen_require(`
4478                 type user_tmp_t;
4479         ')
4480
4481         allow $1 user_tmp_t:file { getattr append };
4482 ')
4483
4484 ######################################
4485 ## <summary>
4486 ##      Read audio files in the users homedir.
4487 ## </summary>
4488 ## <param name="domain">
4489 ##      <summary>
4490 ##      Domain allowed access.
4491 ##      </summary>
4492 ## </param>
4493 ## <rolecap/>
4494 #
4495 interface(`userdom_read_home_audio_files',`
4496         gen_require(`
4497                 type audio_home_t;
4498         ')
4499
4500         userdom_search_user_home_dirs($1)
4501         allow $1 audio_home_t:dir list_dir_perms;
4502         read_files_pattern($1, audio_home_t, audio_home_t)
4503         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4504 ')
4505
4506 ########################################
4507 ## <summary>
4508 ##      Do not audit attempts to write all user home content files.
4509 ## </summary>
4510 ## <param name="domain">
4511 ##      <summary>
4512 ##      Domain to not audit.
4513 ##      </summary>
4514 ## </param>
4515 #
4516 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4517         gen_require(`
4518                 attribute user_home_type;
4519         ')
4520
4521         dontaudit $1 user_home_type:file write_file_perms;
4522 ')
4523
4524 ########################################
4525 ## <summary>
4526 ##      Do not audit attempts to write all user tmp content files.
4527 ## </summary>
4528 ## <param name="domain">
4529 ##      <summary>
4530 ##      Domain to not audit.
4531 ##      </summary>
4532 ## </param>
4533 #
4534 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4535         gen_require(`
4536                 attribute user_tmp_type;
4537         ')
4538
4539         dontaudit $1 user_tmp_type:file write_file_perms;
4540 ')
4541
4542 ########################################
4543 ## <summary>
4544 ##      Manage all user temporary content.
4545 ## </summary>
4546 ## <param name="domain">
4547 ##      <summary>
4548 ##      Domain allowed access.
4549 ##      </summary>
4550 ## </param>
4551 #
4552 interface(`userdom_manage_all_user_tmp_content',`
4553         gen_require(`
4554                 attribute user_tmp_type;
4555         ')
4556
4557         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4558         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4559         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4560         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4561         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4562         files_search_tmp($1)
4563 ')
4564
4565 ########################################
4566 ## <summary>
4567 ##      List all user temporary content.
4568 ## </summary>
4569 ## <param name="domain">
4570 ##      <summary>
4571 ##      Domain allowed access.
4572 ##      </summary>
4573 ## </param>
4574 #
4575 interface(`userdom_list_all_user_tmp_content',`
4576         gen_require(`
4577                 attribute user_tmp_type;
4578         ')
4579
4580         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4581         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4582         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4583         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4584         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4585         files_search_var($1)
4586         files_search_tmp($1)
4587 ')
4588
4589 ########################################
4590 ## <summary>
4591 ##      Manage all user tmpfs content.
4592 ## </summary>
4593 ## <param name="domain">
4594 ##      <summary>
4595 ##      Domain allowed access.
4596 ##      </summary>
4597 ## </param>
4598 #
4599 interface(`userdom_manage_all_user_tmpfs_content',`
4600         gen_require(`
4601                 attribute user_tmpfs_type;
4602         ')
4603
4604         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4605         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4606         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4607         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4608         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4609         fs_search_tmpfs($1)
4610 ')
4611
4612 ########################################
4613 ## <summary>
4614 ##      Delete all user temporary content.
4615 ## </summary>
4616 ## <param name="domain">
4617 ##      <summary>
4618 ##      Domain allowed access.
4619 ##      </summary>
4620 ## </param>
4621 #
4622 interface(`userdom_delete_all_user_tmp_content',`
4623         gen_require(`
4624                 attribute user_tmp_type;
4625         ')
4626
4627         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4628         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4629         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4630         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4631         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4632         # /var/tmp
4633         files_search_var($1)
4634         files_delete_tmp_dir_entry($1)
4635 ')
4636
4637 ########################################
4638 ## <summary>
4639 ##      Read system SSL certificates in the users homedir.
4640 ## </summary>
4641 ## <param name="domain">
4642 ##      <summary>
4643 ##      Domain allowed access.
4644 ##      </summary>
4645 ## </param>
4646 #
4647 interface(`userdom_read_home_certs',`
4648         gen_require(`
4649                 type home_cert_t;
4650         ')
4651
4652         userdom_search_user_home_content($1)
4653         allow $1 home_cert_t:dir list_dir_perms;
4654         read_files_pattern($1, home_cert_t, home_cert_t)
4655         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4656 ')
4657
4658 ########################################
4659 ## <summary>
4660 ##      Manage system SSL certificates in the users homedir.
4661 ## </summary>
4662 ## <param name="domain">
4663 ##      <summary>
4664 ##      Domain allowed access.
4665 ##      </summary>
4666 ## </param>
4667 #
4668 interface(`userdom_manage_home_certs',`
4669         gen_require(`
4670                 type home_cert_t;
4671         ')
4672
4673         allow $1 home_cert_t:dir list_dir_perms;
4674         manage_files_pattern($1, home_cert_t, home_cert_t)
4675         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4676
4677         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4678         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4679 ')
4680
4681 #######################################
4682 ## <summary>
4683 ##  Dontaudit Write system SSL certificates in the users homedir.
4684 ## </summary>
4685 ## <param name="domain">
4686 ##  <summary>
4687 ##      Domain to not audit.
4688 ##  </summary>
4689 ## </param>
4690 #
4691 interface(`userdom_dontaudit_write_home_certs',`
4692     gen_require(`
4693         type home_cert_t;
4694     ')
4695
4696     dontaudit $1 home_cert_t:file write;
4697 ')
4698
4699 ########################################
4700 ## <summary>
4701 ##      dontaudit Search getatrr /root files
4702 ## </summary>
4703 ## <param name="domain">
4704 ##      <summary>
4705 ##      Domain to not audit.
4706 ##      </summary>
4707 ## </param>
4708 #
4709 interface(`userdom_dontaudit_getattr_admin_home_files',`
4710         gen_require(`
4711                 type admin_home_t;
4712         ')
4713
4714         dontaudit $1 admin_home_t:file getattr;
4715 ')
4716
4717 ########################################
4718 ## <summary>
4719 ##      dontaudit read /root lnk files
4720 ## </summary>
4721 ## <param name="domain">
4722 ##      <summary>
4723 ##      Domain to not audit.
4724 ##      </summary>
4725 ## </param>
4726 #
4727 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4728         gen_require(`
4729                 type admin_home_t;
4730         ')
4731
4732         dontaudit $1 admin_home_t:lnk_file read;
4733 ')
4734
4735 ########################################
4736 ## <summary>
4737 ##      dontaudit read /root files
4738 ## </summary>
4739 ## <param name="domain">
4740 ##      <summary>
4741 ##      Domain to not audit.
4742 ##      </summary>
4743 ## </param>
4744 #
4745 interface(`userdom_dontaudit_read_admin_home_files',`
4746         gen_require(`
4747                 type admin_home_t;
4748         ')
4749
4750         dontaudit $1 admin_home_t:file read_file_perms;
4751 ')
4752
4753 ########################################
4754 ## <summary>
4755 ##      Create, read, write, and delete user
4756 ##      temporary chr files.
4757 ## </summary>
4758 ## <param name="domain">
4759 ##      <summary>
4760 ##      Domain allowed access.
4761 ##      </summary>
4762 ## </param>
4763 #
4764 interface(`userdom_manage_user_tmp_chr_files',`
4765         gen_require(`
4766                 type user_tmp_t;
4767         ')
4768
4769         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4770         files_search_tmp($1)
4771 ')
4772
4773 ########################################
4774 ## <summary>
4775 ##      Create, read, write, and delete user
4776 ##      temporary blk files.
4777 ## </summary>
4778 ## <param name="domain">
4779 ##      <summary>
4780 ##      Domain allowed access.
4781 ##      </summary>
4782 ## </param>
4783 #
4784 interface(`userdom_manage_user_tmp_blk_files',`
4785         gen_require(`
4786                 type user_tmp_t;
4787         ')
4788
4789         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4790         files_search_tmp($1)
4791 ')
4792
4793 ########################################
4794 ## <summary>
4795 ##      Dontaudit attempt to set attributes on  user temporary directories.
4796 ## </summary>
4797 ## <param name="domain">
4798 ##      <summary>
4799 ##      Domain to not audit.
4800 ##      </summary>
4801 ## </param>
4802 #
4803 interface(`userdom_dontaudit_setattr_user_tmp',`
4804         gen_require(`
4805                 type user_tmp_t;
4806         ')
4807
4808         dontaudit $1 user_tmp_t:dir setattr;
4809 ')
4810
4811 ########################################
4812 ## <summary>
4813 ##      Read all inherited users files in /tmp
4814 ## </summary>
4815 ## <param name="domain">
4816 ##      <summary>
4817 ##      Domain allowed access.
4818 ##      </summary>
4819 ## </param>
4820 #
4821 interface(`userdom_read_inherited_user_tmp_files',`
4822         gen_require(`
4823                 type user_tmp_t;
4824         ')
4825
4826         allow $1 user_tmp_t:file read_inherited_file_perms;
4827 ')
4828
4829 ########################################
4830 ## <summary>
4831 ##      Write all inherited users files in /tmp
4832 ## </summary>
4833 ## <param name="domain">
4834 ##      <summary>
4835 ##      Domain allowed access.
4836 ##      </summary>
4837 ## </param>
4838 #
4839 interface(`userdom_write_inherited_user_tmp_files',`
4840         gen_require(`
4841                 type user_tmp_t;
4842         ')
4843
4844         allow $1 user_tmp_t:file write;
4845 ')
4846
4847 ########################################
4848 ## <summary>
4849 ##      Delete all users files in /tmp
4850 ## </summary>
4851 ## <param name="domain">
4852 ##      <summary>
4853 ##      Domain allowed access.
4854 ##      </summary>
4855 ## </param>
4856 #
4857 interface(`userdom_delete_user_tmp_files',`
4858         gen_require(`
4859                 type user_tmp_t;
4860         ')
4861
4862         allow $1 user_tmp_t:file delete_file_perms;
4863 ')
4864
4865 ########################################
4866 ## <summary>
4867 ##      Delete user tmpfs files.
4868 ## </summary>
4869 ## <param name="domain">
4870 ##      <summary>
4871 ##      Domain allowed access.
4872 ##      </summary>
4873 ## </param>
4874 #
4875 interface(`userdom_delete_user_tmpfs_files',`
4876         gen_require(`
4877                 type user_tmpfs_t;
4878         ')
4879
4880         allow $1 user_tmpfs_t:file delete_file_perms;
4881 ')
4882
4883 ########################################
4884 ## <summary>
4885 ##      Read/Write unpriviledged user SysV shared
4886 ##      memory segments.
4887 ## </summary>
4888 ## <param name="domain">
4889 ##      <summary>
4890 ##      Domain allowed access.
4891 ##      </summary>
4892 ## </param>
4893 #
4894 interface(`userdom_rw_unpriv_user_shared_mem',`
4895         gen_require(`
4896                 attribute unpriv_userdomain;
4897         ')
4898
4899         allow $1 unpriv_userdomain:shm rw_shm_perms;
4900 ')
4901
4902 ########################################
4903 ## <summary>
4904 ##      Do not audit attempts to search user
4905 ##      temporary directories.
4906 ## </summary>
4907 ## <param name="domain">
4908 ##      <summary>
4909 ##      Domain to not audit.
4910 ##      </summary>
4911 ## </param>
4912 #
4913 interface(`userdom_dontaudit_search_user_tmp',`
4914         gen_require(`
4915                 type user_tmp_t;
4916         ')
4917
4918         dontaudit $1 user_tmp_t:dir search_dir_perms;
4919 ')
4920
4921 ########################################
4922 ## <summary>
4923 ##      Execute a file in a user home directory
4924 ##      in the specified domain.
4925 ## </summary>
4926 ## <desc>
4927 ##      <p>
4928 ##      Execute a file in a user home directory
4929 ##      in the specified domain.
4930 ##      </p>
4931 ##      <p>
4932 ##      No interprocess communication (signals, pipes,
4933 ##      etc.) is provided by this interface since
4934 ##      the domains are not owned by this module.
4935 ##      </p>
4936 ## </desc>
4937 ## <param name="domain">
4938 ##      <summary>
4939 ##      Domain allowed access.
4940 ##      </summary>
4941 ## </param>
4942 ## <param name="target_domain">
4943 ##      <summary>
4944 ##      The type of the new process.
4945 ##      </summary>
4946 ## </param>
4947 #
4948 interface(`userdom_domtrans_user_home',`
4949         gen_require(`
4950                 type user_home_t;
4951         ')
4952
4953         read_lnk_files_pattern($1, user_home_t, user_home_t)
4954         domain_transition_pattern($1, user_home_t, $2)
4955         type_transition $1 user_home_t:process $2;
4956 ')
4957
4958 ########################################
4959 ## <summary>
4960 ##      Execute a file in a user tmp directory
4961 ##      in the specified domain.
4962 ## </summary>
4963 ## <desc>
4964 ##      <p>
4965 ##      Execute a file in a user tmp directory
4966 ##      in the specified domain.
4967 ##      </p>
4968 ##      <p>
4969 ##      No interprocess communication (signals, pipes,
4970 ##      etc.) is provided by this interface since
4971 ##      the domains are not owned by this module.
4972 ##      </p>
4973 ## </desc>
4974 ## <param name="domain">
4975 ##      <summary>
4976 ##      Domain allowed access.
4977 ##      </summary>
4978 ## </param>
4979 ## <param name="target_domain">
4980 ##      <summary>
4981 ##      The type of the new process.
4982 ##      </summary>
4983 ## </param>
4984 #
4985 interface(`userdom_domtrans_user_tmp',`
4986         gen_require(`
4987                 type user_tmp_t;
4988         ')
4989
4990         files_search_tmp($1)
4991         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4992         domain_transition_pattern($1, user_tmp_t, $2)
4993         type_transition $1 user_tmp_t:process $2;
4994 ')
4995
4996 ########################################
4997 ## <summary>
4998 ##      Do not audit attempts to read all user home content files.
4999 ## </summary>
5000 ## <param name="domain">
5001 ##      <summary>
5002 ##      Domain to not audit.
5003 ##      </summary>
5004 ## </param>
5005 #
5006 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5007         gen_require(`
5008                 attribute user_home_type;
5009         ')
5010
5011         dontaudit $1 user_home_type:file read_file_perms;
5012 ')
5013
5014 ########################################
5015 ## <summary>
5016 ##      Do not audit attempts to read all user tmp content files.
5017 ## </summary>
5018 ## <param name="domain">
5019 ##      <summary>
5020 ##      Domain to not audit.
5021 ##      </summary>
5022 ## </param>
5023 #
5024 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5025         gen_require(`
5026                 attribute user_tmp_type;
5027         ')
5028
5029         dontaudit $1 user_tmp_type:file read_file_perms;
5030 ')
5031
5032 #######################################
5033 ## <summary>
5034 ## Read and write unpriviledged user SysV sempaphores.
5035 ## </summary>
5036 ## <param name="domain">
5037 ## <summary>
5038 ## Domain allowed access.
5039 ## </summary>
5040 ## </param>
5041 #
5042 interface(`userdom_rw_unpriv_user_semaphores',`
5043    gen_require(`
5044        attribute unpriv_userdomain;
5045    ')
5046
5047    allow $1 unpriv_userdomain:sem rw_sem_perms;
5048 ')
5049
5050 ########################################
5051 ## <summary>
5052 ##      Transition to userdom named content
5053 ## </summary>
5054 ## <param name="domain">
5055 ##      <summary>
5056 ##      Domain allowed access.
5057 ##      </summary>
5058 ## </param>
5059 #
5060 interface(`userdom_filetrans_home_content',`
5061         gen_require(`
5062                 type home_bin_t, home_cert_t;
5063                 type audio_home_t;
5064         ')
5065
5066         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5067         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5068         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5069         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5070         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5071
5072         #optional_policy(`
5073         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5074         #')
5075 ')