policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 attribute user_tmp_type;
 321                 type user_tmp_t;
 322         ')
 323
 324         role $1 types user_tmp_t;
 325
 326         files_poly_member_tmp($2, user_tmp_t)
 327
 328         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 329         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 330         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 331         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 332         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 333         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 334         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 335         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 336         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 337         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 338         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 339 ')
 340
 341 #######################################
 342 ## <summary>
 343 ##      Dontaudit search of user bin dirs.
 344 ## </summary>
 345 ## <param name="domain">
 346 ##      <summary>
 347 ##      Domain to not audit.
 348 ##      </summary>
 349 ## </param>
 350 #
 351 interface(`userdom_dontaudit_search_user_bin_dirs',`
 352         gen_require(`
 353                 type home_bin_t;
 354         ')
 355
 356         dontaudit $1 home_bin_t:dir search_dir_perms;
 357 ')
 358
 359 #######################################
 360 ## <summary>
 361 ##      Execute user bin files.
 362 ## </summary>
 363 ## <param name="domain">
 364 ##      <summary>
 365 ##      Domain allowed access.
 366 ##      </summary>
 367 ## </param>
 368 #
 369 interface(`userdom_exec_user_bin_files',`
 370         gen_require(`
 371                 attribute user_home_type;
 372                 type home_bin_t, user_home_dir_t;
 373         ')
 374
 375         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 376         files_search_home($1)
 377 ')
 378
 379 #######################################
 380 ## <summary>
 381 ##      The execute access user temporary files.
 382 ## </summary>
 383 ## <param name="domain">
 384 ##      <summary>
 385 ##      Domain allowed access.
 386 ##      </summary>
 387 ## </param>
 388 ## <rolebase/>
 389 #
 390 interface(`userdom_exec_user_tmp_files',`
 391         gen_require(`
 392                 type user_tmp_t;
 393         ')
 394
 395         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 396         dontaudit $1 user_tmp_t:sock_file execute;
 397         files_search_tmp($1)
 398 ')
 399
 400 #######################################
 401 ## <summary>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ## </summary>
 405 ## <desc>
 406 ##      <p>
 407 ##      Role access for the user tmpfs type
 408 ##      that the user has full access.
 409 ##      </p>
 410 ##      <p>
 411 ##      This does not allow execute access.
 412 ##      </p>
 413 ## </desc>
 414 ## <param name="role">
 415 ##      <summary>
 416 ##      Role allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <param name="domain">
 420 ##      <summary>
 421 ##      Domain allowed access.
 422 ##      </summary>
 423 ## </param>
 424 ## <rolecap/>
 425 #
 426 interface(`userdom_manage_tmpfs_role',`
 427         gen_require(`
 428                 attribute user_tmpfs_type;
 429                 type user_tmpfs_t;
 430         ')
 431
 432         role $1 types user_tmpfs_t;
 433
 434         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 435         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 436         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 437         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 438         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 439         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 440         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 441         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 442         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445 ')
 446
 447 #######################################
 448 ## <summary>
 449 ##      The interface allowing the user basic
 450 ##      network permissions
 451 ## </summary>
 452 ## <param name="userdomain">
 453 ##      <summary>
 454 ##      The user domain
 455 ##      </summary>
 456 ## </param>
 457 ## <rolebase/>
 458 #
 459 interface(`userdom_basic_networking',`
 460
 461         allow $1 self:tcp_socket create_stream_socket_perms;
 462         allow $1 self:udp_socket create_socket_perms;
 463
 464         corenet_all_recvfrom_unlabeled($1)
 465         corenet_all_recvfrom_netlabel($1)
 466         corenet_tcp_sendrecv_generic_if($1)
 467         corenet_udp_sendrecv_generic_if($1)
 468         corenet_tcp_sendrecv_generic_node($1)
 469         corenet_udp_sendrecv_generic_node($1)
 470         corenet_tcp_sendrecv_all_ports($1)
 471         corenet_udp_sendrecv_all_ports($1)
 472         corenet_tcp_connect_all_ports($1)
 473         corenet_sendrecv_all_client_packets($1)
 474
 475         optional_policy(`
 476                 init_tcp_recvfrom_all_daemons($1)
 477                 init_udp_recvfrom_all_daemons($1)
 478         ')
 479
 480         optional_policy(`
 481                 ipsec_match_default_spd($1)
 482         ')
 483
 484 ')
 485
 486 #######################################
 487 ## <summary>
 488 ##      The template for creating a user xwindows client.  (Deprecated)
 489 ## </summary>
 490 ## <param name="userdomain_prefix">
 491 ##      <summary>
 492 ##      The prefix of the user domain (e.g., user
 493 ##      is the prefix for user_t).
 494 ##      </summary>
 495 ## </param>
 496 ## <rolebase/>
 497 #
 498 template(`userdom_xwindows_client_template',`
 499         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 500         gen_require(`
 501                 type $1_t, user_tmpfs_t;
 502         ')
 503
 504         dev_rw_xserver_misc($1_t)
 505         dev_rw_power_management($1_t)
 506         dev_read_input($1_t)
 507         dev_read_misc($1_t)
 508         dev_write_misc($1_t)
 509         # open office is looking for the following
 510         dev_getattr_agp_dev($1_t)
 511         dev_dontaudit_rw_dri($1_t)
 512         # GNOME checks for usb and other devices:
 513         dev_rw_usbfs($1_t)
 514         dev_rw_generic_usb_dev($1_t)
 515
 516         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 517         xserver_xsession_entry_type($1_t)
 518         xserver_dontaudit_write_log($1_t)
 519         xserver_stream_connect_xdm($1_t)
 520         # certain apps want to read xdm.pid file
 521         xserver_read_xdm_pid($1_t)
 522         # gnome-session creates socket under /tmp/.ICE-unix/
 523         xserver_create_xdm_tmp_sockets($1_t)
 524         # Needed for escd, remove if we get escd policy
 525         xserver_manage_xdm_tmp_files($1_t)
 526 ')
 527
 528 #######################################
 529 ## <summary>
 530 ##      The template for allowing the user to change passwords.
 531 ## </summary>
 532 ## <param name="userdomain_prefix">
 533 ##      <summary>
 534 ##      The prefix of the user domain (e.g., user
 535 ##      is the prefix for user_t).
 536 ##      </summary>
 537 ## </param>
 538 ## <rolebase/>
 539 #
 540 template(`userdom_change_password_template',`
 541         gen_require(`
 542                 type $1_t;
 543                 role $1_r;
 544         ')
 545
 546         optional_policy(`
 547                 usermanage_run_chfn($1_t,$1_r)
 548                 usermanage_run_passwd($1_t,$1_r)
 549         ')
 550 ')
 551
 552 #######################################
 553 ## <summary>
 554 ##      The template containing rules common to unprivileged
 555 ##      users and administrative users.
 556 ## </summary>
 557 ## <desc>
 558 ##      <p>
 559 ##      This template creates a user domain, types, and
 560 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 561 ##      </p>
 562 ## </desc>
 563 ## <param name="userdomain_prefix">
 564 ##      <summary>
 565 ##      The prefix of the user domain (e.g., user
 566 ##      is the prefix for user_t).
 567 ##      </summary>
 568 ## </param>
 569 #
 570 template(`userdom_common_user_template',`
 571         gen_require(`
 572                 attribute unpriv_userdomain;
 573         ')
 574
 575         userdom_basic_networking($1_usertype)
 576
 577         ##############################
 578         #
 579         # User domain Local policy
 580         #
 581
 582         # evolution and gnome-session try to create a netlink socket
 583         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 584         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 585         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 586         allow $1_t self:socket create_socket_perms;
 587
 588         allow $1_usertype unpriv_userdomain:fd use;
 589
 590         kernel_read_system_state($1_usertype)
 591         kernel_read_network_state($1_usertype)
 592         kernel_read_software_raid_state($1_usertype)
 593         kernel_read_net_sysctls($1_usertype)
 594         # Very permissive allowing every domain to see every type:
 595         kernel_get_sysvipc_info($1_usertype)
 596         # Find CDROM devices:
 597         kernel_read_device_sysctls($1_usertype)
 598         kernel_request_load_module($1_usertype)
 599
 600         corenet_udp_bind_generic_node($1_usertype)
 601         corenet_udp_bind_generic_port($1_usertype)
 602
 603         dev_read_rand($1_usertype)
 604         dev_write_sound($1_usertype)
 605         dev_read_sound($1_usertype)
 606         dev_read_sound_mixer($1_usertype)
 607         dev_write_sound_mixer($1_usertype)
 608
 609         files_exec_etc_files($1_usertype)
 610         files_search_locks($1_usertype)
 611         # Check to see if cdrom is mounted
 612         files_search_mnt($1_usertype)
 613         # cjp: perhaps should cut back on file reads:
 614         files_read_var_files($1_usertype)
 615         files_read_var_symlinks($1_usertype)
 616         files_read_generic_spool($1_usertype)
 617         files_read_var_lib_files($1_usertype)
 618         # Stat lost+found.
 619         files_getattr_lost_found_dirs($1_usertype)
 620         files_read_config_files($1_usertype)
 621         fs_read_noxattr_fs_files($1_usertype)
 622         fs_read_noxattr_fs_symlinks($1_usertype)
 623         fs_rw_cgroup_files($1_usertype)
 624
 625         application_getattr_socket($1_usertype)
 626
 627         logging_send_syslog_msg($1_usertype)
 628         logging_send_audit_msgs($1_usertype)
 629         selinux_get_enforce_mode($1_usertype)
 630
 631         # cjp: some of this probably can be removed
 632         selinux_get_fs_mount($1_usertype)
 633         selinux_validate_context($1_usertype)
 634         selinux_compute_access_vector($1_usertype)
 635         selinux_compute_create_context($1_usertype)
 636         selinux_compute_relabel_context($1_usertype)
 637         selinux_compute_user_contexts($1_usertype)
 638
 639         # for eject
 640         storage_getattr_fixed_disk_dev($1_usertype)
 641
 642         auth_read_login_records($1_usertype)
 643         auth_run_pam($1_t,$1_r)
 644         auth_run_utempter($1_t,$1_r)
 645
 646         init_read_utmp($1_usertype)
 647
 648         seutil_read_file_contexts($1_usertype)
 649         seutil_read_default_contexts($1_usertype)
 650         seutil_run_newrole($1_t,$1_r)
 651         seutil_exec_checkpolicy($1_t)
 652         seutil_exec_setfiles($1_usertype)
 653         # for when the network connection is killed
 654         # this is needed when a login role can change
 655         # to this one.
 656         seutil_dontaudit_signal_newrole($1_t)
 657
 658         tunable_policy(`user_direct_mouse',`
 659                 dev_read_mouse($1_usertype)
 660         ')
 661
 662         tunable_policy(`user_ttyfile_stat',`
 663                 term_getattr_all_ttys($1_t)
 664         ')
 665
 666         optional_policy(`
 667                 alsa_read_rw_config($1_usertype)
 668                 alsa_manage_home_files($1_t)
 669                 alsa_relabel_home_files($1_t)
 670         ')
 671
 672         optional_policy(`
 673                 # Allow graphical boot to check battery lifespan
 674                 apm_stream_connect($1_usertype)
 675         ')
 676
 677         optional_policy(`
 678                 canna_stream_connect($1_usertype)
 679         ')
 680
 681         optional_policy(`
 682                 chrome_role($1_r, $1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 colord_read_lib_files($1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 dbus_system_bus_client($1_usertype)
 691
 692                 allow $1_usertype $1_usertype:dbus  send_msg;
 693
 694                 optional_policy(`
 695                         avahi_dbus_chat($1_usertype)
 696                 ')
 697
 698                 optional_policy(`
 699                         policykit_dbus_chat($1_usertype)
 700                 ')
 701
 702                 optional_policy(`
 703                         bluetooth_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         consolekit_dbus_chat($1_usertype)
 708                         consolekit_read_log($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         devicekit_dbus_chat($1_usertype)
 713                         devicekit_dbus_chat_power($1_usertype)
 714                         devicekit_dbus_chat_disk($1_usertype)
 715                 ')
 716
 717                 optional_policy(`
 718                         evolution_dbus_chat($1_usertype)
 719                         evolution_alarm_dbus_chat($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 nsplugin_role($1_r, $1_usertype)
 784         ')
 785
 786         optional_policy(`
 787                 tunable_policy(`allow_user_mysql_connect',`
 788                         mysql_stream_connect($1_t)
 789                 ')
 790         ')
 791
 792         optional_policy(`
 793                 oident_manage_user_content($1_t)
 794                 oident_relabel_user_content($1_t)
 795         ')
 796
 797         optional_policy(`
 798                 # to allow monitoring of pcmcia status
 799                 pcmcia_read_pid($1_usertype)
 800         ')
 801
 802         optional_policy(`
 803                 pcscd_read_pub_files($1_usertype)
 804                 pcscd_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 tunable_policy(`allow_user_postgresql_connect',`
 809                         postgresql_stream_connect($1_usertype)
 810                         postgresql_tcp_connect($1_usertype)
 811                 ')
 812         ')
 813
 814         optional_policy(`
 815                 resmgr_stream_connect($1_usertype)
 816         ')
 817
 818         optional_policy(`
 819                 rpc_dontaudit_getattr_exports($1_usertype)
 820                 rpc_manage_nfs_rw_content($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 rpcbind_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 samba_stream_connect_winbind($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 sandbox_transition($1_usertype, $1_r)
 833         ')
 834
 835         optional_policy(`
 836                 seunshare_role_template($1, $1_r, $1_t)
 837         ')
 838
 839         optional_policy(`
 840                 slrnpull_search_spool($1_usertype)
 841         ')
 842
 843 ')
 844
 845 #######################################
 846 ## <summary>
 847 ##      The template for creating a login user.
 848 ## </summary>
 849 ## <desc>
 850 ##      <p>
 851 ##      This template creates a user domain, types, and
 852 ##      rules for the user's tty, pty, home directories,
 853 ##      tmp, and tmpfs files.
 854 ##      </p>
 855 ## </desc>
 856 ## <param name="userdomain_prefix">
 857 ##      <summary>
 858 ##      The prefix of the user domain (e.g., user
 859 ##      is the prefix for user_t).
 860 ##      </summary>
 861 ## </param>
 862 #
 863 template(`userdom_login_user_template', `
 864         gen_require(`
 865                 class context contains;
 866         ')
 867
 868         userdom_base_user_template($1)
 869
 870         userdom_manage_home_role($1_r, $1_usertype)
 871
 872         userdom_manage_tmp_role($1_r, $1_usertype)
 873         userdom_manage_tmpfs_role($1_r, $1_usertype)
 874
 875         ifelse(`$1',`unconfined',`',`
 876                 gen_tunable(allow_$1_exec_content, true)
 877
 878                 tunable_policy(`allow_$1_exec_content',`
 879                         userdom_exec_user_tmp_files($1_usertype)
 880                         userdom_exec_user_home_content_files($1_usertype)
 881                 ')
 882                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 883                         fs_exec_nfs_files($1_usertype)
 884                 ')
 885
 886                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 887                         fs_exec_cifs_files($1_usertype)
 888                 ')
 889         ')
 890
 891         userdom_change_password_template($1)
 892
 893         ##############################
 894         #
 895         # User domain Local policy
 896         #
 897
 898         allow $1_t self:capability { setgid chown fowner };
 899         dontaudit $1_t self:capability { sys_nice fsetid };
 900
 901         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 902         dontaudit $1_t self:process setrlimit;
 903         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 904
 905         allow $1_t self:context contains;
 906
 907         kernel_dontaudit_read_system_state($1_usertype)
 908         kernel_dontaudit_list_all_proc($1_usertype)
 909
 910         dev_read_sysfs($1_usertype)
 911         dev_read_urand($1_usertype)
 912
 913         domain_use_interactive_fds($1_usertype)
 914         # Command completion can fire hundreds of denials
 915         domain_dontaudit_exec_all_entry_files($1_usertype)
 916
 917         files_dontaudit_list_default($1_usertype)
 918         files_dontaudit_read_default_files($1_usertype)
 919         # Stat lost+found.
 920         files_getattr_lost_found_dirs($1_usertype)
 921
 922         fs_get_all_fs_quotas($1_usertype)
 923         fs_getattr_all_fs($1_usertype)
 924         fs_search_all($1_usertype)
 925         fs_list_inotifyfs($1_usertype)
 926         fs_rw_anon_inodefs_files($1_usertype)
 927
 928         auth_dontaudit_write_login_records($1_t)
 929         auth_rw_cache($1_t)
 930
 931         # Stop warnings about access to /dev/console
 932         init_dontaudit_use_fds($1_usertype)
 933         init_dontaudit_use_script_fds($1_usertype)
 934
 935         libs_exec_lib_files($1_usertype)
 936
 937         logging_dontaudit_getattr_all_logs($1_usertype)
 938
 939         # for running TeX programs
 940         miscfiles_read_tetex_data($1_usertype)
 941         miscfiles_exec_tetex_data($1_usertype)
 942
 943         seutil_read_config($1_usertype)
 944
 945         optional_policy(`
 946                 cups_read_config($1_usertype)
 947                 cups_stream_connect($1_usertype)
 948                 cups_stream_connect_ptal($1_usertype)
 949         ')
 950
 951         optional_policy(`
 952                 kerberos_use($1_usertype)
 953                 kerberos_filetrans_home_content($1_usertype)
 954         ')
 955
 956         optional_policy(`
 957                 mta_dontaudit_read_spool_symlinks($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 quota_dontaudit_getattr_db($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 rpm_read_db($1_usertype)
 966                 rpm_dontaudit_manage_db($1_usertype)
 967                 rpm_read_cache($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 oddjob_run_mkhomedir($1_t, $1_r)
 972         ')
 973 ')
 974
 975 #######################################
 976 ## <summary>
 977 ##      The template for creating a unprivileged login user.
 978 ## </summary>
 979 ## <desc>
 980 ##      <p>
 981 ##      This template creates a user domain, types, and
 982 ##      rules for the user's tty, pty, home directories,
 983 ##      tmp, and tmpfs files.
 984 ##      </p>
 985 ## </desc>
 986 ## <param name="userdomain_prefix">
 987 ##      <summary>
 988 ##      The prefix of the user domain (e.g., user
 989 ##      is the prefix for user_t).
 990 ##      </summary>
 991 ## </param>
 992 #
 993 template(`userdom_restricted_user_template',`
 994         gen_require(`
 995                 attribute unpriv_userdomain;
 996         ')
 997
 998         userdom_login_user_template($1)
 999
1000         typeattribute $1_t unpriv_userdomain;
1001         domain_interactive_fd($1_t)
1002
1003         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1004         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1005
1006         ##############################
1007         #
1008         # Local policy
1009         #
1010
1011         optional_policy(`
1012                 loadkeys_run($1_t,$1_r)
1013         ')
1014 ')
1015
1016 #######################################
1017 ## <summary>
1018 ##      The template for creating a unprivileged xwindows login user.
1019 ## </summary>
1020 ## <desc>
1021 ##      <p>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ##      </p>
1024 ##      <p>
1025 ##      This template creates a user domain, types, and
1026 ##      rules for the user's tty, pty, home directories,
1027 ##      tmp, and tmpfs files.
1028 ##      </p>
1029 ## </desc>
1030 ## <param name="userdomain_prefix">
1031 ##      <summary>
1032 ##      The prefix of the user domain (e.g., user
1033 ##      is the prefix for user_t).
1034 ##      </summary>
1035 ## </param>
1036 #
1037 template(`userdom_restricted_xwindows_user_template',`
1038
1039         userdom_restricted_user_template($1)
1040
1041         ##############################
1042         #
1043         # Local policy
1044         #
1045
1046         auth_role($1_r, $1_t)
1047         auth_search_pam_console_data($1_usertype)
1048         auth_dontaudit_read_login_records($1_usertype)
1049
1050         dev_read_sound($1_usertype)
1051         dev_write_sound($1_usertype)
1052         # gnome keyring wants to read this.
1053         dev_dontaudit_read_rand($1_usertype)
1054         # temporarily allow since openoffice requires this
1055         dev_read_rand($1_usertype)
1056
1057         dev_read_video_dev($1_usertype)
1058         dev_write_video_dev($1_usertype)
1059         dev_rw_wireless($1_usertype)
1060
1061         libs_dontaudit_setattr_lib_files($1_usertype)
1062
1063         tunable_policy(`user_rw_noexattrfile',`
1064                 dev_rw_usbfs($1_t)
1065                 dev_rw_generic_usb_dev($1_usertype)
1066
1067                 fs_manage_noxattr_fs_files($1_usertype)
1068                 fs_manage_noxattr_fs_dirs($1_usertype)
1069                 fs_manage_dos_dirs($1_usertype)
1070                 fs_manage_dos_files($1_usertype)
1071                 storage_raw_read_removable_device($1_usertype)
1072                 storage_raw_write_removable_device($1_usertype)
1073         ')
1074
1075         logging_send_syslog_msg($1_usertype)
1076         logging_dontaudit_send_audit_msgs($1_t)
1077
1078         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1079         logging_send_audit_msgs($1_t)
1080         selinux_get_enforce_mode($1_t)
1081         seutil_exec_restorecond($1_t)
1082         seutil_read_file_contexts($1_t)
1083         seutil_read_default_contexts($1_t)
1084
1085         xserver_restricted_role($1_r, $1_t)
1086
1087         optional_policy(`
1088                 alsa_read_rw_config($1_usertype)
1089         ')
1090
1091          # cjp: needed by KDE apps
1092          # bug: #682499
1093          optional_policy(`
1094                 gnome_read_usr_config($1_usertype)
1095                 gnome_role_gkeyringd($1, $1_r, $1_t)
1096                 # cjp: telepathy F15 bugs
1097                 telepathy_dbus_session_role($1_r, $1_t, $1)
1098         ')
1099
1100         optional_policy(`
1101                 dbus_role_template($1, $1_r, $1_usertype)
1102                 dbus_system_bus_client($1_usertype)
1103                 allow $1_usertype $1_usertype:dbus send_msg;
1104
1105                 optional_policy(`
1106                         abrt_dbus_chat($1_usertype)
1107                         abrt_run_helper($1_usertype, $1_r)
1108                 ')
1109
1110                 optional_policy(`
1111                         consolekit_dontaudit_read_log($1_usertype)
1112                         consolekit_dbus_chat($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         cups_dbus_chat($1_usertype)
1117                         cups_dbus_chat_config($1_usertype)
1118                 ')
1119
1120                 optional_policy(`
1121                         devicekit_dbus_chat($1_usertype)
1122                         devicekit_dbus_chat_disk($1_usertype)
1123                         devicekit_dbus_chat_power($1_usertype)
1124                 ')
1125
1126                 optional_policy(`
1127                         fprintd_dbus_chat($1_t)
1128                 ')
1129         ')
1130
1131         optional_policy(`
1132                 openoffice_role_template($1, $1_r, $1_usertype)
1133         ')
1134
1135         optional_policy(`
1136                 policykit_role($1_r, $1_usertype)
1137         ')
1138
1139         optional_policy(`
1140                 pulseaudio_role($1_r, $1_usertype)
1141                 pulseaudio_filetrans_admin_home_content($1_usertype)
1142                 pulseaudio_filetrans_home_content($1_usertype)
1143         ')
1144
1145         optional_policy(`
1146                 rtkit_scheduled($1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 setroubleshoot_dontaudit_stream_connect($1_t)
1151         ')
1152
1153         optional_policy(`
1154                 udev_read_db($1_usertype)
1155         ')
1156
1157         optional_policy(`
1158                 wm_role_template($1, $1_r, $1_t)
1159         ')
1160 ')
1161
1162 #######################################
1163 ## <summary>
1164 ##      The template for creating a unprivileged user roughly
1165 ##      equivalent to a regular linux user.
1166 ## </summary>
1167 ## <desc>
1168 ##      <p>
1169 ##      The template for creating a unprivileged user roughly
1170 ##      equivalent to a regular linux user.
1171 ##      </p>
1172 ##      <p>
1173 ##      This template creates a user domain, types, and
1174 ##      rules for the user's tty, pty, home directories,
1175 ##      tmp, and tmpfs files.
1176 ##      </p>
1177 ## </desc>
1178 ## <param name="userdomain_prefix">
1179 ##      <summary>
1180 ##      The prefix of the user domain (e.g., user
1181 ##      is the prefix for user_t).
1182 ##      </summary>
1183 ## </param>
1184 #
1185 template(`userdom_unpriv_user_template', `
1186
1187         ##############################
1188         #
1189         # Declarations
1190         #
1191
1192         # Inherit rules for ordinary users.
1193         userdom_restricted_xwindows_user_template($1)
1194         userdom_common_user_template($1)
1195
1196         ##############################
1197         #
1198         # Local policy
1199         #
1200
1201         # port access is audited even if dac would not have allowed it, so dontaudit it here
1202 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1203         # Need the following rule to allow users to run vpnc
1204         corenet_tcp_bind_xserver_port($1_t)
1205         corenet_tcp_bind_generic_node($1_usertype)
1206
1207         storage_rw_fuse($1_t)
1208
1209         miscfiles_read_hwdata($1_usertype)
1210
1211         # Allow users to run TCP servers (bind to ports and accept connection from
1212         # the same domain and outside users) disabling this forces FTP passive mode
1213         # and may change other protocols
1214
1215         tunable_policy(`user_share_music',`
1216                 corenet_tcp_bind_daap_port($1_usertype)
1217         ')
1218
1219         tunable_policy(`user_tcp_server',`
1220                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1221         ')
1222
1223         tunable_policy(`user_setrlimit',`
1224                 allow $1_usertype self:process setrlimit;
1225         ')
1226
1227         optional_policy(`
1228                 cdrecord_role($1_r, $1_t)
1229         ')
1230
1231         optional_policy(`
1232                 cron_role($1_r, $1_t)
1233         ')
1234
1235         optional_policy(`
1236                 games_rw_data($1_usertype)
1237         ')
1238
1239         optional_policy(`
1240                 gpg_role($1_r, $1_usertype)
1241         ')
1242
1243         optional_policy(`
1244                 gnomeclock_dbus_chat($1_t)
1245         ')
1246
1247         optional_policy(`
1248                 gpm_stream_connect($1_usertype)
1249         ')
1250
1251         optional_policy(`
1252                 execmem_role_template($1, $1_r, $1_t)
1253         ')
1254
1255         optional_policy(`
1256                 java_role_template($1, $1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 mono_role_template($1, $1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 mount_run_fusermount($1_t, $1_r)
1265                 mount_read_pid_files($1_t)
1266         ')
1267
1268         optional_policy(`
1269                 wine_role_template($1, $1_r, $1_t)
1270         ')
1271
1272         optional_policy(`
1273                 postfix_run_postdrop($1_t, $1_r)
1274         ')
1275
1276         # Run pppd in pppd_t by default for user
1277         optional_policy(`
1278                 ppp_run_cond($1_t, $1_r)
1279         ')
1280 ')
1281
1282 #######################################
1283 ## <summary>
1284 ##      The template for creating an administrative user.
1285 ## </summary>
1286 ## <desc>
1287 ##      <p>
1288 ##      This template creates a user domain, types, and
1289 ##      rules for the user's tty, pty, home directories,
1290 ##      tmp, and tmpfs files.
1291 ##      </p>
1292 ##      <p>
1293 ##      The privileges given to administrative users are:
1294 ##      <ul>
1295 ##              <li>Raw disk access</li>
1296 ##              <li>Set all sysctls</li>
1297 ##              <li>All kernel ring buffer controls</li>
1298 ##              <li>Create, read, write, and delete all files but shadow</li>
1299 ##              <li>Manage source and binary format SELinux policy</li>
1300 ##              <li>Run insmod</li>
1301 ##      </ul>
1302 ##      </p>
1303 ## </desc>
1304 ## <param name="userdomain_prefix">
1305 ##      <summary>
1306 ##      The prefix of the user domain (e.g., sysadm
1307 ##      is the prefix for sysadm_t).
1308 ##      </summary>
1309 ## </param>
1310 #
1311 template(`userdom_admin_user_template',`
1312         gen_require(`
1313                 attribute admindomain;
1314                 class passwd { passwd chfn chsh rootok crontab };
1315         ')
1316
1317         ##############################
1318         #
1319         # Declarations
1320         #
1321
1322         # Inherit rules for ordinary users.
1323         userdom_login_user_template($1)
1324         userdom_common_user_template($1)
1325
1326         domain_obj_id_change_exemption($1_t)
1327         role system_r types $1_t;
1328
1329         typeattribute $1_t admindomain;
1330
1331         ifdef(`direct_sysadm_daemon',`
1332                 domain_system_change_exemption($1_t)
1333         ')
1334
1335         ##############################
1336         #
1337         # $1_t local policy
1338         #
1339
1340         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1341         allow $1_t self:capability2 syslog;
1342         allow $1_t self:process { setexec setfscreate };
1343         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1344         allow $1_t self:tun_socket create;
1345         # Set password information for other users.
1346         allow $1_t self:passwd { passwd chfn chsh };
1347         # Skip authentication when pam_rootok is specified.
1348         allow $1_t self:passwd rootok;
1349
1350         # Manipulate other users crontab.
1351         allow $1_t self:passwd crontab;
1352
1353         kernel_read_software_raid_state($1_t)
1354         kernel_getattr_core_if($1_t)
1355         kernel_getattr_message_if($1_t)
1356         kernel_change_ring_buffer_level($1_t)
1357         kernel_clear_ring_buffer($1_t)
1358         kernel_read_ring_buffer($1_t)
1359         kernel_get_sysvipc_info($1_t)
1360         kernel_rw_all_sysctls($1_t)
1361         # signal unlabeled processes:
1362         kernel_kill_unlabeled($1_t)
1363         kernel_signal_unlabeled($1_t)
1364         kernel_sigstop_unlabeled($1_t)
1365         kernel_signull_unlabeled($1_t)
1366         kernel_sigchld_unlabeled($1_t)
1367         kernel_signal($1_t)
1368
1369         corenet_tcp_bind_generic_port($1_t)
1370         # allow setting up tunnels
1371         corenet_rw_tun_tap_dev($1_t)
1372
1373         dev_getattr_generic_blk_files($1_t)
1374         dev_getattr_generic_chr_files($1_t)
1375         # for lsof
1376         dev_getattr_mtrr_dev($1_t)
1377         # Allow MAKEDEV to work
1378         dev_create_all_blk_files($1_t)
1379         dev_create_all_chr_files($1_t)
1380         dev_delete_all_blk_files($1_t)
1381         dev_delete_all_chr_files($1_t)
1382         dev_rename_all_blk_files($1_t)
1383         dev_rename_all_chr_files($1_t)
1384         dev_create_generic_symlinks($1_t)
1385         dev_rw_generic_usb_dev($1_t)
1386         dev_rw_usbfs($1_t)
1387
1388         domain_setpriority_all_domains($1_t)
1389         domain_read_all_domains_state($1_t)
1390         domain_getattr_all_domains($1_t)
1391         domain_getcap_all_domains($1_t)
1392         domain_dontaudit_ptrace_all_domains($1_t)
1393         # signal all domains:
1394         domain_kill_all_domains($1_t)
1395         domain_signal_all_domains($1_t)
1396         domain_signull_all_domains($1_t)
1397         domain_sigstop_all_domains($1_t)
1398         domain_sigstop_all_domains($1_t)
1399         domain_sigchld_all_domains($1_t)
1400         # for lsof
1401         domain_getattr_all_sockets($1_t)
1402         domain_dontaudit_getattr_all_sockets($1_t)
1403
1404         files_exec_usr_src_files($1_t)
1405
1406         fs_getattr_all_fs($1_t)
1407         fs_getattr_all_files($1_t)
1408         fs_list_all($1_t)
1409         fs_set_all_quotas($1_t)
1410         fs_exec_noxattr($1_t)
1411
1412         storage_raw_read_removable_device($1_t)
1413         storage_raw_write_removable_device($1_t)
1414         storage_dontaudit_read_fixed_disk($1_t)
1415
1416         term_use_all_inherited_terms($1_t)
1417         term_use_unallocated_ttys($1_t)
1418
1419         auth_getattr_shadow($1_t)
1420         # Manage almost all files
1421         auth_manage_all_files_except_shadow($1_t)
1422         # Relabel almost all files
1423         auth_relabel_all_files_except_shadow($1_t)
1424
1425         init_telinit($1_t)
1426
1427         logging_send_syslog_msg($1_t)
1428
1429         optional_policy(`
1430                 modutils_domtrans_insmod($1_t)
1431                 modutils_domtrans_depmod($1_t)
1432         ')
1433
1434         # The following rule is temporary until such time that a complete
1435         # policy management infrastructure is in place so that an administrator
1436         # cannot directly manipulate policy files with arbitrary programs.
1437         seutil_manage_src_policy($1_t)
1438         # Violates the goal of limiting write access to checkpolicy.
1439         # But presently necessary for installing the file_contexts file.
1440         seutil_manage_bin_policy($1_t)
1441
1442         userdom_manage_user_home_content_dirs($1_t)
1443         userdom_manage_user_home_content_files($1_t)
1444         userdom_manage_user_home_content_symlinks($1_t)
1445         userdom_manage_user_home_content_pipes($1_t)
1446         userdom_manage_user_home_content_sockets($1_t)
1447         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1448
1449         tunable_policy(`user_rw_noexattrfile',`
1450                 fs_manage_noxattr_fs_files($1_t)
1451                 fs_manage_noxattr_fs_dirs($1_t)
1452         ',`
1453                 fs_read_noxattr_fs_files($1_t)
1454         ')
1455
1456         optional_policy(`
1457                 postgresql_unconfined($1_t)
1458         ')
1459
1460         optional_policy(`
1461                 userhelper_exec($1_t)
1462         ')
1463 ')
1464
1465 ########################################
1466 ## <summary>
1467 ##      Allow user to run as a secadm
1468 ## </summary>
1469 ## <desc>
1470 ##      <p>
1471 ##      Create objects in a user home directory
1472 ##      with an automatic type transition to
1473 ##      a specified private type.
1474 ##      </p>
1475 ##      <p>
1476 ##      This is a templated interface, and should only
1477 ##      be called from a per-userdomain template.
1478 ##      </p>
1479 ## </desc>
1480 ## <param name="domain">
1481 ##      <summary>
1482 ##      Domain allowed access.
1483 ##      </summary>
1484 ## </param>
1485 ## <param name="role">
1486 ##      <summary>
1487 ##      The role  of the object to create.
1488 ##      </summary>
1489 ## </param>
1490 #
1491 template(`userdom_security_admin_template',`
1492         allow $1 self:capability { dac_read_search dac_override };
1493
1494         corecmd_exec_shell($1)
1495
1496         domain_obj_id_change_exemption($1)
1497
1498         dev_relabel_all_dev_nodes($1)
1499
1500         files_create_boot_flag($1)
1501         files_create_default_dir($1)
1502         files_root_filetrans_default($1, dir)
1503
1504         # Necessary for managing /boot/efi
1505         fs_manage_dos_files($1)
1506
1507         mls_process_read_up($1)
1508         mls_file_read_all_levels($1)
1509         mls_file_upgrade($1)
1510         mls_file_downgrade($1)
1511
1512         selinux_set_enforce_mode($1)
1513         selinux_set_all_booleans($1)
1514         selinux_set_parameters($1)
1515         selinux_read_policy($1)
1516
1517         auth_relabel_all_files_except_shadow($1)
1518         auth_relabel_shadow($1)
1519
1520         init_exec($1)
1521
1522         logging_send_syslog_msg($1)
1523         logging_read_audit_log($1)
1524         logging_read_generic_logs($1)
1525         logging_read_audit_config($1)
1526
1527         seutil_manage_bin_policy($1)
1528         seutil_manage_default_contexts($1)
1529         seutil_manage_file_contexts($1)
1530         seutil_manage_module_store($1)
1531         seutil_manage_config($1)
1532         seutil_run_checkpolicy($1,$2)
1533         seutil_run_loadpolicy($1,$2)
1534         seutil_run_semanage($1,$2)
1535         seutil_run_setsebool($1,$2)
1536         seutil_run_setfiles($1, $2)
1537
1538         seutil_manage_bin_policy($1)
1539     seutil_manage_default_contexts($1)
1540     seutil_manage_file_contexts($1)
1541     seutil_manage_module_store($1)
1542     seutil_manage_config($1)
1543
1544         optional_policy(`
1545                 aide_run($1,$2)
1546         ')
1547
1548         optional_policy(`
1549                 consoletype_exec($1)
1550         ')
1551
1552         optional_policy(`
1553                 dmesg_exec($1)
1554         ')
1555
1556         optional_policy(`
1557                 ipsec_run_setkey($1,$2)
1558         ')
1559
1560         optional_policy(`
1561                 netlabel_run_mgmt($1,$2)
1562         ')
1563
1564         optional_policy(`
1565                 samhain_run($1, $2)
1566         ')
1567 ')
1568
1569 ########################################
1570 ## <summary>
1571 ##      Make the specified type usable in a
1572 ##      user home directory.
1573 ## </summary>
1574 ## <param name="type">
1575 ##      <summary>
1576 ##      Type to be used as a file in the
1577 ##      user home directory.
1578 ##      </summary>
1579 ## </param>
1580 #
1581 interface(`userdom_user_home_content',`
1582         gen_require(`
1583                 type user_home_t;
1584                 attribute user_home_type;
1585         ')
1586
1587         allow $1 user_home_t:filesystem associate;
1588         files_type($1)
1589         ubac_constrained($1)
1590
1591         files_poly_member($1)
1592         typeattribute $1  user_home_type;
1593 ')
1594
1595 ########################################
1596 ## <summary>
1597 ##      Make the specified type usable in a
1598 ##      generic temporary directory.
1599 ## </summary>
1600 ## <param name="type">
1601 ##      <summary>
1602 ##      Type to be used as a file in the
1603 ##      generic temporary directory.
1604 ##      </summary>
1605 ## </param>
1606 #
1607 interface(`userdom_user_tmp_content',`
1608         gen_require(`
1609                 attribute user_tmp_type;
1610         ')
1611
1612         typeattribute $1 user_tmp_type;
1613
1614         files_tmp_file($1)
1615         ubac_constrained($1)
1616 ')
1617
1618 ########################################
1619 ## <summary>
1620 ##      Make the specified type usable in a
1621 ##      generic tmpfs_t directory.
1622 ## </summary>
1623 ## <param name="type">
1624 ##      <summary>
1625 ##      Type to be used as a file in the
1626 ##      generic temporary directory.
1627 ##      </summary>
1628 ## </param>
1629 #
1630 interface(`userdom_user_tmpfs_content',`
1631         gen_require(`
1632                 attribute user_tmpfs_type;
1633         ')
1634
1635         typeattribute $1 user_tmpfs_type;
1636
1637         files_tmpfs_file($1)
1638         ubac_constrained($1)
1639 ')
1640
1641 ########################################
1642 ## <summary>
1643 ##      Allow domain to attach to TUN devices created by administrative users.
1644 ## </summary>
1645 ## <param name="domain">
1646 ##      <summary>
1647 ##      Domain allowed access.
1648 ##      </summary>
1649 ## </param>
1650 #
1651 interface(`userdom_attach_admin_tun_iface',`
1652         gen_require(`
1653                 attribute admindomain;
1654         ')
1655
1656         allow $1 admindomain:tun_socket relabelfrom;
1657         allow $1 self:tun_socket relabelto;
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Set the attributes of a user pty.
1663 ## </summary>
1664 ## <param name="domain">
1665 ##      <summary>
1666 ##      Domain allowed access.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_setattr_user_ptys',`
1671         gen_require(`
1672                 type user_devpts_t;
1673         ')
1674
1675         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1676 ')
1677
1678 ########################################
1679 ## <summary>
1680 ##      Create a user pty.
1681 ## </summary>
1682 ## <param name="domain">
1683 ##      <summary>
1684 ##      Domain allowed access.
1685 ##      </summary>
1686 ## </param>
1687 #
1688 interface(`userdom_create_user_pty',`
1689         gen_require(`
1690                 type user_devpts_t;
1691         ')
1692
1693         term_create_pty($1, user_devpts_t)
1694 ')
1695
1696 ########################################
1697 ## <summary>
1698 ##      Get the attributes of user home directories.
1699 ## </summary>
1700 ## <param name="domain">
1701 ##      <summary>
1702 ##      Domain allowed access.
1703 ##      </summary>
1704 ## </param>
1705 #
1706 interface(`userdom_getattr_user_home_dirs',`
1707         gen_require(`
1708                 type user_home_dir_t;
1709         ')
1710
1711         allow $1 user_home_dir_t:dir getattr_dir_perms;
1712         files_search_home($1)
1713 ')
1714
1715 ########################################
1716 ## <summary>
1717 ##      Do not audit attempts to get the attributes of user home directories.
1718 ## </summary>
1719 ## <param name="domain">
1720 ##      <summary>
1721 ##      Domain to not audit.
1722 ##      </summary>
1723 ## </param>
1724 #
1725 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1726         gen_require(`
1727                 type user_home_dir_t;
1728         ')
1729
1730         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1731 ')
1732
1733 ########################################
1734 ## <summary>
1735 ##      Search user home directories.
1736 ## </summary>
1737 ## <param name="domain">
1738 ##      <summary>
1739 ##      Domain allowed access.
1740 ##      </summary>
1741 ## </param>
1742 #
1743 interface(`userdom_search_user_home_dirs',`
1744         gen_require(`
1745                 type user_home_dir_t;
1746         ')
1747
1748         allow $1 user_home_dir_t:dir search_dir_perms;
1749         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1750         files_search_home($1)
1751 ')
1752
1753 ########################################
1754 ## <summary>
1755 ##      Do not audit attempts to search user home directories.
1756 ## </summary>
1757 ## <desc>
1758 ##      <p>
1759 ##      Do not audit attempts to search user home directories.
1760 ##      This will supress SELinux denial messages when the specified
1761 ##      domain is denied the permission to search these directories.
1762 ##      </p>
1763 ## </desc>
1764 ## <param name="domain">
1765 ##      <summary>
1766 ##      Domain to not audit.
1767 ##      </summary>
1768 ## </param>
1769 ## <infoflow type="none"/>
1770 #
1771 interface(`userdom_dontaudit_search_user_home_dirs',`
1772         gen_require(`
1773                 type user_home_dir_t;
1774         ')
1775
1776         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1777 ')
1778
1779 ########################################
1780 ## <summary>
1781 ##      List user home directories.
1782 ## </summary>
1783 ## <param name="domain">
1784 ##      <summary>
1785 ##      Domain allowed access.
1786 ##      </summary>
1787 ## </param>
1788 #
1789 interface(`userdom_list_user_home_dirs',`
1790         gen_require(`
1791                 type user_home_dir_t;
1792         ')
1793
1794         allow $1 user_home_dir_t:dir list_dir_perms;
1795         files_search_home($1)
1796
1797         tunable_policy(`use_nfs_home_dirs',`
1798                 fs_list_nfs($1)
1799         ')
1800
1801         tunable_policy(`use_samba_home_dirs',`
1802                 fs_list_cifs($1)
1803         ')
1804 ')
1805
1806 ########################################
1807 ## <summary>
1808 ##      Do not audit attempts to list user home subdirectories.
1809 ## </summary>
1810 ## <param name="domain">
1811 ##      <summary>
1812 ##      Domain to not audit.
1813 ##      </summary>
1814 ## </param>
1815 #
1816 interface(`userdom_dontaudit_list_user_home_dirs',`
1817         gen_require(`
1818                 type user_home_dir_t;
1819                 type user_home_t;
1820         ')
1821
1822         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1823         dontaudit $1 user_home_t:dir list_dir_perms;
1824 ')
1825
1826 ########################################
1827 ## <summary>
1828 ##      Create user home directories.
1829 ## </summary>
1830 ## <param name="domain">
1831 ##      <summary>
1832 ##      Domain allowed access.
1833 ##      </summary>
1834 ## </param>
1835 #
1836 interface(`userdom_create_user_home_dirs',`
1837         gen_require(`
1838                 type user_home_dir_t;
1839         ')
1840
1841         allow $1 user_home_dir_t:dir create_dir_perms;
1842 ')
1843
1844 ########################################
1845 ## <summary>
1846 ##      Create user home directories.
1847 ## </summary>
1848 ## <param name="domain">
1849 ##      <summary>
1850 ##      Domain allowed access.
1851 ##      </summary>
1852 ## </param>
1853 #
1854 interface(`userdom_manage_user_home_dirs',`
1855         gen_require(`
1856                 type user_home_dir_t;
1857         ')
1858
1859         allow $1 user_home_dir_t:dir manage_dir_perms;
1860 ')
1861
1862 ########################################
1863 ## <summary>
1864 ##      Relabel to user home directories.
1865 ## </summary>
1866 ## <param name="domain">
1867 ##      <summary>
1868 ##      Domain allowed access.
1869 ##      </summary>
1870 ## </param>
1871 #
1872 interface(`userdom_relabelto_user_home_dirs',`
1873         gen_require(`
1874                 type user_home_dir_t;
1875         ')
1876
1877         allow $1 user_home_dir_t:dir relabelto;
1878 ')
1879
1880
1881 ########################################
1882 ## <summary>
1883 ##      Relabel to user home files.
1884 ## </summary>
1885 ## <param name="domain">
1886 ##      <summary>
1887 ##      Domain allowed access.
1888 ##      </summary>
1889 ## </param>
1890 #
1891 interface(`userdom_relabelto_user_home_files',`
1892         gen_require(`
1893                 type user_home_t;
1894         ')
1895
1896         allow $1 user_home_t:file relabelto;
1897 ')
1898 ########################################
1899 ## <summary>
1900 ##      Relabel user home files.
1901 ## </summary>
1902 ## <param name="domain">
1903 ##      <summary>
1904 ##      Domain allowed access.
1905 ##      </summary>
1906 ## </param>
1907 #
1908 interface(`userdom_relabel_user_home_files',`
1909         gen_require(`
1910                 type user_home_t;
1911         ')
1912
1913         allow $1 user_home_t:file relabel_file_perms;
1914 ')
1915
1916 ########################################
1917 ## <summary>
1918 ##      Create directories in the home dir root with
1919 ##      the user home directory type.
1920 ## </summary>
1921 ## <param name="domain">
1922 ##      <summary>
1923 ##      Domain allowed access.
1924 ##      </summary>
1925 ## </param>
1926 #
1927 interface(`userdom_home_filetrans_user_home_dir',`
1928         gen_require(`
1929                 type user_home_dir_t;
1930         ')
1931
1932         files_home_filetrans($1, user_home_dir_t, dir)
1933 ')
1934
1935 ########################################
1936 ## <summary>
1937 ##      Do a domain transition to the specified
1938 ##      domain when executing a program in the
1939 ##      user home directory.
1940 ## </summary>
1941 ## <desc>
1942 ##      <p>
1943 ##      Do a domain transition to the specified
1944 ##      domain when executing a program in the
1945 ##      user home directory.
1946 ##      </p>
1947 ##      <p>
1948 ##      No interprocess communication (signals, pipes,
1949 ##      etc.) is provided by this interface since
1950 ##      the domains are not owned by this module.
1951 ##      </p>
1952 ## </desc>
1953 ## <param name="source_domain">
1954 ##      <summary>
1955 ##      Domain allowed to transition.
1956 ##      </summary>
1957 ## </param>
1958 ## <param name="target_domain">
1959 ##      <summary>
1960 ##      Domain to transition to.
1961 ##      </summary>
1962 ## </param>
1963 #
1964 interface(`userdom_user_home_domtrans',`
1965         gen_require(`
1966                 type user_home_dir_t, user_home_t;
1967         ')
1968
1969         domain_auto_trans($1, user_home_t, $2)
1970         allow $1 user_home_dir_t:dir search_dir_perms;
1971         files_search_home($1)
1972 ')
1973
1974 ########################################
1975 ## <summary>
1976 ##      Do not audit attempts to search user home content directories.
1977 ## </summary>
1978 ## <param name="domain">
1979 ##      <summary>
1980 ##      Domain to not audit.
1981 ##      </summary>
1982 ## </param>
1983 #
1984 interface(`userdom_dontaudit_search_user_home_content',`
1985         gen_require(`
1986                 type user_home_t;
1987         ')
1988
1989         dontaudit $1 user_home_t:dir search_dir_perms;
1990         fs_dontaudit_list_nfs($1)
1991         fs_dontaudit_list_cifs($1)
1992 ')
1993
1994 ########################################
1995 ## <summary>
1996 ##      List contents of users home directory.
1997 ## </summary>
1998 ## <param name="domain">
1999 ##      <summary>
2000 ##      Domain allowed access.
2001 ##      </summary>
2002 ## </param>
2003 #
2004 interface(`userdom_list_user_home_content',`
2005         gen_require(`
2006                 type user_home_dir_t;
2007                 attribute user_home_type;
2008         ')
2009
2010         files_list_home($1)
2011         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2012 ')
2013
2014 ########################################
2015 ## <summary>
2016 ##      Create, read, write, and delete directories
2017 ##      in a user home subdirectory.
2018 ## </summary>
2019 ## <param name="domain">
2020 ##      <summary>
2021 ##      Domain allowed access.
2022 ##      </summary>
2023 ## </param>
2024 #
2025 interface(`userdom_manage_user_home_content_dirs',`
2026         gen_require(`
2027                 type user_home_dir_t, user_home_t;
2028         ')
2029
2030         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2031         files_search_home($1)
2032 ')
2033
2034 ########################################
2035 ## <summary>
2036 ##      Delete directories in a user home subdirectory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`userdom_delete_user_home_content_dirs',`
2045         gen_require(`
2046                 type user_home_t;
2047         ')
2048
2049         allow $1 user_home_t:dir delete_dir_perms;
2050 ')
2051
2052 ########################################
2053 ## <summary>
2054 ##      Set the attributes of user home files.
2055 ## </summary>
2056 ## <param name="domain">
2057 ##      <summary>
2058 ##      Domain allowed access.
2059 ##      </summary>
2060 ## </param>
2061 ## <rolecap/>
2062 #
2063 interface(`userdom_setattr_user_home_content_files',`
2064         gen_require(`
2065                 type user_home_t;
2066         ')
2067
2068         allow $1 user_home_t:file setattr;
2069 ')
2070
2071 ########################################
2072 ## <summary>
2073 ##      Do not audit attempts to set the
2074 ##      attributes of user home files.
2075 ## </summary>
2076 ## <param name="domain">
2077 ##      <summary>
2078 ##      Domain to not audit.
2079 ##      </summary>
2080 ## </param>
2081 #
2082 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2083         gen_require(`
2084                 type user_home_t;
2085         ')
2086
2087         dontaudit $1 user_home_t:file setattr_file_perms;
2088 ')
2089
2090 ########################################
2091 ## <summary>
2092 ##      Mmap user home files.
2093 ## </summary>
2094 ## <param name="domain">
2095 ##      <summary>
2096 ##      Domain allowed access.
2097 ##      </summary>
2098 ## </param>
2099 #
2100 interface(`userdom_mmap_user_home_content_files',`
2101         gen_require(`
2102                 type user_home_dir_t, user_home_t;
2103         ')
2104
2105         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2106         files_search_home($1)
2107 ')
2108
2109 ########################################
2110 ## <summary>
2111 ##      Read user home files.
2112 ## </summary>
2113 ## <param name="domain">
2114 ##      <summary>
2115 ##      Domain allowed access.
2116 ##      </summary>
2117 ## </param>
2118 #
2119 interface(`userdom_read_user_home_content_files',`
2120         gen_require(`
2121                 type user_home_dir_t, user_home_t;
2122         ')
2123
2124         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2125         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2126         files_search_home($1)
2127 ')
2128
2129 ########################################
2130 ## <summary>
2131 ##      Do not audit attempts to getattr user home files.
2132 ## </summary>
2133 ## <param name="domain">
2134 ##      <summary>
2135 ##      Domain to not audit.
2136 ##      </summary>
2137 ## </param>
2138 #
2139 interface(`userdom_dontaudit_getattr_user_home_content',`
2140         gen_require(`
2141                 attribute user_home_type;
2142         ')
2143
2144         dontaudit $1 user_home_type:dir getattr;
2145         dontaudit $1 user_home_type:file getattr;
2146 ')
2147
2148 ########################################
2149 ## <summary>
2150 ##      Do not audit attempts to read user home files.
2151 ## </summary>
2152 ## <param name="domain">
2153 ##      <summary>
2154 ##      Domain to not audit.
2155 ##      </summary>
2156 ## </param>
2157 #
2158 interface(`userdom_dontaudit_read_user_home_content_files',`
2159         gen_require(`
2160                 attribute user_home_type;
2161                 type user_home_dir_t;
2162         ')
2163
2164         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2165         dontaudit $1 user_home_type:dir list_dir_perms;
2166         dontaudit $1 user_home_type:file read_file_perms;
2167         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2168 ')
2169
2170 ########################################
2171 ## <summary>
2172 ##      Do not audit attempts to append user home files.
2173 ## </summary>
2174 ## <param name="domain">
2175 ##      <summary>
2176 ##      Domain to not audit.
2177 ##      </summary>
2178 ## </param>
2179 #
2180 interface(`userdom_dontaudit_append_user_home_content_files',`
2181         gen_require(`
2182                 type user_home_t;
2183         ')
2184
2185         dontaudit $1 user_home_t:file append_file_perms;
2186 ')
2187
2188 ########################################
2189 ## <summary>
2190 ##      Do not audit attempts to write user home files.
2191 ## </summary>
2192 ## <param name="domain">
2193 ##      <summary>
2194 ##      Domain to not audit.
2195 ##      </summary>
2196 ## </param>
2197 #
2198 interface(`userdom_dontaudit_write_user_home_content_files',`
2199         gen_require(`
2200                 type user_home_t;
2201         ')
2202
2203         dontaudit $1 user_home_t:file write_file_perms;
2204 ')
2205
2206 ########################################
2207 ## <summary>
2208 ##      Delete files in a user home subdirectory.
2209 ## </summary>
2210 ## <param name="domain">
2211 ##      <summary>
2212 ##      Domain allowed access.
2213 ##      </summary>
2214 ## </param>
2215 #
2216 interface(`userdom_delete_user_home_content_files',`
2217         gen_require(`
2218                 type user_home_t;
2219         ')
2220
2221         allow $1 user_home_t:file delete_file_perms;
2222 ')
2223
2224 ########################################
2225 ## <summary>
2226 ##      Delete sock files in a user home subdirectory.
2227 ## </summary>
2228 ## <param name="domain">
2229 ##      <summary>
2230 ##      Domain allowed access.
2231 ##      </summary>
2232 ## </param>
2233 #
2234 interface(`userdom_delete_user_home_content_sock_files',`
2235         gen_require(`
2236                 type user_home_t;
2237         ')
2238
2239         allow $1 user_home_t:sock_file delete_file_perms;
2240 ')
2241
2242 ########################################
2243 ## <summary>
2244 ##      Do not audit attempts to write user home files.
2245 ## </summary>
2246 ## <param name="domain">
2247 ##      <summary>
2248 ##      Domain to not audit.
2249 ##      </summary>
2250 ## </param>
2251 #
2252 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2253         gen_require(`
2254                 type user_home_t;
2255         ')
2256
2257         dontaudit $1 user_home_t:file relabel_file_perms;
2258 ')
2259
2260 ########################################
2261 ## <summary>
2262 ##      Read user home subdirectory symbolic links.
2263 ## </summary>
2264 ## <param name="domain">
2265 ##      <summary>
2266 ##      Domain allowed access.
2267 ##      </summary>
2268 ## </param>
2269 #
2270 interface(`userdom_read_user_home_content_symlinks',`
2271         gen_require(`
2272                 type user_home_dir_t, user_home_t;
2273         ')
2274
2275         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2276 ')
2277
2278 ########################################
2279 ## <summary>
2280 ##      Execute user home files.
2281 ## </summary>
2282 ## <param name="domain">
2283 ##      <summary>
2284 ##      Domain allowed access.
2285 ##      </summary>
2286 ## </param>
2287 ## <rolecap/>
2288 #
2289 interface(`userdom_exec_user_home_content_files',`
2290         gen_require(`
2291                 type user_home_dir_t;
2292                 attribute user_home_type;
2293         ')
2294
2295         files_search_home($1)
2296         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2297         dontaudit $1 user_home_type:sock_file execute;
2298         ')
2299
2300 ########################################
2301 ## <summary>
2302 ##      Do not audit attempts to execute user home files.
2303 ## </summary>
2304 ## <param name="domain">
2305 ##      <summary>
2306 ##      Domain to not audit.
2307 ##      </summary>
2308 ## </param>
2309 #
2310 interface(`userdom_dontaudit_exec_user_home_content_files',`
2311         gen_require(`
2312                 type user_home_t;
2313         ')
2314
2315         dontaudit $1 user_home_t:file exec_file_perms;
2316 ')
2317
2318 ########################################
2319 ## <summary>
2320 ##      Create, read, write, and delete files
2321 ##      in a user home subdirectory.
2322 ## </summary>
2323 ## <param name="domain">
2324 ##      <summary>
2325 ##      Domain allowed access.
2326 ##      </summary>
2327 ## </param>
2328 #
2329 interface(`userdom_manage_user_home_content_files',`
2330         gen_require(`
2331                 type user_home_dir_t, user_home_t;
2332         ')
2333
2334         manage_files_pattern($1, user_home_t, user_home_t)
2335         allow $1 user_home_dir_t:dir search_dir_perms;
2336         files_search_home($1)
2337 ')
2338
2339 ########################################
2340 ## <summary>
2341 ##      Do not audit attempts to create, read, write, and delete directories
2342 ##      in a user home subdirectory.
2343 ## </summary>
2344 ## <param name="domain">
2345 ##      <summary>
2346 ##      Domain to not audit.
2347 ##      </summary>
2348 ## </param>
2349 #
2350 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2351         gen_require(`
2352                 type user_home_dir_t, user_home_t;
2353         ')
2354
2355         dontaudit $1 user_home_t:dir manage_dir_perms;
2356 ')
2357
2358 ########################################
2359 ## <summary>
2360 ##      Create, read, write, and delete symbolic links
2361 ##      in a user home subdirectory.
2362 ## </summary>
2363 ## <param name="domain">
2364 ##      <summary>
2365 ##      Domain allowed access.
2366 ##      </summary>
2367 ## </param>
2368 #
2369 interface(`userdom_manage_user_home_content_symlinks',`
2370         gen_require(`
2371                 type user_home_dir_t, user_home_t;
2372         ')
2373
2374         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2375         allow $1 user_home_dir_t:dir search_dir_perms;
2376         files_search_home($1)
2377 ')
2378
2379 ########################################
2380 ## <summary>
2381 ##      Delete symbolic links in a user home directory.
2382 ## </summary>
2383 ## <param name="domain">
2384 ##      <summary>
2385 ##      Domain allowed access.
2386 ##      </summary>
2387 ## </param>
2388 #
2389 interface(`userdom_delete_user_home_content_symlinks',`
2390         gen_require(`
2391                 type user_home_t;
2392         ')
2393
2394         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2395 ')
2396
2397 ########################################
2398 ## <summary>
2399 ##      Create, read, write, and delete named pipes
2400 ##      in a user home subdirectory.
2401 ## </summary>
2402 ## <param name="domain">
2403 ##      <summary>
2404 ##      Domain allowed access.
2405 ##      </summary>
2406 ## </param>
2407 #
2408 interface(`userdom_manage_user_home_content_pipes',`
2409         gen_require(`
2410                 type user_home_dir_t, user_home_t;
2411         ')
2412
2413         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2414         allow $1 user_home_dir_t:dir search_dir_perms;
2415         files_search_home($1)
2416 ')
2417
2418 ########################################
2419 ## <summary>
2420 ##      Create, read, write, and delete named sockets
2421 ##      in a user home subdirectory.
2422 ## </summary>
2423 ## <param name="domain">
2424 ##      <summary>
2425 ##      Domain allowed access.
2426 ##      </summary>
2427 ## </param>
2428 #
2429 interface(`userdom_manage_user_home_content_sockets',`
2430         gen_require(`
2431                 type user_home_dir_t, user_home_t;
2432         ')
2433
2434         allow $1 user_home_dir_t:dir search_dir_perms;
2435         manage_sock_files_pattern($1, user_home_t, user_home_t)
2436         files_search_home($1)
2437 ')
2438
2439 ########################################
2440 ## <summary>
2441 ##      Create objects in a user home directory
2442 ##      with an automatic type transition to
2443 ##      a specified private type.
2444 ## </summary>
2445 ## <param name="domain">
2446 ##      <summary>
2447 ##      Domain allowed access.
2448 ##      </summary>
2449 ## </param>
2450 ## <param name="private_type">
2451 ##      <summary>
2452 ##      The type of the object to create.
2453 ##      </summary>
2454 ## </param>
2455 ## <param name="object_class">
2456 ##      <summary>
2457 ##      The class of the object to be created.
2458 ##      </summary>
2459 ## </param>
2460 #
2461 interface(`userdom_user_home_dir_filetrans',`
2462         gen_require(`
2463                 type user_home_dir_t;
2464         ')
2465
2466         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2467         files_search_home($1)
2468 ')
2469
2470 ########################################
2471 ## <summary>
2472 ##      Create objects in a user home directory
2473 ##      with an automatic type transition to
2474 ##      a specified private type.
2475 ## </summary>
2476 ## <param name="domain">
2477 ##      <summary>
2478 ##      Domain allowed access.
2479 ##      </summary>
2480 ## </param>
2481 ## <param name="private_type">
2482 ##      <summary>
2483 ##      The type of the object to create.
2484 ##      </summary>
2485 ## </param>
2486 ## <param name="object_class">
2487 ##      <summary>
2488 ##      The class of the object to be created.
2489 ##      </summary>
2490 ## </param>
2491 #
2492 interface(`userdom_user_home_content_filetrans',`
2493         gen_require(`
2494                 type user_home_dir_t, user_home_t;
2495         ')
2496
2497         filetrans_pattern($1, user_home_t, $2, $3)
2498         allow $1 user_home_dir_t:dir search_dir_perms;
2499         files_search_home($1)
2500 ')
2501
2502 ########################################
2503 ## <summary>
2504 ##      Create objects in a user home directory
2505 ##      with an automatic type transition to
2506 ##      the user home file type.
2507 ## </summary>
2508 ## <param name="domain">
2509 ##      <summary>
2510 ##      Domain allowed access.
2511 ##      </summary>
2512 ## </param>
2513 ## <param name="object_class">
2514 ##      <summary>
2515 ##      The class of the object to be created.
2516 ##      </summary>
2517 ## </param>
2518 #
2519 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2520         gen_require(`
2521                 type user_home_dir_t, user_home_t;
2522         ')
2523
2524         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2525         files_search_home($1)
2526 ')
2527
2528 ########################################
2529 ## <summary>
2530 ##      Write to user temporary named sockets.
2531 ## </summary>
2532 ## <param name="domain">
2533 ##      <summary>
2534 ##      Domain allowed access.
2535 ##      </summary>
2536 ## </param>
2537 #
2538 interface(`userdom_write_user_tmp_sockets',`
2539         gen_require(`
2540                 type user_tmp_t;
2541         ')
2542
2543         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2544         files_search_tmp($1)
2545 ')
2546
2547 ########################################
2548 ## <summary>
2549 ##      List user temporary directories.
2550 ## </summary>
2551 ## <param name="domain">
2552 ##      <summary>
2553 ##      Domain allowed access.
2554 ##      </summary>
2555 ## </param>
2556 #
2557 interface(`userdom_list_user_tmp',`
2558         gen_require(`
2559                 type user_tmp_t;
2560         ')
2561
2562         allow $1 user_tmp_t:dir list_dir_perms;
2563         files_search_tmp($1)
2564 ')
2565
2566 ########################################
2567 ## <summary>
2568 ##      Do not audit attempts to list user
2569 ##      temporary directories.
2570 ## </summary>
2571 ## <param name="domain">
2572 ##      <summary>
2573 ##      Domain to not audit.
2574 ##      </summary>
2575 ## </param>
2576 #
2577 interface(`userdom_dontaudit_list_user_tmp',`
2578         gen_require(`
2579                 type user_tmp_t;
2580         ')
2581
2582         dontaudit $1 user_tmp_t:dir list_dir_perms;
2583 ')
2584
2585 ########################################
2586 ## <summary>
2587 ##      Do not audit attempts to manage users
2588 ##      temporary directories.
2589 ## </summary>
2590 ## <param name="domain">
2591 ##      <summary>
2592 ##      Domain to not audit.
2593 ##      </summary>
2594 ## </param>
2595 #
2596 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2597         gen_require(`
2598                 type user_tmp_t;
2599         ')
2600
2601         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2602 ')
2603
2604 ########################################
2605 ## <summary>
2606 ##      Read user temporary files.
2607 ## </summary>
2608 ## <param name="domain">
2609 ##      <summary>
2610 ##      Domain allowed access.
2611 ##      </summary>
2612 ## </param>
2613 #
2614 interface(`userdom_read_user_tmp_files',`
2615         gen_require(`
2616                 type user_tmp_t;
2617         ')
2618
2619         read_files_pattern($1, user_tmp_t, user_tmp_t)
2620         allow $1 user_tmp_t:dir list_dir_perms;
2621         files_search_tmp($1)
2622 ')
2623
2624 ########################################
2625 ## <summary>
2626 ##      Do not audit attempts to read users
2627 ##      temporary files.
2628 ## </summary>
2629 ## <param name="domain">
2630 ##      <summary>
2631 ##      Domain to not audit.
2632 ##      </summary>
2633 ## </param>
2634 #
2635 interface(`userdom_dontaudit_read_user_tmp_files',`
2636         gen_require(`
2637                 type user_tmp_t;
2638         ')
2639
2640         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2641 ')
2642
2643 ########################################
2644 ## <summary>
2645 ##      Do not audit attempts to append users
2646 ##      temporary files.
2647 ## </summary>
2648 ## <param name="domain">
2649 ##      <summary>
2650 ##      Domain to not audit.
2651 ##      </summary>
2652 ## </param>
2653 #
2654 interface(`userdom_dontaudit_append_user_tmp_files',`
2655         gen_require(`
2656                 type user_tmp_t;
2657         ')
2658
2659         dontaudit $1 user_tmp_t:file append_file_perms;
2660 ')
2661
2662 ########################################
2663 ## <summary>
2664 ##      Read and write user temporary files.
2665 ## </summary>
2666 ## <param name="domain">
2667 ##      <summary>
2668 ##      Domain allowed access.
2669 ##      </summary>
2670 ## </param>
2671 #
2672 interface(`userdom_rw_user_tmp_files',`
2673         gen_require(`
2674                 type user_tmp_t;
2675         ')
2676
2677         allow $1 user_tmp_t:dir list_dir_perms;
2678         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2679         files_search_tmp($1)
2680 ')
2681
2682 ########################################
2683 ## <summary>
2684 ##      Do not audit attempts to manage users
2685 ##      temporary files.
2686 ## </summary>
2687 ## <param name="domain">
2688 ##      <summary>
2689 ##      Domain to not audit.
2690 ##      </summary>
2691 ## </param>
2692 #
2693 interface(`userdom_dontaudit_manage_user_tmp_files',`
2694         gen_require(`
2695                 type user_tmp_t;
2696         ')
2697
2698         dontaudit $1 user_tmp_t:file manage_file_perms;
2699 ')
2700
2701 ########################################
2702 ## <summary>
2703 ##      Read user temporary symbolic links.
2704 ## </summary>
2705 ## <param name="domain">
2706 ##      <summary>
2707 ##      Domain allowed access.
2708 ##      </summary>
2709 ## </param>
2710 #
2711 interface(`userdom_read_user_tmp_symlinks',`
2712         gen_require(`
2713                 type user_tmp_t;
2714         ')
2715
2716         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2717         allow $1 user_tmp_t:dir list_dir_perms;
2718         files_search_tmp($1)
2719 ')
2720
2721 ########################################
2722 ## <summary>
2723 ##      Create, read, write, and delete user
2724 ##      temporary directories.
2725 ## </summary>
2726 ## <param name="domain">
2727 ##      <summary>
2728 ##      Domain allowed access.
2729 ##      </summary>
2730 ## </param>
2731 #
2732 interface(`userdom_manage_user_tmp_dirs',`
2733         gen_require(`
2734                 type user_tmp_t;
2735         ')
2736
2737         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2738         files_search_tmp($1)
2739 ')
2740
2741 ########################################
2742 ## <summary>
2743 ##      Create, read, write, and delete user
2744 ##      temporary files.
2745 ## </summary>
2746 ## <param name="domain">
2747 ##      <summary>
2748 ##      Domain allowed access.
2749 ##      </summary>
2750 ## </param>
2751 #
2752 interface(`userdom_manage_user_tmp_files',`
2753         gen_require(`
2754                 type user_tmp_t;
2755         ')
2756
2757         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2758         files_search_tmp($1)
2759 ')
2760
2761 ########################################
2762 ## <summary>
2763 ##      Create, read, write, and delete user
2764 ##      temporary symbolic links.
2765 ## </summary>
2766 ## <param name="domain">
2767 ##      <summary>
2768 ##      Domain allowed access.
2769 ##      </summary>
2770 ## </param>
2771 #
2772 interface(`userdom_manage_user_tmp_symlinks',`
2773         gen_require(`
2774                 type user_tmp_t;
2775         ')
2776
2777         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2778         files_search_tmp($1)
2779 ')
2780
2781 ########################################
2782 ## <summary>
2783 ##      Create, read, write, and delete user
2784 ##      temporary named pipes.
2785 ## </summary>
2786 ## <param name="domain">
2787 ##      <summary>
2788 ##      Domain allowed access.
2789 ##      </summary>
2790 ## </param>
2791 #
2792 interface(`userdom_manage_user_tmp_pipes',`
2793         gen_require(`
2794                 type user_tmp_t;
2795         ')
2796
2797         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2798         files_search_tmp($1)
2799 ')
2800
2801 ########################################
2802 ## <summary>
2803 ##      Create, read, write, and delete user
2804 ##      temporary named sockets.
2805 ## </summary>
2806 ## <param name="domain">
2807 ##      <summary>
2808 ##      Domain allowed access.
2809 ##      </summary>
2810 ## </param>
2811 #
2812 interface(`userdom_manage_user_tmp_sockets',`
2813         gen_require(`
2814                 type user_tmp_t;
2815         ')
2816
2817         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2818         files_search_tmp($1)
2819 ')
2820
2821 ########################################
2822 ## <summary>
2823 ##      Create objects in a user temporary directory
2824 ##      with an automatic type transition to
2825 ##      a specified private type.
2826 ## </summary>
2827 ## <param name="domain">
2828 ##      <summary>
2829 ##      Domain allowed access.
2830 ##      </summary>
2831 ## </param>
2832 ## <param name="private_type">
2833 ##      <summary>
2834 ##      The type of the object to create.
2835 ##      </summary>
2836 ## </param>
2837 ## <param name="object_class">
2838 ##      <summary>
2839 ##      The class of the object to be created.
2840 ##      </summary>
2841 ## </param>
2842 #
2843 interface(`userdom_user_tmp_filetrans',`
2844         gen_require(`
2845                 type user_tmp_t;
2846         ')
2847
2848         filetrans_pattern($1, user_tmp_t, $2, $3)
2849         files_search_tmp($1)
2850 ')
2851
2852 ########################################
2853 ## <summary>
2854 ##      Create objects in the temporary directory
2855 ##      with an automatic type transition to
2856 ##      the user temporary type.
2857 ## </summary>
2858 ## <param name="domain">
2859 ##      <summary>
2860 ##      Domain allowed access.
2861 ##      </summary>
2862 ## </param>
2863 ## <param name="object_class">
2864 ##      <summary>
2865 ##      The class of the object to be created.
2866 ##      </summary>
2867 ## </param>
2868 #
2869 interface(`userdom_tmp_filetrans_user_tmp',`
2870         gen_require(`
2871                 type user_tmp_t;
2872         ')
2873
2874         files_tmp_filetrans($1, user_tmp_t, $2)
2875 ')
2876
2877 ########################################
2878 ## <summary>
2879 ##      Read user tmpfs files.
2880 ## </summary>
2881 ## <param name="domain">
2882 ##      <summary>
2883 ##      Domain allowed access.
2884 ##      </summary>
2885 ## </param>
2886 #
2887 interface(`userdom_read_user_tmpfs_files',`
2888         gen_require(`
2889                 type user_tmpfs_t;
2890         ')
2891
2892         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2893         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2894         allow $1 user_tmpfs_t:dir list_dir_perms;
2895         fs_search_tmpfs($1)
2896 ')
2897
2898 ########################################
2899 ## <summary>
2900 ##      Read/Write user tmpfs files.
2901 ## </summary>
2902 ## <param name="domain">
2903 ##      <summary>
2904 ##      Domain allowed access.
2905 ##      </summary>
2906 ## </param>
2907 #
2908 interface(`userdom_rw_user_tmpfs_files',`
2909         gen_require(`
2910                 type user_tmpfs_t;
2911         ')
2912
2913         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2914         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2915         allow $1 user_tmpfs_t:dir list_dir_perms;
2916         fs_search_tmpfs($1)
2917 ')
2918
2919 ########################################
2920 ## <summary>
2921 ##      Get the attributes of a user domain tty.
2922 ## </summary>
2923 ## <param name="domain">
2924 ##      <summary>
2925 ##      Domain allowed access.
2926 ##      </summary>
2927 ## </param>
2928 #
2929 interface(`userdom_getattr_user_ttys',`
2930         gen_require(`
2931                 type user_tty_device_t;
2932         ')
2933
2934         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2935 ')
2936
2937 ########################################
2938 ## <summary>
2939 ##      Do not audit attempts to get the attributes of a user domain tty.
2940 ## </summary>
2941 ## <param name="domain">
2942 ##      <summary>
2943 ##      Domain to not audit.
2944 ##      </summary>
2945 ## </param>
2946 #
2947 interface(`userdom_dontaudit_getattr_user_ttys',`
2948         gen_require(`
2949                 type user_tty_device_t;
2950         ')
2951
2952         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2953 ')
2954
2955 ########################################
2956 ## <summary>
2957 ##      Set the attributes of a user domain tty.
2958 ## </summary>
2959 ## <param name="domain">
2960 ##      <summary>
2961 ##      Domain allowed access.
2962 ##      </summary>
2963 ## </param>
2964 #
2965 interface(`userdom_setattr_user_ttys',`
2966         gen_require(`
2967                 type user_tty_device_t;
2968         ')
2969
2970         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2971 ')
2972
2973 ########################################
2974 ## <summary>
2975 ##      Do not audit attempts to set the attributes of a user domain tty.
2976 ## </summary>
2977 ## <param name="domain">
2978 ##      <summary>
2979 ##      Domain to not audit.
2980 ##      </summary>
2981 ## </param>
2982 #
2983 interface(`userdom_dontaudit_setattr_user_ttys',`
2984         gen_require(`
2985                 type user_tty_device_t;
2986         ')
2987
2988         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2989 ')
2990
2991 ########################################
2992 ## <summary>
2993 ##      Read and write a user domain tty.
2994 ## </summary>
2995 ## <param name="domain">
2996 ##      <summary>
2997 ##      Domain allowed access.
2998 ##      </summary>
2999 ## </param>
3000 #
3001 interface(`userdom_use_user_ttys',`
3002         gen_require(`
3003                 type user_tty_device_t;
3004         ')
3005
3006         allow $1 user_tty_device_t:chr_file rw_term_perms;
3007 ')
3008
3009 ########################################
3010 ## <summary>
3011 ##      Read and write a inherited user domain tty.
3012 ## </summary>
3013 ## <param name="domain">
3014 ##      <summary>
3015 ##      Domain allowed access.
3016 ##      </summary>
3017 ## </param>
3018 #
3019 interface(`userdom_use_inherited_user_ttys',`
3020         gen_require(`
3021                 type user_tty_device_t;
3022         ')
3023
3024         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3025 ')
3026
3027 ########################################
3028 ## <summary>
3029 ##      Read and write a user domain pty.
3030 ## </summary>
3031 ## <param name="domain">
3032 ##      <summary>
3033 ##      Domain allowed access.
3034 ##      </summary>
3035 ## </param>
3036 #
3037 interface(`userdom_use_user_ptys',`
3038         gen_require(`
3039                 type user_devpts_t;
3040         ')
3041
3042         allow $1 user_devpts_t:chr_file rw_term_perms;
3043 ')
3044
3045 ########################################
3046 ## <summary>
3047 ##      Read and write a inherited user domain pty.
3048 ## </summary>
3049 ## <param name="domain">
3050 ##      <summary>
3051 ##      Domain allowed access.
3052 ##      </summary>
3053 ## </param>
3054 #
3055 interface(`userdom_use_inherited_user_ptys',`
3056         gen_require(`
3057                 type user_devpts_t;
3058         ')
3059
3060         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3061 ')
3062
3063 ########################################
3064 ## <summary>
3065 ##      Read and write a inherited user TTYs and PTYs.
3066 ## </summary>
3067 ## <desc>
3068 ##      <p>
3069 ##      Allow the specified domain to read and write inherited user
3070 ##      TTYs and PTYs. This will allow the domain to
3071 ##      interact with the user via the terminal. Typically
3072 ##      all interactive applications will require this
3073 ##      access.
3074 ##      </p>
3075 ## </desc>
3076 ## <param name="domain">
3077 ##      <summary>
3078 ##      Domain allowed access.
3079 ##      </summary>
3080 ## </param>
3081 ## <infoflow type="both" weight="10"/>
3082 #
3083 interface(`userdom_use_inherited_user_terminals',`
3084         gen_require(`
3085                 type user_tty_device_t, user_devpts_t;
3086         ')
3087
3088         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3089         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3090 ')
3091
3092 #######################################
3093 ## <summary>
3094 ##  Allow attempts to read and write
3095 ##  a user domain tty and pty.
3096 ## </summary>
3097 ## <param name="domain">
3098 ##  <summary>
3099 ##  Domain to not audit.
3100 ##  </summary>
3101 ## </param>
3102 #
3103 interface(`userdom_use_user_terminals',`
3104     gen_require(`
3105         type user_tty_device_t, user_devpts_t;
3106     ')
3107
3108     allow $1 user_tty_device_t:chr_file rw_term_perms;
3109     allow $1 user_devpts_t:chr_file rw_term_perms;
3110 ')
3111
3112 ########################################
3113 ## <summary>
3114 ##      Do not audit attempts to read and write
3115 ##      a user domain tty and pty.
3116 ## </summary>
3117 ## <param name="domain">
3118 ##      <summary>
3119 ##      Domain to not audit.
3120 ##      </summary>
3121 ## </param>
3122 #
3123 interface(`userdom_dontaudit_use_user_terminals',`
3124         gen_require(`
3125                 type user_tty_device_t, user_devpts_t;
3126         ')
3127
3128         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3129         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3130 ')
3131
3132
3133 ########################################
3134 ## <summary>
3135 ##      Get attributes of user domain tty and pty.
3136 ## </summary>
3137 ## <param name="domain">
3138 ##      <summary>
3139 ##      Domain allowed access.
3140 ##      </summary>
3141 ## </param>
3142 #
3143 interface(`userdom_getattr_user_terminals',`
3144         gen_require(`
3145                 type user_tty_device_t, user_devpts_t;
3146         ')
3147
3148         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3149 ')
3150
3151 ########################################
3152 ## <summary>
3153 ##      Execute a shell in all user domains.  This
3154 ##      is an explicit transition, requiring the
3155 ##      caller to use setexeccon().
3156 ## </summary>
3157 ## <param name="domain">
3158 ##      <summary>
3159 ##      Domain allowed to transition.
3160 ##      </summary>
3161 ## </param>
3162 #
3163 interface(`userdom_spec_domtrans_all_users',`
3164         gen_require(`
3165                 attribute userdomain;
3166         ')
3167
3168         corecmd_shell_spec_domtrans($1, userdomain)
3169         allow userdomain $1:fd use;
3170         allow userdomain $1:fifo_file rw_file_perms;
3171         allow userdomain $1:process sigchld;
3172 ')
3173
3174 ########################################
3175 ## <summary>
3176 ##      Execute an Xserver session in all unprivileged user domains.  This
3177 ##      is an explicit transition, requiring the
3178 ##      caller to use setexeccon().
3179 ## </summary>
3180 ## <param name="domain">
3181 ##      <summary>
3182 ##      Domain allowed to transition.
3183 ##      </summary>
3184 ## </param>
3185 #
3186 interface(`userdom_xsession_spec_domtrans_all_users',`
3187         gen_require(`
3188                 attribute userdomain;
3189         ')
3190
3191         xserver_xsession_spec_domtrans($1, userdomain)
3192         allow userdomain $1:fd use;
3193         allow userdomain $1:fifo_file rw_file_perms;
3194         allow userdomain $1:process sigchld;
3195 ')
3196
3197 ########################################
3198 ## <summary>
3199 ##      Execute a shell in all unprivileged user domains.  This
3200 ##      is an explicit transition, requiring the
3201 ##      caller to use setexeccon().
3202 ## </summary>
3203 ## <param name="domain">
3204 ##      <summary>
3205 ##      Domain allowed to transition.
3206 ##      </summary>
3207 ## </param>
3208 #
3209 interface(`userdom_spec_domtrans_unpriv_users',`
3210         gen_require(`
3211                 attribute unpriv_userdomain;
3212         ')
3213
3214         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3215         allow unpriv_userdomain $1:fd use;
3216         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3217         allow unpriv_userdomain $1:process sigchld;
3218 ')
3219
3220 ########################################
3221 ## <summary>
3222 ##      Execute an Xserver session in all unprivileged user domains.  This
3223 ##      is an explicit transition, requiring the
3224 ##      caller to use setexeccon().
3225 ## </summary>
3226 ## <param name="domain">
3227 ##      <summary>
3228 ##      Domain allowed to transition.
3229 ##      </summary>
3230 ## </param>
3231 #
3232 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3233         gen_require(`
3234                 attribute unpriv_userdomain;
3235         ')
3236
3237         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3238         allow unpriv_userdomain $1:fd use;
3239         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3240         allow unpriv_userdomain $1:process sigchld;
3241 ')
3242
3243 ########################################
3244 ## <summary>
3245 ##      Manage unpriviledged user SysV sempaphores.
3246 ## </summary>
3247 ## <param name="domain">
3248 ##      <summary>
3249 ##      Domain allowed access.
3250 ##      </summary>
3251 ## </param>
3252 #
3253 interface(`userdom_manage_unpriv_user_semaphores',`
3254         gen_require(`
3255                 attribute unpriv_userdomain;
3256         ')
3257
3258         allow $1 unpriv_userdomain:sem create_sem_perms;
3259 ')
3260
3261 ########################################
3262 ## <summary>
3263 ##      Manage unpriviledged user SysV shared
3264 ##      memory segments.
3265 ## </summary>
3266 ## <param name="domain">
3267 ##      <summary>
3268 ##      Domain allowed access.
3269 ##      </summary>
3270 ## </param>
3271 #
3272 interface(`userdom_manage_unpriv_user_shared_mem',`
3273         gen_require(`
3274                 attribute unpriv_userdomain;
3275         ')
3276
3277         allow $1 unpriv_userdomain:shm create_shm_perms;
3278 ')
3279
3280 ########################################
3281 ## <summary>
3282 ##      Execute bin_t in the unprivileged user domains. This
3283 ##      is an explicit transition, requiring the
3284 ##      caller to use setexeccon().
3285 ## </summary>
3286 ## <param name="domain">
3287 ##      <summary>
3288 ##      Domain allowed to transition.
3289 ##      </summary>
3290 ## </param>
3291 #
3292 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3293         gen_require(`
3294                 attribute unpriv_userdomain;
3295         ')
3296
3297         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3298         allow unpriv_userdomain $1:fd use;
3299         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3300         allow unpriv_userdomain $1:process sigchld;
3301 ')
3302
3303 ########################################
3304 ## <summary>
3305 ##      Execute all entrypoint files in unprivileged user
3306 ##      domains. This is an explicit transition, requiring the
3307 ##      caller to use setexeccon().
3308 ## </summary>
3309 ## <param name="domain">
3310 ##      <summary>
3311 ##      Domain allowed access.
3312 ##      </summary>
3313 ## </param>
3314 #
3315 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3316         gen_require(`
3317                 attribute unpriv_userdomain;
3318         ')
3319
3320         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3321         allow unpriv_userdomain $1:fd use;
3322         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3323         allow unpriv_userdomain $1:process sigchld;
3324 ')
3325
3326 ########################################
3327 ## <summary>
3328 ##      Search users home directories.
3329 ## </summary>
3330 ## <param name="domain">
3331 ##      <summary>
3332 ##      Domain allowed access.
3333 ##      </summary>
3334 ## </param>
3335 #
3336 interface(`userdom_search_user_home_content',`
3337         gen_require(`
3338                 type user_home_dir_t;
3339                 attribute user_home_type;
3340         ')
3341
3342         files_list_home($1)
3343         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3344         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3345 ')
3346
3347 ########################################
3348 ## <summary>
3349 ##      Send general signals to unprivileged user domains.
3350 ## </summary>
3351 ## <param name="domain">
3352 ##      <summary>
3353 ##      Domain allowed access.
3354 ##      </summary>
3355 ## </param>
3356 #
3357 interface(`userdom_signal_unpriv_users',`
3358         gen_require(`
3359                 attribute unpriv_userdomain;
3360         ')
3361
3362         allow $1 unpriv_userdomain:process signal;
3363 ')
3364
3365 ########################################
3366 ## <summary>
3367 ##      Inherit the file descriptors from unprivileged user domains.
3368 ## </summary>
3369 ## <param name="domain">
3370 ##      <summary>
3371 ##      Domain allowed access.
3372 ##      </summary>
3373 ## </param>
3374 #
3375 interface(`userdom_use_unpriv_users_fds',`
3376         gen_require(`
3377                 attribute unpriv_userdomain;
3378         ')
3379
3380         allow $1 unpriv_userdomain:fd use;
3381 ')
3382
3383 ########################################
3384 ## <summary>
3385 ##      Do not audit attempts to inherit the file descriptors
3386 ##      from unprivileged user domains.
3387 ## </summary>
3388 ## <desc>
3389 ##      <p>
3390 ##      Do not audit attempts to inherit the file descriptors
3391 ##      from unprivileged user domains. This will supress
3392 ##      SELinux denial messages when the specified domain is denied
3393 ##      the permission to inherit these file descriptors.
3394 ##      </p>
3395 ## </desc>
3396 ## <param name="domain">
3397 ##      <summary>
3398 ##      Domain to not audit.
3399 ##      </summary>
3400 ## </param>
3401 ## <infoflow type="none"/>
3402 #
3403 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3404         gen_require(`
3405                 attribute unpriv_userdomain;
3406         ')
3407
3408         dontaudit $1 unpriv_userdomain:fd use;
3409 ')
3410
3411 ########################################
3412 ## <summary>
3413 ##      Do not audit attempts to use user ptys.
3414 ## </summary>
3415 ## <param name="domain">
3416 ##      <summary>
3417 ##      Domain to not audit.
3418 ##      </summary>
3419 ## </param>
3420 #
3421 interface(`userdom_dontaudit_use_user_ptys',`
3422         gen_require(`
3423                 type user_devpts_t;
3424         ')
3425
3426         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3427 ')
3428
3429 ########################################
3430 ## <summary>
3431 ##      Relabel files to unprivileged user pty types.
3432 ## </summary>
3433 ## <param name="domain">
3434 ##      <summary>
3435 ##      Domain allowed access.
3436 ##      </summary>
3437 ## </param>
3438 #
3439 interface(`userdom_relabelto_user_ptys',`
3440         gen_require(`
3441                 type user_devpts_t;
3442         ')
3443
3444         allow $1 user_devpts_t:chr_file relabelto;
3445 ')
3446
3447 ########################################
3448 ## <summary>
3449 ##      Do not audit attempts to relabel files from
3450 ##      user pty types.
3451 ## </summary>
3452 ## <param name="domain">
3453 ##      <summary>
3454 ##      Domain to not audit.
3455 ##      </summary>
3456 ## </param>
3457 #
3458 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3459         gen_require(`
3460                 type user_devpts_t;
3461         ')
3462
3463         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3464 ')
3465
3466 ########################################
3467 ## <summary>
3468 ##      Write all users files in /tmp
3469 ## </summary>
3470 ## <param name="domain">
3471 ##      <summary>
3472 ##      Domain allowed access.
3473 ##      </summary>
3474 ## </param>
3475 #
3476 interface(`userdom_write_user_tmp_files',`
3477         gen_require(`
3478                 type user_tmp_t;
3479         ')
3480
3481         write_files_pattern($1, user_tmp_t, user_tmp_t)
3482 ')
3483
3484 ########################################
3485 ## <summary>
3486 ##      Do not audit attempts to write users
3487 ##      temporary files.
3488 ## </summary>
3489 ## <param name="domain">
3490 ##      <summary>
3491 ##      Domain to not audit.
3492 ##      </summary>
3493 ## </param>
3494 #
3495 interface(`userdom_dontaudit_write_user_tmp_files',`
3496         gen_require(`
3497                 type user_tmp_t;
3498         ')
3499
3500         dontaudit $1 user_tmp_t:file write;
3501 ')
3502
3503 ########################################
3504 ## <summary>
3505 ##      Do not audit attempts to read/write users
3506 ##      temporary fifo files.
3507 ## </summary>
3508 ## <param name="domain">
3509 ##      <summary>
3510 ##      Domain to not audit.
3511 ##      </summary>
3512 ## </param>
3513 #
3514 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3515         gen_require(`
3516                 type user_tmp_t;
3517         ')
3518
3519         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3520 ')
3521
3522 ########################################
3523 ## <summary>
3524 ##      Do not audit attempts to use user ttys.
3525 ## </summary>
3526 ## <param name="domain">
3527 ##      <summary>
3528 ##      Domain to not audit.
3529 ##      </summary>
3530 ## </param>
3531 #
3532 interface(`userdom_dontaudit_use_user_ttys',`
3533         gen_require(`
3534                 type user_tty_device_t;
3535         ')
3536
3537         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3538 ')
3539
3540 ########################################
3541 ## <summary>
3542 ##      Read the process state of all user domains.
3543 ## </summary>
3544 ## <param name="domain">
3545 ##      <summary>
3546 ##      Domain allowed access.
3547 ##      </summary>
3548 ## </param>
3549 #
3550 interface(`userdom_read_all_users_state',`
3551         gen_require(`
3552                 attribute userdomain;
3553         ')
3554
3555         read_files_pattern($1, userdomain, userdomain)
3556         read_lnk_files_pattern($1,userdomain,userdomain)
3557         kernel_search_proc($1)
3558 ')
3559
3560 ########################################
3561 ## <summary>
3562 ##      Get the attributes of all user domains.
3563 ## </summary>
3564 ## <param name="domain">
3565 ##      <summary>
3566 ##      Domain allowed access.
3567 ##      </summary>
3568 ## </param>
3569 #
3570 interface(`userdom_getattr_all_users',`
3571         gen_require(`
3572                 attribute userdomain;
3573         ')
3574
3575         allow $1 userdomain:process getattr;
3576 ')
3577
3578 ########################################
3579 ## <summary>
3580 ##      Inherit the file descriptors from all user domains
3581 ## </summary>
3582 ## <param name="domain">
3583 ##      <summary>
3584 ##      Domain allowed access.
3585 ##      </summary>
3586 ## </param>
3587 #
3588 interface(`userdom_use_all_users_fds',`
3589         gen_require(`
3590                 attribute userdomain;
3591         ')
3592
3593         allow $1 userdomain:fd use;
3594 ')
3595
3596 ########################################
3597 ## <summary>
3598 ##      Do not audit attempts to inherit the file
3599 ##      descriptors from any user domains.
3600 ## </summary>
3601 ## <param name="domain">
3602 ##      <summary>
3603 ##      Domain to not audit.
3604 ##      </summary>
3605 ## </param>
3606 #
3607 interface(`userdom_dontaudit_use_all_users_fds',`
3608         gen_require(`
3609                 attribute userdomain;
3610         ')
3611
3612         dontaudit $1 userdomain:fd use;
3613 ')
3614
3615 ########################################
3616 ## <summary>
3617 ##      Send general signals to all user domains.
3618 ## </summary>
3619 ## <param name="domain">
3620 ##      <summary>
3621 ##      Domain allowed access.
3622 ##      </summary>
3623 ## </param>
3624 #
3625 interface(`userdom_signal_all_users',`
3626         gen_require(`
3627                 attribute userdomain;
3628         ')
3629
3630         allow $1 userdomain:process signal;
3631 ')
3632
3633 ########################################
3634 ## <summary>
3635 ##      Send kill signals to all user domains.
3636 ## </summary>
3637 ## <param name="domain">
3638 ##      <summary>
3639 ##      Domain allowed access.
3640 ##      </summary>
3641 ## </param>
3642 #
3643 interface(`userdom_kill_all_users',`
3644         gen_require(`
3645                 attribute userdomain;
3646         ')
3647
3648         allow $1 userdomain:process sigkill;
3649 ')
3650
3651 ########################################
3652 ## <summary>
3653 ##      Send a SIGCHLD signal to all user domains.
3654 ## </summary>
3655 ## <param name="domain">
3656 ##      <summary>
3657 ##      Domain allowed access.
3658 ##      </summary>
3659 ## </param>
3660 #
3661 interface(`userdom_sigchld_all_users',`
3662         gen_require(`
3663                 attribute userdomain;
3664         ')
3665
3666         allow $1 userdomain:process sigchld;
3667 ')
3668
3669 ########################################
3670 ## <summary>
3671 ##      Create keys for all user domains.
3672 ## </summary>
3673 ## <param name="domain">
3674 ##      <summary>
3675 ##      Domain allowed access.
3676 ##      </summary>
3677 ## </param>
3678 #
3679 interface(`userdom_create_all_users_keys',`
3680         gen_require(`
3681                 attribute userdomain;
3682         ')
3683
3684         allow $1 userdomain:key create;
3685 ')
3686
3687 ########################################
3688 ## <summary>
3689 ##      Send a dbus message to all user domains.
3690 ## </summary>
3691 ## <param name="domain">
3692 ##      <summary>
3693 ##      Domain allowed access.
3694 ##      </summary>
3695 ## </param>
3696 #
3697 interface(`userdom_dbus_send_all_users',`
3698         gen_require(`
3699                 attribute userdomain;
3700                 class dbus send_msg;
3701         ')
3702
3703         allow $1 userdomain:dbus send_msg;
3704 ')
3705
3706 ########################################
3707 ## <summary>
3708 ##      Allow apps to set rlimits on userdomain
3709 ## </summary>
3710 ## <param name="domain">
3711 ##      <summary>
3712 ##      Domain allowed access.
3713 ##      </summary>
3714 ## </param>
3715 #
3716 interface(`userdom_set_rlimitnh',`
3717         gen_require(`
3718                 attribute userdomain;
3719         ')
3720
3721         allow $1 userdomain:process rlimitinh;
3722 ')
3723
3724 ########################################
3725 ## <summary>
3726 ##      Define this type as a Allow apps to set rlimits on userdomain
3727 ## </summary>
3728 ## <param name="domain">
3729 ##      <summary>
3730 ##      Domain allowed access.
3731 ##      </summary>
3732 ## </param>
3733 ## <param name="userdomain_prefix">
3734 ##      <summary>
3735 ##      The prefix of the user domain (e.g., user
3736 ##      is the prefix for user_t).
3737 ## </summary>
3738 ## </param>
3739 ## <param name="domain">
3740 ##      <summary>
3741 ##      Domain allowed access.
3742 ##      </summary>
3743 ## </param>
3744 #
3745 template(`userdom_unpriv_usertype',`
3746         gen_require(`
3747                 attribute unpriv_userdomain, userdomain;
3748                 attribute $1_usertype;
3749         ')
3750         typeattribute $2  $1_usertype;
3751         typeattribute $2  unpriv_userdomain;
3752         typeattribute $2  userdomain;
3753
3754         ubac_constrained($2)
3755 ')
3756
3757 ########################################
3758 ## <summary>
3759 ##      Connect to users over an unix stream socket.
3760 ## </summary>
3761 ## <param name="domain">
3762 ##      <summary>
3763 ##      Domain allowed access.
3764 ##      </summary>
3765 ## </param>
3766 #
3767 interface(`userdom_stream_connect',`
3768         gen_require(`
3769                 type user_tmp_t;
3770                 attribute userdomain;
3771         ')
3772
3773         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3774 ')
3775
3776 ########################################
3777 ## <summary>
3778 ##      Ptrace user domains.
3779 ## </summary>
3780 ## <param name="domain">
3781 ##      <summary>
3782 ##      Domain allowed access.
3783 ##      </summary>
3784 ## </param>
3785 #
3786 interface(`userdom_ptrace_all_users',`
3787         gen_require(`
3788                 attribute userdomain;
3789         ')
3790
3791         allow $1 userdomain:process ptrace;
3792 ')
3793
3794 ########################################
3795 ## <summary>
3796 ##      dontaudit Search /root
3797 ## </summary>
3798 ## <param name="domain">
3799 ##      <summary>
3800 ##      Domain to not audit.
3801 ##      </summary>
3802 ## </param>
3803 #
3804 interface(`userdom_dontaudit_search_admin_dir',`
3805         gen_require(`
3806                 type admin_home_t;
3807         ')
3808
3809         dontaudit $1 admin_home_t:dir search_dir_perms;
3810 ')
3811
3812 ########################################
3813 ## <summary>
3814 ##      dontaudit list /root
3815 ## </summary>
3816 ## <param name="domain">
3817 ##      <summary>
3818 ##      Domain to not audit.
3819 ##      </summary>
3820 ## </param>
3821 #
3822 interface(`userdom_dontaudit_list_admin_dir',`
3823         gen_require(`
3824                 type admin_home_t;
3825         ')
3826
3827         dontaudit $1 admin_home_t:dir list_dir_perms;
3828 ')
3829
3830 ########################################
3831 ## <summary>
3832 ##      Allow domain to  list /root
3833 ## </summary>
3834 ## <param name="domain">
3835 ##      <summary>
3836 ##      Domain allowed access.
3837 ##      </summary>
3838 ## </param>
3839 #
3840 interface(`userdom_list_admin_dir',`
3841         gen_require(`
3842                 type admin_home_t;
3843         ')
3844
3845         allow $1 admin_home_t:dir list_dir_perms;
3846 ')
3847
3848 ########################################
3849 ## <summary>
3850 ##      Allow Search /root
3851 ## </summary>
3852 ## <param name="domain">
3853 ##      <summary>
3854 ##      Domain allowed access.
3855 ##      </summary>
3856 ## </param>
3857 #
3858 interface(`userdom_search_admin_dir',`
3859         gen_require(`
3860                 type admin_home_t;
3861         ')
3862
3863         allow $1 admin_home_t:dir search_dir_perms;
3864 ')
3865
3866 ########################################
3867 ## <summary>
3868 ##      RW unpriviledged user SysV sempaphores.
3869 ## </summary>
3870 ## <param name="domain">
3871 ##      <summary>
3872 ##      Domain allowed access.
3873 ##      </summary>
3874 ## </param>
3875 #
3876 interface(`userdom_rw_semaphores',`
3877         gen_require(`
3878                 attribute unpriv_userdomain;
3879         ')
3880
3881         allow $1 unpriv_userdomain:sem rw_sem_perms;
3882 ')
3883
3884 ########################################
3885 ## <summary>
3886 ##      Send a message to unpriv users over a unix domain
3887 ##      datagram socket.
3888 ## </summary>
3889 ## <param name="domain">
3890 ##      <summary>
3891 ##      Domain allowed access.
3892 ##      </summary>
3893 ## </param>
3894 #
3895 interface(`userdom_dgram_send',`
3896         gen_require(`
3897                 attribute unpriv_userdomain;
3898         ')
3899
3900         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3901 ')
3902
3903 ######################################
3904 ## <summary>
3905 ##      Send a message to users over a unix domain
3906 ##      datagram socket.
3907 ## </summary>
3908 ## <param name="domain">
3909 ##      <summary>
3910 ##      Domain allowed access.
3911 ##      </summary>
3912 ## </param>
3913 #
3914 interface(`userdom_users_dgram_send',`
3915         gen_require(`
3916                  attribute userdomain;
3917       ')
3918
3919        allow $1 userdomain:unix_dgram_socket sendto;
3920 ')
3921
3922 #######################################
3923 ## <summary>
3924 ##      Allow execmod on files in homedirectory
3925 ## </summary>
3926 ## <param name="domain">
3927 ##      <summary>
3928 ##      Domain allowed access.
3929 ##      </summary>
3930 ## </param>
3931 ## <rolebase/>
3932 #
3933 interface(`userdom_execmod_user_home_files',`
3934         gen_require(`
3935                 type user_home_type;
3936         ')
3937
3938         allow $1 user_home_type:file execmod;
3939 ')
3940
3941 ########################################
3942 ## <summary>
3943 ##      Read admin home files.
3944 ## </summary>
3945 ## <param name="domain">
3946 ##      <summary>
3947 ##      Domain allowed access.
3948 ##      </summary>
3949 ## </param>
3950 ## <rolecap/>
3951 #
3952 interface(`userdom_read_admin_home_files',`
3953         gen_require(`
3954                 type admin_home_t;
3955         ')
3956
3957         read_files_pattern($1, admin_home_t, admin_home_t)
3958 ')
3959
3960 ########################################
3961 ## <summary>
3962 ##      Execute admin home files.
3963 ## </summary>
3964 ## <param name="domain">
3965 ##      <summary>
3966 ##      Domain allowed access.
3967 ##      </summary>
3968 ## </param>
3969 ## <rolecap/>
3970 #
3971 interface(`userdom_exec_admin_home_files',`
3972         gen_require(`
3973                 type admin_home_t;
3974         ')
3975
3976         exec_files_pattern($1, admin_home_t, admin_home_t)
3977 ')
3978
3979 ########################################
3980 ## <summary>
3981 ##      Append files inherited
3982 ##      in the /root directory.
3983 ## </summary>
3984 ## <param name="domain">
3985 ##      <summary>
3986 ##      Domain allowed access.
3987 ##      </summary>
3988 ## </param>
3989 #
3990 interface(`userdom_inherit_append_admin_home_files',`
3991         gen_require(`
3992                 type admin_home_t;
3993         ')
3994
3995         allow $1 admin_home_t:file { getattr append };
3996 ')
3997
3998
3999 #######################################
4000 ## <summary>
4001 ##      Manage all files/directories in the homedir
4002 ## </summary>
4003 ## <param name="userdomain">
4004 ##      <summary>
4005 ##      The user domain
4006 ##      </summary>
4007 ## </param>
4008 ## <rolebase/>
4009 #
4010 interface(`userdom_manage_user_home_content',`
4011         gen_require(`
4012                 type user_home_dir_t, user_home_t;
4013                 attribute user_home_type;
4014         ')
4015
4016         files_list_home($1)
4017         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4018         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4019         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4020         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4021         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4022         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4023
4024 ')
4025
4026
4027 ########################################
4028 ## <summary>
4029 ##      Create objects in a user home directory
4030 ##      with an automatic type transition to
4031 ##      the user home file type.
4032 ## </summary>
4033 ## <param name="domain">
4034 ##      <summary>
4035 ##      Domain allowed access.
4036 ##      </summary>
4037 ## </param>
4038 ## <param name="object_class">
4039 ##      <summary>
4040 ##      The class of the object to be created.
4041 ##      </summary>
4042 ## </param>
4043 #
4044 interface(`userdom_user_home_dir_filetrans_pattern',`
4045         gen_require(`
4046                 type user_home_dir_t, user_home_t;
4047         ')
4048
4049         type_transition $1 user_home_dir_t:$2 user_home_t;
4050 ')
4051
4052 ########################################
4053 ## <summary>
4054 ##      Create objects in the /root directory
4055 ##      with an automatic type transition to
4056 ##      a specified private type.
4057 ## </summary>
4058 ## <param name="domain">
4059 ##      <summary>
4060 ##      Domain allowed access.
4061 ##      </summary>
4062 ## </param>
4063 ## <param name="private_type">
4064 ##      <summary>
4065 ##      The type of the object to create.
4066 ##      </summary>
4067 ## </param>
4068 ## <param name="object_class">
4069 ##      <summary>
4070 ##      The class of the object to be created.
4071 ##      </summary>
4072 ## </param>
4073 #
4074 interface(`userdom_admin_home_dir_filetrans',`
4075         gen_require(`
4076                 type admin_home_t;
4077         ')
4078
4079         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4080 ')
4081
4082 ########################################
4083 ## <summary>
4084 ##      Send signull to unprivileged user domains.
4085 ## </summary>
4086 ## <param name="domain">
4087 ##      <summary>
4088 ##      Domain allowed access.
4089 ##      </summary>
4090 ## </param>
4091 #
4092 interface(`userdom_signull_unpriv_users',`
4093         gen_require(`
4094                 attribute unpriv_userdomain;
4095         ')
4096
4097         allow $1 unpriv_userdomain:process signull;
4098 ')
4099
4100 ########################################
4101 ## <summary>
4102 ##      Write all users files in /tmp
4103 ## </summary>
4104 ## <param name="domain">
4105 ##      <summary>
4106 ##      Domain allowed access.
4107 ##      </summary>
4108 ## </param>
4109 #
4110 interface(`userdom_write_user_tmp_dirs',`
4111         gen_require(`
4112                 type user_tmp_t;
4113         ')
4114
4115         write_files_pattern($1, user_tmp_t, user_tmp_t)
4116 ')
4117
4118 ########################################
4119 ## <summary>
4120 ##      Manage keys for all user domains.
4121 ## </summary>
4122 ## <param name="domain">
4123 ##      <summary>
4124 ##      Domain allowed access.
4125 ##      </summary>
4126 ## </param>
4127 #
4128 interface(`userdom_manage_all_users_keys',`
4129         gen_require(`
4130                 attribute userdomain;
4131         ')
4132
4133         allow $1 userdomain:key manage_key_perms;
4134 ')
4135
4136
4137 ########################################
4138 ## <summary>
4139 ##      Do not audit attempts to read and write
4140 ##      unserdomain stream.
4141 ## </summary>
4142 ## <param name="domain">
4143 ##      <summary>
4144 ##      Domain to not audit.
4145 ##      </summary>
4146 ## </param>
4147 #
4148 interface(`userdom_dontaudit_rw_stream',`
4149         gen_require(`
4150                 attribute userdomain;
4151         ')
4152
4153         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4154 ')
4155
4156 ########################################
4157 ## <summary>
4158 ##      Do not audit attempts to read and write
4159 ##      unserdomain datagram socket.
4160 ## </summary>
4161 ## <param name="domain">
4162 ##      <summary>
4163 ##      Domain to not audit.
4164 ##      </summary>
4165 ## </param>
4166 #
4167 interface(`userdom_dontaudit_rw_dgram_socket',`
4168         gen_require(`
4169                 attribute userdomain;
4170         ')
4171
4172         dontaudit $1 userdomain:unix_dgram_socket { read write };
4173 ')
4174
4175 ########################################
4176 ## <summary>
4177 ##      Append files
4178 ##      in a user home subdirectory.
4179 ## </summary>
4180 ## <param name="domain">
4181 ##      <summary>
4182 ##      Domain allowed access.
4183 ##      </summary>
4184 ## </param>
4185 #
4186 interface(`userdom_append_user_home_content_files',`
4187         gen_require(`
4188                 type user_home_dir_t, user_home_t;
4189         ')
4190
4191         append_files_pattern($1, user_home_t, user_home_t)
4192         allow $1 user_home_dir_t:dir search_dir_perms;
4193         files_search_home($1)
4194 ')
4195
4196 ########################################
4197 ## <summary>
4198 ##      Read files inherited
4199 ##      in a user home subdirectory.
4200 ## </summary>
4201 ## <param name="domain">
4202 ##      <summary>
4203 ##      Domain allowed access.
4204 ##      </summary>
4205 ## </param>
4206 #
4207 interface(`userdom_read_inherited_user_home_content_files',`
4208         gen_require(`
4209                 attribute user_home_type;
4210         ')
4211
4212         allow $1 user_home_type:file { getattr read };
4213 ')
4214
4215 ########################################
4216 ## <summary>
4217 ##      Append files inherited
4218 ##      in a user home subdirectory.
4219 ## </summary>
4220 ## <param name="domain">
4221 ##      <summary>
4222 ##      Domain allowed access.
4223 ##      </summary>
4224 ## </param>
4225 #
4226 interface(`userdom_inherit_append_user_home_content_files',`
4227         gen_require(`
4228                 type user_home_t;
4229         ')
4230
4231         allow $1 user_home_t:file { getattr append };
4232 ')
4233
4234 ########################################
4235 ## <summary>
4236 ##      Append files inherited
4237 ##      in a user tmp files.
4238 ## </summary>
4239 ## <param name="domain">
4240 ##      <summary>
4241 ##      Domain allowed access.
4242 ##      </summary>
4243 ## </param>
4244 #
4245 interface(`userdom_inherit_append_user_tmp_files',`
4246         gen_require(`
4247                 type user_tmp_t;
4248         ')
4249
4250         allow $1 user_tmp_t:file { getattr append };
4251 ')
4252
4253 ######################################
4254 ## <summary>
4255 ##      Read audio files in the users homedir.
4256 ## </summary>
4257 ## <param name="domain">
4258 ##      <summary>
4259 ##      Domain allowed access.
4260 ##      </summary>
4261 ## </param>
4262 ## <rolecap/>
4263 #
4264 interface(`userdom_read_home_audio_files',`
4265         gen_require(`
4266                 type audio_home_t;
4267         ')
4268
4269         userdom_search_user_home_dirs($1)
4270         allow $1 audio_home_t:dir list_dir_perms;
4271         read_files_pattern($1, audio_home_t, audio_home_t)
4272         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4273 ')
4274
4275 ########################################
4276 ## <summary>
4277 ##      Do not audit attempts to write all user home content files.
4278 ## </summary>
4279 ## <param name="domain">
4280 ##      <summary>
4281 ##      Domain to not audit.
4282 ##      </summary>
4283 ## </param>
4284 #
4285 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4286         gen_require(`
4287                 attribute user_home_type;
4288         ')
4289
4290         dontaudit $1 user_home_type:file write_file_perms;
4291 ')
4292
4293 ########################################
4294 ## <summary>
4295 ##      Do not audit attempts to write all user tmp content files.
4296 ## </summary>
4297 ## <param name="domain">
4298 ##      <summary>
4299 ##      Domain to not audit.
4300 ##      </summary>
4301 ## </param>
4302 #
4303 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4304         gen_require(`
4305                 attribute user_tmp_type;
4306         ')
4307
4308         dontaudit $1 user_tmp_type:file write_file_perms;
4309 ')
4310
4311 ########################################
4312 ## <summary>
4313 ##      Manage all user temporary content.
4314 ## </summary>
4315 ## <param name="domain">
4316 ##      <summary>
4317 ##      Domain allowed access.
4318 ##      </summary>
4319 ## </param>
4320 #
4321 interface(`userdom_manage_all_user_tmp_content',`
4322         gen_require(`
4323                 attribute user_tmp_type;
4324         ')
4325
4326         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4327         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4328         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4329         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4330         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4331         files_search_tmp($1)
4332 ')
4333
4334 ########################################
4335 ## <summary>
4336 ##      List all user temporary content.
4337 ## </summary>
4338 ## <param name="domain">
4339 ##      <summary>
4340 ##      Domain allowed access.
4341 ##      </summary>
4342 ## </param>
4343 #
4344 interface(`userdom_list_all_user_tmp_content',`
4345         gen_require(`
4346                 attribute user_tmp_type;
4347         ')
4348
4349         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4350         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4351         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4352         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4353         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4354         files_search_var($1)
4355         files_search_tmp($1)
4356 ')
4357
4358 ########################################
4359 ## <summary>
4360 ##      Manage all user tmpfs content.
4361 ## </summary>
4362 ## <param name="domain">
4363 ##      <summary>
4364 ##      Domain allowed access.
4365 ##      </summary>
4366 ## </param>
4367 #
4368 interface(`userdom_manage_all_user_tmpfs_content',`
4369         gen_require(`
4370                 attribute user_tmpfs_type;
4371         ')
4372
4373         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4374         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4375         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4376         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4377         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4378         fs_search_tmpfs($1)
4379 ')
4380
4381 ########################################
4382 ## <summary>
4383 ##      Delete all user temporary content.
4384 ## </summary>
4385 ## <param name="domain">
4386 ##      <summary>
4387 ##      Domain allowed access.
4388 ##      </summary>
4389 ## </param>
4390 #
4391 interface(`userdom_delete_all_user_tmp_content',`
4392         gen_require(`
4393                 attribute user_tmp_type;
4394         ')
4395
4396         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4397         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4398         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4399         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4400         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4401         # /var/tmp
4402         files_search_var($1)
4403         files_delete_tmp_dir_entry($1)
4404 ')
4405
4406 ########################################
4407 ## <summary>
4408 ##      Read system SSL certificates in the users homedir.
4409 ## </summary>
4410 ## <param name="domain">
4411 ##      <summary>
4412 ##      Domain allowed access.
4413 ##      </summary>
4414 ## </param>
4415 #
4416 interface(`userdom_read_home_certs',`
4417         gen_require(`
4418                 type home_cert_t;
4419         ')
4420
4421         userdom_search_user_home_content($1)
4422         allow $1 home_cert_t:dir list_dir_perms;
4423         read_files_pattern($1, home_cert_t, home_cert_t)
4424         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4425 ')
4426
4427 #######################################
4428 ## <summary>
4429 ##  Dontaudit Write system SSL certificates in the users homedir.
4430 ## </summary>
4431 ## <param name="domain">
4432 ##  <summary>
4433 ##      Domain to not audit.
4434 ##  </summary>
4435 ## </param>
4436 #
4437 interface(`userdom_dontaudit_write_home_certs',`
4438     gen_require(`
4439         type home_cert_t;
4440     ')
4441
4442     dontaudit $1 home_cert_t:file write;
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      dontaudit Search getatrr /root files
4448 ## </summary>
4449 ## <param name="domain">
4450 ##      <summary>
4451 ##      Domain to not audit.
4452 ##      </summary>
4453 ## </param>
4454 #
4455 interface(`userdom_dontaudit_getattr_admin_home_files',`
4456         gen_require(`
4457                 type admin_home_t;
4458         ')
4459
4460         dontaudit $1 admin_home_t:file getattr;
4461 ')
4462
4463 ########################################
4464 ## <summary>
4465 ##      dontaudit read /root lnk files
4466 ## </summary>
4467 ## <param name="domain">
4468 ##      <summary>
4469 ##      Domain to not audit.
4470 ##      </summary>
4471 ## </param>
4472 #
4473 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4474         gen_require(`
4475                 type admin_home_t;
4476         ')
4477
4478         dontaudit $1 admin_home_t:lnk_file read;
4479 ')
4480
4481 ########################################
4482 ## <summary>
4483 ##      dontaudit read /root files
4484 ## </summary>
4485 ## <param name="domain">
4486 ##      <summary>
4487 ##      Domain to not audit.
4488 ##      </summary>
4489 ## </param>
4490 #
4491 interface(`userdom_dontaudit_read_admin_home_files',`
4492         gen_require(`
4493                 type admin_home_t;
4494         ')
4495
4496         dontaudit $1 admin_home_t:file read_file_perms;
4497 ')
4498
4499 ########################################
4500 ## <summary>
4501 ##      Create, read, write, and delete user
4502 ##      temporary chr files.
4503 ## </summary>
4504 ## <param name="domain">
4505 ##      <summary>
4506 ##      Domain allowed access.
4507 ##      </summary>
4508 ## </param>
4509 #
4510 interface(`userdom_manage_user_tmp_chr_files',`
4511         gen_require(`
4512                 type user_tmp_t;
4513         ')
4514
4515         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4516         files_search_tmp($1)
4517 ')
4518
4519 ########################################
4520 ## <summary>
4521 ##      Create, read, write, and delete user
4522 ##      temporary blk files.
4523 ## </summary>
4524 ## <param name="domain">
4525 ##      <summary>
4526 ##      Domain allowed access.
4527 ##      </summary>
4528 ## </param>
4529 #
4530 interface(`userdom_manage_user_tmp_blk_files',`
4531         gen_require(`
4532                 type user_tmp_t;
4533         ')
4534
4535         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4536         files_search_tmp($1)
4537 ')
4538
4539 ########################################
4540 ## <summary>
4541 ##      Dontaudit attempt to set attributes on  user temporary directories.
4542 ## </summary>
4543 ## <param name="domain">
4544 ##      <summary>
4545 ##      Domain to not audit.
4546 ##      </summary>
4547 ## </param>
4548 #
4549 interface(`userdom_dontaudit_setattr_user_tmp',`
4550         gen_require(`
4551                 type user_tmp_t;
4552         ')
4553
4554         dontaudit $1 user_tmp_t:dir setattr;
4555 ')
4556
4557 ########################################
4558 ## <summary>
4559 ##      Write all inherited users files in /tmp
4560 ## </summary>
4561 ## <param name="domain">
4562 ##      <summary>
4563 ##      Domain allowed access.
4564 ##      </summary>
4565 ## </param>
4566 #
4567 interface(`userdom_write_inherited_user_tmp_files',`
4568         gen_require(`
4569                 type user_tmp_t;
4570         ')
4571
4572         allow $1 user_tmp_t:file write;
4573 ')
4574
4575 ########################################
4576 ## <summary>
4577 ##      Delete all users files in /tmp
4578 ## </summary>
4579 ## <param name="domain">
4580 ##      <summary>
4581 ##      Domain allowed access.
4582 ##      </summary>
4583 ## </param>
4584 #
4585 interface(`userdom_delete_user_tmp_files',`
4586         gen_require(`
4587                 type user_tmp_t;
4588         ')
4589
4590         allow $1 user_tmp_t:file delete_file_perms;
4591 ')
4592
4593 ########################################
4594 ## <summary>
4595 ##      Delete user tmpfs files.
4596 ## </summary>
4597 ## <param name="domain">
4598 ##      <summary>
4599 ##      Domain allowed access.
4600 ##      </summary>
4601 ## </param>
4602 #
4603 interface(`userdom_delete_user_tmpfs_files',`
4604         gen_require(`
4605                 type user_tmpfs_t;
4606         ')
4607
4608         allow $1 user_tmpfs_t:file delete_file_perms;
4609 ')
4610
4611 ########################################
4612 ## <summary>
4613 ##      Read/Write unpriviledged user SysV shared
4614 ##      memory segments.
4615 ## </summary>
4616 ## <param name="domain">
4617 ##      <summary>
4618 ##      Domain allowed access.
4619 ##      </summary>
4620 ## </param>
4621 #
4622 interface(`userdom_rw_unpriv_user_shared_mem',`
4623         gen_require(`
4624                 attribute unpriv_userdomain;
4625         ')
4626
4627         allow $1 unpriv_userdomain:shm rw_shm_perms;
4628 ')
4629
4630 ########################################
4631 ## <summary>
4632 ##      Do not audit attempts to search user
4633 ##      temporary directories.
4634 ## </summary>
4635 ## <param name="domain">
4636 ##      <summary>
4637 ##      Domain to not audit.
4638 ##      </summary>
4639 ## </param>
4640 #
4641 interface(`userdom_dontaudit_search_user_tmp',`
4642         gen_require(`
4643                 type user_tmp_t;
4644         ')
4645
4646         dontaudit $1 user_tmp_t:dir search_dir_perms;
4647 ')
4648
4649 ########################################
4650 ## <summary>
4651 ##      Execute a file in a user home directory
4652 ##      in the specified domain.
4653 ## </summary>
4654 ## <desc>
4655 ##      <p>
4656 ##      Execute a file in a user home directory
4657 ##      in the specified domain.
4658 ##      </p>
4659 ##      <p>
4660 ##      No interprocess communication (signals, pipes,
4661 ##      etc.) is provided by this interface since
4662 ##      the domains are not owned by this module.
4663 ##      </p>
4664 ## </desc>
4665 ## <param name="domain">
4666 ##      <summary>
4667 ##      Domain allowed access.
4668 ##      </summary>
4669 ## </param>
4670 ## <param name="target_domain">
4671 ##      <summary>
4672 ##      The type of the new process.
4673 ##      </summary>
4674 ## </param>
4675 #
4676 interface(`userdom_domtrans_user_home',`
4677         gen_require(`
4678                 type user_home_t;
4679         ')
4680
4681         read_lnk_files_pattern($1, user_home_t, user_home_t)
4682         domain_transition_pattern($1, user_home_t, $2)
4683         type_transition $1 user_home_t:process $2;
4684 ')
4685
4686 ########################################
4687 ## <summary>
4688 ##      Execute a file in a user tmp directory
4689 ##      in the specified domain.
4690 ## </summary>
4691 ## <desc>
4692 ##      <p>
4693 ##      Execute a file in a user tmp directory
4694 ##      in the specified domain.
4695 ##      </p>
4696 ##      <p>
4697 ##      No interprocess communication (signals, pipes,
4698 ##      etc.) is provided by this interface since
4699 ##      the domains are not owned by this module.
4700 ##      </p>
4701 ## </desc>
4702 ## <param name="domain">
4703 ##      <summary>
4704 ##      Domain allowed access.
4705 ##      </summary>
4706 ## </param>
4707 ## <param name="target_domain">
4708 ##      <summary>
4709 ##      The type of the new process.
4710 ##      </summary>
4711 ## </param>
4712 #
4713 interface(`userdom_domtrans_user_tmp',`
4714         gen_require(`
4715                 type user_tmp_t;
4716         ')
4717
4718         files_search_tmp($1)
4719         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4720         domain_transition_pattern($1, user_tmp_t, $2)
4721         type_transition $1 user_tmp_t:process $2;
4722 ')
4723
4724 ########################################
4725 ## <summary>
4726 ##      Do not audit attempts to read all user home content files.
4727 ## </summary>
4728 ## <param name="domain">
4729 ##      <summary>
4730 ##      Domain to not audit.
4731 ##      </summary>
4732 ## </param>
4733 #
4734 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4735         gen_require(`
4736                 attribute user_home_type;
4737         ')
4738
4739         dontaudit $1 user_home_type:file read_file_perms;
4740 ')
4741
4742 ########################################
4743 ## <summary>
4744 ##      Do not audit attempts to read all user tmp content files.
4745 ## </summary>
4746 ## <param name="domain">
4747 ##      <summary>
4748 ##      Domain to not audit.
4749 ##      </summary>
4750 ## </param>
4751 #
4752 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4753         gen_require(`
4754                 attribute user_tmp_type;
4755         ')
4756
4757         dontaudit $1 user_tmp_type:file read_file_perms;
4758 ')
4759